Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[4.x] OAuth improvements including support for SAML2 providers #9612

Merged
merged 19 commits into from
Feb 29, 2024

Conversation

duncanmcclean
Copy link
Member

@duncanmcclean duncanmcclean commented Feb 28, 2024

This pull request fixes two issues preventing our Socialite/oAuth integration from working with SAML2 Socialite Providers, like Auth0/Okta.

Essentially, there were only two changes required to make our code work with SAML2:

  • The /oauth/{provider}/callback route needs to accept POST requests, not just GET requests.
  • When we're fetching the user via Socialite, we needed to call ->stateless(), otherwise we'd get an error.
    • However, the ->stateless() option only works for some providers and not all of them. There's also no way for us to know programatically if a specific provider supports it or not - you need to simply test it and see.
    • To workaround this, I've made it possible to specify stateless as a config option in the providers array in config/statamic/oauth.php... more details on that below

Provider "Configs"

You can configure which providers Statamic should use for oAuth in the providers array in config/statamic/oauth.php. You can optionally configure labels for providers too.

'providers' => [
    'github',
    'saml2' => 'Okta',
],

Like I mentioned, only some providers support the ->stateless() method, so I've made it so you can pass an array of config options:

'providers' => [
    'github',
    'saml2' => ['stateless' => true, 'label' => 'Okta'],
],

Most of the code changes in this PR are around making the config stuff work. Happy to re-work if you think there's a better way to do this.


Fixes #9535.

src/Http/Controllers/OAuthController.php Outdated Show resolved Hide resolved
src/OAuth/Provider.php Outdated Show resolved Hide resolved
src/OAuth/Manager.php Outdated Show resolved Hide resolved
routes/web.php Show resolved Hide resolved
src/Http/Controllers/OAuthController.php Outdated Show resolved Hide resolved
duncanmcclean and others added 11 commits February 29, 2024 15:07
- provider class accepts config array in constructor
- provider class uses constructor property promotion
- provider class deprecated using label method as a setter. now just pass it through the config.
- pass config array into provider via the manager
…AuthId will have the config which could potentially be important.
@jasonvarga jasonvarga changed the title [4.x] Support for SAML2 Socialite Providers [4.x] OAuth improvements including support for SAML2 providers Feb 29, 2024
@jasonvarga
Copy link
Member

I made some more tweaks:

  • Provider::label() and Provider::config() are now just getters.
  • Provider::label() is still a setter for backwards compatibility, but the setter/property is marked as deprecated. The label should now just be passed through the config.
  • Added tests for those since they were missing.
  • Use OAuth::provider() in UserRepository to ensure new Provider only happens in one place: Manager.php. Otherwise, that instance would be missing config which might be important.

@jasonvarga jasonvarga merged commit d6f1e37 into 4.x Feb 29, 2024
36 checks passed
@jasonvarga jasonvarga deleted the fix/oauth-support-for-saml2-providers branch February 29, 2024 16:42
@jasonvarga jasonvarga mentioned this pull request Feb 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

When using Saml2 Socialite provider callback page 404s
2 participants