Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable PKCE Support #80

Closed
wants to merge 1 commit into from
+22 −0
Closed

Enable PKCE Support #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions config/settings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,6 @@ discourse_openid_connect:
textarea: true
openid_connect_match_by_email:
default: true
openid_connect_use_pkce:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'll need a description for this in server.en.yml

default: true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting this true by default could break existing installations which are incompatible with PKCE. We should make it false by default.

Suggested change
default: true
default: false

Perhaps in future we could explore making it 'default true for new installations only'... but that can be a separate PR

client: true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
client: true

The JS app does not need this site setting

18 changes: 18 additions & 0 deletions lib/openid_connect_authenticator.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
# frozen_string_literal: true
require 'base64'
require 'openssl'

class OpenIDConnectAuthenticator < Auth::ManagedAuthenticator
def name
Expand Down Expand Up @@ -107,6 +109,12 @@ def register_middleware(omniauth)
passthrough_authorize_options:
SiteSetting.openid_connect_authorize_parameters.split("|"),
claims: SiteSetting.openid_connect_claims,
pkce: SiteSetting.openid_connect_use_pkce,
pkce_options: {
code_verifier: -> { generate_code_verifier },
code_challenge: -> (code_verifier) { generate_code_challenge(code_verifier) },
code_challenge_method: 'S256'
}
)

opts[:client_options][:connection_opts] = {
Expand All @@ -128,6 +136,16 @@ def register_middleware(omniauth)
}
end

def generate_code_verifier
Base64.urlsafe_encode64(OpenSSL::Random.random_bytes(32)).tr('=', '')
end

def generate_code_challenge(code_verifier)
Base64.urlsafe_encode64(
Digest::SHA256.digest(code_verifier)
).tr('+/', '-_').tr('=', '')
end

def request_timeout_seconds
GlobalSetting.openid_connect_request_timeout_seconds
end
Expand Down
1 change: 1 addition & 0 deletions plugin.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
# url: https://github.com/discourse/discourse-openid-connect

enabled_site_setting :openid_connect_enabled
enabled_site_setting :openid_connect_use_pkce
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

enabled_site_setting means "when this site setting is disabled, turn off all plugin functionality". Each plugin can only have one. We definitely don't want the PKCE one here.

Suggested change
enabled_site_setting :openid_connect_use_pkce


require_relative "lib/openid_connect_faraday_formatter"
require_relative "lib/omniauth_open_id_connect"
Expand Down