Merge pull request #7497 from selten/okta-oidc-auth

Add Okta as OIDC authentication option

client/galaxy/scripts/components/login/Login.vue

@@ -84,6 +84,7 @@ export default {
         const oidc_idps_icons = {
             google: "https://developers.google.com/identity/images/btn_google_signin_light_normal_web.png",
             elixir: "https://elixir-europe.org/sites/default/files/images/login-button-orange.png",
+            okta: "https://www.okta.com/sites/all/themes/Okta/images/blog/Logos/Okta_Logo_BrightBlue_Medium.png",
         };
         return {
             login: null,

doc/source/admin/authentication.md

@@ -18,7 +18,7 @@ If deploying Galaxy using the default authentication option, user activation can
 ## OIDC and OAuth2.0
 Leveraging OpenID Connect (OIDC) protocol, we enable login to Galaxy without explicitly creating a Galaxy user. This feature is disabled by default. In short, to enable this feature, a Galaxy server admin has to take the following two steps: 
 
-1. Define the Galaxy instance on an OIDC identity provider. At the moment, we support Google. To set a Galaxy instance on Google, go to _credentials_ section at [developers console](https://console.developers.google.com/), and configure the instance. At the end, you'll receive _client ID_ and _client secret_ take a note of these two tokens. 
+1. Define the Galaxy instance on an OIDC identity provider. At the moment, we support Google and Okta. To set a Galaxy instance on Google, go to _credentials_ section at [developers console](https://console.developers.google.com/), and configure the instance. At the end, you'll receive _client ID_ and _client secret_ take a note of these two tokens. For Okta, create a new application in Okta, type _web_. At the end you should take note of the _client ID_ and _client secret_ tokens.
 
 2. Configure Galaxy. In the `galaxy.yml` file enable the OIDC service using the `enable_oidc` key and set the two configuration files (i.e., `oidc_config_file` and `oidc_backends_config_file`), based on the IdP information. 
 

lib/galaxy/authnz/managers.py

@@ -121,6 +121,11 @@ class AuthnzManager(object):
             'enable_idp_logout': asbool(config_xml.findtext('enable_idp_logout', 'false'))}
         if config_xml.find('prompt') is not None:
             rtv['prompt'] = config_xml.find('prompt').text
+        if config_xml.find('api_url') is not None:
+            rtv['api_url'] = config_xml.find('api_url').text
+        if config_xml.find('url') is not None:
+            rtv['url'] = config_xml.find('url').text
+
         return rtv
 
     def _parse_custos_config(self, config_xml):

lib/galaxy/authnz/psa_authnz.py

@@ -22,14 +22,16 @@ DEFAULTS = {
 
 BACKENDS = {
     'google': 'social_core.backends.google_openidconnect.GoogleOpenIdConnect',
-    "globus": "social_core.backends.globus.GlobusOpenIdConnect",
-    'elixir': 'social_core.backends.elixir.ElixirOpenIdConnect'
+    'globus': 'social_core.backends.globus.GlobusOpenIdConnect',
+    'elixir': 'social_core.backends.elixir.ElixirOpenIdConnect',
+    'okta': 'social_core.backends.okta_openidconnect.OktaOpenIdConnect'
 }
 
 BACKENDS_NAME = {
     'google': 'google-openidconnect',
-    "globus": "globus",
-    'elixir': 'elixir'
+    'globus': 'globus',
+    'elixir': 'elixir',
+    'okta': 'okta-openidconnect'
 }
 
 AUTH_PIPELINE = (
@@ -126,6 +128,10 @@ class PSAAuthnz(IdentityProvider):
         self.config['redirect_uri'] = oidc_backend_config.get('redirect_uri')
         if oidc_backend_config.get('prompt') is not None:
             self.config[setting_name('AUTH_EXTRA_ARGUMENTS')]['prompt'] = oidc_backend_config.get('prompt')
+        if oidc_backend_config.get('api_url') is not None:
+            self.config[setting_name('API_URL')] = oidc_backend_config.get('api_url')
+        if oidc_backend_config.get('url') is not None:
+            self.config[setting_name('URL')] = oidc_backend_config.get('url')
 
     def _get_helper(self, name, do_import=False):
         this_config = self.config.get(setting_name(name), DEFAULTS.get(name, None))

lib/galaxy/config/sample/oidc_backends_config.xml.sample

@@ -110,4 +110,25 @@ Please mind `http` and `https`.
         <prompt>consent</prompt>
     </provider>
 
+    <provider name="Okta">
+        <client_id> ... </client_id>
+        <client_secret> ... </client_secret>
+        <redirect_uri>http://localhost:8080/authnz/okta/callback</redirect_uri>
+        <!-- Okta API URL, based on 'Single Sign-On to Okta' URL here: https://developer.okta.com/docs/api/resources/oidc#2-okta-as-the-identity-platform-for-your-app-or-api
+        This has subsequently had the '/v1/authorize' removed. In productive deployments, this will likely resemble:
+        https://${company}.okta.com/oauth2/${authServerId}/
+
+        To get the URL, you have to create an application in Okta. The following settings serve as example as of the time of writing:
+        - Page 1 - Platform
+          - Platform: Web
+        - Page 2 - Settings
+          - Name: (Decide yourself)
+          - Base URIs: http://localhost:8080/
+          - Login redirect URIs: http://localhost:8080/authnz/okta/callback
+          - Grant type allowed: Authorization code
+
+        You should subsequently be able to get the client ID and the client secret from the Okta website.
+         -->
+        <api_url> ... </api_url>
+    </provider>
 </OIDC>

lib/galaxy/dependencies/pipfiles/default/pinned-requirements.txt

@@ -170,7 +170,7 @@ setuptools-scm==3.5.0
 shellescape==3.4.1
 simplejson==3.17.0
 six==1.11.0
-social-auth-core[openidconnect]==3.1.0+gx0
+social-auth-core[openidconnect]==3.3.0
 sqlalchemy-migrate==0.13.0
 sqlalchemy-utils==0.36.3
 sqlalchemy==1.3.16