mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-03-11 09:04:54 +00:00
64f1a1c918
- Use the excellent Apache module auth_openidc. - Implement macros that can be easily used to configure OpenID Connect. Tests: - Accessing /freedombox/apache/discover-idp/ shows - 'method' other than 'get' throw a 'bad request' error - oidc_callback should match host. Otherwise 'bad request' error is raised. - Mismatched host header is not allowed - Invalid domain setup is not allowed - target_link_uri is returned as is - method is returned as is and only 'get' is allowed. - x_csrf is returned as is - oidc_scopes is returned as 'email freedombox_groups' - HTTP request is answered and not redirected to https - When logging in with OIDC, authorization is skipped. When authorization is shown, it is shown as 'Web app protected by FreedomBox'. - libapache2-mod-auth-openidc is added a dependency for freedombox package. It is installable in stable, testing, and unstable distributions. - On applying patches, Apache setup configuration is run and OpenIDC component is created. - When patches are applied and setup install is run, auth_openidc module, 10-freedombox, freedombox-openidc config is enabled in Apache. - When setup is rerun, passphrase is not changed - metadata directory and parent are created when apache setup is run. Mode is 0o700 and ownership is www-data. - freedombox-openidc is created when apache setup is run and has 0o700 permissions. - Metadata directory will contain the client id and client passphrase when discovery happens for a particular domain. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
72 lines
2.7 KiB
Python
72 lines
2.7 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""Views for the Apache app."""
|
|
|
|
from urllib.parse import urlencode, urlparse
|
|
|
|
from django.http import (HttpResponseBadRequest, HttpResponseRedirect,
|
|
HttpResponseServerError)
|
|
from django.views import View
|
|
|
|
from . import setup_oidc_client, validate_host
|
|
|
|
# By default 'openid' scope already included by mod_auth_openidc
|
|
OIDC_SCOPES = 'email freedombox_groups'
|
|
|
|
|
|
class DiscoverIDPView(View):
|
|
"""A view called by auth_openidc Apache module to find the IDP.
|
|
|
|
According to documentation for auth_openidc: an Issuer selection can be
|
|
passed back to the callback URL as in:
|
|
<callback-url>?iss=[${issuer}|${domain}|${e-mail-style-account-name}]
|
|
[parameters][&login_hint=<login-hint>][&scopes=<scopes>]
|
|
[&auth_request_params=<params>]
|
|
|
|
where the <iss> parameter contains the URL-encoded issuer value of the
|
|
selected Provider (or...), [parameters] contains the additional parameters
|
|
that were passed in on the discovery request (e.g.
|
|
target_link_uri=<url>&x_csrf=<x_csrf>&method=<method>&scopes=<scopes>)
|
|
"""
|
|
|
|
def get(self, request):
|
|
"""Redirect back to auth_openidc module after selecting a IDP."""
|
|
target_link_uri = request.GET.get('target_link_uri', '')
|
|
method = request.GET.get('method', 'get')
|
|
x_csrf = request.GET.get('x_csrf', '')
|
|
oidc_callback = request.GET.get('oidc_callback')
|
|
|
|
if method != 'get':
|
|
return HttpResponseBadRequest(f'Cannot handle "{method}" method')
|
|
|
|
oidc_callback_parts = urlparse(oidc_callback)
|
|
request_host = request.META['HTTP_HOST']
|
|
if request_host != oidc_callback_parts.netloc:
|
|
return HttpResponseBadRequest(
|
|
f'Cannot redirect from {request_host} to a different host '
|
|
f'{oidc_callback_parts.netloc}')
|
|
|
|
try:
|
|
validate_host(oidc_callback_parts.hostname)
|
|
except ValueError:
|
|
return HttpResponseBadRequest(
|
|
f'Accessed using unknown domain {request_host}. Please add '
|
|
'the domain to list of configured domains.')
|
|
|
|
try:
|
|
setup_oidc_client(oidc_callback_parts.netloc,
|
|
oidc_callback_parts.hostname)
|
|
except ValueError:
|
|
return HttpResponseServerError(
|
|
f'Server not configured to called as {request_host}')
|
|
|
|
url = '/apache/oidc/callback'
|
|
params = {
|
|
'iss': f'https://{request_host}/freedombox/o',
|
|
'target_link_uri': target_link_uri,
|
|
'method': method,
|
|
'x_csrf': x_csrf,
|
|
'scopes': OIDC_SCOPES,
|
|
}
|
|
params = urlencode(params)
|
|
return HttpResponseRedirect(f'{url}?{params}')
|