Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add setting to force login through openid #21851

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add setting to force login through openid #21851

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bddae8a
add force openID login option
tiltingpenguin Nov 17, 2022
50163be
move setting location to admin page
tiltingpenguin Nov 23, 2022
1235715
Add cli flag
tiltingpenguin Jan 5, 2023
f4224c5
Update variable names and documentation
tiltingpenguin Jan 5, 2023
d20b362
Add proper redirect and improve readability
tiltingpenguin Jan 5, 2023
1a0a4d4
Merge branch 'main' into force-openid-login
techknowlogick Jan 16, 2023
c7cfdcc
Redirect to first forced OAuth
tiltingpenguin Jan 17, 2023
d7236bf
Merge branch 'main' into force-openid-login
zeripath Feb 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cmd/admin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -826,6 +826,7 @@ func parseOAuth2Config(c *cli.Context) *oauth2.Source {
CustomURLMapping: customURLMapping,
IconURL: c.String("icon-url"),
SkipLocalTwoFA: c.Bool("skip-local-2fa"),
ForceOAuth: c.Bool("force-configured-oauth"),
Scopes: c.StringSlice("scopes"),
RequiredClaimName: c.String("required-claim-name"),
RequiredClaimValue: c.String("required-claim-value"),
Expand Down Expand Up @@ -914,6 +915,9 @@ func runUpdateOauth(c *cli.Context) error {
if c.IsSet("restricted-group") {
oAuth2Config.RestrictedGroup = c.String("restricted-group")
}
if c.IsSet("force-oauth") {
oAuth2Config.ForceOAuth = c.BoolT("force-oauth")
}

// update custom URL mapping
customURLMapping := &oauth2.CustomURLMapping{}
Expand Down
2 changes: 2 additions & 0 deletions options/locale/locale_de-DE.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2663,6 +2663,8 @@ auths.oauth2_profileURL=Profil-URL
auths.oauth2_emailURL=E-Mail-URL
auths.skip_local_two_fa=Lokale 2FA überspringen
auths.skip_local_two_fa_helper=Leer lassen bedeutet, dass lokale User die 2FA immer noch bestehen müssen, um sich anzumelden
auths.force_oauth=Anmelden durch diese Quelle erzwingen
auths.force_oauth_helper=Setzen um Anmeldungen automatisch auf diesen OAuth Anbieter umzuleiten
auths.oauth2_tenant=Inhaber
auths.oauth2_scopes=Zusätzliche Bereiche
auths.oauth2_required_claim_name=Benötigter Claim-Name
Expand Down
2 changes: 2 additions & 0 deletions options/locale/locale_en-US.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2680,6 +2680,8 @@ auths.oauth2_profileURL = Profile URL
auths.oauth2_emailURL = Email URL
auths.skip_local_two_fa = Skip local 2FA
auths.skip_local_two_fa_helper = Leaving unset means local users with 2FA set will still have to pass 2FA to log on
auths.force_oauth = Force login via this authentication
auths.force_oauth_helper = Set this to automatically redirect sign in to this OAuth provider
auths.oauth2_tenant = Tenant
auths.oauth2_scopes = Additional Scopes
auths.oauth2_required_claim_name = Required Claim Name
Expand Down
1 change: 1 addition & 0 deletions routers/web/admin/auths.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,7 @@ func parseOAuth2Config(form forms.AuthenticationForm) *oauth2.Source {
GroupClaimName: form.Oauth2GroupClaimName,
RestrictedGroup: form.Oauth2RestrictedGroup,
AdminGroup: form.Oauth2AdminGroup,
ForceOAuth: form.ForceOAuth,
}
}

Expand Down
23 changes: 23 additions & 0 deletions routers/web/auth/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,24 @@ func checkAutoLogin(ctx *context.Context) bool {
return false
}

func checkForceOAuth(ctx *context.Context) bool {
// Check if authentication is forced to OAuth

authSources, err := auth.GetActiveOAuth2ProviderSources()
if err != nil {
return false
}

for _, source := range authSources {
if source.Cfg.(*oauth2.Source).ForceOAuth {
ctx.RedirectToFirst(setting.AppSubURL + "/user/login/openid")
return true
}
}

return false
}

// SignIn render sign in page
func SignIn(ctx *context.Context) {
ctx.Data["Title"] = ctx.Tr("sign_in")
Expand All @@ -155,6 +173,11 @@ func SignIn(ctx *context.Context) {
return
}

// Check if authentication is forced to OAuth
if checkForceOAuth(ctx) {
return
}

orderedOAuth2Names, oauth2Providers, err := oauth2.GetActiveOAuth2Providers()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great! Thank you so much!! Are you able to re-use this GetActiveOAuth2Providers call, to reduce the duplication of DB calls?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried that but sadly the map of Providers that GetActiveOAuth2Providers returns is a different object that doesn't contain all the Source attributes, including my ForceOAuth parameter

if err != nil {
ctx.ServerError("UserSignIn", err)
Expand Down
1 change: 1 addition & 0 deletions services/auth/source/oauth2/source.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ type Source struct {
OpenIDConnectAutoDiscoveryURL string
CustomURLMapping *CustomURLMapping
IconURL string
ForceOAuth bool `json:",omitempty"`

Scopes []string
RequiredClaimName string
Expand Down
1 change: 1 addition & 0 deletions services/forms/auth_form.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ type AuthenticationForm struct {
Oauth2Key string
Oauth2Secret string
OpenIDConnectAutoDiscoveryURL string
ForceOAuth bool
Oauth2UseCustomURL bool
Oauth2TokenURL string
Oauth2AuthURL string
Expand Down
7 changes: 7 additions & 0 deletions templates/admin/auth/edit.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -299,6 +299,13 @@
<p class="help">{{.locale.Tr "admin.auths.skip_local_two_fa_helper"}}</p>
</div>
</div>
<div class="optional field">
<div class="ui checkbox">
<label for="force_oauth"><strong>{{.locale.Tr "admin.auths.force_oauth"}}</strong></label>
<input id="force_oauth" name="force_oauth" type="checkbox" {{if $cfg.ForceOAuth}}checked{{end}}>
<p class="help">{{.locale.Tr "admin.auths.force_oauth_helper"}}</p>
</div>
</div>
<div class="oauth2_use_custom_url inline field">
<div class="ui checkbox">
<label><strong>{{.locale.Tr "admin.auths.oauth2_use_custom_url"}}</strong></label>
Expand Down
7 changes: 7 additions & 0 deletions templates/admin/auth/source/oauth.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,13 @@
<p class="help">{{.locale.Tr "admin.auths.skip_local_two_fa_helper"}}</p>
</div>
</div>
<div class="optional field">
<div class="ui checkbox">
<label for="force_oauth"><strong>{{.locale.Tr "admin.auths.force_oauth"}}</strong></label>
<input id="force_oauth" name="force_oauth" type="checkbox" {{if .force_oauth}}checked{{end}}>
<p class="help">{{.locale.Tr "admin.auths.force_oauth_helper"}}</p>
</div>
</div>

<div class="oauth2_use_custom_url inline field">
<div class="ui checkbox">
Expand Down