yetangitu/OpenSTF
1
0
Fork 0
mirror of https://github.com/openstf/stf synced 2025-10-04 02:09:32 +02:00
Code Issues Releases Wiki Activity

Email domain restriction added for OAuth2 authorization.

Browse source
This commit is contained in:
Karol Wrótniak 2017-01-27 22:02:41 +01:00
parent 79aadbb090
commit 8b9ff7e580
No known key found for this signature in database
GPG key ID: DE1EED7FE32385FE
2 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/cli/auth-oauth2/index.js
View file

@ -54,6 +54,12 @@ module.exports.builder = function(yargs) {
, default: process.env.OAUTH_SCOPE , default: process.env.OAUTH_SCOPE
, demand: true , demand: true
}) })
.option('oauth-domain', {
describe: 'Optional email domain to allow authentication for.'
, type: 'string'
, default: process.env.OAUTH_DOMAIN
, demand: false
})
.option('port', { .option('port', {
alias: 'p' alias: 'p'
, describe: 'The port to bind to.' , describe: 'The port to bind to.'
@ -89,6 +95,7 @@ module.exports.handler = function(argv) {
, secret: argv.secret , secret: argv.secret
, ssid: argv.ssid , ssid: argv.ssid
, appUrl: argv.appUrl , appUrl: argv.appUrl
, domain: argv.oauthDomain
, oauth: { , oauth: {
authorizationURL: argv.oauthAuthorizationUrl authorizationURL: argv.oauthAuthorizationUrl
, tokenURL: argv.oauthTokenUrl , tokenURL: argv.oauthTokenUrl

17
lib/units/auth/oauth2/index.js
View file

@ -28,10 +28,20 @@ module.exports = function(options) {
, session: false , session: false
})) }))
function isEmailAllowed(email) {
if (email) {
if (options.domain) {
return email.endsWith(options.domain)
}
return true
}
return false
}
app.get( app.get(
'/auth/oauth/callback' '/auth/oauth/callback'
, function(req, res) { , function(req, res) {
if (req.user.email) { if (isEmailAllowed(req.user.email)) {
res.redirect(urlutil.addParams(options.appUrl, { res.redirect(urlutil.addParams(options.appUrl, {
jwt: jwtutil.encode({ jwt: jwtutil.encode({
payload: { payload: {
@ -46,8 +56,9 @@ module.exports = function(options) {
})) }))
} }
else { else {
log.warn('Missing email in profile', req.user) log.warn('Missing or disallowed email in profile', req.user)
res.redirect('/auth/oauth/') res.send('<html><body>Missing or rejected email address ' +
'<a href="/auth/oauth/">Retry</a></body></html>')
} }
} }
) )