diff --git a/.github/ISSUE_TEMPLATE/2_bug_provider.yml b/.github/ISSUE_TEMPLATE/2_bug_provider.yml index 1ee4409a23..13bf118798 100644 --- a/.github/ISSUE_TEMPLATE/2_bug_provider.yml +++ b/.github/ISSUE_TEMPLATE/2_bug_provider.yml @@ -104,6 +104,7 @@ body: - "Yandex" - "Zoho" - "Zoom" + - "Ztrust" validations: required: true - type: textarea diff --git a/apps/dev/nextjs/.env.local.example b/apps/dev/nextjs/.env.local.example index 18f1f2945f..774674a963 100644 --- a/apps/dev/nextjs/.env.local.example +++ b/apps/dev/nextjs/.env.local.example @@ -43,6 +43,10 @@ AUTH_KEYCLOAK_ID= AUTH_KEYCLOAK_SECRET= AUTH_KEYCLOAK_ISSUER= +AUTH_ZTRUST_ID= +AUTH_ZTRUST_SECRET= +AUTH_ZTRUST_ISSUER= + AUTH_LINE_ID= AUTH_LINE_SECRET= diff --git a/apps/dev/nextjs/auth.ts b/apps/dev/nextjs/auth.ts index 0571764576..02aa5f9fec 100644 --- a/apps/dev/nextjs/auth.ts +++ b/apps/dev/nextjs/auth.ts @@ -2,6 +2,7 @@ import NextAuth from "next-auth" import Credentials from "next-auth/providers/credentials" import Keycloak from "next-auth/providers/keycloak" import GitHub from "next-auth/providers/github" +import Ztrust from "next-auth/providers/ztrust" // import { PrismaClient } from "@prisma/client" // import { PrismaAdapter } from "@auth/prisma-adapter" @@ -68,6 +69,7 @@ export const { handlers, auth, signIn, signOut, unstable_update } = NextAuth({ }), GitHub, Keycloak, + Ztrust, ], callbacks: { diff --git a/docs/pages/getting-started/providers/ztrust.mdx b/docs/pages/getting-started/providers/ztrust.mdx new file mode 100644 index 0000000000..34b071674e --- /dev/null +++ b/docs/pages/getting-started/providers/ztrust.mdx @@ -0,0 +1,105 @@ +import { Callout } from "nextra/components" +import { Code } from "@/components/Code" + + + +# Ztrust Provider + +## Resources + +- [Ztrust OIDC documentation](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.1/5.-securing-applications) + +## Setup + +### Callback URL + + + + +```bash +https://example.com/api/auth/callback/ztrust +``` + + + + +```bash +https://example.com/auth/callback/ztrust +``` + + + + +```bash +https://example.com/auth/callback/ztrust +``` + + + + +### Environment Variables + +``` +AUTH_ZTRUST_ID +AUTH_ZTRUST_SECRET +AUTH_ZTRUST_ISSUER +``` + +### Configuration + + + + +```ts filename="/auth.ts" +import NextAuth from "next-auth" +import Ztrust from "next-auth/providers/ztrust" + +export const { handlers, auth, signIn, signOut } = NextAuth({ + providers: [Ztrust], +}) +``` + + + + +```ts filename="/src/routes/plugin@auth.ts" +import { QwikAuth$ } from "@auth/qwik" +import Ztrust from "@auth/qwik/providers/ztrust" + +export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$( + () => ({ + providers: [Ztrust], + }) +) +``` + + + + +```ts filename="/src/auth.ts" +import { SvelteKitAuth } from "@auth/sveltekit" +import Ztrust from "@auth/sveltekit/providers/ztrust" + +export const { handle, signIn, signOut } = SvelteKitAuth({ + providers: [Ztrust], +}) +``` + + + + +```ts filename="/src/app.ts" +import { ExpressAuth } from "@auth/express" +import Ztrust from "@auth/express/providers/ztrust" + +app.use("/auth/*", ExpressAuth({ providers: [Ztrust] })) +``` + + + + +Enable the "Client Authentication" option to retrieve your client secret in the Credentials tab. + +Prior to v20, create an `openid-connect` client in ztrust with "confidential" as the "Access Type". + +- Issuer should include the realm – e.g. `https://my-ztrust-domain.com/realms/My_Realm` diff --git a/docs/public/img/providers/ztrust.svg b/docs/public/img/providers/ztrust.svg new file mode 100644 index 0000000000..ddd4b7626b --- /dev/null +++ b/docs/public/img/providers/ztrust.svg @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/static/img/providers/ztrust.svg b/docs/static/img/providers/ztrust.svg new file mode 100644 index 0000000000..ddd4b7626b --- /dev/null +++ b/docs/static/img/providers/ztrust.svg @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/core/src/providers/ztrust.ts b/packages/core/src/providers/ztrust.ts new file mode 100644 index 0000000000..231a823631 --- /dev/null +++ b/packages/core/src/providers/ztrust.ts @@ -0,0 +1,120 @@ +/** + *
+ * Built-in Ztrust integration. + * + * + * + *
+ * + * @module providers/ztrust + */ +import type { OIDCConfig, OIDCUserConfig } from "./index.js" + +interface User { + id: string + name: string + email: string + image?: string + [key: string]: any +} + +export interface ztrustProfile extends Record { + exp: number + iat: number + auth_time: number + jti: string + iss: string + aud: string + sub: string + typ: string + azp: string + session_state: string + at_hash: string + acr: string + sid: string + email_verified: boolean + name: string + preferred_username: string + given_name: string + family_name: string + email: string + picture: string + user: User + groups?: string[] +} + +/** + * Add Ztrust login to your page. + * + * ### Setup + * + * #### Callback URL + * ``` + * https://example.com/api/auth/callback/ztrust + * ``` + * + * #### Configuration + *```ts + * import { Auth } from "@auth/core" + * import Ztrust from "@auth/core/providers/ztrust" + * + * const request = new Request(origin) + * const response = await Auth(request, { + * providers: [ + * Ztrust({ + * clientId: ZTRUST_CLIENT_ID, + * clientSecret: ZTRUST_CLIENT_SECRET, + * issuer: ZTRUST_ISSUER, + * }), + * ], + * }) + * ``` + * + * ### Resources + * + * - [Ztrust OIDC documentation](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.1/5.-securing-applications) + * + * :::tip + * + * Create an openid-connect client in Ztrust with "confidential" as the "Access Type". + * + * ::: + * + * :::note + * + * issuer should include the realm – e.g. https://ztrust-domain.com/realms/My_Realm_name + * + * ::: + * ### Notes + * + * By default, Auth.js assumes that the Ztrust provider is + * based on the [Open ID Connect](https://openid.net/specs/openid-connect-core-1_0.html) specification. + * + * :::tip + * + * The Ztrust provider comes with a [default configuration](https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/ztrust.ts). + * To override the defaults for your use case, check out [customizing a built-in OAuth provider](https://authjs.dev/guides/configuring-oauth-providers). + * + * ::: + * + * :::info **Disclaimer** + * + * If you think you found a bug in the default configuration, you can [open an issue](https://authjs.dev/new/provider-issue). + * + * Auth.js strictly adheres to the specification and it cannot take responsibility for any deviation from + * the spec by the provider. You can open an issue, but if the problem is non-compliance with the spec, + * we might not pursue a resolution. You can ask for more help in [Discussions](https://authjs.dev/new/github-discussions). + * + * ::: + */ +export default function ZTrust

( + options: OIDCUserConfig

+): OIDCConfig

{ + return { + id: "ztrust", + name: "ZTrust", + type: "oidc", + style: { brandColor: "#428bca" }, + options, + } +}