feat: Add OAuth callback support for OIDC (#1290)

Closes #593, closes #690, closes #1289

docker-compose-dev.yml

@@ -55,6 +55,7 @@ services:
       # - OIDC_ISSUER=
       # - OIDC_CLIENT_ID=
       # - OIDC_CLIENT_SECRET=
+      # - OIDC_USE_OAUTH_CALLBACK=true
       # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
       # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile

docker-compose.yml

@@ -73,6 +73,7 @@ services:
       # - OIDC_CLIENT_SECRET=
       # Optionally store in secrets - then OIDC_CLIENT_SECRET should not be set
       # - OIDC_CLIENT_SECRET__FILE=/run/secrets/oidc_client_secret
+      # - OIDC_USE_OAUTH_CALLBACK=true
       # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
       # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile

server/.env.sample

@@ -46,6 +46,7 @@ SECRET_KEY=notsecretkey
 # OIDC_ISSUER=
 # OIDC_CLIENT_ID=
 # OIDC_CLIENT_SECRET=
+# OIDC_USE_OAUTH_CALLBACK=true
 # OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
 # OIDC_USERINFO_SIGNED_RESPONSE_ALG=
 # OIDC_SCOPES=openid email profile

server/api/helpers/users/get-or-create-one-with-oidc.js

@@ -34,16 +34,29 @@ module.exports = {
 
     let tokenSet;
     try {
-      tokenSet = await client.callback(
+      if (sails.config.custom.oidcUseOauthCallback) {
-        sails.config.custom.oidcRedirectUri,
+        tokenSet = await client.oauthCallback(
-        {
+          sails.config.custom.oidcRedirectUri,
-          iss: sails.config.custom.oidcIssuer,
+          {
-          code: inputs.code,
+            iss: sails.config.custom.oidcIssuer,
-        },
+            code: inputs.code,
-        {
+          },
-          nonce: inputs.nonce,
+          {
-        },
+            nonce: inputs.nonce,
-      );
+          },
+        );
+      } else {
+        tokenSet = await client.callback(
+          sails.config.custom.oidcRedirectUri,
+          {
+            iss: sails.config.custom.oidcIssuer,
+            code: inputs.code,
+          },
+          {
+            nonce: inputs.nonce,
+          },
+        );
+      }
     } catch (error) {
       sails.log.warn(`Error while exchanging OIDC code: ${error}`);
       throw 'invalidCodeOrNonce';
@@ -93,7 +106,6 @@ module.exports = {
             if (configRoles.includes('*')) {
               return true;
             }
-
             return configRoles.some((configRole) => claimsRolesSet.has(configRole));
           },
         );
@@ -148,7 +160,7 @@ module.exports = {
       identityProviderUser = await IdentityProviderUser.qm.createOne({
         userId: user.id,
         issuer: sails.config.custom.oidcIssuer,
-        sub: claims.sub,
+        sub: claims.sub || `${user.id}@${sails.config.custom.oidcIssuer}`,
       });
     }
 

server/config/custom.js

@@ -64,6 +64,7 @@ module.exports.custom = {
   oidcIssuer: process.env.OIDC_ISSUER,
   oidcClientId: process.env.OIDC_CLIENT_ID,
   oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
+  oidcUseOauthCallback: process.env.OIDC_USE_OAUTH_CALLBACK === 'true',
   oidcIdTokenSignedResponseAlg: process.env.OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG,
   oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG,
   oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',

server/package-lock.json

@@ -7809,9 +7809,9 @@
       }
     },
     "node_modules/oidc-token-hash": {
-      "version": "5.1.0",
+      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.1.tgz",
-      "integrity": "sha512-y0W+X7Ppo7oZX6eovsRkuzcSM40Bicg2JEJkDJ4irIt1wsYAP5MLSNv+QAogO8xivMffw/9OvV3um1pxXgt1uA==",
+      "integrity": "sha512-D7EmwxJV6DsEB6vOFLrBM2OzsVgQzgPWyHlV2OOAVj772n+WTXpudC9e9u5BVKQnYwaD30Ivhi9b+4UeBcGu9g==",
       "license": "MIT",
       "engines": {
         "node": "^10.13.0 || >=12.0.0"