beenull/sftpgo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

OIDC: allow to get the role field from a sub-struct

Browse source 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino 2022-08-10 21:42:58 +02:00
parent 78f75cdcb9
commit a61211d32c
No known key found for this signature in database
GPG key ID: 2F1FB59433D5A8CB
5 changed files with 97 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/full-configuration.md
View file

@ -281,7 +281,7 @@ The configuration file contains the following sections:
- `redirect_base_url`, string. Defines the base URL to redirect to after OpenID authentication. The suffix `/web/oidc/redirect` will be added to this base URL, adding also the `web_root` if configured. Default: blank.
- `username_field`, string. Defines the ID token claims field to map to the SFTPGo username. Default: blank.
- `scopes`, list of strings. Request the OAuth provider to provide the scope information from an authenticated users. The `openid` scope is mandatory. Default: `"openid", "profile", "email"`.
- `role_field`, string. Defines the optional ID token claims field to map to a SFTPGo role. If the defined ID token claims field is set to `admin` the authenticated user is mapped to an SFTPGo admin. You don't need to specify this field if you want to use OpenID only for the Web Client UI. Default: blank.
- `role_field`, string. Defines the optional ID token claims field to map to a SFTPGo role. If the defined ID token claims field is set to `admin` the authenticated user is mapped to an SFTPGo admin. You don't need to specify this field if you want to use OpenID only for the Web Client UI. If the field is inside a nested structure, you can use the dot notation to traverse the structures. Default: blank.
- `implicit_roles`, boolean. If set, the `role_field` is ignored and the SFTPGo role is assumed based on the login link used. Default: `false`.
- `custom_fields`, list of strings. Custom token claims fields to pass to the pre-login hook. Default: empty.
- `debug`, boolean. If set, the received id tokens will be logged at debug level. Default: `false`.

4
go.mod
View file

@ -9,10 +9,10 @@ require (
github.com/GehirnInc/crypt v0.0.0-20200316065508-bb7000b8a962
github.com/alexedwards/argon2id v0.0.0-20211130144151-3585854a6387
github.com/aws/aws-sdk-go-v2 v1.16.10
github.com/aws/aws-sdk-go-v2/config v1.15.17
github.com/aws/aws-sdk-go-v2/config v1.16.0
github.com/aws/aws-sdk-go-v2/credentials v1.12.12
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.11
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.23
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.24
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.13.11
github.com/aws/aws-sdk-go-v2/service/s3 v1.27.4
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.15.16

8
go.sum
View file

@ -150,8 +150,8 @@ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.1/go.mod h1:n8Bs1ElDD
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.4 h1:zfT11pa7ifu/VlLDpmc5OY2W4nYmnKkFDGeMVnmqAI0=
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.4/go.mod h1:ES0I1GBs+YYgcDS1ek47Erbn4TOL811JKqBXtgzqyZ8=
github.com/aws/aws-sdk-go-v2/config v1.15.3/go.mod h1:9YL3v07Xc/ohTsxFXzan9ZpFpdTOFl4X65BAKYaz8jg=
github.com/aws/aws-sdk-go-v2/config v1.15.17 h1:cM/4dqEPc5SjBOeYVdUI7iL/B6jDupCesXzg3AuUzRE=
github.com/aws/aws-sdk-go-v2/config v1.15.17/go.mod h1:eatrtwIm5WdvASoYCy5oPkinfiwiYFg2jLG9tJoKzkE=
github.com/aws/aws-sdk-go-v2/config v1.16.0 h1:LxHC50cwOLxYo67NEpwpNUiOi6ngXfDpEETphSZ6bAw=
github.com/aws/aws-sdk-go-v2/config v1.16.0/go.mod h1:eatrtwIm5WdvASoYCy5oPkinfiwiYFg2jLG9tJoKzkE=
github.com/aws/aws-sdk-go-v2/credentials v1.11.2/go.mod h1:j8YsY9TXTm31k4eFhspiQicfXPLZ0gYXA50i4gxPE8g=
github.com/aws/aws-sdk-go-v2/credentials v1.12.12 h1:iShu6VaWZZZfUZvlGtRjl+g1lWk44g1QmiCTD4KS0jI=
github.com/aws/aws-sdk-go-v2/credentials v1.12.12/go.mod h1:vFHC2HifIWHebmoVsfpqliKuqbAY2LaVlvy03JzF4c4=
@ -159,8 +159,8 @@ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.3/go.mod h1:uk1vhHHERfSVCUnq
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.11 h1:zZHPdM2x09/0F8D7XyVvQnP2/jaW7bEMmtcSCPYq/iI=
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.11/go.mod h1:38Asv/UyQbDNpSXCurZRlDMjzIl6J+wUe8vY3TtUuzA=
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.3/go.mod h1:0dHuD2HZZSiwfJSy1FO5bX1hQ1TxVV1QXXjpn3XUE44=
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.23 h1:lzS1GSHBzvBMlCA030/ecL5tF2ip8RLr/LBq5fBpv/4=
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.23/go.mod h1:yGuKwoNVv2eGUHlp7ciCQLHmFNeESebnHucZfRL9EkA=
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.24 h1:9MflwbI3Ua4PFyCNo39nnJ2ZYaQ/GabPUPdutegSJUs=
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.24/go.mod h1:W970x9QKWWb0Y30Num5dFFji/qRQSt0UP4UzbM3sYCo=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.9/go.mod h1:AnVH5pvai0pAF4lXRq0bmhbes1u9R8wTE+g+183bZNM=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.17 h1:U8DZvyFFesBmK62dYC6BRXm4Cd/wPP3aPcecu3xv/F4=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.17/go.mod h1:6qtGip7sJEyvgsLjphRZWF9qPe3xJf1mL/MM01E35Wc=

42
internal/httpd/oidc.go
View file

@ -225,12 +225,7 @@ func (t *oidcToken) parseClaims(claims map[string]any, usernameField, roleField
if forcedRole != "" {
t.Role = forcedRole
} else {
if roleField != "" {
role, ok := claims[roleField]
if ok {
t.Role = role
}
}
t.getRoleFromField(claims, roleField)
}
t.CustomFields = nil
if len(customFields) > 0 {
@ -254,6 +249,41 @@ func (t *oidcToken) parseClaims(claims map[string]any, usernameField, roleField
return nil
}
func (t *oidcToken) getRoleFromField(claims map[string]any, roleField string) {
if roleField != "" {
role, ok := claims[roleField]
if ok {
t.Role = role
return
}
if !strings.Contains(roleField, ".") {
return
}
getStructValue := func(outer any, field string) (any, bool) {
switch val := outer.(type) {
case map[string]any:
res, ok := val[field]
return res, ok
}
return nil, false
}
for idx, field := range strings.Split(roleField, ".") {
if idx == 0 {
role, ok = getStructValue(claims, field)
} else {
role, ok = getStructValue(role, field)
}
if !ok {
return
}
}
t.Role = role
}
}
func (t *oidcToken) isAdmin() bool {
switch v := t.Role.(type) {
case string:

54
internal/httpd/oidc_test.go
View file

@ -1156,6 +1156,7 @@ func TestOIDCIsAdmin(t *testing.T) {
{input: append(emptySlice, 1), want: false},
{input: 1, want: false},
{input: nil, want: false},
{input: map[string]string{"admin": "admin"}, want: false},
}
for _, tc := range tests {
token := oidcToken{
@ -1165,6 +1166,59 @@ func TestOIDCIsAdmin(t *testing.T) {
}
}
func TestParseAdminRole(t *testing.T) {
claims := make(map[string]any)
rawClaims := []byte(`{
"sub": "35666371",
"email": "example@example.com",
"preferred_username": "Sally",
"name": "Sally Tyler",
"updated_at": "2018-04-13T22:08:45Z",
"given_name": "Sally",
"family_name": "Tyler",
"params": {
"sftpgo_role": "admin",
"subparams": {
"sftpgo_role": "admin",
"inner": {
"sftpgo_role": ["user","admin"]
}
}
},
"at_hash": "lPLhxI2wjEndc-WfyroDZA",
"rt_hash": "mCmxPtA04N-55AxlEUbq-A",
"aud": "78d1d040-20c9-0136-5146-067351775fae92920",
"exp": 1523664997,
"iat": 1523657797
}`)
err := json.Unmarshal(rawClaims, &claims)
assert.NoError(t, err)
type test struct {
input string
want bool
}
tests := []test{
{input: "sftpgo_role", want: false},
{input: "params.sftpgo_role", want: true},
{input: "params.subparams.sftpgo_role", want: true},
{input: "params.subparams.inner.sftpgo_role", want: true},
{input: "email", want: false},
{input: "missing", want: false},
{input: "params.email", want: false},
{input: "missing.sftpgo_role", want: false},
{input: "params", want: false},
{input: "params.subparams.inner.sftpgo_role.missing", want: false},
}
for _, tc := range tests {
token := oidcToken{}
token.getRoleFromField(claims, tc.input)
assert.Equal(t, tc.want, token.isAdmin(), "%q should return %t", tc.input, tc.want)
}
}
func TestOIDCWithLoginFormsDisabled(t *testing.T) {
oidcMgr, ok := oidcMgr.(*memoryOIDCManager)
require.True(t, ok)