Feature/openid connect

docs/openid-auth.md

@@ -0,0 +1,152 @@
+# Configuring OpenID Authentication
+
+The purpose of this guide is to demonstrate the process of configuring an OpenID Application as an authentication and authorization source for Code-Server.
+
+More information reguarding how OpenID Connect works can be found here:
+
+- https://openid.net/connect/faq/
+- https://auth0.com/docs/protocols/openid-connect-protocol
+- https://developer.okta.com/blog/2019/10/21/illustrated-guide-to-oauth-and-oidc
+
+## Prerequisites
+
+- Either Keycloak has been deployed or an existing Auth0/Okta account exist.
+  - Auth0 Signup: https://auth0.com/signup
+  - Okta Signup: https://developer.okta.com/signup/
+  - Getting started with Keycloak: https://www.keycloak.org/docs/latest/getting_started/
+- A value needs generated for `openid-secret`. This value will be used to encrypt the OpenID Connect session token.
+  - MacOS/Linux: `openssl rand -base64 25`
+  - Windows: https://activedirectoryfaq.com/2017/08/creating-individual-random-passwords/
+
+## Auth0 OpenID Connect Application Setup
+
+### Creating The Application
+
+1. Navigate to the Application management section of your Auth0 dashboard at `https://manage.auth0.com/dashboard/us/{{auth0_account_name}}/applications`
+2. Click the **_Create Application_** button in the top right of the page.
+3. Either provide a name for this application or use the default, then select **_Regular Web Application_** as the application type and click the blue **_Create_** button.
+   <kbd>
+   <img src="assets/openid-connect/auth0/create-application.png" />
+   </kbd>
+
+### Gather The Client ID
+
+1. Make note of the `Client ID` value. This value will be used in the Code-Server `openid-client-id` configuration variable.
+   <kbd>
+   <img src="assets/openid-connect/auth0/application-client-id.png" />
+   </kbd>
+
+### Update the application URLs
+
+1. Update the **_Allowed Callback URL_** and **_Allowed Logout URLs_** fields so that they point to the correct code-server endpoint.
+   <kbd>
+   <img src="assets/openid-connect/auth0/update-application.png" />
+   </kbd>
+
+### Example Auth0 Code-Server Configuration
+
+---
+
+**NOTE:** The `openid-issuer-base-url` should be set to the value of the **_Domain_** field of the Okta application.
+
+---
+
+```yml
+bind-addr: 127.0.0.1:8080
+cert: false
+
+auth: openid
+openid-issuer-base-url: "https://cdr.auth0.com"
+openid-client-id: "yg3IIz2alcikRqjqOsnRJABn8Uthfrtv"
+openid-base-url: "http://localhost:8080"
+openid-secret: "{prerequisites_openid-secret_value}"
+```
+
+## Okta OpenID Connect Application Setup
+
+### Creating The Application
+
+1. Navigate to the **_Add Application_** page of your Okta dashboard at `https://{{okta_account_name}}-admin.okta.com/admin/apps/add-app`
+2. Click the **_Create New App_** button located in the upper right of the page.
+3. Set the **_Platform_** to **_Web_** and **_Sign on method_** to **_OpenID Connect_**. Then click **_Create_**
+   <kbd>
+   <img src="assets/openid-connect/okta/create-application.png" />
+   </kbd>
+
+### Update The Application
+
+1. Update the **_Application name_** field with the desired name for this application.
+2. Update the **_Login redirect URIs_** and **_Logout redirect URIs (Optional)_** fields so that they point to the correct code-server endpoint then click **_Save_**
+   <kbd><img src="assets/openid-connect/okta/update-application.png"/></kbd>
+3. To update the **_Allowed grant types_** start by navigating to the **_General Settings_** section and clicking the **_Edit_** link in the top right corner of the section card.
+4. Once in the edit view, locate the **_Allowed grant types_** checkbox list and make sure the check the boxs for **_Implicit (Hybrid)_** and **_Allow ID Token with implicit grant type_** are checked, then scroll to the bottom of the page and click **_Save_**.
+   <kbd><img src="assets/openid-connect/okta/update-application-grants.png"/></kbd>
+5. Lastly, ensure a user is assigned to this application by navigating to the **_Assignments_** tab, clicking on **_Assign_**, then selecting **_Assign to People_**.
+   <kbd><img src="assets/openid-connect/okta/update-application-assignments.png"/></kbd>
+
+### Gather The Client ID
+
+1. Make note of the `Client ID` value. This value will be used in the Code-Server `openid-client-id` configuration variable.
+   <kbd>
+   <img src="assets/openid-connect/okta/application-client-id.png" />
+   </kbd>
+
+### Example Code-Server Configuration
+
+---
+
+**NOTE:** The `openid-issuer-base-url` should be set to the value of the **_Okta domain_** field of the Okta application.
+
+---
+
+```yml
+bind-addr: 127.0.0.1:8080
+cert: false
+
+auth: openid
+openid-issuer-base-url: "https://cdr.okta.com"
+openid-client-id: "0oal8azjyekLwJXan5d6"
+openid-base-url: "http://localhost:8080"
+openid-secret: "{prerequisites_openid-secret_value}"
+```
+
+## Keycloak OpenID Connect Client Setup
+
+### Creating The Client
+
+1. Once logged into the Keycloak instance, navigate to the **_Clients_** page by clicking the **_Clients_** link in the navigation menu on the left side of the page.
+2. Begin the client creation process by clicking the **_Create_** button located in the top right corner of the clint list.
+3. Fill out the client creation fields then click **_Save_** - **_Client ID_**: This is the value that will later be populated in `openid-client-id`. This value is entirely up the the user or process creating the client. - **_Client Protocol_**: This value should be set to **_openid-connect_** - **_Root URL_**: This field should be populated with the Code-Server base url.
+   <kbd>
+   <img src="assets/openid-connect/keycloak/create-client.png" />
+   </kbd>
+
+### Update The Client Name
+
+1. Once the **_Save_** button in the **_Add Client_** window has been clicked, the client will be created and the page will be redirected to the client settings view. From inside that view proceed to name the newly create client by populating the **_Name_** field.
+2. Enable implicit flow by changing **_Implicit Flow Enabled_** from **_OFF_** to **_ON_**.
+3. Scroll to the bottom of the page and click **_Save_**.
+   <kbd>
+   <img src="assets/openid-connect/keycloak/update-client.png" />
+   </kbd>
+
+### Example Code-Server Configuration
+
+---
+
+**NOTE:** The `openid-issuer-base-url` will depend on the Keycloak realm. In the example below the realm is called `master`.
+
+**NOTE:** The `openid-client-id` value should be set to the value given to the **_Client ID_** when the client was first created.
+
+---
+
+```yml
+bind-addr: 127.0.0.1:8080
+cert: false
+
+auth: openid
+openid-issuer-base-url: "https://keycloak.local/auth/realms/master/.well-known/openid-configuration"
+openid-client-id: "example-code-server"
+openid-base-url: "http://localhost:8080"
+openid-secret: "{prerequisites_openid-secret_value}"
+```

package.json

@@ -86,6 +86,7 @@
     "cookie-parser": "^1.4.5",
     "env-paths": "^2.2.0",
     "express": "^5.0.0-alpha.8",
+    "express-openid-connect": "^2.3.1",
     "http-proxy": "^1.18.0",
     "httpolyglot": "^0.1.2",
     "js-yaml": "^4.0.0",

src/node/app.ts

@@ -1,11 +1,12 @@
 import { logger } from "@coder/logger"
 import compression from "compression"
 import express, { Express } from "express"
+import { auth } from "express-openid-connect"
 import { promises as fs } from "fs"
 import http from "http"
 import * as httpolyglot from "httpolyglot"
 import * as util from "../common/util"
-import { DefaultedArgs } from "./cli"
+import { AuthType, DefaultedArgs } from "./cli"
 import { handleUpgrade } from "./wsRouter"
 
 /**
@@ -59,6 +60,19 @@ export const createApp = async (args: DefaultedArgs): Promise<[Express, Express,
   const wsApp = express()
   handleUpgrade(wsApp, server)
 
+  if (args.auth === AuthType.Openid) {
+    const openidConfig = {
+      authRequired: true,
+      auth0Logout: true,
+      issuerBaseURL: args["openid-issuer-base-url"],
+      clientID: args["openid-client-id"],
+      baseURL: args["openid-base-url"],
+      secret: args["openid-secret"],
+    }
+    app.use(auth(openidConfig))
+    wsApp.use(auth(openidConfig))
+  }
+
   return [app, wsApp, server]
 }
 

src/node/cli.ts

@@ -9,6 +9,7 @@ import { canConnect, generateCertificate, generatePassword, humanPath, paths } f
 export enum AuthType {
   Password = "password",
   None = "none",
+  Openid = "openid",
 }
 
 export class Optional<T> {
@@ -29,6 +30,12 @@ export interface Args extends VsArgs {
   config?: string
   auth?: AuthType
   password?: string
+  "openid-issuer-base-url"?: string
+  "openid-client-id"?: string
+  "openid-base-url"?: string
+  "openid-secret"?: string
+  "openid-group-claim"?: OptionalString
+  "openid-user-group"?: string
   "hashed-password"?: string
   cert?: OptionalString
   "cert-host"?: string
@@ -105,6 +112,30 @@ const options: Options<Required<Args>> = {
     type: "string",
     description: "The password for password authentication (can only be passed in via $PASSWORD or the config file).",
   },
+  "openid-issuer-base-url": {
+    type: "string",
+    description: "The base url for providers .well-known endpoint",
+  },
+  "openid-client-id": {
+    type: "string",
+    description: "The client ID of this OpenID application",
+  },
+  "openid-base-url": {
+    type: "string",
+    description: "The base URL for code-server",
+  },
+  "openid-secret": {
+    type: "string",
+    description: "A long secret used to encrypt the session cookie",
+  },
+  "openid-group-claim": {
+    type: OptionalString,
+    description: "A claim that contains the authenticated users group assignments",
+  },
+  "openid-user-group": {
+    type: "string",
+    description: "The group that a user will need to be a member of to access this instance",
+  },
   "hashed-password": {
     type: "string",
     description:

src/node/http.ts

@@ -1,5 +1,6 @@
 import { field, logger } from "@coder/logger"
 import * as express from "express"
+import { RequestContext } from "express-openid-connect"
 import * as expressCore from "express-serve-static-core"
 import qs from "qs"
 import safeCompare from "safe-compare"
@@ -16,6 +17,7 @@ declare global {
     export interface Request {
       args: DefaultedArgs
       heart: Heart
+      oidc: RequestContext
     }
   }
 }
@@ -69,6 +71,39 @@ export const authenticated = (req: express.Request): boolean => {
           ? safeCompare(req.cookies.key, req.args["hashed-password"])
           : req.args.password && safeCompare(req.cookies.key, hash(req.args.password)))
       )
+    case AuthType.Openid:
+      if (req.oidc.isAuthenticated()) {
+        logger.debug("User authenticated with OpenID Connect", field("user", req.oidc.user))
+
+        // Check to see if a group claim was specified.
+        // If there was no group claim specified the user will be considered authorized.
+        if (!req.args["openid-group-claim"]) {
+          return true
+        }
+
+        // With the user authenticated we need to check the group claims to make sure they're authorized.
+        for (const key in req.oidc.idTokenClaims) {
+          const claims = <string[]>req.oidc.idTokenClaims[key]
+          if (key === req.args["openid-group-claim"] && req.args["openid-group-claim"].value) {
+            for (const value in claims) {
+              if (req.args["openid-user-group"] === claims[value]) {
+                logger.debug("User authorized", field("user", req.oidc.user))
+                return true
+              }
+            }
+          }
+        }
+
+        // Throw an error informing the user that they're unauthorized.
+        logger.debug("User not authorized", field("user", req.oidc.user))
+        throw new HttpError("Unauthorized", HttpCode.Unauthorized)
+      }
+
+      // Returning false means the user isn't authenticated.
+      // This should trigger a redirect so the user can get authenticated.
+      logger.debug("User not authenticated using OpenID Connect", field("user", req.oidc.user))
+      return false
+
     default:
       throw new Error(`Unsupported auth type ${req.args.auth}`)
   }

test/unit/cli.test.ts

@@ -200,7 +200,7 @@ describe("parser", () => {
 
   it("should error if value is invalid", () => {
     expect(() => parse(["--port", "foo"])).toThrowError(/--port must be a number/)
-    expect(() => parse(["--auth", "invalid"])).toThrowError(/--auth valid values: \[password, none\]/)
+    expect(() => parse(["--auth", "invalid"])).toThrowError(/--auth valid values: \[password, none, openid\]/)
     expect(() => parse(["--log", "invalid"])).toThrowError(/--log valid values: \[trace, debug, info, warn, error\]/)
   })