shishantbiswas/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-06-02 20:48:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: implement disabling oidc issuer checks (#13991)

Browse Source 
* use DANGEROUS prefix and drop a warning log
This commit is contained in:
Steven Masley
2024-07-24 11:45:47 -10:00
committed by GitHub
parent 652827f0e8
commit 4f01372179
14 changed files with 272 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/server.go
+11 -2
View File
@@ -106,7 +106,7 @@ import (
"github.com/coder/coder/v2/tailnet"
)
func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*coderd.OIDCConfig, error) {
func createOIDCConfig(ctx context.Context, logger slog.Logger, vals *codersdk.DeploymentValues) (*coderd.OIDCConfig, error) {
if vals.OIDC.ClientID == "" {
return nil, xerrors.Errorf("OIDC client ID must be set!")
}
@@ -114,6 +114,12 @@ func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*co
return nil, xerrors.Errorf("OIDC issuer URL must be set!")
}
// Skipping issuer checks is not recommended.
if vals.OIDC.SkipIssuerChecks {
logger.Warn(ctx, "issuer checks with OIDC is disabled. This is not recommended as it can compromise the security of the authentication")
ctx = oidc.InsecureIssuerURLContext(ctx, vals.OIDC.IssuerURL.String())
}
oidcProvider, err := oidc.NewProvider(
ctx, vals.OIDC.IssuerURL.String(),
)
@@ -167,6 +173,9 @@ func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*co
Provider: oidcProvider,
Verifier: oidcProvider.Verifier(&oidc.Config{
ClientID: vals.OIDC.ClientID.String(),
// Enabling this skips checking the "iss" claim in the token
// matches the issuer URL. This is not recommended.
SkipIssuerCheck: vals.OIDC.SkipIssuerChecks.Value(),
}),
EmailDomain: vals.OIDC.EmailDomain,
AllowSignups: vals.OIDC.AllowSignups.Value(),
@@ -657,7 +666,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
// Missing:
// - Userinfo
// - Verify
oc, err := createOIDCConfig(ctx, vals)
oc, err := createOIDCConfig(ctx, options.Logger, vals)
if err != nil {
return xerrors.Errorf("create oidc config: %w", err)
}
cli/testdata/coder_server_--help.golden
Vendored
+6
View File
@@ -513,6 +513,12 @@ OIDC OPTIONS:
The custom text to show on the error page informing about disabled
OIDC signups. Markdown format is supported.
--dangerous-oidc-skip-issuer-checks bool, $CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS
OIDC issuer urls must match in the request, the id_token 'iss' claim,
and in the well-known configuration. This flag disables that
requirement, and can lead to an insecure OIDC configuration. It is not
recommended to use this flag.
PROVISIONING OPTIONS:
Tune the behavior of the provisioner, which is responsible for creating,
updating, and deleting workspace resources.
cli/testdata/server-config.yaml.golden
Vendored
+5
View File
@@ -364,6 +364,11 @@ oidc:
# Markdown format is supported.
# (default: <unset>, type: string)
signupsDisabledText: ""
# OIDC issuer urls must match in the request, the id_token 'iss' claim, and in the
# well-known configuration. This flag disables that requirement, and can lead to
# an insecure OIDC configuration. It is not recommended to use this flag.
# (default: <unset>, type: bool)
dangerousSkipIssuerChecks: false
# Telemetry is critical to our ability to improve Coder. We strip all personal
# information before sending data to our servers. Please only disable telemetry
# when required by your organization's security policy.