2019-03-09 00:42:50 +08:00
// Copyright 2019 The Gitea Authors. All rights reserved.
2022-11-28 02:20:29 +08:00
// SPDX-License-Identifier: MIT
2019-03-09 00:42:50 +08:00
2022-01-02 21:12:35 +08:00
package auth
2019-03-09 00:42:50 +08:00
import (
2023-06-15 09:12:50 +08:00
go_context "context"
2019-03-11 10:54:59 +08:00
"encoding/base64"
2022-01-02 21:12:35 +08:00
"errors"
2019-03-09 00:42:50 +08:00
"fmt"
2020-08-28 12:37:05 +08:00
"html"
2022-01-02 21:12:35 +08:00
"io"
2021-04-05 23:30:52 +08:00
"net/http"
2019-03-09 00:42:50 +08:00
"net/url"
2023-06-15 09:12:50 +08:00
"sort"
2019-03-11 10:54:59 +08:00
"strings"
2019-03-09 00:42:50 +08:00
2022-01-02 21:12:35 +08:00
"code.gitea.io/gitea/models/auth"
2022-08-25 10:31:57 +08:00
org_model "code.gitea.io/gitea/models/organization"
2021-11-24 17:49:20 +08:00
user_model "code.gitea.io/gitea/models/user"
2023-02-08 14:44:42 +08:00
auth_module "code.gitea.io/gitea/modules/auth"
2019-03-09 00:42:50 +08:00
"code.gitea.io/gitea/modules/base"
2023-02-08 14:44:42 +08:00
"code.gitea.io/gitea/modules/container"
2019-03-09 00:42:50 +08:00
"code.gitea.io/gitea/modules/context"
2021-07-25 00:03:58 +08:00
"code.gitea.io/gitea/modules/json"
2019-03-09 00:42:50 +08:00
"code.gitea.io/gitea/modules/log"
2024-02-04 21:29:09 +08:00
"code.gitea.io/gitea/modules/optional"
2019-03-09 00:42:50 +08:00
"code.gitea.io/gitea/modules/setting"
2019-08-15 22:46:21 +08:00
"code.gitea.io/gitea/modules/timeutil"
2022-04-30 03:38:11 +08:00
"code.gitea.io/gitea/modules/util"
2021-01-26 23:36:53 +08:00
"code.gitea.io/gitea/modules/web"
2022-01-02 21:12:35 +08:00
"code.gitea.io/gitea/modules/web/middleware"
auth_service "code.gitea.io/gitea/services/auth"
2023-02-08 14:44:42 +08:00
source_service "code.gitea.io/gitea/services/auth/source"
2021-07-24 18:16:34 +08:00
"code.gitea.io/gitea/services/auth/source/oauth2"
2022-01-02 21:12:35 +08:00
"code.gitea.io/gitea/services/externalaccount"
2021-04-07 03:44:05 +08:00
"code.gitea.io/gitea/services/forms"
2022-01-02 21:12:35 +08:00
user_service "code.gitea.io/gitea/services/user"
2019-06-13 03:41:28 +08:00
2021-01-26 23:36:53 +08:00
"gitea.com/go-chi/binding"
2023-07-19 17:57:10 +08:00
"github.com/golang-jwt/jwt/v5"
2022-01-02 21:12:35 +08:00
"github.com/markbates/goth"
2022-06-20 23:37:54 +08:00
"github.com/markbates/goth/gothic"
2023-06-15 09:12:50 +08:00
go_oauth2 "golang.org/x/oauth2"
2019-03-09 00:42:50 +08:00
)
const (
tplGrantAccess base . TplName = "user/auth/grant"
tplGrantError base . TplName = "user/auth/grant_error"
)
// TODO move error and responses to SDK or models
// AuthorizeErrorCode represents an error code specified in RFC 6749
2022-10-23 13:28:46 +08:00
// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
2019-03-09 00:42:50 +08:00
type AuthorizeErrorCode string
const (
// ErrorCodeInvalidRequest represents the according error in RFC 6749
ErrorCodeInvalidRequest AuthorizeErrorCode = "invalid_request"
// ErrorCodeUnauthorizedClient represents the according error in RFC 6749
ErrorCodeUnauthorizedClient AuthorizeErrorCode = "unauthorized_client"
// ErrorCodeAccessDenied represents the according error in RFC 6749
ErrorCodeAccessDenied AuthorizeErrorCode = "access_denied"
// ErrorCodeUnsupportedResponseType represents the according error in RFC 6749
ErrorCodeUnsupportedResponseType AuthorizeErrorCode = "unsupported_response_type"
// ErrorCodeInvalidScope represents the according error in RFC 6749
ErrorCodeInvalidScope AuthorizeErrorCode = "invalid_scope"
// ErrorCodeServerError represents the according error in RFC 6749
ErrorCodeServerError AuthorizeErrorCode = "server_error"
// ErrorCodeTemporaryUnavailable represents the according error in RFC 6749
ErrorCodeTemporaryUnavailable AuthorizeErrorCode = "temporarily_unavailable"
)
// AuthorizeError represents an error type specified in RFC 6749
2022-10-23 13:28:46 +08:00
// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1
2019-03-09 00:42:50 +08:00
type AuthorizeError struct {
ErrorCode AuthorizeErrorCode ` json:"error" form:"error" `
ErrorDescription string
State string
}
// Error returns the error message
func ( err AuthorizeError ) Error ( ) string {
return fmt . Sprintf ( "%s: %s" , err . ErrorCode , err . ErrorDescription )
}
// AccessTokenErrorCode represents an error code specified in RFC 6749
2022-10-23 13:28:46 +08:00
// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
2019-03-09 00:42:50 +08:00
type AccessTokenErrorCode string
const (
// AccessTokenErrorCodeInvalidRequest represents an error code specified in RFC 6749
AccessTokenErrorCodeInvalidRequest AccessTokenErrorCode = "invalid_request"
// AccessTokenErrorCodeInvalidClient represents an error code specified in RFC 6749
AccessTokenErrorCodeInvalidClient = "invalid_client"
// AccessTokenErrorCodeInvalidGrant represents an error code specified in RFC 6749
AccessTokenErrorCodeInvalidGrant = "invalid_grant"
// AccessTokenErrorCodeUnauthorizedClient represents an error code specified in RFC 6749
AccessTokenErrorCodeUnauthorizedClient = "unauthorized_client"
// AccessTokenErrorCodeUnsupportedGrantType represents an error code specified in RFC 6749
AccessTokenErrorCodeUnsupportedGrantType = "unsupported_grant_type"
// AccessTokenErrorCodeInvalidScope represents an error code specified in RFC 6749
AccessTokenErrorCodeInvalidScope = "invalid_scope"
)
// AccessTokenError represents an error response specified in RFC 6749
2022-10-23 13:28:46 +08:00
// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
2019-03-09 00:42:50 +08:00
type AccessTokenError struct {
ErrorCode AccessTokenErrorCode ` json:"error" form:"error" `
ErrorDescription string ` json:"error_description" `
}
// Error returns the error message
func ( err AccessTokenError ) Error ( ) string {
return fmt . Sprintf ( "%s: %s" , err . ErrorCode , err . ErrorDescription )
}
2022-01-08 05:02:09 +08:00
// errCallback represents a oauth2 callback error
type errCallback struct {
Code string
Description string
}
func ( err errCallback ) Error ( ) string {
return err . Description
}
2019-03-09 00:42:50 +08:00
// TokenType specifies the kind of token
type TokenType string
const (
// TokenTypeBearer represents a token type specified in RFC 6749
TokenTypeBearer TokenType = "bearer"
// TokenTypeMAC represents a token type specified in RFC 6749
TokenTypeMAC = "mac"
)
// AccessTokenResponse represents a successful access token response
2022-10-23 13:28:46 +08:00
// https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2
2019-03-09 00:42:50 +08:00
type AccessTokenResponse struct {
2019-04-12 15:50:21 +08:00
AccessToken string ` json:"access_token" `
TokenType TokenType ` json:"token_type" `
ExpiresIn int64 ` json:"expires_in" `
RefreshToken string ` json:"refresh_token" `
2021-01-02 00:33:27 +08:00
IDToken string ` json:"id_token,omitempty" `
2019-03-09 00:42:50 +08:00
}
2023-06-15 09:12:50 +08:00
func newAccessTokenResponse ( ctx go_context . Context , grant * auth . OAuth2Grant , serverKey , clientKey oauth2 . JWTSigningKey ) ( * AccessTokenResponse , * AccessTokenError ) {
2019-04-12 15:50:21 +08:00
if setting . OAuth2 . InvalidateRefreshTokens {
2022-05-20 22:08:52 +08:00
if err := grant . IncreaseCounter ( ctx ) ; err != nil {
2019-04-12 15:50:21 +08:00
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidGrant ,
ErrorDescription : "cannot increase the grant counter" ,
}
2019-03-09 00:42:50 +08:00
}
}
// generate access token to access the API
2019-08-15 22:46:21 +08:00
expirationDate := timeutil . TimeStampNow ( ) . Add ( setting . OAuth2 . AccessTokenExpirationTime )
2021-07-24 18:16:34 +08:00
accessToken := & oauth2 . Token {
2019-03-09 00:42:50 +08:00
GrantID : grant . ID ,
2021-07-24 18:16:34 +08:00
Type : oauth2 . TypeAccessToken ,
2022-01-21 05:52:56 +08:00
RegisteredClaims : jwt . RegisteredClaims {
ExpiresAt : jwt . NewNumericDate ( expirationDate . AsTime ( ) ) ,
2019-03-09 00:42:50 +08:00
} ,
}
2021-08-28 03:28:00 +08:00
signedAccessToken , err := accessToken . SignToken ( serverKey )
2019-03-09 00:42:50 +08:00
if err != nil {
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot sign token" ,
}
}
// generate refresh token to request an access token after it expired later
2022-01-21 05:52:56 +08:00
refreshExpirationDate := timeutil . TimeStampNow ( ) . Add ( setting . OAuth2 . RefreshTokenExpirationTime * 60 * 60 ) . AsTime ( )
2021-07-24 18:16:34 +08:00
refreshToken := & oauth2 . Token {
2019-03-09 00:42:50 +08:00
GrantID : grant . ID ,
Counter : grant . Counter ,
2021-07-24 18:16:34 +08:00
Type : oauth2 . TypeRefreshToken ,
2022-06-20 18:02:49 +08:00
RegisteredClaims : jwt . RegisteredClaims {
2022-01-21 05:52:56 +08:00
ExpiresAt : jwt . NewNumericDate ( refreshExpirationDate ) ,
2019-03-09 00:42:50 +08:00
} ,
}
2021-08-28 03:28:00 +08:00
signedRefreshToken , err := refreshToken . SignToken ( serverKey )
2019-03-09 00:42:50 +08:00
if err != nil {
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot sign token" ,
}
}
2021-01-02 00:33:27 +08:00
// generate OpenID Connect id_token
signedIDToken := ""
if grant . ScopeContains ( "openid" ) {
2022-05-20 22:08:52 +08:00
app , err := auth . GetOAuth2ApplicationByID ( ctx , grant . ApplicationID )
2021-01-02 00:33:27 +08:00
if err != nil {
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot find application" ,
}
}
2022-12-03 10:48:26 +08:00
user , err := user_model . GetUserByID ( ctx , grant . UserID )
2021-06-14 18:33:16 +08:00
if err != nil {
2021-11-24 17:49:20 +08:00
if user_model . IsErrUserNotExist ( err ) {
2021-06-14 18:33:16 +08:00
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot find user" ,
}
}
log . Error ( "Error loading user: %v" , err )
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "server error" ,
}
}
2021-07-24 18:16:34 +08:00
idToken := & oauth2 . OIDCToken {
2022-01-21 05:52:56 +08:00
RegisteredClaims : jwt . RegisteredClaims {
ExpiresAt : jwt . NewNumericDate ( expirationDate . AsTime ( ) ) ,
2021-01-02 00:33:27 +08:00
Issuer : setting . AppURL ,
2022-01-21 05:52:56 +08:00
Audience : [ ] string { app . ClientID } ,
2021-01-02 00:33:27 +08:00
Subject : fmt . Sprint ( grant . UserID ) ,
} ,
Nonce : grant . Nonce ,
}
2021-06-14 18:33:16 +08:00
if grant . ScopeContains ( "profile" ) {
2022-06-17 06:29:54 +08:00
idToken . Name = user . GetDisplayName ( )
2021-08-20 00:11:30 +08:00
idToken . PreferredUsername = user . Name
idToken . Profile = user . HTMLURL ( )
Add context cache as a request level cache (#22294)
To avoid duplicated load of the same data in an HTTP request, we can set
a context cache to do that. i.e. Some pages may load a user from a
database with the same id in different areas on the same page. But the
code is hidden in two different deep logic. How should we share the
user? As a result of this PR, now if both entry functions accept
`context.Context` as the first parameter and we just need to refactor
`GetUserByID` to reuse the user from the context cache. Then it will not
be loaded twice on an HTTP request.
But of course, sometimes we would like to reload an object from the
database, that's why `RemoveContextData` is also exposed.
The core context cache is here. It defines a new context
```go
type cacheContext struct {
ctx context.Context
data map[any]map[any]any
lock sync.RWMutex
}
var cacheContextKey = struct{}{}
func WithCacheContext(ctx context.Context) context.Context {
return context.WithValue(ctx, cacheContextKey, &cacheContext{
ctx: ctx,
data: make(map[any]map[any]any),
})
}
```
Then you can use the below 4 methods to read/write/del the data within
the same context.
```go
func GetContextData(ctx context.Context, tp, key any) any
func SetContextData(ctx context.Context, tp, key, value any)
func RemoveContextData(ctx context.Context, tp, key any)
func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error)
```
Then let's take a look at how `system.GetString` implement it.
```go
func GetSetting(ctx context.Context, key string) (string, error) {
return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) {
return cache.GetString(genSettingCacheKey(key), func() (string, error) {
res, err := GetSettingNoCache(ctx, key)
if err != nil {
return "", err
}
return res.SettingValue, nil
})
})
}
```
First, it will check if context data include the setting object with the
key. If not, it will query from the global cache which may be memory or
a Redis cache. If not, it will get the object from the database. In the
end, if the object gets from the global cache or database, it will be
set into the context cache.
An object stored in the context cache will only be destroyed after the
context disappeared.
2023-02-15 21:37:34 +08:00
idToken . Picture = user . AvatarLink ( ctx )
2021-08-20 00:11:30 +08:00
idToken . Website = user . Website
idToken . Locale = user . Language
idToken . UpdatedAt = user . UpdatedUnix
2021-06-14 18:33:16 +08:00
}
if grant . ScopeContains ( "email" ) {
2021-08-20 00:11:30 +08:00
idToken . Email = user . Email
idToken . EmailVerified = user . IsActive
2021-06-14 18:33:16 +08:00
}
2021-10-22 17:19:24 +08:00
if grant . ScopeContains ( "groups" ) {
2023-09-16 22:39:12 +08:00
groups , err := getOAuthGroupsForUser ( ctx , user )
2021-10-22 17:19:24 +08:00
if err != nil {
log . Error ( "Error getting groups: %v" , err )
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "server error" ,
}
}
idToken . Groups = groups
}
2021-06-14 18:33:16 +08:00
2021-08-28 03:28:00 +08:00
signedIDToken , err = idToken . SignToken ( clientKey )
2021-01-02 00:33:27 +08:00
if err != nil {
return nil , & AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot sign token" ,
}
}
}
2019-03-09 00:42:50 +08:00
return & AccessTokenResponse {
AccessToken : signedAccessToken ,
TokenType : TokenTypeBearer ,
ExpiresIn : setting . OAuth2 . AccessTokenExpirationTime ,
RefreshToken : signedRefreshToken ,
2021-01-02 00:33:27 +08:00
IDToken : signedIDToken ,
2019-03-09 00:42:50 +08:00
} , nil
}
2021-05-06 13:30:15 +08:00
type userInfoResponse struct {
2021-10-22 17:19:24 +08:00
Sub string ` json:"sub" `
Name string ` json:"name" `
Username string ` json:"preferred_username" `
Email string ` json:"email" `
Picture string ` json:"picture" `
Groups [ ] string ` json:"groups" `
2021-05-06 13:30:15 +08:00
}
// InfoOAuth manages request for userinfo endpoint
func InfoOAuth ( ctx * context . Context ) {
2022-03-22 15:03:22 +08:00
if ctx . Doer == nil || ctx . Data [ "AuthedMethod" ] != ( & auth_service . OAuth2 { } ) . Name ( ) {
2021-08-21 10:16:45 +08:00
ctx . Resp . Header ( ) . Set ( "WWW-Authenticate" , ` Bearer realm="" ` )
2021-12-15 14:59:57 +08:00
ctx . PlainText ( http . StatusUnauthorized , "no valid authorization" )
2021-05-06 13:30:15 +08:00
return
}
2021-10-22 17:19:24 +08:00
2021-05-06 13:30:15 +08:00
response := & userInfoResponse {
2022-03-22 15:03:22 +08:00
Sub : fmt . Sprint ( ctx . Doer . ID ) ,
Name : ctx . Doer . FullName ,
Username : ctx . Doer . Name ,
Email : ctx . Doer . Email ,
Add context cache as a request level cache (#22294)
To avoid duplicated load of the same data in an HTTP request, we can set
a context cache to do that. i.e. Some pages may load a user from a
database with the same id in different areas on the same page. But the
code is hidden in two different deep logic. How should we share the
user? As a result of this PR, now if both entry functions accept
`context.Context` as the first parameter and we just need to refactor
`GetUserByID` to reuse the user from the context cache. Then it will not
be loaded twice on an HTTP request.
But of course, sometimes we would like to reload an object from the
database, that's why `RemoveContextData` is also exposed.
The core context cache is here. It defines a new context
```go
type cacheContext struct {
ctx context.Context
data map[any]map[any]any
lock sync.RWMutex
}
var cacheContextKey = struct{}{}
func WithCacheContext(ctx context.Context) context.Context {
return context.WithValue(ctx, cacheContextKey, &cacheContext{
ctx: ctx,
data: make(map[any]map[any]any),
})
}
```
Then you can use the below 4 methods to read/write/del the data within
the same context.
```go
func GetContextData(ctx context.Context, tp, key any) any
func SetContextData(ctx context.Context, tp, key, value any)
func RemoveContextData(ctx context.Context, tp, key any)
func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error)
```
Then let's take a look at how `system.GetString` implement it.
```go
func GetSetting(ctx context.Context, key string) (string, error) {
return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) {
return cache.GetString(genSettingCacheKey(key), func() (string, error) {
res, err := GetSettingNoCache(ctx, key)
if err != nil {
return "", err
}
return res.SettingValue, nil
})
})
}
```
First, it will check if context data include the setting object with the
key. If not, it will query from the global cache which may be memory or
a Redis cache. If not, it will get the object from the database. In the
end, if the object gets from the global cache or database, it will be
set into the context cache.
An object stored in the context cache will only be destroyed after the
context disappeared.
2023-02-15 21:37:34 +08:00
Picture : ctx . Doer . AvatarLink ( ctx ) ,
2021-05-06 13:30:15 +08:00
}
2021-10-22 17:19:24 +08:00
2023-09-16 22:39:12 +08:00
groups , err := getOAuthGroupsForUser ( ctx , ctx . Doer )
2021-10-22 17:19:24 +08:00
if err != nil {
ctx . ServerError ( "Oauth groups for user" , err )
return
}
response . Groups = groups
2021-05-06 13:30:15 +08:00
ctx . JSON ( http . StatusOK , response )
}
2021-10-22 17:19:24 +08:00
// returns a list of "org" and "org:team" strings,
// that the given user is a part of.
2023-09-16 22:39:12 +08:00
func getOAuthGroupsForUser ( ctx go_context . Context , user * user_model . User ) ( [ ] string , error ) {
orgs , err := org_model . GetUserOrgsList ( ctx , user )
2021-10-22 17:19:24 +08:00
if err != nil {
2022-10-25 03:29:17 +08:00
return nil , fmt . Errorf ( "GetUserOrgList: %w" , err )
2021-10-22 17:19:24 +08:00
}
var groups [ ] string
for _ , org := range orgs {
groups = append ( groups , org . Name )
2023-10-03 18:30:41 +08:00
teams , err := org . LoadTeams ( ctx )
2021-11-19 19:41:40 +08:00
if err != nil {
2022-10-25 03:29:17 +08:00
return nil , fmt . Errorf ( "LoadTeams: %w" , err )
2021-10-22 17:19:24 +08:00
}
2021-11-19 19:41:40 +08:00
for _ , team := range teams {
2023-10-03 18:30:41 +08:00
if team . IsMember ( ctx , user . ID ) {
2021-10-22 17:19:24 +08:00
groups = append ( groups , org . Name + ":" + team . LowerName )
}
}
}
return groups , nil
}
2021-08-21 10:16:45 +08:00
// IntrospectOAuth introspects an oauth token
func IntrospectOAuth ( ctx * context . Context ) {
2022-03-22 15:03:22 +08:00
if ctx . Doer == nil {
2021-08-21 10:16:45 +08:00
ctx . Resp . Header ( ) . Set ( "WWW-Authenticate" , ` Bearer realm="" ` )
2021-12-15 14:59:57 +08:00
ctx . PlainText ( http . StatusUnauthorized , "no valid authorization" )
2021-08-21 10:16:45 +08:00
return
}
var response struct {
Active bool ` json:"active" `
Scope string ` json:"scope,omitempty" `
2022-01-21 05:52:56 +08:00
jwt . RegisteredClaims
2021-08-21 10:16:45 +08:00
}
form := web . GetForm ( ctx ) . ( * forms . IntrospectTokenForm )
2021-08-28 03:28:00 +08:00
token , err := oauth2 . ParseToken ( form . Token , oauth2 . DefaultSigningKey )
2021-08-21 10:16:45 +08:00
if err == nil {
2023-07-19 17:57:10 +08:00
grant , err := auth . GetOAuth2GrantByID ( ctx , token . GrantID )
if err == nil && grant != nil {
app , err := auth . GetOAuth2ApplicationByID ( ctx , grant . ApplicationID )
if err == nil && app != nil {
response . Active = true
response . Scope = grant . Scope
response . Issuer = setting . AppURL
response . Audience = [ ] string { app . ClientID }
response . Subject = fmt . Sprint ( grant . UserID )
2021-08-21 10:16:45 +08:00
}
}
}
ctx . JSON ( http . StatusOK , response )
}
2019-03-09 00:42:50 +08:00
// AuthorizeOAuth manages authorize requests
2021-01-26 23:36:53 +08:00
func AuthorizeOAuth ( ctx * context . Context ) {
2021-04-07 03:44:05 +08:00
form := web . GetForm ( ctx ) . ( * forms . AuthorizationForm )
2019-03-09 00:42:50 +08:00
errs := binding . Errors { }
2021-01-26 23:36:53 +08:00
errs = form . Validate ( ctx . Req , errs )
2019-06-13 03:41:28 +08:00
if len ( errs ) > 0 {
errstring := ""
for _ , e := range errs {
errstring += e . Error ( ) + "\n"
}
2019-06-13 12:23:45 +08:00
ctx . ServerError ( "AuthorizeOAuth: Validate: " , fmt . Errorf ( "errors occurred during validation: %s" , errstring ) )
2019-06-13 03:41:28 +08:00
return
}
2019-03-09 00:42:50 +08:00
2022-05-20 22:08:52 +08:00
app , err := auth . GetOAuth2ApplicationByClientID ( ctx , form . ClientID )
2019-03-09 00:42:50 +08:00
if err != nil {
2022-01-02 21:12:35 +08:00
if auth . IsErrOauthClientIDInvalid ( err ) {
2019-03-09 00:42:50 +08:00
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeUnauthorizedClient ,
ErrorDescription : "Client ID not registered" ,
State : form . State ,
} , "" )
return
}
ctx . ServerError ( "GetOAuth2ApplicationByClientID" , err )
return
}
2021-09-24 19:32:56 +08:00
2022-10-12 22:08:29 +08:00
var user * user_model . User
if app . UID != 0 {
2022-12-03 10:48:26 +08:00
user , err = user_model . GetUserByID ( ctx , app . UID )
2022-10-12 22:08:29 +08:00
if err != nil {
ctx . ServerError ( "GetUserByID" , err )
return
}
2019-03-09 00:42:50 +08:00
}
if ! app . ContainsRedirectURI ( form . RedirectURI ) {
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeInvalidRequest ,
ErrorDescription : "Unregistered Redirect URI" ,
State : form . State ,
} , "" )
return
}
if form . ResponseType != "code" {
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeUnsupportedResponseType ,
ErrorDescription : "Only code response type is supported." ,
State : form . State ,
} , form . RedirectURI )
return
}
// pkce support
switch form . CodeChallengeMethod {
case "S256" :
case "plain" :
if err := ctx . Session . Set ( "CodeChallengeMethod" , form . CodeChallengeMethod ) ; err != nil {
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeServerError ,
ErrorDescription : "cannot set code challenge method" ,
State : form . State ,
} , form . RedirectURI )
return
}
if err := ctx . Session . Set ( "CodeChallengeMethod" , form . CodeChallenge ) ; err != nil {
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeServerError ,
ErrorDescription : "cannot set code challenge" ,
State : form . State ,
} , form . RedirectURI )
return
}
2020-05-17 20:43:29 +08:00
// Here we're just going to try to release the session early
if err := ctx . Session . Release ( ) ; err != nil {
// we'll tolerate errors here as they *should* get saved elsewhere
log . Error ( "Unable to save changes to the session: %v" , err )
}
2019-03-09 00:42:50 +08:00
case "" :
2022-10-24 15:59:24 +08:00
// "Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message"
// https://datatracker.ietf.org/doc/html/rfc8252#section-8.1
if ! app . ConfidentialClient {
// "the authorization endpoint MUST return the authorization error response with the "error" value set to "invalid_request""
// https://datatracker.ietf.org/doc/html/rfc7636#section-4.4.1
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeInvalidRequest ,
ErrorDescription : "PKCE is required for public clients" ,
State : form . State ,
} , form . RedirectURI )
return
}
2019-03-09 00:42:50 +08:00
default :
2022-10-24 15:59:24 +08:00
// "If the server supporting PKCE does not support the requested transformation, the authorization endpoint MUST return the authorization error response with "error" value set to "invalid_request"."
// https://www.rfc-editor.org/rfc/rfc7636#section-4.4.1
2019-03-09 00:42:50 +08:00
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeInvalidRequest ,
ErrorDescription : "unsupported code challenge method" ,
State : form . State ,
} , form . RedirectURI )
return
}
2022-05-20 22:08:52 +08:00
grant , err := app . GetGrantByUserID ( ctx , ctx . Doer . ID )
2019-03-09 00:42:50 +08:00
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
return
}
// Redirect if user already granted access
if grant != nil {
2022-05-20 22:08:52 +08:00
code , err := grant . GenerateNewAuthorizationCode ( ctx , form . RedirectURI , form . CodeChallenge , form . CodeChallengeMethod )
2019-03-09 00:42:50 +08:00
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
return
}
redirect , err := code . GenerateRedirectURI ( form . State )
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
return
}
2021-01-02 00:33:27 +08:00
// Update nonce to reflect the new session
if len ( form . Nonce ) > 0 {
2022-05-20 22:08:52 +08:00
err := grant . SetNonce ( ctx , form . Nonce )
2021-01-02 00:33:27 +08:00
if err != nil {
log . Error ( "Unable to update nonce: %v" , err )
}
}
2022-03-23 12:54:07 +08:00
ctx . Redirect ( redirect . String ( ) )
2019-03-09 00:42:50 +08:00
return
}
// show authorize page to grant access
ctx . Data [ "Application" ] = app
ctx . Data [ "RedirectURI" ] = form . RedirectURI
ctx . Data [ "State" ] = form . State
2021-01-02 00:33:27 +08:00
ctx . Data [ "Scope" ] = form . Scope
ctx . Data [ "Nonce" ] = form . Nonce
2022-10-12 22:08:29 +08:00
if user != nil {
ctx . Data [ "ApplicationCreatorLinkHTML" ] = fmt . Sprintf ( ` <a href="%s">@%s</a> ` , html . EscapeString ( user . HomeLink ( ) ) , html . EscapeString ( user . Name ) )
} else {
ctx . Data [ "ApplicationCreatorLinkHTML" ] = fmt . Sprintf ( ` <a href="%s">%s</a> ` , html . EscapeString ( setting . AppSubURL + "/" ) , html . EscapeString ( setting . AppName ) )
}
2020-08-28 12:37:05 +08:00
ctx . Data [ "ApplicationRedirectDomainHTML" ] = "<strong>" + html . EscapeString ( form . RedirectURI ) + "</strong>"
2019-03-09 00:42:50 +08:00
// TODO document SESSION <=> FORM
2019-06-13 03:41:28 +08:00
err = ctx . Session . Set ( "client_id" , app . ClientID )
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
log . Error ( err . Error ( ) )
return
}
err = ctx . Session . Set ( "redirect_uri" , form . RedirectURI )
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
log . Error ( err . Error ( ) )
return
}
err = ctx . Session . Set ( "state" , form . State )
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
log . Error ( err . Error ( ) )
return
}
2020-05-17 20:43:29 +08:00
// Here we're just going to try to release the session early
if err := ctx . Session . Release ( ) ; err != nil {
// we'll tolerate errors here as they *should* get saved elsewhere
log . Error ( "Unable to save changes to the session: %v" , err )
}
2021-04-05 23:30:52 +08:00
ctx . HTML ( http . StatusOK , tplGrantAccess )
2019-03-09 00:42:50 +08:00
}
// GrantApplicationOAuth manages the post request submitted when a user grants access to an application
2021-01-26 23:36:53 +08:00
func GrantApplicationOAuth ( ctx * context . Context ) {
2021-04-07 03:44:05 +08:00
form := web . GetForm ( ctx ) . ( * forms . GrantApplicationForm )
2019-03-09 00:42:50 +08:00
if ctx . Session . Get ( "client_id" ) != form . ClientID || ctx . Session . Get ( "state" ) != form . State ||
ctx . Session . Get ( "redirect_uri" ) != form . RedirectURI {
2021-04-05 23:30:52 +08:00
ctx . Error ( http . StatusBadRequest )
2019-03-09 00:42:50 +08:00
return
}
2022-05-20 22:08:52 +08:00
app , err := auth . GetOAuth2ApplicationByClientID ( ctx , form . ClientID )
2019-03-09 00:42:50 +08:00
if err != nil {
ctx . ServerError ( "GetOAuth2ApplicationByClientID" , err )
return
}
2022-05-20 22:08:52 +08:00
grant , err := app . CreateGrant ( ctx , ctx . Doer . ID , form . Scope )
2019-03-09 00:42:50 +08:00
if err != nil {
handleAuthorizeError ( ctx , AuthorizeError {
State : form . State ,
ErrorDescription : "cannot create grant for user" ,
ErrorCode : ErrorCodeServerError ,
} , form . RedirectURI )
return
}
2021-01-02 00:33:27 +08:00
if len ( form . Nonce ) > 0 {
2022-05-20 22:08:52 +08:00
err := grant . SetNonce ( ctx , form . Nonce )
2021-01-02 00:33:27 +08:00
if err != nil {
log . Error ( "Unable to update nonce: %v" , err )
}
}
2019-03-09 00:42:50 +08:00
var codeChallenge , codeChallengeMethod string
codeChallenge , _ = ctx . Session . Get ( "CodeChallenge" ) . ( string )
codeChallengeMethod , _ = ctx . Session . Get ( "CodeChallengeMethod" ) . ( string )
2022-05-20 22:08:52 +08:00
code , err := grant . GenerateNewAuthorizationCode ( ctx , form . RedirectURI , codeChallenge , codeChallengeMethod )
2019-03-09 00:42:50 +08:00
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
return
}
redirect , err := code . GenerateRedirectURI ( form . State )
if err != nil {
handleServerError ( ctx , form . State , form . RedirectURI )
2019-04-25 19:30:38 +08:00
return
2019-03-09 00:42:50 +08:00
}
2022-03-23 12:54:07 +08:00
ctx . Redirect ( redirect . String ( ) , http . StatusSeeOther )
2019-03-09 00:42:50 +08:00
}
2021-04-16 10:32:00 +08:00
// OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities
func OIDCWellKnown ( ctx * context . Context ) {
2023-08-08 09:22:47 +08:00
t , err := ctx . Render . TemplateLookup ( "user/auth/oidc_wellknown" , nil )
2023-04-08 21:15:22 +08:00
if err != nil {
ctx . ServerError ( "unable to find template" , err )
return
}
2021-04-16 10:32:00 +08:00
ctx . Resp . Header ( ) . Set ( "Content-Type" , "application/json" )
2021-06-18 05:56:46 +08:00
ctx . Data [ "SigningKey" ] = oauth2 . DefaultSigningKey
2023-04-08 21:15:22 +08:00
if err = t . Execute ( ctx . Resp , ctx . Data ) ; err != nil {
ctx . ServerError ( "unable to execute template" , err )
2021-04-16 10:32:00 +08:00
}
}
2021-06-18 05:56:46 +08:00
// OIDCKeys generates the JSON Web Key Set
func OIDCKeys ( ctx * context . Context ) {
jwk , err := oauth2 . DefaultSigningKey . ToJWK ( )
if err != nil {
log . Error ( "Error converting signing key to JWK: %v" , err )
ctx . Error ( http . StatusInternalServerError )
return
}
jwk [ "use" ] = "sig"
jwks := map [ string ] [ ] map [ string ] string {
"keys" : {
jwk ,
} ,
}
ctx . Resp . Header ( ) . Set ( "Content-Type" , "application/json" )
2021-07-25 00:03:58 +08:00
enc := json . NewEncoder ( ctx . Resp )
2021-06-18 05:56:46 +08:00
if err := enc . Encode ( jwks ) ; err != nil {
log . Error ( "Failed to encode representation as json. Error: %v" , err )
}
}
2019-03-09 00:42:50 +08:00
// AccessTokenOAuth manages all access token requests by the client
2021-01-26 23:36:53 +08:00
func AccessTokenOAuth ( ctx * context . Context ) {
2021-04-07 03:44:05 +08:00
form := * web . GetForm ( ctx ) . ( * forms . AccessTokenForm )
2022-10-07 10:53:49 +08:00
// if there is no ClientID or ClientSecret in the request body, fill these fields by the Authorization header and ensure the provided field matches the Authorization header
if form . ClientID == "" || form . ClientSecret == "" {
2019-03-11 10:54:59 +08:00
authHeader := ctx . Req . Header . Get ( "Authorization" )
authContent := strings . SplitN ( authHeader , " " , 2 )
if len ( authContent ) == 2 && authContent [ 0 ] == "Basic" {
payload , err := base64 . StdEncoding . DecodeString ( authContent [ 1 ] )
if err != nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot parse basic auth header" ,
} )
return
}
pair := strings . SplitN ( string ( payload ) , ":" , 2 )
if len ( pair ) != 2 {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot parse basic auth header" ,
} )
return
}
2022-10-07 10:53:49 +08:00
if form . ClientID != "" && form . ClientID != pair [ 0 ] {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "client_id in request body inconsistent with Authorization header" ,
} )
return
}
2019-03-11 10:54:59 +08:00
form . ClientID = pair [ 0 ]
2022-10-07 10:53:49 +08:00
if form . ClientSecret != "" && form . ClientSecret != pair [ 1 ] {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "client_secret in request body inconsistent with Authorization header" ,
} )
return
}
2019-03-11 10:54:59 +08:00
form . ClientSecret = pair [ 1 ]
}
}
2021-06-18 05:56:46 +08:00
2021-08-28 03:28:00 +08:00
serverKey := oauth2 . DefaultSigningKey
clientKey := serverKey
if serverKey . IsSymmetric ( ) {
var err error
clientKey , err = oauth2 . CreateJWTSigningKey ( serverKey . SigningMethod ( ) . Alg ( ) , [ ] byte ( form . ClientSecret ) )
2021-06-18 05:56:46 +08:00
if err != nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "Error creating signing key" ,
} )
return
}
}
2019-03-09 00:42:50 +08:00
switch form . GrantType {
case "refresh_token" :
2021-08-28 03:28:00 +08:00
handleRefreshToken ( ctx , form , serverKey , clientKey )
2019-03-09 00:42:50 +08:00
case "authorization_code" :
2021-08-28 03:28:00 +08:00
handleAuthorizationCode ( ctx , form , serverKey , clientKey )
2019-03-09 00:42:50 +08:00
default :
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnsupportedGrantType ,
ErrorDescription : "Only refresh_token or authorization_code grant type is supported" ,
} )
}
}
2021-08-28 03:28:00 +08:00
func handleRefreshToken ( ctx * context . Context , form forms . AccessTokenForm , serverKey , clientKey oauth2 . JWTSigningKey ) {
2022-10-23 13:28:46 +08:00
app , err := auth . GetOAuth2ApplicationByClientID ( ctx , form . ClientID )
if err != nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidClient ,
ErrorDescription : fmt . Sprintf ( "cannot load client with client id: %q" , form . ClientID ) ,
} )
return
}
// "The authorization server MUST ... require client authentication for confidential clients"
// https://datatracker.ietf.org/doc/html/rfc6749#section-6
2023-06-03 11:59:28 +08:00
if app . ConfidentialClient && ! app . ValidateClientSecret ( [ ] byte ( form . ClientSecret ) ) {
2022-10-23 13:28:46 +08:00
errorDescription := "invalid client secret"
if form . ClientSecret == "" {
errorDescription = "invalid empty client secret"
}
// "invalid_client ... Client authentication failed"
// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidClient ,
ErrorDescription : errorDescription ,
} )
return
}
2021-08-28 03:28:00 +08:00
token , err := oauth2 . ParseToken ( form . RefreshToken , serverKey )
2019-03-09 00:42:50 +08:00
if err != nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
2022-09-29 03:10:27 +08:00
ErrorDescription : "unable to parse refresh token" ,
2019-03-09 00:42:50 +08:00
} )
return
}
// get grant before increasing counter
2022-05-20 22:08:52 +08:00
grant , err := auth . GetOAuth2GrantByID ( ctx , token . GrantID )
2019-03-09 00:42:50 +08:00
if err != nil || grant == nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidGrant ,
ErrorDescription : "grant does not exist" ,
} )
return
}
// check if token got already used
2019-04-12 15:50:21 +08:00
if setting . OAuth2 . InvalidateRefreshTokens && ( grant . Counter != token . Counter || token . Counter == 0 ) {
2019-03-09 00:42:50 +08:00
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
ErrorDescription : "token was already used" ,
} )
log . Warn ( "A client tried to use a refresh token for grant_id = %d was used twice!" , grant . ID )
return
}
2022-05-20 22:08:52 +08:00
accessToken , tokenErr := newAccessTokenResponse ( ctx , grant , serverKey , clientKey )
2019-03-09 00:42:50 +08:00
if tokenErr != nil {
handleAccessTokenError ( ctx , * tokenErr )
return
}
2021-04-05 23:30:52 +08:00
ctx . JSON ( http . StatusOK , accessToken )
2019-03-09 00:42:50 +08:00
}
2021-08-28 03:28:00 +08:00
func handleAuthorizationCode ( ctx * context . Context , form forms . AccessTokenForm , serverKey , clientKey oauth2 . JWTSigningKey ) {
2022-05-20 22:08:52 +08:00
app , err := auth . GetOAuth2ApplicationByClientID ( ctx , form . ClientID )
2019-03-09 00:42:50 +08:00
if err != nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidClient ,
2019-03-11 10:54:59 +08:00
ErrorDescription : fmt . Sprintf ( "cannot load client with client id: '%s'" , form . ClientID ) ,
2019-03-09 00:42:50 +08:00
} )
return
}
2023-06-03 11:59:28 +08:00
if app . ConfidentialClient && ! app . ValidateClientSecret ( [ ] byte ( form . ClientSecret ) ) {
2022-10-07 10:53:49 +08:00
errorDescription := "invalid client secret"
if form . ClientSecret == "" {
errorDescription = "invalid empty client secret"
}
2019-03-09 00:42:50 +08:00
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
2022-10-07 10:53:49 +08:00
ErrorDescription : errorDescription ,
2019-03-09 00:42:50 +08:00
} )
return
}
if form . RedirectURI != "" && ! app . ContainsRedirectURI ( form . RedirectURI ) {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
2022-09-29 03:10:27 +08:00
ErrorDescription : "unexpected redirect URI" ,
2019-03-09 00:42:50 +08:00
} )
return
}
2022-05-20 22:08:52 +08:00
authorizationCode , err := auth . GetOAuth2AuthorizationByCode ( ctx , form . Code )
2019-03-09 00:42:50 +08:00
if err != nil || authorizationCode == nil {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
ErrorDescription : "client is not authorized" ,
} )
return
}
// check if code verifier authorizes the client, PKCE support
if ! authorizationCode . ValidateCodeChallenge ( form . CodeVerifier ) {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeUnauthorizedClient ,
2022-09-29 03:10:27 +08:00
ErrorDescription : "failed PKCE code challenge" ,
2019-03-09 00:42:50 +08:00
} )
return
}
// check if granted for this application
if authorizationCode . Grant . ApplicationID != app . ID {
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidGrant ,
ErrorDescription : "invalid grant" ,
} )
return
}
// remove token from database to deny duplicate usage
2022-05-20 22:08:52 +08:00
if err := authorizationCode . Invalidate ( ctx ) ; err != nil {
2019-03-09 00:42:50 +08:00
handleAccessTokenError ( ctx , AccessTokenError {
ErrorCode : AccessTokenErrorCodeInvalidRequest ,
ErrorDescription : "cannot proceed your request" ,
} )
}
2022-05-20 22:08:52 +08:00
resp , tokenErr := newAccessTokenResponse ( ctx , authorizationCode . Grant , serverKey , clientKey )
2019-03-09 00:42:50 +08:00
if tokenErr != nil {
handleAccessTokenError ( ctx , * tokenErr )
return
}
// send successful response
2021-04-05 23:30:52 +08:00
ctx . JSON ( http . StatusOK , resp )
2019-03-09 00:42:50 +08:00
}
func handleAccessTokenError ( ctx * context . Context , acErr AccessTokenError ) {
2021-04-05 23:30:52 +08:00
ctx . JSON ( http . StatusBadRequest , acErr )
2019-03-09 00:42:50 +08:00
}
2021-12-20 12:41:31 +08:00
func handleServerError ( ctx * context . Context , state , redirectURI string ) {
2019-03-09 00:42:50 +08:00
handleAuthorizeError ( ctx , AuthorizeError {
ErrorCode : ErrorCodeServerError ,
ErrorDescription : "A server error occurred" ,
State : state ,
} , redirectURI )
}
func handleAuthorizeError ( ctx * context . Context , authErr AuthorizeError , redirectURI string ) {
if redirectURI == "" {
log . Warn ( "Authorization failed: %v" , authErr . ErrorDescription )
ctx . Data [ "Error" ] = authErr
2022-03-23 12:54:07 +08:00
ctx . HTML ( http . StatusBadRequest , tplGrantError )
2019-03-09 00:42:50 +08:00
return
}
redirect , err := url . Parse ( redirectURI )
if err != nil {
ctx . ServerError ( "url.Parse" , err )
return
}
q := redirect . Query ( )
q . Set ( "error" , string ( authErr . ErrorCode ) )
q . Set ( "error_description" , authErr . ErrorDescription )
q . Set ( "state" , authErr . State )
redirect . RawQuery = q . Encode ( )
2022-03-23 12:54:07 +08:00
ctx . Redirect ( redirect . String ( ) , http . StatusSeeOther )
2019-03-09 00:42:50 +08:00
}
2022-01-02 21:12:35 +08:00
// SignInOAuth handles the OAuth2 login buttons
func SignInOAuth ( ctx * context . Context ) {
provider := ctx . Params ( ":provider" )
2023-10-14 16:37:24 +08:00
authSource , err := auth . GetActiveOAuth2SourceByName ( ctx , provider )
2022-01-02 21:12:35 +08:00
if err != nil {
ctx . ServerError ( "SignIn" , err )
return
}
2023-01-25 00:41:38 +08:00
redirectTo := ctx . FormString ( "redirect_to" )
if len ( redirectTo ) > 0 {
middleware . SetRedirectToCookie ( ctx . Resp , redirectTo )
}
2022-01-02 21:12:35 +08:00
// try to do a direct callback flow, so we don't authenticate the user again but use the valid accesstoken to get the user
2023-09-15 01:09:32 +08:00
user , gothUser , err := oAuth2UserLoginCallback ( ctx , authSource , ctx . Req , ctx . Resp )
2022-01-02 21:12:35 +08:00
if err == nil && user != nil {
// we got the user without going through the whole OAuth2 authentication flow again
handleOAuth2SignIn ( ctx , authSource , user , gothUser )
return
}
if err = authSource . Cfg . ( * oauth2 . Source ) . Callout ( ctx . Req , ctx . Resp ) ; err != nil {
if strings . Contains ( err . Error ( ) , "no provider for " ) {
2023-10-14 16:37:24 +08:00
if err = oauth2 . ResetOAuth2 ( ctx ) ; err != nil {
2022-01-02 21:12:35 +08:00
ctx . ServerError ( "SignIn" , err )
return
}
if err = authSource . Cfg . ( * oauth2 . Source ) . Callout ( ctx . Req , ctx . Resp ) ; err != nil {
ctx . ServerError ( "SignIn" , err )
}
return
}
ctx . ServerError ( "SignIn" , err )
}
// redirect is done in oauth2.Auth
}
// SignInOAuthCallback handles the callback from the given provider
func SignInOAuthCallback ( ctx * context . Context ) {
provider := ctx . Params ( ":provider" )
2023-06-15 09:12:50 +08:00
if ctx . Req . FormValue ( "error" ) != "" {
var errorKeyValues [ ] string
for k , vv := range ctx . Req . Form {
for _ , v := range vv {
errorKeyValues = append ( errorKeyValues , fmt . Sprintf ( "%s = %s" , html . EscapeString ( k ) , html . EscapeString ( v ) ) )
}
}
sort . Strings ( errorKeyValues )
ctx . Flash . Error ( strings . Join ( errorKeyValues , "<br>" ) , true )
}
2022-01-02 21:12:35 +08:00
// first look if the provider is still active
2023-10-14 16:37:24 +08:00
authSource , err := auth . GetActiveOAuth2SourceByName ( ctx , provider )
2022-01-02 21:12:35 +08:00
if err != nil {
ctx . ServerError ( "SignIn" , err )
return
}
if authSource == nil {
2023-06-15 09:12:50 +08:00
ctx . ServerError ( "SignIn" , errors . New ( "no valid provider found, check configured callback url in provider" ) )
2022-01-02 21:12:35 +08:00
return
}
2023-09-15 01:09:32 +08:00
u , gothUser , err := oAuth2UserLoginCallback ( ctx , authSource , ctx . Req , ctx . Resp )
2022-01-02 21:12:35 +08:00
if err != nil {
if user_model . IsErrUserProhibitLogin ( err ) {
2022-02-03 18:44:18 +08:00
uplerr := err . ( user_model . ErrUserProhibitLogin )
2022-01-02 21:12:35 +08:00
log . Info ( "Failed authentication attempt for %s from %s: %v" , uplerr . Name , ctx . RemoteAddr ( ) , err )
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( http . StatusOK , "user/auth/prohibit_login" )
return
}
2022-01-08 05:02:09 +08:00
if callbackErr , ok := err . ( errCallback ) ; ok {
log . Info ( "Failed OAuth callback: (%v) %v" , callbackErr . Code , callbackErr . Description )
switch callbackErr . Code {
case "access_denied" :
ctx . Flash . Error ( ctx . Tr ( "auth.oauth.signin.error.access_denied" ) )
case "temporarily_unavailable" :
ctx . Flash . Error ( ctx . Tr ( "auth.oauth.signin.error.temporarily_unavailable" ) )
default :
ctx . Flash . Error ( ctx . Tr ( "auth.oauth.signin.error" ) )
}
ctx . Redirect ( setting . AppSubURL + "/user/login" )
return
}
2023-06-15 09:12:50 +08:00
if err , ok := err . ( * go_oauth2 . RetrieveError ) ; ok {
ctx . Flash . Error ( "OAuth2 RetrieveError: " + err . Error ( ) , true )
}
2022-01-02 21:12:35 +08:00
ctx . ServerError ( "UserSignIn" , err )
return
}
if u == nil {
2022-05-29 08:03:17 +08:00
if ctx . Doer != nil {
// attach user to already logged in user
2023-09-25 21:17:37 +08:00
err = externalaccount . LinkAccountToUser ( ctx , ctx . Doer , gothUser )
2022-05-29 08:03:17 +08:00
if err != nil {
ctx . ServerError ( "UserLinkAccount" , err )
return
}
ctx . Redirect ( setting . AppSubURL + "/user/settings/security" )
return
} else if ! setting . Service . AllowOnlyInternalRegistration && setting . OAuth2Client . EnableAutoRegistration {
2022-01-02 21:12:35 +08:00
// create new user with details from oauth2 provider
var missingFields [ ] string
if gothUser . UserID == "" {
missingFields = append ( missingFields , "sub" )
}
if gothUser . Email == "" {
missingFields = append ( missingFields , "email" )
}
if setting . OAuth2Client . Username == setting . OAuth2UsernameNickname && gothUser . NickName == "" {
missingFields = append ( missingFields , "nickname" )
}
if len ( missingFields ) > 0 {
log . Error ( "OAuth2 Provider %s returned empty or missing fields: %s" , authSource . Name , missingFields )
if authSource . IsOAuth2 ( ) && authSource . Cfg . ( * oauth2 . Source ) . Provider == "openidConnect" {
log . Error ( "You may need to change the 'OPENID_CONNECT_SCOPES' setting to request all required fields" )
}
err = fmt . Errorf ( "OAuth2 Provider %s returned empty or missing fields: %s" , authSource . Name , missingFields )
ctx . ServerError ( "CreateUser" , err )
return
}
2024-01-04 08:48:20 +08:00
uname , err := getUserName ( & gothUser )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
2022-01-02 21:12:35 +08:00
u = & user_model . User {
2024-01-04 08:48:20 +08:00
Name : uname ,
2022-04-30 03:38:11 +08:00
FullName : gothUser . Name ,
Email : gothUser . Email ,
LoginType : auth . OAuth2 ,
LoginSource : authSource . ID ,
LoginName : gothUser . UserID ,
}
overwriteDefault := & user_model . CreateUserOverwriteOptions {
2023-04-25 14:40:48 +08:00
IsActive : util . OptionalBoolOf ( ! setting . OAuth2Client . RegisterEmailConfirm && ! setting . Service . RegisterManualConfirm ) ,
2022-01-02 21:12:35 +08:00
}
2023-02-08 14:44:42 +08:00
source := authSource . Cfg . ( * oauth2 . Source )
2024-02-04 21:29:09 +08:00
isAdmin , isRestricted := getUserAdminAndRestrictedFromGroupClaims ( source , & gothUser )
u . IsAdmin = isAdmin . ValueOrDefault ( false )
u . IsRestricted = isRestricted . ValueOrDefault ( false )
2022-01-02 21:12:35 +08:00
2022-04-30 03:38:11 +08:00
if ! createAndHandleCreatedUser ( ctx , base . TplName ( "" ) , nil , u , overwriteDefault , & gothUser , setting . OAuth2Client . AccountLinking != setting . OAuth2AccountLinkingDisabled ) {
2022-01-02 21:12:35 +08:00
// error already handled
return
}
2023-02-08 14:44:42 +08:00
if err := syncGroupsToTeams ( ctx , source , & gothUser , u ) ; err != nil {
ctx . ServerError ( "SyncGroupsToTeams" , err )
return
}
2022-01-02 21:12:35 +08:00
} else {
// no existing user is found, request attach or new account
showLinkingLogin ( ctx , gothUser )
return
}
}
handleOAuth2SignIn ( ctx , authSource , u , gothUser )
}
2023-07-05 02:36:08 +08:00
func claimValueToStringSet ( claimValue any ) container . Set [ string ] {
2022-01-02 21:12:35 +08:00
var groups [ ] string
switch rawGroup := claimValue . ( type ) {
case [ ] string :
groups = rawGroup
2023-07-05 02:36:08 +08:00
case [ ] any :
2022-02-01 04:41:11 +08:00
for _ , group := range rawGroup {
groups = append ( groups , fmt . Sprintf ( "%s" , group ) )
}
2022-01-02 21:12:35 +08:00
default :
str := fmt . Sprintf ( "%s" , rawGroup )
groups = strings . Split ( str , "," )
}
2023-02-08 14:44:42 +08:00
return container . SetOf ( groups ... )
2022-01-02 21:12:35 +08:00
}
2023-02-08 14:44:42 +08:00
func syncGroupsToTeams ( ctx * context . Context , source * oauth2 . Source , gothUser * goth . User , u * user_model . User ) error {
if source . GroupTeamMap != "" || source . GroupTeamMapRemoval {
groupTeamMapping , err := auth_module . UnmarshalGroupTeamMapping ( source . GroupTeamMap )
if err != nil {
return err
}
groups := getClaimedGroups ( source , gothUser )
if err := source_service . SyncGroupsToTeams ( ctx , u , groups , groupTeamMapping , source . GroupTeamMapRemoval ) ; err != nil {
return err
}
2022-01-02 21:12:35 +08:00
}
2023-02-08 14:44:42 +08:00
return nil
}
func getClaimedGroups ( source * oauth2 . Source , gothUser * goth . User ) container . Set [ string ] {
2022-01-02 21:12:35 +08:00
groupClaims , has := gothUser . RawData [ source . GroupClaimName ]
if ! has {
2023-02-08 14:44:42 +08:00
return nil
2022-01-02 21:12:35 +08:00
}
2023-02-08 14:44:42 +08:00
return claimValueToStringSet ( groupClaims )
}
2024-02-04 21:29:09 +08:00
func getUserAdminAndRestrictedFromGroupClaims ( source * oauth2 . Source , gothUser * goth . User ) ( isAdmin , isRestricted optional . Option [ bool ] ) {
2023-02-08 14:44:42 +08:00
groups := getClaimedGroups ( source , gothUser )
2022-01-02 21:12:35 +08:00
if source . AdminGroup != "" {
2024-02-04 21:29:09 +08:00
isAdmin = optional . Some ( groups . Contains ( source . AdminGroup ) )
2022-01-02 21:12:35 +08:00
}
if source . RestrictedGroup != "" {
2024-02-04 21:29:09 +08:00
isRestricted = optional . Some ( groups . Contains ( source . RestrictedGroup ) )
2022-01-02 21:12:35 +08:00
}
2024-02-04 21:29:09 +08:00
return isAdmin , isRestricted
2022-01-02 21:12:35 +08:00
}
func showLinkingLogin ( ctx * context . Context , gothUser goth . User ) {
2023-07-05 02:36:08 +08:00
if err := updateSession ( ctx , nil , map [ string ] any {
2022-11-10 19:43:06 +08:00
"linkAccountGothUser" : gothUser ,
} ) ; err != nil {
ctx . ServerError ( "updateSession" , err )
2022-01-02 21:12:35 +08:00
return
}
ctx . Redirect ( setting . AppSubURL + "/user/link_account" )
}
2023-10-11 12:24:07 +08:00
func updateAvatarIfNeed ( ctx * context . Context , url string , u * user_model . User ) {
2022-01-02 21:12:35 +08:00
if setting . OAuth2Client . UpdateAvatar && len ( url ) > 0 {
resp , err := http . Get ( url )
if err == nil {
defer func ( ) {
_ = resp . Body . Close ( )
} ( )
}
// ignore any error
if err == nil && resp . StatusCode == http . StatusOK {
data , err := io . ReadAll ( io . LimitReader ( resp . Body , setting . Avatar . MaxFileSize + 1 ) )
if err == nil && int64 ( len ( data ) ) <= setting . Avatar . MaxFileSize {
2023-10-11 12:24:07 +08:00
_ = user_service . UploadAvatar ( ctx , u , data )
2022-01-02 21:12:35 +08:00
}
}
}
}
func handleOAuth2SignIn ( ctx * context . Context , source * auth . Source , u * user_model . User , gothUser goth . User ) {
2023-10-11 12:24:07 +08:00
updateAvatarIfNeed ( ctx , gothUser . AvatarURL , u )
2022-01-02 21:12:35 +08:00
needs2FA := false
if ! source . Cfg . ( * oauth2 . Source ) . SkipLocalTwoFA {
2023-09-15 14:13:19 +08:00
_ , err := auth . GetTwoFactorByUID ( ctx , u . ID )
2022-01-02 21:12:35 +08:00
if err != nil && ! auth . IsErrTwoFactorNotEnrolled ( err ) {
ctx . ServerError ( "UserSignIn" , err )
return
}
needs2FA = err == nil
}
2023-02-08 14:44:42 +08:00
oauth2Source := source . Cfg . ( * oauth2 . Source )
groupTeamMapping , err := auth_module . UnmarshalGroupTeamMapping ( oauth2Source . GroupTeamMap )
if err != nil {
ctx . ServerError ( "UnmarshalGroupTeamMapping" , err )
return
}
groups := getClaimedGroups ( oauth2Source , & gothUser )
2022-01-02 21:12:35 +08:00
// If this user is enrolled in 2FA and this source doesn't override it,
// we can't sign the user in just yet. Instead, redirect them to the 2FA authentication page.
if ! needs2FA {
2023-07-05 02:36:08 +08:00
if err := updateSession ( ctx , nil , map [ string ] any {
2022-11-10 19:43:06 +08:00
"uid" : u . ID ,
"uname" : u . Name ,
} ) ; err != nil {
ctx . ServerError ( "updateSession" , err )
2022-01-02 21:12:35 +08:00
return
}
2022-04-08 13:21:05 +08:00
// Clear whatever CSRF cookie has right now, force to generate a new one
2023-04-14 03:45:33 +08:00
ctx . Csrf . DeleteCookie ( ctx )
2022-01-02 21:12:35 +08:00
2024-02-04 21:29:09 +08:00
opts := & user_service . UpdateOptions {
SetLastLogin : true ,
2022-01-02 21:12:35 +08:00
}
2024-02-04 21:29:09 +08:00
opts . IsAdmin , opts . IsRestricted = getUserAdminAndRestrictedFromGroupClaims ( oauth2Source , & gothUser )
if err := user_service . UpdateUser ( ctx , u , opts ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
2022-01-02 21:12:35 +08:00
return
}
2023-02-08 14:44:42 +08:00
if oauth2Source . GroupTeamMap != "" || oauth2Source . GroupTeamMapRemoval {
if err := source_service . SyncGroupsToTeams ( ctx , u , groups , groupTeamMapping , oauth2Source . GroupTeamMapRemoval ) ; err != nil {
ctx . ServerError ( "SyncGroupsToTeams" , err )
return
}
}
2022-01-02 21:12:35 +08:00
// update external user information
2023-10-14 16:37:24 +08:00
if err := externalaccount . UpdateExternalUser ( ctx , u , gothUser ) ; err != nil {
2022-10-20 03:07:21 +08:00
if ! errors . Is ( err , util . ErrNotExist ) {
log . Error ( "UpdateExternalUser failed: %v" , err )
}
2022-01-02 21:12:35 +08:00
}
if err := resetLocale ( ctx , u ) ; err != nil {
ctx . ServerError ( "resetLocale" , err )
return
}
2023-04-14 03:45:33 +08:00
if redirectTo := ctx . GetSiteCookie ( "redirect_to" ) ; len ( redirectTo ) > 0 {
2022-01-02 21:12:35 +08:00
middleware . DeleteRedirectToCookie ( ctx . Resp )
ctx . RedirectToFirst ( redirectTo )
return
}
ctx . Redirect ( setting . AppSubURL + "/" )
return
}
2024-02-04 21:29:09 +08:00
opts := & user_service . UpdateOptions { }
opts . IsAdmin , opts . IsRestricted = getUserAdminAndRestrictedFromGroupClaims ( oauth2Source , & gothUser )
if opts . IsAdmin . Has ( ) || opts . IsRestricted . Has ( ) {
if err := user_service . UpdateUser ( ctx , u , opts ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
2022-01-02 21:12:35 +08:00
return
}
}
2023-02-08 14:44:42 +08:00
if oauth2Source . GroupTeamMap != "" || oauth2Source . GroupTeamMapRemoval {
if err := source_service . SyncGroupsToTeams ( ctx , u , groups , groupTeamMapping , oauth2Source . GroupTeamMapRemoval ) ; err != nil {
ctx . ServerError ( "SyncGroupsToTeams" , err )
return
}
}
2023-07-05 02:36:08 +08:00
if err := updateSession ( ctx , nil , map [ string ] any {
2022-11-10 19:43:06 +08:00
// User needs to use 2FA, save data and redirect to 2FA page.
"twofaUid" : u . ID ,
"twofaRemember" : false ,
} ) ; err != nil {
ctx . ServerError ( "updateSession" , err )
2022-01-02 21:12:35 +08:00
return
}
2022-01-14 23:03:31 +08:00
// If WebAuthn is enrolled -> Redirect to WebAuthn instead
2023-09-16 22:39:12 +08:00
regs , err := auth . GetWebAuthnCredentialsByUID ( ctx , u . ID )
2022-01-02 21:12:35 +08:00
if err == nil && len ( regs ) > 0 {
2022-01-14 23:03:31 +08:00
ctx . Redirect ( setting . AppSubURL + "/user/webauthn" )
2022-01-02 21:12:35 +08:00
return
}
ctx . Redirect ( setting . AppSubURL + "/user/two_factor" )
}
// OAuth2UserLoginCallback attempts to handle the callback from the OAuth2 provider and if successful
// login the user
2023-09-15 01:09:32 +08:00
func oAuth2UserLoginCallback ( ctx * context . Context , authSource * auth . Source , request * http . Request , response http . ResponseWriter ) ( * user_model . User , goth . User , error ) {
2022-01-02 21:12:35 +08:00
oauth2Source := authSource . Cfg . ( * oauth2 . Source )
2022-06-20 23:37:54 +08:00
// Make sure that the response is not an error response.
errorName := request . FormValue ( "error" )
if len ( errorName ) > 0 {
errorDescription := request . FormValue ( "error_description" )
// Delete the goth session
err := gothic . Logout ( response , request )
if err != nil {
return nil , goth . User { } , err
}
return nil , goth . User { } , errCallback {
Code : errorName ,
Description : errorDescription ,
}
}
// Proceed to authenticate through goth.
2022-01-02 21:12:35 +08:00
gothUser , err := oauth2Source . Callback ( request , response )
if err != nil {
if err . Error ( ) == "securecookie: the value is too long" || strings . Contains ( err . Error ( ) , "Data too long" ) {
log . Error ( "OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider" , authSource . Name , setting . OAuth2 . MaxTokenLength )
err = fmt . Errorf ( "OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider" , authSource . Name , setting . OAuth2 . MaxTokenLength )
}
return nil , goth . User { } , err
}
if oauth2Source . RequiredClaimName != "" {
claimInterface , has := gothUser . RawData [ oauth2Source . RequiredClaimName ]
if ! has {
return nil , goth . User { } , user_model . ErrUserProhibitLogin { Name : gothUser . UserID }
}
if oauth2Source . RequiredClaimValue != "" {
2023-02-08 14:44:42 +08:00
groups := claimValueToStringSet ( claimInterface )
if ! groups . Contains ( oauth2Source . RequiredClaimValue ) {
2022-01-02 21:12:35 +08:00
return nil , goth . User { } , user_model . ErrUserProhibitLogin { Name : gothUser . UserID }
}
}
}
user := & user_model . User {
LoginName : gothUser . UserID ,
LoginType : auth . OAuth2 ,
LoginSource : authSource . ID ,
}
2023-09-15 01:09:32 +08:00
hasUser , err := user_model . GetUser ( ctx , user )
2022-01-02 21:12:35 +08:00
if err != nil {
return nil , goth . User { } , err
}
if hasUser {
return user , gothUser , nil
}
// search in external linked users
externalLoginUser := & user_model . ExternalLoginUser {
ExternalID : gothUser . UserID ,
LoginSourceID : authSource . ID ,
}
2023-10-14 16:37:24 +08:00
hasUser , err = user_model . GetExternalLogin ( request . Context ( ) , externalLoginUser )
2022-01-02 21:12:35 +08:00
if err != nil {
return nil , goth . User { } , err
}
if hasUser {
2022-12-03 10:48:26 +08:00
user , err = user_model . GetUserByID ( request . Context ( ) , externalLoginUser . UserID )
2022-01-02 21:12:35 +08:00
return user , gothUser , err
}
// no user found to login
return nil , gothUser , nil
}