64 lines
1.7 KiB
Go
64 lines
1.7 KiB
Go
|
package server
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"fmt"
|
||
|
|
|
||
|
|
"github.com/coreos/go-oidc/v3/oidc"
|
||
|
|
"github.com/danyel/go-loose/internal/password"
|
||
|
|
"golang.org/x/oauth2"
|
||
|
|
)
|
||
|
|
|
||
|
|
func (s *Server) configureOIDC(ctx context.Context, issuer, clientID, clientSecret string) error {
|
||
|
|
provider, err := oidc.NewProvider(ctx, issuer)
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("discover OIDC provider: %w", err)
|
||
|
|
}
|
||
|
|
config := &oauth2.Config{
|
||
|
|
ClientID: clientID, ClientSecret: clientSecret,
|
||
|
|
Endpoint: provider.Endpoint(), RedirectURL: s.cfg.OIDCRedirectURL,
|
||
|
|
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
|
||
|
|
}
|
||
|
|
s.authMu.Lock()
|
||
|
|
s.oauth = config
|
||
|
|
s.verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
|
||
|
|
s.authMu.Unlock()
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func (s *Server) oidcConfiguration() (*oauth2.Config, *oidc.IDTokenVerifier) {
|
||
|
|
s.authMu.RLock()
|
||
|
|
defer s.authMu.RUnlock()
|
||
|
|
return s.oauth, s.verifier
|
||
|
|
}
|
||
|
|
|
||
|
|
func (s *Server) hasOIDC() bool {
|
||
|
|
config, verifier := s.oidcConfiguration()
|
||
|
|
return config != nil && verifier != nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func (s *Server) ensureLocalAdministrator(ctx context.Context) error {
|
||
|
|
if !s.cfg.LocalLogin {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
dummyHash, err := password.Hash("not-a-real-account-password")
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("hash password timing value: %w", err)
|
||
|
|
}
|
||
|
|
s.loginGuard.dummyHash = dummyHash
|
||
|
|
if s.cfg.LocalAdminPassword == "" {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
passwordHash, err := password.Hash(s.cfg.LocalAdminPassword)
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("hash local administrator password: %w", err)
|
||
|
|
}
|
||
|
|
if err := s.store.EnsurePasswordUser(
|
||
|
|
ctx, s.cfg.LocalAdminEmail, "Local Administrator", passwordHash,
|
||
|
|
s.cfg.BootstrapTenant, s.cfg.BootstrapApp,
|
||
|
|
); err != nil {
|
||
|
|
return fmt.Errorf("bootstrap local administrator: %w", err)
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|