From 7257de1722318226e7e621054e7009eed5400285 Mon Sep 17 00:00:00 2001 From: Alexandru Mahmoud Date: Mon, 14 Jun 2021 16:57:02 -0400 Subject: [PATCH 1/2] Temporary fix for keycloak OIDC --- lib/galaxy/authnz/custos_authnz.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/galaxy/authnz/custos_authnz.py b/lib/galaxy/authnz/custos_authnz.py index f2a22191dd3..e5eef15b196 100644 --- a/lib/galaxy/authnz/custos_authnz.py +++ b/lib/galaxy/authnz/custos_authnz.py @@ -87,6 +87,7 @@ class CustosAuthnz(IdentityProvider): else: userinfo = self._get_userinfo(oauth2_session) email = userinfo['email'] + username = userinfo.get('preferred_username', self._generate_username(trans, email)) user_id = userinfo['sub'] # Create or update custos_authnz_token record @@ -110,9 +111,13 @@ class CustosAuthnz(IdentityProvider): message = "There already exists a user with email %s. To associate this external login, you must first be logged in as that existing account." % email log.exception(message) raise exceptions.AuthenticationFailed(message) - else: - login_redirect_url = login_redirect_url + 'root/login?confirm=true&custos_token=' + json.dumps(token) + elif self.config['provider'] == 'custos': + login_redirect_url = f"{login_redirect_url}root/login?confirm=true&custos_token={json.dumps(token)}" return login_redirect_url, None + else: + user = trans.app.user_manager.create(email=email, username=username) + if trans.app.config.user_activation_on: + trans.app.user_manager.send_activation_email(trans, email, username) custos_authnz_token = CustosAuthnzToken(user=user, external_user_id=user_id, @@ -130,7 +135,7 @@ class CustosAuthnz(IdentityProvider): custos_authnz_token.refresh_expiration_time = refresh_expiration_time trans.sa_session.add(custos_authnz_token) trans.sa_session.flush() - return login_redirect_url, custos_authnz_token.user + return "/", custos_authnz_token.user def create_user(self, token, trans, login_redirect_url): token_dict = json.loads(token) From 1fee6893248169c17dc69ad3c4961a4d0313b338 Mon Sep 17 00:00:00 2001 From: Nuwan Goonasekera <2070605+nuwang@users.noreply.github.com> Date: Mon, 26 Jul 2021 16:52:29 +0530 Subject: [PATCH 2/2] Allow absolute or relative url in assertion --- test/unit/authnz/test_custos_authnz.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/unit/authnz/test_custos_authnz.py b/test/unit/authnz/test_custos_authnz.py index 2b71f40d16b..4cf04f52215 100644 --- a/test/unit/authnz/test_custos_authnz.py +++ b/test/unit/authnz/test_custos_authnz.py @@ -313,7 +313,7 @@ class CustosAuthnzTestCase(unittest.TestCase): self.assertTrue(self._create_oauth2_session_called) self.assertTrue(self._fetch_token_called) self.assertTrue(self._get_userinfo_called) - self.assertEqual(login_redirect_url, "http://localhost:8000/") + self.assertEqual(login_redirect_url, "/") self.assertIsNotNone(user) def test_callback_nonce_validation_with_bad_nonce(self):