Login error
+ + \ No newline at end of file diff --git a/multiapps/compose.yaml b/localhost/demoapps/compose.yaml similarity index 56% rename from multiapps/compose.yaml rename to localhost/demoapps/compose.yaml index 4fc76d7..9bf0b57 100644 --- a/multiapps/compose.yaml +++ b/localhost/demoapps/compose.yaml @@ -1,3 +1,5 @@ +name: ipax-demoapps + services: idp: container_name: idp @@ -7,36 +9,36 @@ services: ports: - 8080:8080 environment: - KEYCLOAK_ADMIN: admin - KEYCLOAK_ADMIN_PASSWORD: admin + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: admin KC_FEATURES: update-email volumes: - ./keycloak/:/opt/keycloak/data/import/ command: "start-dev --import-realm" demoapps: container_name: demoapps - image: ghcr.io/identicum/ipax:latest - pull_policy: always + image: ghcr.io/identicum/ipax:refactor restart: always ports: - 80:80 environment: NGINX_RESOLVER: 127.0.0.11 valid=5s NGINX_LOG_LEVEL: debug + IPAX_MODE: demoapps volumes: - - ../lua/:/etc/ipax/lua/ - - ../conf/nginx.conf.template:/usr/local/openresty/nginx/conf/nginx.conf.template - - ../conf/demoapp.conf:/usr/local/openresty/nginx/conf/demoapp.conf - - ../conf/demoapp_default_variables.conf:/usr/local/openresty/nginx/conf/demoapp_default_variables.conf - - ../templates:/var/ipax/templates/ - - ./server.conf:/usr/local/openresty/nginx/conf/server.conf - - ./conf.d/:/etc/ipax/conf.d/ + - ../../entrypoint.sh:/entrypoint.sh + - ../../conf/:/var/ipax/conf/ + - ./conf/:/var/ipax/conf/demoapps/ + - ../../html/:/var/ipax/html/ + - ../../lua/:/var/ipax/lua/ + - ../../templates:/var/ipax/templates/ depends_on: idp: condition: service_healthy mailcatcher: container_name: mailcatcher image: ghcr.io/identicum/mailcatcher:latest + pull_policy: always restart: always ports: - 1080:1080 \ No newline at end of file diff --git a/localhost/demoapps/conf/demoapp1.conf b/localhost/demoapps/conf/demoapp1.conf new file mode 100644 index 0000000..a0e1e11 --- /dev/null +++ b/localhost/demoapps/conf/demoapp1.conf @@ -0,0 +1,12 @@ +set $ipax_app_name 'demoapp1'; +set $ipax_display_name 'DemoApp1'; +set $ipax_base_url 'http://demoapps/demoapp1'; + +set $oidc_discovery 'http://idp:8080/realms/demorealm/.well-known/openid-configuration'; +set $oidc_client_id 'demoapp1_client_id'; +set $oidc_client_secret 'demoapp1_client_secret'; + +set $kc_update_password_action 'UPDATE_PASSWORD'; +set $kc_update_email_action 'UPDATE_EMAIL'; + +set $kc_add_passkey_action 'webauthn-register-passwordless'; \ No newline at end of file diff --git a/localhost/demoapps/conf/demoapp2.conf b/localhost/demoapps/conf/demoapp2.conf new file mode 100644 index 0000000..300b03d --- /dev/null +++ b/localhost/demoapps/conf/demoapp2.conf @@ -0,0 +1,10 @@ +set $ipax_app_name 'demoapp2'; +set $ipax_display_name 'DemoApp2'; +set $ipax_base_url 'http://demoapps/demoapp2'; + +set $oidc_discovery 'http://idp:8080/realms/demorealm/.well-known/openid-configuration'; +set $oidc_client_id 'demoapp2_client_id'; +set $oidc_use_pkce 'true'; +set $oidc_scope 'openid profile email'; + +set $kc_delete_account_action 'delete_account'; \ No newline at end of file diff --git a/localhost/demoapps/conf/demoapp3.conf b/localhost/demoapps/conf/demoapp3.conf new file mode 100644 index 0000000..525548c --- /dev/null +++ b/localhost/demoapps/conf/demoapp3.conf @@ -0,0 +1,11 @@ +set $ipax_app_name 'demoapp3'; +set $ipax_display_name 'DemoApp3'; +set $ipax_base_url 'http://demoapps/demoapp3'; + +set $oidc_discovery 'http://idp:8080/realms/demorealm/.well-known/openid-configuration'; +set $oidc_client_id 'demoapp3_client_id'; +set $oidc_use_pkce 'true'; +set $oidc_scope 'openid profile email'; +set $oidc_prompt 'none'; + +set $kc_delete_account_action 'delete_account'; \ No newline at end of file diff --git a/multiapps/keycloak/demorealm.json b/localhost/demoapps/keycloak/demorealm.json similarity index 72% rename from multiapps/keycloak/demorealm.json rename to localhost/demoapps/keycloak/demorealm.json index 7cace92..8dca2ac 100644 --- a/multiapps/keycloak/demorealm.json +++ b/localhost/demoapps/keycloak/demorealm.json @@ -18,8 +18,8 @@ "directAccessGrantsEnabled": false, "serviceAccountsEnabled": false, "frontchannelLogout": true, - "rootUrl": "http://demoapp1", - "baseUrl": "http://demoapp1", + "rootUrl": "http://demoapps/demoapp1", + "baseUrl": "/", "redirectUris": [ "/private/redirect_uri", "/private/info" @@ -33,14 +33,35 @@ { "name": "demoapp2", "clientId": "demoapp2_client_id", - "secret": "demoapp2_client_secret", + "publicClient": true, "standardFlowEnabled": true, "implicitFlowEnabled": false, "directAccessGrantsEnabled": false, "serviceAccountsEnabled": false, "frontchannelLogout": true, - "rootUrl": "http://demoapp2", - "baseUrl": "http://demoapp2", + "rootUrl": "http://demoapps/demoapp2", + "baseUrl": "/", + "redirectUris": [ + "/private/redirect_uri", + "/private/info" + ], + "defaultClientScopes": [ ], + "optionalClientScopes": [ "profile", "email", "roles", "phone" ], + "attributes": { + "post.logout.redirect.uris": "/logoutSuccess.html" + } + }, + { + "name": "demoapp3", + "clientId": "demoapp3_client_id", + "publicClient": true, + "standardFlowEnabled": true, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": false, + "serviceAccountsEnabled": false, + "frontchannelLogout": true, + "rootUrl": "http://demoapps/demoapp3", + "baseUrl": "/", "redirectUris": [ "/private/redirect_uri", "/private/info" @@ -103,6 +124,15 @@ "defaultAction": false, "priority": 61, "config": {} + }, + { + "alias": "webauthn-register-passwordless", + "name": "Webauthn Register Passwordless", + "providerId": "webauthn-register-passwordless", + "enabled": true, + "defaultAction": false, + "priority": 62, + "config": {} } ], "smtpServer": { diff --git a/compose.yaml b/localhost/single/compose.yaml similarity index 52% rename from compose.yaml rename to localhost/single/compose.yaml index 1c79550..239a574 100644 --- a/compose.yaml +++ b/localhost/single/compose.yaml @@ -1,3 +1,5 @@ +name: ipax-single + services: idp: container_name: idp @@ -7,8 +9,8 @@ services: ports: - 8080:8080 environment: - KEYCLOAK_ADMIN: admin - KEYCLOAK_ADMIN_PASSWORD: admin + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: admin KC_FEATURES: update-email volumes: - ./keycloak/:/opt/keycloak/data/import/ @@ -16,7 +18,7 @@ services: ipax: container_name: ipax - image: ghcr.io/identicum/ipax:latest + image: ghcr.io/identicum/ipax:refactor restart: always ports: - 80:80 @@ -25,31 +27,21 @@ services: NGINX_LOG_LEVEL: debug OIDC_DISCOVERY: http://idp:8080/realms/demorealm/.well-known/openid-configuration OIDC_CLIENT_ID: ipax_client_id - OIDC_USE_PKCE: "false" OIDC_CLIENT_SECRET: ipax_client_secret OIDC_SCOPE: openid profile email roles phone - OIDC_POST_LOGOUT_REDIRECT_URI: http://localhost/logoutSuccess.html + IPAX_DISPLAY_NAME: IPAx single demoapp + IPAX_BASE_URL: http://demoapp1 + IPAX_MODE: single KC_DELETE_ACCOUNT_ACTION: delete_account KC_DELETE_ACCOUNT_LABEL: Delete user KC_UPDATE_EMAIL_ACTION: UPDATE_EMAIL KC_UPDATE_PASSWORD_ACTION: UPDATE_PASSWORD volumes: - - ./conf/health.conf:/usr/local/openresty/nginx/conf/health.conf - - ./conf/info.conf:/usr/local/openresty/nginx/conf/info.conf - - ./conf/lua.conf:/usr/local/openresty/nginx/conf/lua.conf - - ./conf/filter_cookie.conf:/usr/local/openresty/nginx/conf/filter_cookie.conf - - ./conf/nginx.conf.template:/usr/local/openresty/nginx/conf/nginx.conf.template - - ./conf/norobots.conf:/usr/local/openresty/nginx/conf/norobots.conf - - ./conf/server.conf:/usr/local/openresty/nginx/conf/server.conf - - ./html/:/var/ipax/html/ - - ./lua/:/etc/ipax/lua/ - - ./templates:/var/ipax/templates/ - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost/ipax/health"] - interval: 10s - timeout: 1s - retries: 5 - start_period: 5s + - ../../entrypoint.sh:/entrypoint.sh + - ../../conf/:/var/ipax/conf/ + - ../../html/:/var/ipax/html/ + - ../../lua/:/var/ipax/lua/ + - ../../templates:/var/ipax/templates/ depends_on: idp: condition: service_healthy diff --git a/keycloak/demorealm.json b/localhost/single/keycloak/demorealm.json similarity index 96% rename from keycloak/demorealm.json rename to localhost/single/keycloak/demorealm.json index 0594159..a63e579 100644 --- a/keycloak/demorealm.json +++ b/localhost/single/keycloak/demorealm.json @@ -18,8 +18,8 @@ "directAccessGrantsEnabled": false, "serviceAccountsEnabled": false, "frontchannelLogout": true, - "rootUrl": "http://localhost", - "baseUrl": "http://localhost", + "rootUrl": "http://demoapp1", + "baseUrl": "/", "redirectUris": [ "/private/redirect_uri", "/private/info" diff --git a/lua/ipax.lua b/lua/ipax.lua index 20844dc..e91276a 100644 --- a/lua/ipax.lua +++ b/lua/ipax.lua @@ -1,355 +1,262 @@ --- -------------------------------------------------------------------------------------------------------------- --- -------------------------------------------------------------------------------------------------------------- --- https://github.com/zmartzone/lua-resty-openidc/blob/master/lib/resty/openidc.lua -local http = require("resty.http") -local function openidc_cache_get(type, key) - local dict = ngx.shared[type] - local value - if dict then - value = dict:get(key) - if value then ngx.log(ngx.DEBUG, "cache hit: type=", type, " key=", key) end - end - return value - end - local function openidc_configure_timeouts(httpc, timeout) - if timeout then - if type(timeout) == "table" then - local r, e = httpc:set_timeouts(timeout.connect or 0, timeout.send or 0, timeout.read or 0) - else - local r, e = httpc:set_timeout(timeout) - end - end - end - -- Set outgoing proxy options -local function openidc_configure_proxy(httpc, proxy_opts) - if httpc and proxy_opts and type(proxy_opts) == "table" then - ngx.log(ngx.DEBUG, "openidc_configure_proxy : use http proxy") - httpc:set_proxy_options(proxy_opts) - else - ngx.log(ngx.DEBUG, "openidc_configure_proxy : don't use http proxy") - end - end --- get the Discovery metadata from the specified URL -local function openidc_discover(url, ssl_verify, keepalive, timeout, exptime, proxy_opts, http_request_decorator) - ngx.log(ngx.DEBUG, "openidc_discover: URL is: " .. url) - local json, err - local v = openidc_cache_get("discovery", url) - if not v then - ngx.log(ngx.DEBUG, "discovery data not in cache, making call to discovery endpoint") - -- make the call to the discovery endpoint - local httpc = http.new() - openidc_configure_timeouts(httpc, timeout) - openidc_configure_proxy(httpc, proxy_opts) - local res, error = httpc:request_uri(url, decorate_request(http_request_decorator, { - ssl_verify = (ssl_verify ~= "no"), - keepalive = (keepalive ~= "no") - })) - if not res then - err = "accessing discovery url (" .. url .. ") failed: " .. error - ngx.log(ngx.DEBUG, err) - else - ngx.log(ngx.DEBUG, "response data: " .. res.body) - json, err = openidc_parse_json_response(res) - if json then - openidc_cache_set("discovery", url, cjson.encode(json), exptime or 24 * 60 * 60) - else - err = "could not decode JSON from Discovery data" .. (err and (": " .. err) or '') - ngx.log(ngx.DEBUG, err) - end - end - else - json = cjson.decode(v) - end - return json, err -end +local _M = {} --- turn a discovery url set in the opts dictionary into the discovered information -local function openidc_ensure_discovered_data(opts) - local err - if type(opts.discovery) == "string" then - local discovery - discovery, err = openidc_discover(opts.discovery, opts.ssl_verify, opts.keepalive, opts.timeout, opts.discovery_expires_in, opts.proxy_opts, opts.http_request_decorator) - if not err then - opts.discovery = discovery - end - end - return err +local function is_true(input) + if string.lower(input) == "true" then + return true + else + return false + end end -local function get_first(table_or_string) - local res = table_or_string - if table_or_string and type(table_or_string) == 'table' then - res = table_or_string[1] +local function get_authorization_params(oidc_acr_values) + ngx.log(ngx.DEBUG, "Starting") + local authorization_params_table = {} + if oidc_acr_values ~= '' then + authorization_params_table["acr_values"]=oidc_acr_values end - return res + return authorization_params_table end -local function get_first_header(headers, header_name) - local header = headers[header_name] - return get_first(header) +function _M.get_var_or_env(ngx_var_key) + local env_var_name = string.upper(ngx_var_key) + if ngx.var[ngx_var_key] and ngx.var[ngx_var_key] ~= "" then + return ngx.var[ngx_var_key] + else + return os.getenv(env_var_name) + end end -local function get_first_header_and_strip_whitespace(headers, header_name) - local header = get_first_header(headers, header_name) - return header and header:gsub('%s', '') -end +function _M.get_oidc_opts() + ngx.log(ngx.DEBUG, "Starting") + local ipax_base_url = _M.get_var_or_env("ipax_base_url") -local function get_forwarded_parameter(headers, param_name) - local forwarded = get_first_header(headers, 'Forwarded') - local params = {} - if forwarded then - local function parse_parameter(pv) - local name, value = pv:match("^%s*([^=]+)%s*=%s*(.-)%s*$") - if name and value then - if value:sub(1, 1) == '"' then - value = value:sub(2, -2) - end - params[name:lower()] = value - end - end - -- this assumes there is no quoted comma inside the header's value which should be fine as comma is not legal inside a node name, a URI scheme or a host name. The only thing that might bite us are extensions. - local first_part = forwarded - local first_comma = forwarded:find("%s*,%s*") - if first_comma then - first_part = forwarded:sub(1, first_comma - 1) - end - first_part:gsub("[^;]+", parse_parameter) + local oidc_redirect_uri + if ngx.var.oidc_redirect_uri and ngx.var.oidc_redirect_uri ~= "" then + oidc_redirect_uri = ngx.var.oidc_redirect_uri + else + oidc_redirect_uri = ipax_base_url .. os.getenv("OIDC_REDIRECT_URI") end - return params[param_name:gsub("^%s*(.-)%s*$", "%1"):lower()] -end - -local function get_scheme(headers) - return get_forwarded_parameter(headers, 'proto') - or get_first_header_and_strip_whitespace(headers, 'X-Forwarded-Proto') - or ngx.var.scheme -end - -local function get_host_name_from_x_header(headers) - local header = get_first_header_and_strip_whitespace(headers, 'X-Forwarded-Host') - return header and header:gsub('^([^,]+),?.*$', '%1') -end - -local function get_host_name(headers) - return get_forwarded_parameter(headers, 'host') - or get_host_name_from_x_header(headers) - or ngx.var.http_host -end --- -------------------------------------------------------------------------------------------------------------- --- -------------------------------------------------------------------------------------------------------------- --- IPAx module -local _M = {} - - -local function isTrue(input) - if string.lower(input) == "true" then - return true + local oidc_post_logout_redirect_uri + if ngx.var.oidc_post_logout_redirect_uri and ngx.var.oidc_post_logout_redirect_uri ~= "" then + oidc_post_logout_redirect_uri = ngx.var.oidc_post_logout_redirect_uri else - return false - end -end - -local function getAuthorizationParams() - local authorizationParamsTable = {} + oidc_post_logout_redirect_uri = ipax_base_url .. os.getenv("OIDC_POST_LOGOUT_REDIRECT_URI") + end - local acr_values = os.getenv("OIDC_ACR_VALUES") - if acr_values ~= '' then - authorizationParamsTable["acr_values"]=acr_values + local logout_path = _M.get_var_or_env("oidc_logout_path") + if os.getenv("IPAX_MODE")=='demoapps' then + logout_path = "/" .. _M.get_var_or_env("ipax_app_name") .. logout_path end - return authorizationParamsTable + local oidc_opts = { + discovery = _M.get_var_or_env("oidc_discovery"), + ssl_verify = _M.get_var_or_env("oidc_ssl_verify"), + client_id = _M.get_var_or_env("oidc_client_id"), + use_pkce = is_true(_M.get_var_or_env("oidc_use_pkce")), + scope = _M.get_var_or_env("oidc_scope"), + redirect_uri = oidc_redirect_uri, + logout_path = logout_path, + post_logout_redirect_uri = oidc_post_logout_redirect_uri, + authorization_params = get_authorization_params(_M.get_var_or_env("oidc_acr_values")), + renew_access_token_on_expiry = true, + session_contents = {id_token=true, enc_id_token=true, access_token=true, user=true}, + -- Custom shared dictionaries per instance + jwks_uri_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_jwks", + discovery_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_discovery", + state_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_oidc_state", + access_tokens_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_oidc_access_tokens", + refresh_tokens_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_oidc_refresh_tokens", + id_tokens_lua_shared_dict = _M.get_var_or_env("ipax_app_name") .. "_oidc_id_tokens" + } + local oidc_client_secret = _M.get_var_or_env("oidc_client_secret") + if oidc_client_secret ~= '' then + oidc_opts["client_secret"]=oidc_client_secret + end + local prompt_override = _M.get_var_or_env("oidc_prompt") + if prompt_override ~= '' then + oidc_opts["prompt"]=prompt_override + end + return oidc_opts end -local oidc_opts = { - discovery = os.getenv("OIDC_DISCOVERY"), - ssl_verify = os.getenv("OIDC_SSL_VERIFY"), - client_id = os.getenv("OIDC_CLIENT_ID"), - use_pkce = isTrue(os.getenv("OIDC_USE_PKCE")), - client_secret = os.getenv("OIDC_CLIENT_SECRET"), - scope = os.getenv("OIDC_SCOPE"), - redirect_uri = os.getenv("OIDC_REDIRECT_URI"), - logout_path = os.getenv("OIDC_LOGOUT_URI"), - post_logout_redirect_uri = os.getenv("OIDC_POST_LOGOUT_REDIRECT_URI"), - authorization_params = getAuthorizationParams(), - renew_access_token_on_expiry = true, - session_contents = {id_token=true, enc_id_token=true, access_token=true, user=true} -} -local prompt_override = os.getenv("OIDC_PROMPT") -if prompt_override ~= '' then - oidc_opts["prompt"]=prompt_override +function _M.get_session_opts() + ngx.log(ngx.DEBUG, "Starting") + local session_opts = { + cookie_name = _M.get_var_or_env("ipax_app_name") .. "_session", + cookie_same_site = _M.get_var_or_env("session_cookie_same_site"), + cookie_secure = is_true(_M.get_var_or_env("session_cookie_secure")), + idling_timeout = tonumber(_M.get_var_or_env("session_idling_timeout")), + remember = is_true(_M.get_var_or_env("session_remember")), + remember_cookie_name = _M.get_var_or_env("ipax_app_name") .. "_remember", + secret = _M.get_var_or_env("ipax_base_url") .. _M.get_var_or_env("session_secret"), + cookie_http_only = true + } + return session_opts end -local session_opts = { - secret = os.getenv("SESSION_SECRET"), - cookie = { - persistent = os.getenv("SESSION_COOKIE_PERSISTENT"), - lifetime = os.getenv("SESSION_COOKIE_LIFETIME"), - samesite = os.getenv("SESSION_COOKIE_SAMESITE") - } -} +function _M.get_id_token(res) + ngx.log(ngx.DEBUG, "Starting") + return res.id_token +end -local function split(input, separator) - if separator == nil then - separator = "%s" - end - local t={} - for str in string.gmatch(input, "([^" .. separator .. "]+)") do - table.insert(t, str) - end - return t +function _M.get_access_token(res) + ngx.log(ngx.DEBUG, "Starting") + return res.access_token end -function _M.check_authentication(err) - if err then - -- ngx.log(ngx.DEBUG, "check_authentication() err: " .. err) - error = string.match(err, "error=(.*)&+") - if (error == 'login_required') then - return ngx.redirect("/loginRequired.html", ngx.HTTP_MOVED_TEMPORARILY) - else - return ngx.redirect("/authenticationError.html", ngx.HTTP_MOVED_TEMPORARILY) - end - end - return true +local function get_refresh_token(res) + ngx.log(ngx.DEBUG, "Starting") + local refresh_token = res.refresh_token or nil + return refresh_token end -function _M.get_user() - local res = _M.get_res() - return res.user +function _M.get_user(res) + ngx.log(ngx.DEBUG, "Starting") + local user = res.user or nil + return user end -function _M.get_userinfo_json() - local res = _M.get_res() +function _M.get_userinfo_json(res) + ngx.log(ngx.DEBUG, "Starting") local json = require("json").encode(res.user) ngx.log(ngx.DEBUG, "userinfo_json: " .. json) return json end -function _M.get_preferred_name_from_userinfo() - ngx.log(ngx.DEBUG, "preferred_username: " .. (preferred_username or "nil")) - local userinfo_json = _M.get_userinfo_json() +local function get_preferred_name_from_userinfo(res) + ngx.log(ngx.DEBUG, "Starting") + local userinfo_json = _M.get_userinfo_json(res) local userinfo_table = require("json").decode(userinfo_json) - local preferred_username = userinfo_table.preferred_username - ngx.log(ngx.DEBUG, "preferred_username: " .. (preferred_username or "nil")) + local preferred_username = userinfo_table.preferred_username or "nil" + ngx.log(ngx.DEBUG, "returning preferred_username: " .. preferred_username) return preferred_username end -function _M.get_preferred_username_from_userinfo_or_idtoken() - local userinfo_preferred_username = _M.get_preferred_name_from_userinfo() - +local function get_preferred_username_from_userinfo_or_idtoken(res) + ngx.log(ngx.DEBUG, "Starting") + local userinfo_preferred_username = get_preferred_name_from_userinfo(res) if userinfo_preferred_username == nil then local id_token = _M.get_id_token() return id_token.preferred_username else return userinfo_preferred_username end - -end - -function _M.get_id_token() - local res = _M.get_res() - return res.id_token -end - -function _M.get_access_token() - local res = _M.get_res() - return res.access_token end -function _M.get_refresh_token() - local res = _M.get_res() - local refresh_token = res.refresh_token or nil - return refresh_token -end +function _M.get_res(oidc_opts, session_opts) + ngx.log(ngx.DEBUG, "Starting for client_id: " .. oidc_opts.client_id) + -- for k, v in pairs(oidc_opts) do + -- ngx.log(ngx.DEBUG, "Using oidc_opts[" .. k .. "] = " .. tostring(v)) + -- end + -- for k, v in pairs(session_opts) do + -- ngx.log(ngx.DEBUG, "Using session_opts[" .. k .. "] = " .. tostring(v)) + -- end + local res, err, target, session = require("resty.openidc").authenticate(oidc_opts, nil, nil, session_opts) + if err then + if string.find(err, "error=login_required") then + ngx.redirect("../loginRequired.html", ngx.HTTP_MOVED_TEMPORARILY) + else + ngx.log(ngx.ERR, "Authentication failed: ", err) + ngx.redirect("../loginError.html", ngx.HTTP_MOVED_TEMPORARILY) + end + end -function _M.get_res() - local res, err, target, session = require("resty.openidc").authenticate(oidc_opts, null, action, session_opts) - --ngx.log(ngx.DEBUG, "refresh_token: " .. session:get("refresh_token")) res["refresh_token"] = session:get("refresh_token") session:close() - local authentication_feedback = _M.check_authentication(err) return res end -function _M.check_multivalued_user_claim(claim_values, check_item) - for index, value in pairs(claim_values) do - -- ToDo: compare case-insensitive - if value == check_item then - return true - end - end - ngx.exit(ngx.HTTP_FORBIDDEN) - return false -end - -function _M.is_value_in_list(value_list, check_item) - for index, value in pairs(value_list) do - if value == check_item then - return true - end - end - return false -end - -function _M.get_names_from_dns(object_dns) - local object_names={} - if object_dns == nil then - ngx.log(ngx.DEBUG, 'get_names_from_dns() object_dns is nil') - return object_names - end - for index, value in pairs(object_dns) do - local object_rdn = split(value, ",")[1] - local object_name = split(object_rdn, "=")[2] - object_names[index] = object_name - end - return object_names -end - -function _M.get_group_names(claim_values, separator) - if separator == nil then - separator = "|" - end - local group_names = _M.get_names_from_dns(claim_values) - return table.concat(group_names, separator) -end - -local function get_kc_user_action_url(kc_action) - local headers = ngx.req.get_headers() - local redirect_uri = get_scheme(headers) .. "://" .. get_host_name(headers) .. "/private/info" +local function get_kc_user_action_url(ipax_base_url, client_id, kc_action, authorization_endpoint) + ngx.log(ngx.DEBUG, "Starting for client_id: " .. client_id) + local redirect_uri = ipax_base_url .. "/private/info" local params = { - client_id = oidc_opts.client_id, + client_id = client_id, response_type = "code", scope = "openid", redirect_uri = redirect_uri, kc_action = kc_action } - openidc_ensure_discovered_data(oidc_opts) - return oidc_opts.discovery.authorization_endpoint .. "?" .. ngx.encode_args(params) + return authorization_endpoint .. "?" .. ngx.encode_args(params) +end + +local function get_discovery_document(oidc_opts) + ngx.log(ngx.DEBUG, "Starting for discovery: " .. oidc_opts.discovery) + local http = require("resty.http") + local http = require("resty.http") + local httpc = http.new() + local res, err = httpc:request_uri(oidc_opts.discovery, { method = "GET", oidc_opts.ssl_verify }) + if not res then + ngx.log(ngx.ERR, "failed to request discovery document: ", err) + return nil + end + if res.status ~= 200 then + ngx.log(ngx.ERR, "discovery document request failed with status: ", res.status) + return nil + end + return require("cjson").decode(res.body) end -function _M.get_user_actions() +local function get_user_actions(oidc_opts, ipax_base_url) + ngx.log(ngx.DEBUG, "Starting for client_id: " .. oidc_opts.client_id) local userActionsTable = {} + local discovery_document = get_discovery_document(oidc_opts) + local authorization_endpoint = discovery_document.authorization_endpoint + local client_id = oidc_opts.client_id - local kc_delete_account_action = os.getenv("KC_DELETE_ACCOUNT_ACTION") + local kc_delete_account_action = _M.get_var_or_env("kc_delete_account_action") if kc_delete_account_action ~= '' then - userActionsTable["kc_delete_account_action"]='' .. os.getenv("KC_DELETE_ACCOUNT_LABEL") .. '' + userActionsTable["kc_delete_account_action"]='' .. _M.get_var_or_env("kc_delete_account_label") .. '' end - local kc_update_password_action = os.getenv("KC_UPDATE_PASSWORD_ACTION") + local kc_update_password_action = _M.get_var_or_env("kc_update_password_action") if kc_update_password_action ~= '' then - userActionsTable["kc_update_password_action"]='' .. os.getenv("KC_UPDATE_PASSWORD_LABEL") .. '' + userActionsTable["kc_update_password_action"]='' .. _M.get_var_or_env("kc_update_password_label") .. '' end - local kc_update_email_action = os.getenv("KC_UPDATE_EMAIL_ACTION") + local kc_update_email_action = _M.get_var_or_env("kc_update_email_action") if kc_update_email_action ~= '' then - userActionsTable["kc_update_email_action"]='' .. os.getenv("KC_UPDATE_EMAIL_LABEL") .. '' + userActionsTable["kc_update_email_action"]='' .. _M.get_var_or_env("kc_update_email_label") .. '' end - local kc_enrol_biometrics_action = os.getenv("KC_ENROL_BIOMETRICS_ACTION") + local kc_enrol_biometrics_action = _M.get_var_or_env("kc_enrol_biometrics_action") if kc_enrol_biometrics_action ~= '' then - userActionsTable["kc_enrol_biometrics_action"]='' .. os.getenv("KC_ENROL_BIOMETRICS_LABEL") .. '' + userActionsTable["kc_enrol_biometrics_action"]='' .. _M.get_var_or_env("kc_enrol_biometrics_label") .. '' + end + + local kc_add_passkey_action = _M.get_var_or_env("kc_add_passkey_action") + if kc_add_passkey_action ~= '' then + userActionsTable["kc_add_passkey_action"]='' .. _M.get_var_or_env("kc_add_passkey_label") .. '' end return userActionsTable end +function _M.get_info_data(oidc_opts, session_opts, ipax_display_name, ipax_app_name, ipax_base_url, headers) + ngx.log(ngx.DEBUG, "Starting for client_id: " .. oidc_opts.client_id) + local res = _M.get_res(oidc_opts, session_opts) + -- id_token is returned as a lua table + local id_token = _M.get_id_token(res); + -- access_token is returned as string + local access_token = _M.get_access_token(res); + -- ngx.log(ngx.DEBUG, "access_token: " .. access_token) + local refresh_token = get_refresh_token(res); + -- ngx.log(ngx.DEBUG, "refresh_token: " .. tostring(refresh_token)) + + local data = { + user = _M.get_user(res), + headers = headers, + access_token = access_token, + refresh_token = refresh_token or "Not Provided in token endpoint response", + id_token = id_token, + userinfo_json = _M.get_userinfo_json(res), + username = get_preferred_username_from_userinfo_or_idtoken(res) or "Not Informed", + user_actions = get_user_actions(oidc_opts, ipax_base_url), + logout_path = oidc_opts.logout_path, + ipax_app_name = ipax_app_name, + ipax_display_name = ipax_display_name + } + return data +end + return _M diff --git a/lua/ipax_openidc.lua b/lua/ipax_openidc.lua deleted file mode 100644 index 22ead0d..0000000 --- a/lua/ipax_openidc.lua +++ /dev/null @@ -1,170 +0,0 @@ --- -------------------------------------------------------------------------------------------------------------- --- -------------------------------------------------------------------------------------------------------------- --- https://github.com/zmartzone/lua-resty-openidc/blob/master/lib/resty/openidc.lua -local _M = {} -local http = require("resty.http") -local cjson = require("cjson") -local cjson_s = require("cjson.safe") - -local function openidc_cache_get(type, key) - local dict = ngx.shared[type] - local value - if dict then - value = dict:get(key) - if value then ngx.log(ngx.DEBUG, "cache hit: type=", type, " key=", key) end - end - return value -end - -local function openidc_configure_timeouts(httpc, timeout) - if timeout then - if type(timeout) == "table" then - local r, e = httpc:set_timeouts(timeout.connect or 0, timeout.send or 0, timeout.read or 0) - else - local r, e = httpc:set_timeout(timeout) - end - end -end - --- Set outgoing proxy options -local function openidc_configure_proxy(httpc, proxy_opts) - if httpc and proxy_opts and type(proxy_opts) == "table" then - ngx.log(ngx.DEBUG, "openidc_configure_proxy : use http proxy") - httpc:set_proxy_options(proxy_opts) - else - ngx.log(ngx.DEBUG, "openidc_configure_proxy : don't use http proxy") - end -end - -local function decorate_request(http_request_decorator, req) - return http_request_decorator and http_request_decorator(req) or req -end - --- parse the JSON result from a call to the OP -local function openidc_parse_json_response(response, ignore_body_on_success) - local ignore_body_on_success = ignore_body_on_success or false - local err - local res - -- check the response from the OP - if response.status ~= 200 then - err = "response indicates failure, status=" .. response.status .. ", body=" .. response.body - else - if ignore_body_on_success then - return nil, nil - end - -- decode the response and extract the JSON object - res = cjson_s.decode(response.body) - if not res then - err = "JSON decoding failed" - end - end - return res, err -end - --- get the Discovery metadata from the specified URL -local function openidc_discover(url, ssl_verify, keepalive, timeout, exptime, proxy_opts, http_request_decorator) - ngx.log(ngx.DEBUG, "openidc_discover: URL is: " .. url) - local json, err - local v = openidc_cache_get("discovery", url) - if not v then - ngx.log(ngx.DEBUG, "discovery data not in cache, making call to discovery endpoint") - -- make the call to the discovery endpoint - local httpc = http.new() - openidc_configure_timeouts(httpc, timeout) - openidc_configure_proxy(httpc, proxy_opts) - local res, error = httpc:request_uri(url, decorate_request(http_request_decorator, { - ssl_verify = (ssl_verify ~= "no"), - keepalive = (keepalive ~= "no") - })) - if not res then - err = "accessing discovery url (" .. url .. ") failed: " .. error - ngx.log(ngx.DEBUG, err) - else - ngx.log(ngx.DEBUG, "response data: " .. res.body) - json, err = openidc_parse_json_response(res) - if json then - openidc_cache_set("discovery", url, cjson.encode(json), exptime or 24 * 60 * 60) - else - err = "could not decode JSON from Discovery data" .. (err and (": " .. err) or '') - ngx.log(ngx.DEBUG, err) - end - end - else - json = cjson.decode(v) - end - return json, err -end - --- turn a discovery url set in the opts dictionary into the discovered information -function _M.openidc_ensure_discovered_data(opts) - local err - if type(opts.discovery) == "string" then - local discovery - discovery, err = openidc_discover(opts.discovery, opts.ssl_verify, opts.keepalive, opts.timeout, opts.discovery_expires_in, opts.proxy_opts, opts.http_request_decorator) - if not err then - opts.discovery = discovery - end - end - return err -end - -local function get_first(table_or_string) - local res = table_or_string - if table_or_string and type(table_or_string) == 'table' then - res = table_or_string[1] - end - return res -end - -local function get_first_header(headers, header_name) - local header = headers[header_name] - return get_first(header) -end - -local function get_first_header_and_strip_whitespace(headers, header_name) - local header = get_first_header(headers, header_name) - return header and header:gsub('%s', '') -end - -local function get_forwarded_parameter(headers, param_name) - local forwarded = get_first_header(headers, 'Forwarded') - local params = {} - if forwarded then - local function parse_parameter(pv) - local name, value = pv:match("^%s*([^=]+)%s*=%s*(.-)%s*$") - if name and value then - if value:sub(1, 1) == '"' then - value = value:sub(2, -2) - end - params[name:lower()] = value - end - end - -- this assumes there is no quoted comma inside the header's value which should be fine as comma is not legal inside a node name, a URI scheme or a host name. The only thing that might bite us are extensions. - local first_part = forwarded - local first_comma = forwarded:find("%s*,%s*") - if first_comma then - first_part = forwarded:sub(1, first_comma - 1) - end - first_part:gsub("[^;]+", parse_parameter) - end - return params[param_name:gsub("^%s*(.-)%s*$", "%1"):lower()] -end - -function _M.get_scheme(headers) - return get_forwarded_parameter(headers, 'proto') - or get_first_header_and_strip_whitespace(headers, 'X-Forwarded-Proto') - or ngx.var.scheme -end - -local function get_host_name_from_x_header(headers) - local header = get_first_header_and_strip_whitespace(headers, 'X-Forwarded-Host') - return header and header:gsub('^([^,]+),?.*$', '%1') -end - -function _M.get_host_name(headers) - return get_forwarded_parameter(headers, 'host') - or get_host_name_from_x_header(headers) - or ngx.var.http_host -end - -return _M diff --git a/lua/multiapps.lua b/lua/multiapps.lua deleted file mode 100644 index 048b60e..0000000 --- a/lua/multiapps.lua +++ /dev/null @@ -1,116 +0,0 @@ --- -------------------------------------------------------------------------------------------------------------- --- -------------------------------------------------------------------------------------------------------------- --- IPAx multiapps -local _M = {} -local ipax = require("ipax") -local ipax_openidc = require("ipax_openidc") - -local session_opts = { - secret = os.getenv("SESSION_SECRET"), - cookie = { - persistent = os.getenv("SESSION_COOKIE_PERSISTENT"), - lifetime = os.getenv("SESSION_COOKIE_LIFETIME"), - samesite = os.getenv("SESSION_COOKIE_SAMESITE") - } -} - -function _M.get_res(oidc_opts, base_url, prompt_override) - oidc_opts["renew_access_token_on_expiry"] = true - oidc_opts["session_contents"] = {id_token=true, enc_id_token=true, access_token=true, user=true} - oidc_opts["redirect_uri"] = base_url .. os.getenv("OIDC_REDIRECT_URI") - oidc_opts["logout_path"] = os.getenv("OIDC_LOGOUT_URI") - oidc_opts["post_logout_redirect_uri"] = base_url .. "/logoutSuccess.html" - ngx.log(ngx.DEBUG, "prompt_override: " .. prompt_override) - if prompt_override ~= '' then - oidc_opts["prompt"]=prompt_override - end - local res, err, target, session = require("resty.openidc").authenticate(oidc_opts, null, action, session_opts) - --ngx.log(ngx.DEBUG, "refresh_token: " .. session:get("refresh_token")) - res["refresh_token"] = session:get("refresh_token") - session:close() - local authentication_feedback = ipax.check_authentication(err) - return res -end - -function _M.get_userinfo_json(res) - local json = require("json").encode(res.user) - return json -end - -function _M.get_id_token(res) - return res.id_token -end - -function _M.get_access_token(res) - return res.access_token -end - -function _M.get_refresh_token(res) - return res.refresh_token -end - -function _M.get_userinfo_json(res) - local json = require("json").encode(res.user) - -- ngx.log(ngx.DEBUG, "userinfo_json: " .. json) - return json -end - -function _M.get_preferred_name_from_userinfo(res) - local userinfo_json = _M.get_userinfo_json(res) - local userinfo_table = require("json").decode(userinfo_json) - local preferred_username = userinfo_table.preferred_username - if preferred_username == nil then - return "(unknown)" - else - return preferred_username - end -end - -function _M.get_preferred_username_from_userinfo_or_idtoken(res) - local id_token = _M.get_id_token(res) - local preferred_username = id_token.preferred_username - - if preferred_username == nil then - return _M.get_preferred_name_from_userinfo(res) - else - return preferred_username - end -end - -local function get_kc_user_action_url(oidc_opts, kc_action) - local headers = ngx.req.get_headers() - local redirect_uri = ipax_openidc.get_scheme(headers) .. "://" .. ipax_openidc.get_host_name(headers) .. "/private/info" - local params = { - client_id = oidc_opts.client_id, - response_type = "code", - scope = "openid", - redirect_uri = redirect_uri, - kc_action = kc_action - } - ipax_openidc.openidc_ensure_discovered_data(oidc_opts) - return oidc_opts.discovery.authorization_endpoint .. "?" .. ngx.encode_args(params) -end - -function _M.get_user_actions(oidc_opts, kc_actions) - local userActionsTable = {} - - if kc_actions.delete_account ~= '' then - userActionsTable["kc_delete_account_action"]='' .. os.getenv("KC_DELETE_ACCOUNT_LABEL") .. '' - end - - if kc_actions.update_password ~= '' then - userActionsTable["kc_update_password_action"]='' .. os.getenv("KC_UPDATE_PASSWORD_LABEL") .. '' - end - - if kc_actions.update_email ~= '' then - userActionsTable["kc_update_email_action"]='' .. os.getenv("KC_UPDATE_EMAIL_LABEL") .. '' - end - - if kc_actions.enrol_biometrics ~= '' then - userActionsTable["kc_enrol_biometrics_action"]='' .. os.getenv("KC_ENROL_BIOMETRICS_LABEL") .. '' - end - - return userActionsTable -end - -return _M diff --git a/multiapps/conf.d/demoapp1.conf b/multiapps/conf.d/demoapp1.conf deleted file mode 100644 index 4eac5e2..0000000 --- a/multiapps/conf.d/demoapp1.conf +++ /dev/null @@ -1,15 +0,0 @@ -server { - server_name demoapp1; - include demoapp_default_variables.conf; - - set $demoapp_alias 'DemoApp1'; - set $demoapp_base_url 'http://demoapp1'; - set $oidc_discovery 'http://idp:8080/realms/demorealm/.well-known/openid-configuration'; - set $client_id 'demoapp1_client_id'; - set $client_secret 'demoapp1_client_secret'; - set $scope 'openid profile email roles phone'; - set $kc_update_password_action 'UPDATE_PASSWORD'; - set $kc_update_email_action 'UPDATE_EMAIL'; - - include demoapp.conf; -} diff --git a/multiapps/conf.d/demoapp2.conf b/multiapps/conf.d/demoapp2.conf deleted file mode 100644 index 4c6094b..0000000 --- a/multiapps/conf.d/demoapp2.conf +++ /dev/null @@ -1,14 +0,0 @@ -server { - server_name demoapp2; - include demoapp_default_variables.conf; - - set $demoapp_alias 'DemoApp2'; - set $demoapp_base_url 'http://demoapp2'; - set $oidc_discovery 'http://idp:8080/realms/demorealm/.well-known/openid-configuration'; - set $client_id 'demoapp2_client_id'; - set $client_secret 'demoapp2_client_secret'; - set $scope 'openid profile email roles phone'; - set $kc_delete_account_action 'delete_account'; - - include demoapp.conf; -} diff --git a/multiapps/server.conf b/multiapps/server.conf deleted file mode 100644 index 736b979..0000000 --- a/multiapps/server.conf +++ /dev/null @@ -1,9 +0,0 @@ -server { - listen 80; - server_name localhost; - location / { - root /var/ipax/html/; - add_header Cache-Control no-store; - add_header Pragma no-cache; - } -} diff --git a/templates/demoapps.html b/templates/demoapps.html new file mode 100644 index 0000000..ff2742e --- /dev/null +++ b/templates/demoapps.html @@ -0,0 +1,10 @@ + + + + +