mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
feat: add redirect URL override for external auth (#28082)
This commit is contained in:
Asher
@@ -43,6 +43,27 @@ Set it with a value that helps you identify the provider.
|
||||
For example, if you use `CODER_EXTERNAL_AUTH_0_ID="primary-github"` for your GitHub provider,
|
||||
configure your callback URL as `https://example.com/external-auth/primary-github/callback`.
|
||||
|
||||
By default, the redirect URL is built from the access URL Coder is configured
|
||||
with. You can override the base URL with:
|
||||
|
||||
```dotenv
|
||||
CODER_EXTERNAL_AUTH_0_REDIRECT_URL=https://my.tld
|
||||
```
|
||||
|
||||
This would change the callback in the above example to
|
||||
`https://my.tld/external-auth/primary-github/callback` (any path component on
|
||||
the redirect URL is ignored).
|
||||
|
||||
Using this setting can break OAuth, so use with caution. The override is
|
||||
intended to be used when the access URL is internal and either:
|
||||
|
||||
- Users access Coder via some other URL that proxies to the internal one.
|
||||
- The redirect URL redirects to the internal access URL (this can be used to
|
||||
work around providers that require public domains for the callback).
|
||||
|
||||
Ultimately, the user must end up on the same domain they were on when the
|
||||
authentication flow was initiated.
|
||||
|
||||
### Add an authentication button to the workspace template
|
||||
|
||||
Add the following code to any template to add a button to the workspace setup page which will allow you to authenticate with your provider:
|
||||
|
||||
Generated
+1
@@ -351,6 +351,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
|
||||
"mcp_tool_deny_regex": "string",
|
||||
"mcp_url": "string",
|
||||
"no_refresh": true,
|
||||
"redirect_url": "string",
|
||||
"regex": "string",
|
||||
"revoke_url": "string",
|
||||
"scopes": [
|
||||
|
||||
Generated
+23
-18
@@ -6096,6 +6096,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
|
||||
"mcp_tool_deny_regex": "string",
|
||||
"mcp_url": "string",
|
||||
"no_refresh": true,
|
||||
"redirect_url": "string",
|
||||
"regex": "string",
|
||||
"revoke_url": "string",
|
||||
"scopes": [
|
||||
@@ -6723,6 +6724,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
|
||||
"mcp_tool_deny_regex": "string",
|
||||
"mcp_url": "string",
|
||||
"no_refresh": true,
|
||||
"redirect_url": "string",
|
||||
"regex": "string",
|
||||
"revoke_url": "string",
|
||||
"scopes": [
|
||||
@@ -7724,6 +7726,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
|
||||
"mcp_tool_deny_regex": "string",
|
||||
"mcp_url": "string",
|
||||
"no_refresh": true,
|
||||
"redirect_url": "string",
|
||||
"regex": "string",
|
||||
"revoke_url": "string",
|
||||
"scopes": [
|
||||
@@ -7737,23 +7740,24 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
|
||||
|
||||
### Properties
|
||||
|
||||
| Name | Type | Required | Restrictions | Description |
|
||||
|------------------------------------|-----------------|----------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `api_base_url` | string | false | | Api base URL is the base URL for provider REST API calls (e.g., "https://api.github.com" for GitHub). Derived from defaults when not explicitly configured. |
|
||||
| `app_install_url` | string | false | | |
|
||||
| `app_installations_url` | string | false | | |
|
||||
| `auth_url` | string | false | | |
|
||||
| `client_id` | string | false | | |
|
||||
| `code_challenge_methods_supported` | array of string | false | | Code challenge methods supported lists the PKCE code challenge methods The only one supported by Coder is "S256". |
|
||||
| `device_code_url` | string | false | | |
|
||||
| `device_flow` | boolean | false | | |
|
||||
| `display_icon` | string | false | | Display icon is a URL to an icon to display in the UI. |
|
||||
| `display_name` | string | false | | Display name is shown in the UI to identify the auth config. |
|
||||
| `id` | string | false | | ID is a unique identifier for the auth config. It defaults to `type` when not provided. |
|
||||
| `mcp_tool_allow_regex` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `mcp_tool_deny_regex` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `mcp_url` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `no_refresh` | boolean | false | | |
|
||||
| Name | Type | Required | Restrictions | Description |
|
||||
|------------------------------------|-----------------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `api_base_url` | string | false | | Api base URL is the base URL for provider REST API calls (e.g., "https://api.github.com" for GitHub). Derived from defaults when not explicitly configured. |
|
||||
| `app_install_url` | string | false | | |
|
||||
| `app_installations_url` | string | false | | |
|
||||
| `auth_url` | string | false | | |
|
||||
| `client_id` | string | false | | |
|
||||
| `code_challenge_methods_supported` | array of string | false | | Code challenge methods supported lists the PKCE code challenge methods The only one supported by Coder is "S256". |
|
||||
| `device_code_url` | string | false | | |
|
||||
| `device_flow` | boolean | false | | |
|
||||
| `display_icon` | string | false | | Display icon is a URL to an icon to display in the UI. |
|
||||
| `display_name` | string | false | | Display name is shown in the UI to identify the auth config. |
|
||||
| `id` | string | false | | ID is a unique identifier for the auth config. It defaults to `type` when not provided. |
|
||||
| `mcp_tool_allow_regex` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `mcp_tool_deny_regex` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `mcp_url` | string | false | | Deprecated: Injected MCP in AI Bridge is deprecated and will be removed in a future release. |
|
||||
| `no_refresh` | boolean | false | | |
|
||||
| `redirect_url` | string | false | | Redirect URL is optional, defaulting to 'ACCESS_URL'. Only useful in niche situations where the OAuth callback domain is different from the ACCESS_URL domain. The path component is ignored. |
|
||||
|`regex`|string|false||Regex allows API requesters to match an auth config by a string (e.g. coder.com) instead of by it's type.
|
||||
Git clone makes use of this by parsing the URL from: 'Username for "https://github.com":' And sending it to the Coder server to match against the Regex.|
|
||||
|`revoke_url`|string|false|||
|
||||
@@ -9615,7 +9619,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit - FeatureAgen
|
||||
| `organization_field` | string | false | | |
|
||||
| `organization_mapping` | object | false | | |
|
||||
| `redirect_allowed_hosts` | array of string | false | | Redirect allowed hosts is an allowlist of hostnames that may be used as the host of the OIDC redirect_uri. When non-empty, the redirect_uri is constructed from the incoming request's Host header (validated against this list) instead of from AccessURL. Every listed host must also be registered as a valid redirect URI in the OIDC provider. This setting is mutually exclusive with RedirectURL: if RedirectURL is set, this allowlist is ignored. |
|
||||
| `redirect_url` | [serpent.URL](#serpenturl) | false | | Redirect URL is optional, defaulting to 'ACCESS_URL'. Only useful in niche situations where the OIDC callback domain is different from the ACCESS_URL domain. |
|
||||
| `redirect_url` | [serpent.URL](#serpenturl) | false | | Redirect URL is optional, defaulting to 'ACCESS_URL'. Only useful in niche situations where the OIDC callback domain is different from the ACCESS_URL domain. The path component is ignored. |
|
||||
| `scopes` | array of string | false | | |
|
||||
| `sign_in_text` | string | false | | |
|
||||
| `signups_disabled_text` | string | false | | |
|
||||
@@ -19348,6 +19352,7 @@ None
|
||||
"mcp_tool_deny_regex": "string",
|
||||
"mcp_url": "string",
|
||||
"no_refresh": true,
|
||||
"redirect_url": "string",
|
||||
"regex": "string",
|
||||
"revoke_url": "string",
|
||||
"scopes": [
|
||||
|
||||
Reference in New Issue
Block a user