Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #20778: Add Oauth2/openid connect backend #451

Conversation

fanf
Copy link
Member

@fanf fanf commented Mar 14, 2022

https://issues.rudder.io/issues/20778

Add the possibility to have an Oauthv2/OIDC (openid connect) SSO authentication in Rudder.
Under the hood, it uses spring-security module for Oauthv2 (https://docs.spring.io/spring-security/reference/5.7/reactive/oauth2/index.html).
The main difficulties is that contrary to other existing backend, Oauthv2 is a change in the list of security filter chain, not a new authentication "data base" for the web authentication filter.
So we need to hack existing chain (configured in main rudder) and hand-build missing filters for oauth/oidc and but them back at the correct place. This is complicated. It's done in AuthBackendsConf.scala in AuthBackendsSpringConfiguration.

In that class:

  • we read and update existing filter chain in setApplicationContext method (spring method for "do stuff with spring stuff, even the goriest one that would not be allowed elsewhere")
  • all @Bean below are just the need plumbing to build by hand what spring would do with the <oauth> smart tag, that we can't use, because we can't "inject" xml config file once the main <http> chain is built (we can just add new <http> chain, which is useless)
    Even with that, we still need applicationContext-security-auth-oidc.xml and applicationContext-security-auth-oauth2.xml because it's these files that allows our licence system to know if the corresponding "auth backend" are enabled (so, ~ useless for the logic of authenticating users with oauth, needed for plumbing with license check).

We also need to extends what is a userDetails because oauth has its own with specific infor related to the protocol (some info can be shared between the identity provider and an application like rudder).

Oauth2Authentication.scala is just for parsing the complicated configuration needed for oauth and build an easy to deal with data structure. You can see an attempt to explain needed configuration properties in the README.adoc.

Finally, when we have an Single Sign On solution, we likely don't want to show to standard rudder login form, since, well, you're supposed to log on the identity provider site. But perhaps you still want to show it for emergency (like "no more network with the identity provider"). So there's a new config option with the plugin to either show, hide (ie hide but available with a toggle button), or remove (ie: don't sent the HTML at all) Rudder form.

@fanf fanf requested a review from VinceMacBuche March 14, 2022 15:11
@fanf fanf force-pushed the bug_20778/add_oauth2_openid_connect_backend branch from 8db7bda to 7f99739 Compare March 14, 2022 17:32
@fanf
Copy link
Member Author

fanf commented Mar 17, 2022

PR updated with a new commit

@fanf
Copy link
Member Author

fanf commented Mar 17, 2022

PR updated with a new commit

@VinceMacBuche
Copy link
Member

OK, squash merging this PR

wip

wip: user correctly retrieved

milestone1: correct login of an user with openid connect

trying to wire at runtime oauth

Login working with the plugin mode

some more cleaning

Fixes #20778: Add Oauth2/openid connect backend
@VinceMacBuche VinceMacBuche force-pushed the bug_20778/add_oauth2_openid_connect_backend branch from a0c0e1e to 1a2c1c9 Compare April 8, 2022 21:30
@VinceMacBuche VinceMacBuche merged commit 1a2c1c9 into Normation:branches/rudder/6.2 Apr 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants