mirror of
https://github.com/rocky-linux/peridot.git
synced 2024-12-20 09:48:29 +00:00
Add more customization options for authOptions
This commit is contained in:
parent
95340b21ee
commit
361a9378aa
@ -53,7 +53,7 @@ const { auth } = expressOidc;
|
||||
export default async function(opts) {
|
||||
// Create a new app for health checks.
|
||||
const appZ = express();
|
||||
appZ.get('/_/healthz', ((req, res) => {
|
||||
appZ.get('/healthz', ((req, res) => {
|
||||
res.end();
|
||||
}));
|
||||
|
||||
@ -83,15 +83,19 @@ export default async function(opts) {
|
||||
console.log(`Using clientID: ${opts.clientID}`);
|
||||
console.log(`Using baseURL: ${opts.baseURL}`);
|
||||
|
||||
if (opts.issuerBaseURL.endsWith('.localhost') || opts.issuerBaseURL.endsWith('.localhost/')) {
|
||||
const kong = 'kong-proxy.kong.svc.cluster.local'
|
||||
if ((opts.issuerBaseURL.endsWith('.localhost')
|
||||
|| opts.issuerBaseURL.endsWith('.localhost/'))
|
||||
&& process.env['BYC_ENV']) {
|
||||
const kong = 'kong-proxy.kong.svc.cluster.local';
|
||||
const urlObject = new URL(opts.issuerBaseURL);
|
||||
console.warn(`Forcing ${urlObject.hostname} to resolve to ${kong}`);
|
||||
const lookup = async () => {
|
||||
return new Promise((resolve, reject) => {
|
||||
// noinspection HttpUrlsUsage
|
||||
dns.lookup(kong, { family: 4 }, (err, address, family) => {
|
||||
if(err) reject(err);
|
||||
if (err) {
|
||||
reject(err);
|
||||
}
|
||||
resolve(address);
|
||||
});
|
||||
});
|
||||
@ -99,11 +103,13 @@ export default async function(opts) {
|
||||
const internalServiceResolve = await lookup();
|
||||
evilDns.add(urlObject.hostname, internalServiceResolve);
|
||||
// Disable TLS verification for development
|
||||
process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0
|
||||
process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0;
|
||||
}
|
||||
|
||||
const config = {
|
||||
authRequired: process.env['DISABLE_AUTH_ENFORCE'] ? process.env['DISABLE_AUTH_ENFORCE'] === 'false' : !!!opts.disableAuthEnforce,
|
||||
authRequired: process.env['DISABLE_AUTH_ENFORCE']
|
||||
? process.env['DISABLE_AUTH_ENFORCE'] === 'false'
|
||||
: !!!opts.disableAuthEnforce,
|
||||
// Disable telemetry
|
||||
enableTelemetry: false,
|
||||
// Use dev secret is none is present (Prod requires a secret so not a security issue)
|
||||
@ -115,7 +121,6 @@ export default async function(opts) {
|
||||
clientID: opts.clientID,
|
||||
// The specific application should supply a dev secret while prod secrets should be set as an env variable
|
||||
clientSecret: opts.clientSecret,
|
||||
// We're currently only using the Rocky issuer
|
||||
issuerBaseURL: opts.issuerBaseURL,
|
||||
idpLogout: true,
|
||||
authorizationParams: {
|
||||
@ -138,13 +143,50 @@ export default async function(opts) {
|
||||
// Remember, authentication done here is only for simplicity purposes.
|
||||
// The authentication token is then passed on to the API.
|
||||
// Bypassing auth here doesn't accomplish anything.
|
||||
let middlewares = [];
|
||||
|
||||
|
||||
// If requireEmailSuffix is present, let's validate post callback
|
||||
// that the signed in email ends with a suffix in the allowlist
|
||||
// Again, a bypass here doesn't accomplish anything.
|
||||
let requireEmailSuffix = opts.authOptions?.requireEmailSuffix;
|
||||
if (process.env['AUTH_OPTIONS_REQUIRE_EMAIL_SUFFIX']) {
|
||||
requireEmailSuffix = process.env['AUTH_OPTIONS_REQUIRE_EMAIL_SUFFIX'].split(
|
||||
',');
|
||||
}
|
||||
if (requireEmailSuffix) {
|
||||
middlewares.push((req, res, next) => {
|
||||
const email = req.oidc?.user?.email;
|
||||
if (!email) {
|
||||
return next('No email found in the user object');
|
||||
}
|
||||
const suffixes = requireEmailSuffix;
|
||||
let isAllowed = false;
|
||||
for (const suffix of suffixes) {
|
||||
if (email.endsWith(suffix)) {
|
||||
isAllowed = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (isAllowed) {
|
||||
next();
|
||||
} else {
|
||||
res.redirect(process.env['AUTH_REJECT_REDIRECT_URL']
|
||||
? process.env['AUTH_REJECT_REDIRECT_URL']
|
||||
: (opts.authOptions.authRejectRedirectUrl
|
||||
|| 'https://rockylinux.org'));
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
app.use((req, res, next) => {
|
||||
try {
|
||||
auth(config)(req, res, next);
|
||||
} catch (err) {
|
||||
next(err);
|
||||
}
|
||||
});
|
||||
}, [middlewares]);
|
||||
}
|
||||
|
||||
// Currently in dev, webpack is handling all file serving
|
||||
@ -200,9 +242,11 @@ export default async function(opts) {
|
||||
// Make it possible to override api url using an env variable.
|
||||
// Example: /api can be set with URL_API
|
||||
// Example 2: /manage/api can be set with URL_MANAGE_API
|
||||
const prodEnvName = `URL_${x.substr(1).replace('/', '_').toUpperCase()}`;
|
||||
const prodEnvName = `URL_${x.substr(1).replace('/',
|
||||
'_').toUpperCase()}`;
|
||||
|
||||
const apiUrl = prod ? (process.env[prodEnvName] || opts.apis[x].prodApiUrl) : opts.apis[x].devApiUrl;
|
||||
const apiUrl = prod ? (process.env[prodEnvName]
|
||||
|| opts.apis[x].prodApiUrl) : opts.apis[x].devApiUrl;
|
||||
|
||||
createProxyMiddleware({
|
||||
target: apiUrl,
|
||||
@ -265,7 +309,7 @@ export default async function(opts) {
|
||||
webpackMildCompile(compiler);
|
||||
|
||||
const wdm = webpackDevMiddleware(compiler, {
|
||||
publicPath: opts.webpackConfig.output.publicPath,
|
||||
publicPath: opts.webpackConfig.output.publicPath
|
||||
});
|
||||
|
||||
app.use(history());
|
||||
@ -279,7 +323,8 @@ export default async function(opts) {
|
||||
// For SPAs, the only HTML page is the index page
|
||||
if (res.get('content-type').indexOf('text/html') !== -1) {
|
||||
// Run through handlebars compiler with our template parameters
|
||||
newData = hbs.handlebars.compile(data.toString())(templateParams(req));
|
||||
newData = hbs.handlebars.compile(data.toString())(
|
||||
templateParams(req));
|
||||
} else {
|
||||
// No new data, just return old data
|
||||
newData = data;
|
||||
|
Loading…
Reference in New Issue
Block a user