This repository has been archived on 2023-08-14. You can view files and clone it, but cannot push or open issues or pull requests.
dex/connector/gitlab/gitlab.go

311 lines
8.3 KiB
Go
Raw Normal View History

2017-01-24 17:56:52 +00:00
// Package gitlab provides authentication strategies using Gitlab.
package gitlab
import (
"context"
2017-01-24 17:56:52 +00:00
"encoding/json"
"errors"
"fmt"
"io"
2017-01-24 17:56:52 +00:00
"net/http"
"strconv"
"time"
2017-01-24 17:56:52 +00:00
"golang.org/x/oauth2"
"github.com/dexidp/dex/connector"
"github.com/dexidp/dex/pkg/groups"
"github.com/dexidp/dex/pkg/log"
2017-01-24 17:56:52 +00:00
)
const (
2018-11-20 10:18:50 +00:00
// read operations of the /api/v4/user endpoint
scopeUser = "read_user"
2018-11-20 10:18:50 +00:00
// used to retrieve groups from /oauth/userinfo
// https://docs.gitlab.com/ee/integration/openid_connect_provider.html
scopeOpenID = "openid"
)
2020-01-16 03:26:57 +00:00
// Config holds configuration options for gitlab logins.
2017-01-24 17:56:52 +00:00
type Config struct {
2019-04-25 10:47:01 +00:00
BaseURL string `json:"baseURL"`
ClientID string `json:"clientID"`
ClientSecret string `json:"clientSecret"`
RedirectURI string `json:"redirectURI"`
Groups []string `json:"groups"`
UseLoginAsID bool `json:"useLoginAsID"`
2017-01-24 17:56:52 +00:00
}
type gitlabUser struct {
ID int
Name string
Username string
State string
Email string
IsAdmin bool
}
// Open returns a strategy for logging in through GitLab.
func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
2017-01-24 17:56:52 +00:00
if c.BaseURL == "" {
c.BaseURL = "https://gitlab.com"
2017-01-24 17:56:52 +00:00
}
return &gitlabConnector{
baseURL: c.BaseURL,
redirectURI: c.RedirectURI,
clientID: c.ClientID,
clientSecret: c.ClientSecret,
logger: logger,
2019-04-25 10:47:01 +00:00
groups: c.Groups,
useLoginAsID: c.UseLoginAsID,
2017-01-24 17:56:52 +00:00
}, nil
}
type connectorData struct {
// Support GitLab's Access Tokens and Refresh tokens.
AccessToken string `json:"accessToken"`
RefreshToken string `json:"refreshToken"`
2017-01-24 17:56:52 +00:00
}
var (
_ connector.CallbackConnector = (*gitlabConnector)(nil)
_ connector.RefreshConnector = (*gitlabConnector)(nil)
)
type gitlabConnector struct {
baseURL string
redirectURI string
2019-04-25 10:47:01 +00:00
groups []string
2017-01-24 17:56:52 +00:00
clientID string
clientSecret string
logger log.Logger
2019-05-01 18:13:44 +00:00
httpClient *http.Client
// if set to true will use the user's handle rather than their numeric id as the ID
useLoginAsID bool
2017-01-24 17:56:52 +00:00
}
func (c *gitlabConnector) oauth2Config(scopes connector.Scopes) *oauth2.Config {
gitlabScopes := []string{scopeUser}
if c.groupsRequired(scopes.Groups) {
2018-11-20 10:18:50 +00:00
gitlabScopes = []string{scopeUser, scopeOpenID}
}
2017-01-24 17:56:52 +00:00
gitlabEndpoint := oauth2.Endpoint{AuthURL: c.baseURL + "/oauth/authorize", TokenURL: c.baseURL + "/oauth/token"}
return &oauth2.Config{
ClientID: c.clientID,
ClientSecret: c.clientSecret,
Endpoint: gitlabEndpoint,
Scopes: gitlabScopes,
RedirectURL: c.redirectURI,
}
}
func (c *gitlabConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
if c.redirectURI != callbackURL {
return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", c.redirectURI, callbackURL)
}
return c.oauth2Config(scopes).AuthCodeURL(state), nil
}
type oauth2Error struct {
error string
errorDescription string
}
func (e *oauth2Error) Error() string {
if e.errorDescription == "" {
return e.error
}
return e.error + ": " + e.errorDescription
}
func (c *gitlabConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
q := r.URL.Query()
if errType := q.Get("error"); errType != "" {
return identity, &oauth2Error{errType, q.Get("error_description")}
}
oauth2Config := c.oauth2Config(s)
2019-05-01 18:13:44 +00:00
2017-01-24 17:56:52 +00:00
ctx := r.Context()
2019-05-01 18:13:44 +00:00
if c.httpClient != nil {
ctx = context.WithValue(r.Context(), oauth2.HTTPClient, c.httpClient)
}
2017-01-24 17:56:52 +00:00
token, err := oauth2Config.Exchange(ctx, q.Get("code"))
if err != nil {
return identity, fmt.Errorf("gitlab: failed to get token: %v", err)
}
return c.identity(ctx, s, token)
}
func (c *gitlabConnector) identity(ctx context.Context, s connector.Scopes, token *oauth2.Token) (identity connector.Identity, err error) {
oauth2Config := c.oauth2Config(s)
2017-01-24 17:56:52 +00:00
client := oauth2Config.Client(ctx, token)
user, err := c.user(ctx, client)
if err != nil {
return identity, fmt.Errorf("gitlab: get user: %v", err)
}
username := user.Name
if username == "" {
username = user.Email
}
2017-01-24 17:56:52 +00:00
identity = connector.Identity{
UserID: strconv.Itoa(user.ID),
Username: username,
PreferredUsername: user.Username,
Email: user.Email,
EmailVerified: true,
2017-01-24 17:56:52 +00:00
}
if c.useLoginAsID {
identity.UserID = user.Username
}
2017-01-24 17:56:52 +00:00
if c.groupsRequired(s.Groups) {
2019-04-25 10:47:01 +00:00
groups, err := c.getGroups(ctx, client, s.Groups, user.Username)
2017-01-24 17:56:52 +00:00
if err != nil {
return identity, fmt.Errorf("gitlab: get groups: %v", err)
}
identity.Groups = groups
}
if s.OfflineAccess {
data := connectorData{RefreshToken: token.RefreshToken, AccessToken: token.AccessToken}
2017-01-24 17:56:52 +00:00
connData, err := json.Marshal(data)
if err != nil {
return identity, fmt.Errorf("gitlab: marshal connector data: %v", err)
2017-01-24 17:56:52 +00:00
}
identity.ConnectorData = connData
}
return identity, nil
}
func (c *gitlabConnector) Refresh(ctx context.Context, s connector.Scopes, ident connector.Identity) (connector.Identity, error) {
var data connectorData
if err := json.Unmarshal(ident.ConnectorData, &data); err != nil {
return ident, fmt.Errorf("gitlab: unmarshal connector data: %v", err)
2017-01-24 17:56:52 +00:00
}
oauth2Config := c.oauth2Config(s)
2017-01-24 17:56:52 +00:00
if c.httpClient != nil {
ctx = context.WithValue(ctx, oauth2.HTTPClient, c.httpClient)
}
switch {
case data.RefreshToken != "":
{
t := &oauth2.Token{
RefreshToken: data.RefreshToken,
Expiry: time.Now().Add(-time.Hour),
}
token, err := oauth2Config.TokenSource(ctx, t).Token()
if err != nil {
return ident, fmt.Errorf("gitlab: failed to get refresh token: %v", err)
}
return c.identity(ctx, s, token)
}
case data.AccessToken != "":
{
token := &oauth2.Token{
AccessToken: data.AccessToken,
}
return c.identity(ctx, s, token)
2017-01-24 17:56:52 +00:00
}
default:
return ident, errors.New("no refresh or access token found")
2017-01-24 17:56:52 +00:00
}
}
func (c *gitlabConnector) groupsRequired(groupScope bool) bool {
return len(c.groups) > 0 || groupScope
}
2017-01-24 17:56:52 +00:00
// user queries the GitLab API for profile information using the provided client. The HTTP
// client is expected to be constructed by the golang.org/x/oauth2 package, which inserts
// a bearer token as part of the request.
func (c *gitlabConnector) user(ctx context.Context, client *http.Client) (gitlabUser, error) {
var u gitlabUser
req, err := http.NewRequest("GET", c.baseURL+"/api/v4/user", nil)
2017-01-24 17:56:52 +00:00
if err != nil {
return u, fmt.Errorf("gitlab: new req: %v", err)
}
req = req.WithContext(ctx)
resp, err := client.Do(req)
if err != nil {
return u, fmt.Errorf("gitlab: get URL %v", err)
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
body, err := io.ReadAll(resp.Body)
2017-01-24 17:56:52 +00:00
if err != nil {
return u, fmt.Errorf("gitlab: read body: %v", err)
}
return u, fmt.Errorf("%s: %s", resp.Status, body)
}
if err := json.NewDecoder(resp.Body).Decode(&u); err != nil {
return u, fmt.Errorf("failed to decode response: %v", err)
}
return u, nil
}
2019-05-01 18:13:44 +00:00
type userInfo struct {
Groups []string
}
2019-04-25 10:47:01 +00:00
// userGroups queries the GitLab API for group membership.
2017-01-24 17:56:52 +00:00
//
// The HTTP passed client is expected to be constructed by the golang.org/x/oauth2 package,
// which inserts a bearer token as part of the request.
2019-04-25 10:47:01 +00:00
func (c *gitlabConnector) userGroups(ctx context.Context, client *http.Client) ([]string, error) {
2018-11-20 10:18:50 +00:00
req, err := http.NewRequest("GET", c.baseURL+"/oauth/userinfo", nil)
if err != nil {
return nil, fmt.Errorf("gitlab: new req: %v", err)
}
2018-11-20 10:18:50 +00:00
req = req.WithContext(ctx)
resp, err := client.Do(req)
if err != nil {
return nil, fmt.Errorf("gitlab: get URL %v", err)
}
defer resp.Body.Close()
2018-11-20 10:18:50 +00:00
if resp.StatusCode != http.StatusOK {
body, err := io.ReadAll(resp.Body)
2018-11-20 10:18:50 +00:00
if err != nil {
return nil, fmt.Errorf("gitlab: read body: %v", err)
2017-01-24 17:56:52 +00:00
}
2018-11-20 10:18:50 +00:00
return nil, fmt.Errorf("%s: %s", resp.Status, body)
}
2019-05-01 18:13:44 +00:00
var u userInfo
2018-11-20 10:18:50 +00:00
if err := json.NewDecoder(resp.Body).Decode(&u); err != nil {
return nil, fmt.Errorf("failed to decode response: %v", err)
2017-01-24 17:56:52 +00:00
}
2018-11-20 10:18:50 +00:00
return u.Groups, nil
2017-01-24 17:56:52 +00:00
}
2019-04-25 10:47:01 +00:00
func (c *gitlabConnector) getGroups(ctx context.Context, client *http.Client, groupScope bool, userLogin string) ([]string, error) {
gitlabGroups, err := c.userGroups(ctx, client)
if err != nil {
return nil, err
}
if len(c.groups) > 0 {
filteredGroups := groups.Filter(gitlabGroups, c.groups)
2019-04-25 10:47:01 +00:00
if len(filteredGroups) == 0 {
return nil, fmt.Errorf("gitlab: user %q is not in any of the required groups", userLogin)
}
return filteredGroups, nil
} else if groupScope {
return gitlabGroups, nil
}
return nil, nil
}