From 955062730b07c4d1ac412c30faacbfcead9737f3 Mon Sep 17 00:00:00 2001 From: Matti R Date: Thu, 8 Apr 2021 18:15:21 -0400 Subject: [PATCH 1/5] add well-known config for OIDC --- routers/routes/web.go | 1 + routers/user/oauth.go | 10 ++++++++++ templates/user/auth/oidc_wellknown.tmpl | 9 +++++++++ 3 files changed, 20 insertions(+) create mode 100644 templates/user/auth/oidc_wellknown.tmpl diff --git a/routers/routes/web.go b/routers/routes/web.go index 8131c4fc878a6..9b385f70e11e0 100644 --- a/routers/routes/web.go +++ b/routers/routes/web.go @@ -345,6 +345,7 @@ func RegisterRoutes(m *web.Route) { // Routers. // for health check m.Get("/", routers.Home) + m.Get("/.well-known/openid-configuration", user.OIDCWellKnown) m.Group("/explore", func() { m.Get("", func(ctx *context.Context) { ctx.Redirect(setting.AppSubURL + "/explore/repos") diff --git a/routers/user/oauth.go b/routers/user/oauth.go index c8c846c687795..ae06efd0c0168 100644 --- a/routers/user/oauth.go +++ b/routers/user/oauth.go @@ -389,6 +389,16 @@ func GrantApplicationOAuth(ctx *context.Context) { ctx.Redirect(redirect.String(), 302) } +// OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities +func OIDCWellKnown(ctx *context.Context) { + t := ctx.Render.TemplateLookup("user/auth/oidc_wellknown") + ctx.Resp.Header().Set("Content-Type", "application/json") + if err := t.Execute(ctx.Resp, ctx.Data); err != nil { + log.Error("%v", err) + ctx.Error(http.StatusInternalServerError) + } +} + // AccessTokenOAuth manages all access token requests by the client func AccessTokenOAuth(ctx *context.Context) { form := *web.GetForm(ctx).(*forms.AccessTokenForm) diff --git a/templates/user/auth/oidc_wellknown.tmpl b/templates/user/auth/oidc_wellknown.tmpl new file mode 100644 index 0000000000000..088da1cf467c0 --- /dev/null +++ b/templates/user/auth/oidc_wellknown.tmpl @@ -0,0 +1,9 @@ +{ + "issuer": "{{AppUrl | JSEscape | Safe}}", + "authorization_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/authorize", + "token_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/access_token", + "userinfo_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/userinfo", + "response_types_supported": [ + "code" + ] +} \ No newline at end of file From 1dae24a7ea23341eb72dcd8ece87436e9ed0ec13 Mon Sep 17 00:00:00 2001 From: Matti R Date: Fri, 9 Apr 2021 17:27:47 -0400 Subject: [PATCH 2/5] spacing per feedback --- .editorconfig | 3 +++ templates/user/auth/oidc_wellknown.tmpl | 14 +++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.editorconfig b/.editorconfig index 54738e8838d66..7183f06074e4c 100644 --- a/.editorconfig +++ b/.editorconfig @@ -12,6 +12,9 @@ insert_final_newline = true [*.{go,tmpl,html}] indent_style = tab +[templates/user/auth/oidc_wellknown.tmpl] +indent_style = space + [Makefile] indent_style = tab diff --git a/templates/user/auth/oidc_wellknown.tmpl b/templates/user/auth/oidc_wellknown.tmpl index 088da1cf467c0..74a150f32e979 100644 --- a/templates/user/auth/oidc_wellknown.tmpl +++ b/templates/user/auth/oidc_wellknown.tmpl @@ -1,9 +1,9 @@ { - "issuer": "{{AppUrl | JSEscape | Safe}}", - "authorization_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/authorize", - "token_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/access_token", - "userinfo_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/userinfo", - "response_types_supported": [ - "code" - ] + "issuer": "{{AppUrl | JSEscape | Safe}}", + "authorization_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/authorize", + "token_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/access_token", + "userinfo_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/userinfo", + "response_types_supported": [ + "code" + ] } \ No newline at end of file From 925d89bda3353395a7b4b8011bd3c9c56ac73cb4 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Sun, 11 Apr 2021 12:33:37 -0400 Subject: [PATCH 3/5] Update oidc_wellknown.tmpl --- templates/user/auth/oidc_wellknown.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/user/auth/oidc_wellknown.tmpl b/templates/user/auth/oidc_wellknown.tmpl index 74a150f32e979..339b1c1639f92 100644 --- a/templates/user/auth/oidc_wellknown.tmpl +++ b/templates/user/auth/oidc_wellknown.tmpl @@ -6,4 +6,4 @@ "response_types_supported": [ "code" ] -} \ No newline at end of file +} From 53d4cd46c561044431462b1368734c9a365a6bd0 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Tue, 13 Apr 2021 14:48:37 -0400 Subject: [PATCH 4/5] add id_token --- templates/user/auth/oidc_wellknown.tmpl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/templates/user/auth/oidc_wellknown.tmpl b/templates/user/auth/oidc_wellknown.tmpl index 339b1c1639f92..fcde060a8d19f 100644 --- a/templates/user/auth/oidc_wellknown.tmpl +++ b/templates/user/auth/oidc_wellknown.tmpl @@ -4,6 +4,7 @@ "token_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/access_token", "userinfo_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/userinfo", "response_types_supported": [ - "code" + "code", + "id_token" ] } From e69470466ce09b859b026f055d5dae9df4455416 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Thu, 15 Apr 2021 20:21:45 -0400 Subject: [PATCH 5/5] Update oidc_wellknown.tmpl --- templates/user/auth/oidc_wellknown.tmpl | 1 - 1 file changed, 1 deletion(-) diff --git a/templates/user/auth/oidc_wellknown.tmpl b/templates/user/auth/oidc_wellknown.tmpl index fcde060a8d19f..290ed4a71df40 100644 --- a/templates/user/auth/oidc_wellknown.tmpl +++ b/templates/user/auth/oidc_wellknown.tmpl @@ -2,7 +2,6 @@ "issuer": "{{AppUrl | JSEscape | Safe}}", "authorization_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/authorize", "token_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/access_token", - "userinfo_endpoint": "{{AppUrl | JSEscape | Safe}}login/oauth/userinfo", "response_types_supported": [ "code", "id_token"