Feature/openid connect

package.json

@@ -86,6 +86,7 @@
     "cookie-parser": "^1.4.5",
     "env-paths": "^2.2.0",
     "express": "^5.0.0-alpha.8",
+    "express-openid-connect": "^2.3.1",
     "http-proxy": "^1.18.0",
     "httpolyglot": "^0.1.2",
     "js-yaml": "^4.0.0",

src/node/app.ts

@@ -1,11 +1,12 @@
 import { logger } from "@coder/logger"
 import compression from "compression"
 import express, { Express } from "express"
+import { auth } from "express-openid-connect"
 import { promises as fs } from "fs"
 import http from "http"
 import * as httpolyglot from "httpolyglot"
 import * as util from "../common/util"
-import { DefaultedArgs } from "./cli"
+import { AuthType, DefaultedArgs } from "./cli"
 import { handleUpgrade } from "./wsRouter"
 
 /**
@@ -59,6 +60,19 @@ export const createApp = async (args: DefaultedArgs): Promise<[Express, Express,
   const wsApp = express()
   handleUpgrade(wsApp, server)
 
+  if (args.auth == AuthType.Openid) {
+    const openidConfig = {
+      authRequired: true,
+      auth0Logout: true,
+      issuerBaseURL: args["openid-issuer-base-url"],
+      clientID: args["openid-client-id"],
+      baseURL: args["openid-base-url"],
+      secret: args["openid-secret"]
+    };
+    app.use(auth(openidConfig));
+    wsApp.use(auth(openidConfig));
+  }
+
   return [app, wsApp, server]
 }
 

src/node/cli.ts

@@ -9,6 +9,7 @@ import { canConnect, generateCertificate, generatePassword, humanPath, paths } f
 export enum AuthType {
   Password = "password",
   None = "none",
+  Openid = "openid"
 }
 
 export class Optional<T> {
@@ -29,6 +30,12 @@ export interface Args extends VsArgs {
   config?: string
   auth?: AuthType
   password?: string
+  "openid-issuer-base-url"?: string
+  "openid-client-id"?: string
+  "openid-base-url"?: string
+  "openid-secret"?: string
+  "openid-group-claim"?:string
+  "openid-user-group"?:string
   "hashed-password"?: string
   cert?: OptionalString
   "cert-host"?: string
@@ -105,6 +112,30 @@ const options: Options<Required<Args>> = {
     type: "string",
     description: "The password for password authentication (can only be passed in via $PASSWORD or the config file).",
   },
+  "openid-issuer-base-url": {
+    type: "string",
+    description: "The base url for providers .well-known endpoint",
+  },
+  "openid-client-id": {
+    type: "string",
+    description: "The client ID of this OpenID application",
+  },
+  "openid-base-url": {
+    type: "string",
+    description: "The base URL for code-server",
+  },
+  "openid-secret": {
+    type: "string",
+    description: "A long secret used to encrypt the session cookie",
+  },
+  "openid-group-claim": {
+    type: "string",
+    description: "A claim that contains the authenticated users group assignments",
+  },
+  "openid-user-group": {
+    type: "string",
+    description: "The group that a user will need to be a member of to access this instance",
+  },
   "hashed-password": {
     type: "string",
     description:

src/node/http.ts

@@ -1,6 +1,7 @@
 import { field, logger } from "@coder/logger"
 import * as express from "express"
 import * as expressCore from "express-serve-static-core"
+import { RequestContext } from "express-openid-connect"
 import qs from "qs"
 import safeCompare from "safe-compare"
 import { HttpCode, HttpError } from "../common/http"
@@ -16,6 +17,7 @@ declare global {
     export interface Request {
       args: DefaultedArgs
       heart: Heart
+      oidc: RequestContext
     }
   }
 }
@@ -69,6 +71,29 @@ export const authenticated = (req: express.Request): boolean => {
           ? safeCompare(req.cookies.key, req.args["hashed-password"])
           : req.args.password && safeCompare(req.cookies.key, hash(req.args.password)))
       )
+    case AuthType.Openid:
+      console.log(req.oidc.user)
+      console.log(req.oidc.isAuthenticated())  
+
+      const groupClaim = req.args["openid-group-claim"]
+      const userGroup = req.args["openid-user-group"]
+
+      if (req.oidc.isAuthenticated()){
+        for (const key in req.oidc.idTokenClaims) {
+          var claims = <string[]>req.oidc.idTokenClaims[key]
+          if (key == groupClaim) {
+            for (const value in claims) {
+              if(userGroup == claims[value]) {
+                return true
+              }
+            }
+          }
+        }
+        throw new HttpError("Unauthorized", HttpCode.Unauthorized)
+      }
+
+      return false
+
     default:
       throw new Error(`Unsupported auth type ${req.args.auth}`)
   }