mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-07-14 17:42:03 -04:00
4f1aca6d90
This works the previous commits so that clients can add an addtional 'platform' query parameter to the webfinger request that can be used to query the oidc client id and list of scopes that the clients need to use when connecting to the IDP. This also removes the non-standard issuer relatation introduced in a previous commit as we can just introduce new relations in the http://openid.net name space. For IDP like Authentik that create a separate issuer url per Client (Application in Authentik's terms) it is suggested to just configure as single Client and use that id for all platforms (i.e. setting 'WEBFINGER_ANDROID_OIDC_CLIENT_ID', 'WEBFINGER_DESKTOP_OIDC_CLIENT_ID', 'WEBFINGER_IOS_OIDC_CLIENT_ID' and 'WEBFINGER_WEB_OIDC_CLIENT_ID' to same value. Related: #2088 Related: https://github.com/opencloud-eu/desktop/issues/246
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package relations
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/opencloud-eu/opencloud/services/webfinger/pkg/config"
|
|
"github.com/opencloud-eu/opencloud/services/webfinger/pkg/service/v0"
|
|
"github.com/opencloud-eu/opencloud/services/webfinger/pkg/webfinger"
|
|
)
|
|
|
|
const (
|
|
OpenIDConnectRel = "http://openid.net/specs/connect/1.0/issuer"
|
|
clientIDProp = "http://opencloud.eu/ns/oidc/client_id"
|
|
scopesProp = "http://opencloud.eu/ns/oidc/scopes"
|
|
)
|
|
|
|
type openIDDiscovery struct {
|
|
Href string
|
|
OIDCClients map[string]config.OIDCClientConfig
|
|
}
|
|
|
|
// OpenIDDiscovery adds the Openid Connect issuer relation
|
|
func OpenIDDiscovery(href string, clients map[string]config.OIDCClientConfig) service.RelationProvider {
|
|
return &openIDDiscovery{
|
|
Href: href,
|
|
OIDCClients: clients,
|
|
}
|
|
}
|
|
|
|
func (l *openIDDiscovery) Add(_ context.Context, platform string, jrd *webfinger.JSONResourceDescriptor) {
|
|
if jrd == nil {
|
|
jrd = &webfinger.JSONResourceDescriptor{}
|
|
}
|
|
jrd.Links = append(jrd.Links, webfinger.Link{
|
|
Rel: OpenIDConnectRel,
|
|
Href: l.Href,
|
|
})
|
|
|
|
if platform != "" {
|
|
if clientConfig, ok := l.OIDCClients[platform]; ok {
|
|
jrd.Properties = make(map[string]any)
|
|
jrd.Properties[clientIDProp] = clientConfig.ClientID
|
|
jrd.Properties[scopesProp] = clientConfig.Scopes
|
|
}
|
|
}
|
|
}
|