mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

initial hostedDomain support

Browse source
This commit is contained in:
Ben Navetta 2017-06-20 22:47:28 -07:00
parent 3493e30f43
commit 4194530cf3
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
connector/oidc/oidc.go
View file

@ -33,6 +33,7 @@ type Config struct {
Scopes []string `json:"scopes"` // defaults to "profile" and "email" Scopes []string `json:"scopes"` // defaults to "profile" and "email"
HostedDomain string `json:"hostedDomain"`
} }
// Domains that don't support basic auth. golang.org/x/oauth2 has an internal // Domains that don't support basic auth. golang.org/x/oauth2 has an internal
@ -112,6 +113,7 @@ func (c *Config) Open(logger logrus.FieldLogger) (conn connector.Connector, err
), ),
logger: logger, logger: logger,
cancel: cancel, cancel: cancel,
hostedDomain: c.HostedDomain,
}, nil }, nil
} }
@ -127,6 +129,7 @@ type oidcConnector struct {
ctx context.Context ctx context.Context
cancel context.CancelFunc cancel context.CancelFunc
logger logrus.FieldLogger logger logrus.FieldLogger
hostedDomain string
} }
func (c *oidcConnector) Close() error { func (c *oidcConnector) Close() error {
@ -138,7 +141,12 @@ func (c *oidcConnector) LoginURL(s connector.Scopes, callbackURL, state string)
if c.redirectURI != callbackURL { if c.redirectURI != callbackURL {
return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI) return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
} }
if c.hostedDomain != "" {
return c.oauth2Config.AuthCodeURL(state, oauth2.SetAuthURLParam("hd", c.hostedDomain)), nil
} else {
return c.oauth2Config.AuthCodeURL(state), nil return c.oauth2Config.AuthCodeURL(state), nil
}
} }
type oauth2Error struct { type oauth2Error struct {
@ -176,11 +184,16 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
Username string `json:"name"` Username string `json:"name"`
Email string `json:"email"` Email string `json:"email"`
EmailVerified bool `json:"email_verified"` EmailVerified bool `json:"email_verified"`
HostedDomain string `json:"hd"`
} }
if err := idToken.Claims(&claims); err != nil { if err := idToken.Claims(&claims); err != nil {
return identity, fmt.Errorf("oidc: failed to decode claims: %v", err) return identity, fmt.Errorf("oidc: failed to decode claims: %v", err)
} }
if claims.HostedDomain != c.hostedDomain {
return identity, fmt.Errorf("oidc: unexpected hd claim %v", claims.HostedDomain)
}
identity = connector.Identity{ identity = connector.Identity{
UserID: idToken.Subject, UserID: idToken.Subject,
Username: claims.Username, Username: claims.Username,