Skip to content

Commit b8f3f1c

Browse files
epiclenepiclen
committed
Added Dex support, improved OAuth flow
1 parent 2a1bc45 commit b8f3f1c

File tree

4 files changed

+151
-0
lines changed

4 files changed

+151
-0
lines changed

‎config.inc.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,18 @@
537537
// $tlCfg->OAuthServers[1]['oauth_profile'] = 'https://login.microsoftonline.com/TENANTID/openid/userinfo';
538538
// $tlCfg->OAuthServers[1]['oauth_scope'] = 'https://graph.microsoft.com/mail.read https://graph.microsoft.com/user.read openid profile email';
539539

540+
// OIDC
541+
// $tlCfg->OAuthServers[1]['oauth_enabled'] = true;
542+
// $tlCfg->OAuthServers[1]['oauth_name'] = 'oidc';
543+
// $tlCfg->OAuthServers[1]['oauth_client_id'] = 'CLIENT_ID';
544+
// $tlCfg->OAuthServers[1]['oauth_client_secret'] = 'CLIENT_SECRET';
545+
// $tlCfg->OAuthServers[1]['oauth_grant_type'] = 'authorization_code';
546+
// $tlCfg->OAuthServers[1]['oauth_url'] = 'OAUTH_URL';
547+
// $tlCfg->OAuthServers[1]['token_url'] = 'TOKEN_URL';
548+
// $tlCfg->OAuthServers[1]['redirect_uri'] = 'redirect_uri';
549+
// $tlCfg->OAuthServers[1]['oauth_scope'] = 'openid profile email groups ext offline_access';
550+
// $tlCfg->OAuthServers[1]['https'] = $_SERVER['HTTPS'];
551+
540552
/**
541553
* Single Sign On authentication
542554
*

‎custom_config.inc.php.oidc_oauth‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
/**
3+
* OAUTH auth
4+
* Configure this on custom_config.inc.php
5+
*/
6+
7+
// OIDC
8+
// $tlCfg->OAuthServers[1]['oauth_enabled'] = true;
9+
// $tlCfg->OAuthServers[1]['oauth_name'] = 'oidc';
10+
// $tlCfg->OAuthServers[1]['oauth_client_id'] = 'CLIENT_ID';
11+
// $tlCfg->OAuthServers[1]['oauth_client_secret'] = 'CLIENT_SECRET';
12+
// $tlCfg->OAuthServers[1]['oauth_grant_type'] = 'authorization_code';
13+
// $tlCfg->OAuthServers[1]['oauth_url'] = 'OAUTH_URL';
14+
// $tlCfg->OAuthServers[1]['token_url'] = 'TOKEN_URL';
15+
// $tlCfg->OAuthServers[1]['redirect_uri'] = 'redirect_uri';
16+
// $tlCfg->OAuthServers[1]['oauth_scope'] = 'openid profile email groups ext offline_access';
17+
// $tlCfg->OAuthServers[1]['https'] = $_SERVER['HTTPS'];

‎docs/oauth/dex.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# How to configurate oauth work with OIDC
2+
3+
## About Dex
4+
Dex is an identity service that uses OpenID Connect to drive authentication for other apps.
5+
6+
https://github.com/dexidp/dex
7+
8+
## Configuration
9+
config.inc.php example:
10+
11+
```
12+
// OIDC
13+
$tlCfg->OAuthServers[1]['oauth_enabled'] = true;
14+
$tlCfg->OAuthServers[1]['oauth_name'] = 'oidc';
15+
$tlCfg->OAuthServers[1]['oauth_client_id'] = 'CLIENT_ID';
16+
$tlCfg->OAuthServers[1]['oauth_client_secret'] = 'CLIENT_SECRET';
17+
$tlCfg->OAuthServers[1]['oauth_grant_type'] = 'authorization_code';
18+
$tlCfg->OAuthServers[1]['oauth_url'] = 'OAUTH_URL';
19+
$tlCfg->OAuthServers[1]['token_url'] = 'TOKEN_URL';
20+
$tlCfg->OAuthServers[1]['redirect_uri'] = 'redirect_uri';
21+
$tlCfg->OAuthServers[1]['oauth_scope'] = 'openid profile email groups ext offline_access';
22+
$tlCfg->OAuthServers[1]['https'] = $_SERVER['HTTPS'];
23+
```
24+
25+
oauth_enabled: enable this oauth configuration.
26+
27+
oauth_name: "oidc".
28+
29+
oauth_client_id: id of OAuth program
30+
31+
oauth_client_secret: secret code.
32+
33+
oauth_grant_type: authorization_code is default value.
34+
35+
oauth_url: url of OAuth server.
36+
37+
token_url: url for getting token.
38+
39+
redirect_uri: callback uri.
40+
41+
oauth_scope: openid profile email groups ext offline_access

‎lib/functions/oauth_providers/oidc.php‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<?php
2+
/**
3+
* TestLink Open Source Project - http://testlink.sourceforge.net/
4+
* This script is distributed under the GNU General Public License 2 or later.
5+
*
6+
* @filesource oidc.php
7+
*
8+
* OIDC OAUTH API (authentication)
9+
*
10+
* @internal revisions
11+
* @since 1.9.20
12+
*
13+
*/
14+
15+
// Get token
16+
function oauth_get_token($authCfg, $code) {
17+
18+
$result = new stdClass();
19+
$result->status = array('status' => tl::OK, 'msg' => null);
20+
21+
// Params to get token
22+
$oauthParams = array(
23+
'code' => $code,
24+
'client_id' => $authCfg['oauth_client_id'],
25+
'client_secret' => $authCfg['oauth_client_secret'],
26+
'grant_type' => $authCfg['oauth_grant_type']
27+
);
28+
29+
$oauthParams['redirect_uri'] = $authCfg['redirect_uri'];
30+
if( isset($authCfg['https']) ) {
31+
$oauthParams['redirect_uri'] =
32+
str_replace('http://', 'https://', $oauthParams['redirect_uri']);
33+
}
34+
35+
// Step #1 - Get the token
36+
$curl = curl_init();
37+
curl_setopt($curl, CURLOPT_URL, $authCfg['token_url']);
38+
curl_setopt($curl, CURLOPT_POST, 1);
39+
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/json'));
40+
curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($oauthParams));
41+
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
42+
curl_setopt($curl, CURLOPT_COOKIESESSION, true);
43+
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
44+
$result_curl = curl_exec($curl);
45+
46+
if( $result_curl === false ) {
47+
echo 'Curl error: ' . curl_error($curl);
48+
echo '<pre>';
49+
var_dump(curl_getinfo($curl));
50+
echo '</pre>';
51+
return false;
52+
}
53+
curl_close($curl);
54+
$tokenInfo = json_decode($result_curl);
55+
56+
// If token is received start session
57+
if (isset($tokenInfo->access_token)) {
58+
59+
$tokens = explode('.', $tokenInfo->id_token);
60+
if (count($tokens) != 3)
61+
return false;
62+
63+
$base64payload = $tokens[1];
64+
65+
$payload = json_decode(base64_decode($base64payload));
66+
if ($payload==false){
67+
return false;
68+
}
69+
70+
$result->options = new stdClass();
71+
$result->options->givenName = $payload->name;
72+
$result->options->familyName = $payload->name;
73+
$result->options->user = $payload->email;
74+
$result->options->auth = 'oauth';
75+
return $result;
76+
}
77+
$result->status['msg'] = 'An error occurred during getting token';
78+
$result->status['status'] = tl::ERROR;
79+
80+
return $result;
81+
}

0 commit comments

Comments
 (0)