snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/pkg/provision/oidc.go

@@ -0,0 +1,140 @@
+package provision
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/cortezaproject/corteza/server/auth/external"
+	"github.com/cortezaproject/corteza/server/pkg/options"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"go.uber.org/zap"
+)
+
+// Provisions OIDC providers from PROVISION_OIDC_PROVIDER env variable
+//
+// Env variable should contains space delimited pairs of providers (<name> <provider> ....)
+func oidcAutoDiscovery(ctx context.Context, log *zap.Logger, s store.SettingValues, opt options.AuthOpt) (err error) {
+	log.Info("provision start")
+	defer log.Info("provision end")
+
+	var provider = strings.TrimSpace(options.EnvString("PROVISION_OIDC_PROVIDER", ""))
+
+	log.Debug("OIDC auto discovery provision",
+		zap.String("envkey", "PROVISION_OIDC_PROVIDER"),
+		zap.String("providers", provider),
+	)
+
+	if len(provider) == 0 {
+		return
+	}
+
+	var (
+		providers  = strings.Split(provider, " ")
+		plen       = len(providers)
+		name, purl string
+		eap        *types.ExternalAuthProvider
+	)
+
+	if plen%2 == 1 {
+		return fmt.Errorf("expecting even number of providers")
+	}
+
+	for p := 0; p < plen; p = p + 2 {
+		name, purl = providers[p], providers[p+1]
+
+		// force:    false
+		// because we do not want to override the provider every time the system restarts
+		//
+		// validate: false
+		// because at the initial (empty db) start, we cannot actually validate (server is not yet up)
+		//
+		// enable:   true
+		// we want provider & the entire external auth to be validated
+		eap, err = external.RegisterOidcProvider(ctx, log, s, opt, name, purl, false, false, true)
+
+		if err != nil {
+			log.Error(
+				"could not register OIDC provider",
+				zap.String("url", purl),
+				zap.String("name", name),
+				zap.Error(err))
+			return
+		} else if eap == nil {
+			log.Info("provider already exists",
+				zap.String("name", name))
+		} else {
+			log.Info("provider successfully registered",
+				zap.String("url", purl),
+				zap.String("key", eap.Key),
+				zap.String("name", name))
+		}
+	}
+
+	return
+}
+
+func authAddExternals(ctx context.Context, log *zap.Logger, s store.SettingValues) (err error) {
+	log.Info("provision start")
+	defer log.Info("provision end")
+
+	var (
+		kinds = []string{
+			"github",
+			"facebook",
+			"google",
+			"linkedin",
+			"oidc",
+			"nylas",
+		}
+
+		key, name string
+
+		pp []string
+
+		eap *types.ExternalAuthProvider
+	)
+
+	for _, kind := range kinds {
+		key = "PROVISION_SETTINGS_AUTH_EXTERNAL_" + strings.ToUpper(kind)
+		val, has := os.LookupEnv(key)
+
+		if !has {
+			continue
+		}
+
+		if val = strings.TrimSpace(val); val == "" {
+			log.Warn(fmt.Sprintf("found empty value for %s", key))
+			continue
+		} else {
+			log.Info(fmt.Sprintf("provosioning external auth provider from %s", key))
+		}
+
+		eap = &types.ExternalAuthProvider{Enabled: true}
+
+		if kind == "oidc" {
+			pp = strings.SplitN(val, " ", 4)
+
+			if len(pp) < 4 {
+				log.Warn(fmt.Sprintf("expecting 4 values (name, issuer-url, ket, secret) in %s", key))
+			}
+
+			// Spread name, issuer-url, key and secret from provision string for OIDC provider
+			name, eap.IssuerUrl, eap.Key, eap.Secret = pp[0], pp[1], pp[2], pp[3]
+
+			eap.Handle = external.OIDC_PROVIDER_PREFIX + name
+		} else {
+			pp = strings.SplitN(val, " ", 2)
+
+			// Spread key and secret from provision string
+			eap.Key, eap.Secret = pp[0], pp[1]
+			eap.Handle = kind
+		}
+
+		_ = external.AddProvider(ctx, log, s, eap, false)
+	}
+
+	return
+}