opensource/planka
3
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2026-08-28 18:17:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add OAuth callback support for OIDC (#1290)

Browse Source 
Closes #593, closes #690, closes #1289
This commit is contained in:
Luis Chacón
2025-08-09 10:58:55 -06:00
committed by GitHub
parent b4f6e24442
commit cbb00d1d59
6 changed files with 31 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose-dev.yml
+1
View File
@@ -55,6 +55,7 @@ services:
# - OIDC_ISSUER=
# - OIDC_CLIENT_ID=
# - OIDC_CLIENT_SECRET=
# - OIDC_USE_OAUTH_CALLBACK=true
# - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
# - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
# - OIDC_SCOPES=openid email profile
docker-compose.yml
+1
View File
@@ -73,6 +73,7 @@ services:
# - OIDC_CLIENT_SECRET=
# Optionally store in secrets - then OIDC_CLIENT_SECRET should not be set
# - OIDC_CLIENT_SECRET__FILE=/run/secrets/oidc_client_secret
# - OIDC_USE_OAUTH_CALLBACK=true
# - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
# - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
# - OIDC_SCOPES=openid email profile
server/.env.sample
+1
View File
@@ -46,6 +46,7 @@ SECRET_KEY=notsecretkey
# OIDC_ISSUER=
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_USE_OAUTH_CALLBACK=true
# OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
# OIDC_USERINFO_SIGNED_RESPONSE_ALG=
# OIDC_SCOPES=openid email profile
server/api/helpers/users/get-or-create-one-with-oidc.js
+24 -12
View File
@@ -34,16 +34,29 @@ module.exports = {
let tokenSet;
try {
tokenSet = await client.callback(
sails.config.custom.oidcRedirectUri,
{
iss: sails.config.custom.oidcIssuer,
code: inputs.code,
},
{
nonce: inputs.nonce,
},
);
if (sails.config.custom.oidcUseOauthCallback) {
tokenSet = await client.oauthCallback(
sails.config.custom.oidcRedirectUri,
{
iss: sails.config.custom.oidcIssuer,
code: inputs.code,
},
{
nonce: inputs.nonce,
},
);
} else {
tokenSet = await client.callback(
sails.config.custom.oidcRedirectUri,
{
iss: sails.config.custom.oidcIssuer,
code: inputs.code,
},
{
nonce: inputs.nonce,
},
);
}
} catch (error) {
sails.log.warn(`Error while exchanging OIDC code: ${error}`);
throw 'invalidCodeOrNonce';
@@ -93,7 +106,6 @@ module.exports = {
if (configRoles.includes('*')) {
return true;
}
return configRoles.some((configRole) => claimsRolesSet.has(configRole));
},
);
@@ -148,7 +160,7 @@ module.exports = {
identityProviderUser = await IdentityProviderUser.qm.createOne({
userId: user.id,
issuer: sails.config.custom.oidcIssuer,
sub: claims.sub,
sub: claims.sub || `${user.id}@${sails.config.custom.oidcIssuer}`,
});
}
server/config/custom.js
+1
View File
@@ -64,6 +64,7 @@ module.exports.custom = {
oidcIssuer: process.env.OIDC_ISSUER,
oidcClientId: process.env.OIDC_CLIENT_ID,
oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
oidcUseOauthCallback: process.env.OIDC_USE_OAUTH_CALLBACK === 'true',
oidcIdTokenSignedResponseAlg: process.env.OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG,
oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG,
oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
server/package-lock.json
Generated
+3 -3
View File
@@ -7809,9 +7809,9 @@
}
},
"node_modules/oidc-token-hash": {
"version": "5.1.0",
"resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.0.tgz",
"integrity": "sha512-y0W+X7Ppo7oZX6eovsRkuzcSM40Bicg2JEJkDJ4irIt1wsYAP5MLSNv+QAogO8xivMffw/9OvV3um1pxXgt1uA==",
"version": "5.1.1",
"resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.1.tgz",
"integrity": "sha512-D7EmwxJV6DsEB6vOFLrBM2OzsVgQzgPWyHlV2OOAVj772n+WTXpudC9e9u5BVKQnYwaD30Ivhi9b+4UeBcGu9g==",
"license": "MIT",
"engines": {
"node": "^10.13.0 || >=12.0.0"