8000 Allow override of baseUrl and apiUrl in GitHub identity provider by nngo · Pull Request #7021 · keycloak/keycloak · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Allow override of baseUrl and apiUrl in GitHub identity provider #7021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 6, 2022
Merged

Allow override of baseUrl and apiUrl in GitHub identity provider #7021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2aa5c0d
KEYCLOAK-13828 Allow override of baseUrl & apiUrl in GitHub identity …
nngo Apr 28, 2020
81cc80f
Remove empty testGetProfileEndpointForValidation() unit test
nngo Jan 10, 2022
7908204
Always show GH baseUrl and apiUrl per PR comment
nngo Jan 10, 2022
de8d3c2
Merge remote-tracking branch 'origin/main' into KEYCLOAK-13828-github…
nngo Jan 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 76 additions & 17 deletions services/src/main/java/org/keycloak/social/github/GitHubIdentityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,18 +35,79 @@
*/
public class GitHubIdentityProvider extends AbstractOAuth2IdentityProvider implements SocialIdentityProvider {

public static final String AUTH_URL = "https://github.com/login/oauth/authorize";
public static final String TOKEN_URL = "https://github.com/login/oauth/access_token";
public static final String PROFILE_URL = "https://api.github.com/user";
public static final String EMAIL_URL = "https://api.github.com/user/emails";
public static final String DEFAULT_SCOPE = "user:email";

public GitHubIdentityProvider(KeycloakSession session, OAuth2IdentityProviderConfig config) {
super(session, config);
config.setAuthorizationUrl(AUTH_URL);
config.setTokenUrl(TOKEN_URL);
config.setUserInfoUrl(PROFILE_URL);
}
public static final String DEFAULT_BASE_URL = "https://github.com";
public static final String AUTH_FRAGMENT = "/login/oauth/authorize";
public static final String TOKEN_FRAGMENT = "/login/oauth/access_token";
public static final String DEFAULT_AUTH_URL = DEFAULT_BASE_URL + AUTH_FRAGMENT;
public static final String DEFAULT_TOKEN_URL = DEFAULT_BASE_URL + TOKEN_FRAGMENT;
/** @deprecated Use {@link #DEFAULT_AUTH_URL} instead. */
@Deprecated
public static final String AUTH_URL = DEFAULT_AUTH_URL;
/** @deprecated Use {@link #DEFAULT_TOKEN_URL} instead. */
@Deprecated
public static final String TOKEN_URL = DEFAULT_TOKEN_URL;

public static final String DEFAULT_API_URL = "https://api.github.com";
public static final String PROFILE_FRAGMENT = "/user";
public static final String EMAIL_FRAGMENT = "/user/emails";
public static final String DEFAULT_PROFILE_URL = DEFAULT_API_URL + PROFILE_FRAGMENT;
public static final String DEFAULT_EMAIL_URL = DEFAULT_API_URL + EMAIL_FRAGMENT;
/** @deprecated Use {@link #DEFAULT_PROFILE_URL} instead. */
@Deprecated
public static final String PROFILE_URL = DEFAULT_PROFILE_URL;
/** @deprecated Use {@link #DEFAULT_EMAIL_URL} instead. */
@Deprecated
public static final String EMAIL_URL = DEFAULT_EMAIL_URL;

public static final String DEFAULT_SCOPE = "user:email";

/** Base URL key in config map. */
protected static final String BASE_URL_KEY = "baseUrl";
/** API URL key in config map. */
protected static final String API_URL_KEY = "apiUrl";
/** Email URL key in config map. */
protected static final String EMAIL_URL_KEY = "emailUrl";

private final String authUrl;
private final String tokenUrl;
private final String profileUrl;
private final String emailUrl;

public GitHubIdentityProvider(KeycloakSession session, OAuth2IdentityProviderConfig config) {
super(session, config);

String baseUrl = getUrlFromConfig(config, BASE_URL_KEY, DEFAULT_BASE_URL);
String apiUrl = getUrlFromConfig(config, API_URL_KEY, DEFAULT_API_URL);

authUrl = baseUrl + AUTH_FRAGMENT;
tokenUrl = baseUrl + TOKEN_FRAGMENT;
profileUrl = apiUrl + PROFILE_FRAGMENT;
emailUrl = apiUrl + EMAIL_FRAGMENT;

config.setAuthorizationUrl(authUrl);
config.setTokenUrl(tokenUrl);
config.setUserInfoUrl(profileUrl);
config.getConfig().put(EMAIL_URL_KEY, emailUrl);
}

/**
* Get URL from config with default value fallback.
*
* @param config Identity provider configuration.
* @param key Key to look for value in config's config map.
* @param defaultValue Default value if value at key is null or empty string.
* @return URL for specified key in the configuration with default value fallback.
*/
protected static String getUrlFromConfig(OAuth2IdentityProviderConfig config, String key, String defaultValue) {
String url = config.getConfig().get(key);
if (url == null || url.trim().isEmpty()) {
url = defaultValue;
}
if (url.endsWith("/")) {
url = url.substring(0, url.length() - 1);
}
return url;
}

@Override
protected boolean supportsExternalExchange() {
Expand All @@ -55,7 +116,7 @@ protected boolean supportsExternalExchange() {

@Override
protected String getProfileEndpointForValidation(EventBuilder event) {
return PROFILE_URL;
return profileUrl;
}

@Override
Expand All @@ -72,14 +133,12 @@ protected BrokeredIdentityContext extractIdentityFromProfile(EventBuilder event,
AbstractJsonUserAttributeMapper.storeUserProfileForMapper(user, profile, getConfig().getAlias());

return user;

}


@Override
protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
try {
JsonNode profile = SimpleHttp.doGet(PROFILE_URL, session).header("Authorization", "Bearer " + accessToken).asJson();
JsonNode profile = SimpleHttp.doGet(profileUrl, session).header("Authorization", "Bearer " + accessToken).asJson();

BrokeredIdentityContext user = extractIdentityFromProfile(null, profile);

Expand All @@ -95,7 +154,7 @@ protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {

private String searchEmail(String accessToken) {
try {
ArrayNode emails = (ArrayNode) SimpleHttp.doGet(EMAIL_URL, session).header("Authorization", "Bearer " + accessToken).asJson();
ArrayNode emails = (ArrayNode) SimpleHttp.doGet(emailUrl, session).header("Authorization", "Bearer " + accessToken).asJson();

Iterator<JsonNode> loop = emails.elements();
while (loop.hasNext()) {
Expand Down
67 changes: 67 additions & 0 deletions services/src/test/java/org/keycloak/social/github/GitHubIdentityProviderTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
/*
* Copyright 2020 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.keycloak.social.github;

import static org.junit.Assert.assertEquals;

import org.junit.Test;
import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;

/**
* Unit test for {@link org.keycloak.social.github.GitHubIdentityProvider}.
*
* @author Neon Ngo
*/
public class GitHubIdentityProviderTest {

/**
* Test constructor with empty config (i.e. to use default values).
* This also tests GitHubIdentityProvider.getProfileEndpointForValidation(null).
*/
@Test
public void testGitHubIdentityProvider() {
OAuth2IdentityProviderConfig config = new OAuth2IdentityProviderConfig();
GitHubIdentityProvider idp = new GitHubIdentityProvider(null, config);

validateUrls(idp, GitHubIdentityProvider.DEFAULT_BASE_URL, GitHubIdentityProvider.DEFAULT_API_URL);
}

/**
* Test constructor with config overrides of default base URL and API URL.
*/
@Test
public void testGitHubIdentityProviderOverrides() {
OAuth2IdentityProviderConfig config = new OAuth2IdentityProviderConfig();
String baseUrl = "https://test.com";
String apiUrl = "https://api.test.com";
config.getConfig().put(GitHubIdentityProvider.BASE_URL_KEY, baseUrl);
config.getConfig().put(GitHubIdentityProvider.API_URL_KEY, apiUrl);
GitHubIdentityProvider idp = new GitHubIdentityProvider(null, config);

validateUrls(idp, baseUrl, apiUrl);
}

protected void validateUrls(GitHubIdentityProvider idp, String baseUrl, String apiUrl) {
OAuth2IdentityProviderConfig config = idp.getConfig();
assertEquals(baseUrl + GitHubIdentityProvider.AUTH_FRAGMENT, config.getAuthorizationUrl());
assertEquals(baseUrl + GitHubIdentityProvider.TOKEN_FRAGMENT, config.getTokenUrl());
assertEquals(apiUrl + GitHubIdentityProvider.EMAIL_FRAGMENT, config.getConfig().get(GitHubIdentityProvider.EMAIL_URL_KEY));
assertEquals(apiUrl + GitHubIdentityProvider.PROFILE_FRAGMENT, config.getUserInfoUrl());
assertEquals(apiUrl + GitHubIdentityProvider.PROFILE_FRAGMENT, idp.getProfileEndpointForValidation(null));
}

}
4 changes: 4 additions & 0 deletions themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -654,6 +654,10 @@ redirect-uri.tooltip=The redirect uri to use when configuring the identity provi
alias=Alias
display-name=Display Name
identity-provider.alias.tooltip=The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
identity-provider.api-url=API URL
identity-provider.api-url.tooltip=Override the default API URL for this identity provider.
identity-provider.base-url=Base URL
identity-provider.base-url.tooltip=Override the default Base URL for this identity provider.
identity-provider.display-name.tooltip=Friendly name for Identity Providers.
identity-provider.enabled.tooltip=Enable/disable this identity provider.
authenticate-by-default=Authenticate by Default
Expand Down
14 changes: 14 additions & 0 deletions ...ain/resources/theme/base/admin/resources/partials/realm-identity-provider-github-ext.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
<div class="form-group clearfix block">
<label class="col-md-2 control-label" for="baseUrl">{{:: 'identity-provider.base-url' | translate}}</label>
<div class="col-md-6">
<input class="form-control" id="baseUrl" type="text" ng-model="identityProvider.config.baseUrl">
</div>
<kc-tooltip>{{:: 'identity-provider.base-url.tooltip' | translate}}</kc-tooltip>
</div>
<div class="form-group clearfix block">
<label class="col-md-2 control-label" for="apiUrl">{{:: 'identity-provider.api-url' | translate}}</label>
<div class="col-md-6">
<input class="form-control" id="apiUrl" type="text" ng-model="identityProvider.config.apiUrl">
</div>
<kc-tooltip>{{:: 'identity-provider.api-url.tooltip' | translate}}</kc-tooltip>
</div>
0