فهرست منبع

[auth] Allow extra params for OIDC to override token payload for Hue to work behind https proxy (#4017)

- This feature allows using Hue with OIDC, deployed behind https proxy (e.g. on Kubernetes, exposed by HttpRoute - which provides SSL). Redirect URL, passed during OIDC authentication has to match with the one registered in application. 

- The problem is that Hue builds dynamically redirect url, using request's protocol (http instead of https), because it doesn't know about proxy. Note that OIDC backend doesn't take into account reverse proxy configuration.

- Using OIDC_AUTH_REQUEST_EXTRA_PARAMS it's possible to override token_payload with correct URL. The same mechanism is used in mozilla_django_oidc, but the parameter wasn't passed from Hue settings, which is fixed by this change.

Configuration may look like:
`'{"redirect_uri" : "https://host/oidc/callback/"}'`
Maciej Maciejko 7 ماه پیش
والد
کامیت
73252e5abb

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -846,6 +846,9 @@ tls=no
 # Whether Hue as OpenID Connect client verify SSL cert
 ## oidc_verify_ssl=true
 
+# OIDC authentication request extra params
+## oidc_auth_request_extra_params={}
+
 # As relay party Hue URL path to redirect to after login
 ## login_redirect_url=https://localhost:8888/oidc/callback/
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -848,6 +848,9 @@
     # Whether Hue as OpenID Connect client verify SSL cert
     ## oidc_verify_ssl=true
 
+    # OIDC authentication request extra params
+    ## oidc_auth_request_extra_params={}
+
     # As relay party Hue URL path to redirect to after login
     ## login_redirect_url=https://localhost:8888/oidc/callback/
 

+ 3 - 0
desktop/core/src/desktop/auth/backend.py

@@ -836,6 +836,9 @@ class OIDCBackend(OIDCAuthenticationBackend):
       ),
     }
 
+    oidc_extra_params = import_from_settings('OIDC_AUTH_REQUEST_EXTRA_PARAMS', {})
+    token_payload.update(oidc_extra_params)
+
     # Get the token
     token_info = self.get_token(token_payload)
     id_token = token_info.get('id_token')

+ 7 - 0
desktop/core/src/desktop/conf.py

@@ -1662,6 +1662,13 @@ OIDC = ConfigSection(
       default=False
     ),
 
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS=Config(
+      key="oidc_auth_request_extra_params",
+      help=_("OIDC authentication request extra params."),
+      type=coerce_json_dict,
+      default='{}'
+    ),
+
     LOGIN_REDIRECT_URL=Config(
       key="login_redirect_url",
       help=_("As relay party Hue URL path to redirect to after login."),

+ 1 - 0
desktop/core/src/desktop/settings.py

@@ -611,6 +611,7 @@ if is_oidc_configured():
   OIDC_RP_IDP_SIGN_KEY = desktop.conf.OIDC.OIDC_RP_IDP_SIGN_KEY.get()
   OIDC_OP_JWKS_ENDPOINT = desktop.conf.OIDC.OIDC_OP_JWKS_ENDPOINT.get()
   OIDC_VERIFY_SSL = desktop.conf.OIDC.OIDC_VERIFY_SSL.get()
+  OIDC_AUTH_REQUEST_EXTRA_PARAMS = desktop.conf.OIDC.OIDC_AUTH_REQUEST_EXTRA_PARAMS.get()
   LOGIN_REDIRECT_URL = desktop.conf.OIDC.LOGIN_REDIRECT_URL.get()
   LOGOUT_REDIRECT_URL = desktop.conf.OIDC.LOGOUT_REDIRECT_URL.get()
   LOGIN_REDIRECT_URL_FAILURE = desktop.conf.OIDC.LOGIN_REDIRECT_URL_FAILURE.get()