Merge pull request #556 from MaienM/oidc-claims-and-roles

Implement settings for OIDC claims & roles

Author: madeofpendletonwool

clients/clientapi.py

@@ -3586,6 +3586,12 @@ class OIDCProviderValues(BaseModel):
     button_color: Optional[str] = "#000000"
     button_text_color: Optional[str] = "#000000"
     icon_svg: Optional[str] = None
+    name_claim: Optional[str] = None
+    email_claim: Optional[str] = None
+    username_claim: Optional[str] = None
+    roles_claim: Optional[str] = None
+    user_role: Optional[str] = None
+    admin_role: Optional[str] = None
 
 @app.post("/api/data/add_oidc_provider")
 async def api_add_oidc_provider(
@@ -3605,7 +3611,13 @@ async def api_add_oidc_provider(
             provider_values.scope,
             provider_values.button_color,
             provider_values.button_text_color,
-            provider_values.icon_svg
+            provider_values.icon_svg,
+            provider_values.name_claim,
+            provider_values.email_claim,
+            provider_values.username_claim,
+            provider_values.roles_claim,
+            provider_values.user_role,
+            provider_values.admin_role
         ))
         if not provider_id:
             raise HTTPException(
@@ -6434,7 +6446,7 @@ async def oidc_callback(
             )
 
         # Unpack provider details
-        provider_id, client_id, client_secret, token_url, userinfo_url = provider
+        provider_id, client_id, client_secret, token_url, userinfo_url, name_claim, email_claim, username_claim, roles_claim, user_role, admin_role = provider
 
         # Exchange authorization code for access token
         async with httpx.AsyncClient() as client:
@@ -6479,7 +6491,7 @@ async def oidc_callback(
 
                 user_info = userinfo_response.json()
                 print(f"User info response: {user_info}")
-                email = user_info.get("email")
+                email = user_info.get(email_claim or "email")
 
                 parsed_url = urlparse(userinfo_url)
                 if not email and parsed_url.hostname == 'api.github.com':
@@ -6515,23 +6527,87 @@ async def oidc_callback(
                     url=f"{frontend_base}/oauth/callback?error=network_error"
                 )
 
+            # Verify access.
+            if roles_claim and user_role:
+                roles = user_info.get(roles_claim)
+                if not isinstance(roles, list):
+                    print(f'Claim {roles_claim} should be a list of strings, but it is {roles}.')
+                    return RedirectResponse(
+                        url=f"{frontend_base}/oauth/callback?error=no_access&details=invalid_roles"
+                    )
+                if user_role not in roles and not (admin_role and admin_role in roles):
+                    print(f"User user role {user_role} {f'and admin role {admin_role}' if admin_role else ''} not in user's roles ({roles}), denying access.")
+                    return RedirectResponse(
+                        url=f"{frontend_base}/oauth/callback?error=no_access"
+                    )
+
             # Check if user exists
             user = database_functions.functions.get_user_by_email(cnx, database_type, email)
 
             # In your OIDC callback function, replace the user creation section with:
 
+            # Determine the user's information
+            fullname = user_info.get(name_claim or "name", "")
+            if username_claim and username_claim not in user_info:
+                print(f"Unable to determine username for user, username claim {username_claim} not present")
+                return RedirectResponse(
+                    url=f"{frontend_base}/oauth/callback?error=user_creation_failed&details=username_claim_missing"
+                )
+            username = user_info.get(username_claim or "preferred_username")
+
             if not user:
                 # Create new user
                 print(f"User with email {email} not found, creating new user")
-                fullname = user_info.get("name", "")
-                username = email.split("@")[0].lower()
-                base_username = username
-                counter = 1
-                max_attempts = 10
 
-                while counter <= max_attempts:
+                if username is None:
+                    username = email.split("@")[0].lower()
+                    base_username = username
+                    counter = 1
+                    max_attempts = 10
+
+                    while counter <= max_attempts:
+                        try:
+                            print(f"Attempt {counter} to create user with base username: {base_username}")
+                            user_id = database_functions.functions.create_oidc_user(
+                                cnx, database_type, email, fullname, username
+                            )
+                            print(f"User created successfully with ID: {user_id}")
+
+                            if not user_id:
+                                print(f"ERROR: Invalid user_id returned: {user_id}")
+                                return RedirectResponse(
+                                    url=f"{frontend_base}/oauth/callback?error=invalid_user_id"
+                                )
+
+                            print(f"Creating API key for user_id: {user_id}")
+                            api_key = database_functions.functions.create_api_key(cnx, database_type, user_id)
+                            print(f"API key created: {api_key[:5]}... (truncated for security)")
+                            break
+                        except UniqueViolation:
+                            print(f"Username conflict with {username}, trying next variation")
+                            username = f"{base_username}{counter}"
+                            counter += 1
+                            if counter > max_attempts:
+                                print(f"Failed to create user after {max_attempts} attempts due to username conflicts")
+                                return RedirectResponse(
+                                    url=f"{frontend_base}/oauth/callback?error=username_conflict"
+                                )
+                        except Exception as e:
+                            print(f"Error during user creation: {str(e)}")
+                            import traceback
+                            print(f"Traceback: {traceback.format_exc()}")
+                            return RedirectResponse(
+                                url=f"{frontend_base}/oauth/callback?error=user_creation_failed&details={str(e)[:50]}"
+                            )
+                    else:
+                        print("Failed to create user after maximum attempts")
+                        return RedirectResponse(
+                            url=f"{frontend_base}/oauth/callback?error=user_creation_failed"
+                        )
+
+                else:
                     try:
-                        print(f"Attempt {counter} to create user with base username: {base_username}")
+                        print(f"Attempt to create user with username: {username}")
                         user_id = database_functions.functions.create_oidc_user(
                             cnx, database_type, email, fullname, username
                         )
@@ -6546,28 +6622,18 @@ async def oidc_callback(
                         print(f"Creating API key for user_id: {user_id}")
                         api_key = database_functions.functions.create_api_key(cnx, database_type, user_id)
                         print(f"API key created: {api_key[:5]}... (truncated for security)")
-                        break
                     except UniqueViolation:
-                        print(f"Username conflict with {username}, trying next variation")
-                        username = f"{base_username}{counter}"
-                        counter += 1
-                        if counter > max_attempts:
-                            print(f"Failed to create user after {max_attempts} attempts due to username conflicts")
-                            return RedirectResponse(
-                                url=f"{frontend_base}/oauth/callback?error=username_conflict"
-                            )
+                        print("Failed to create user due to username conflicts")
+                        return RedirectResponse(
+                            url=f"{frontend_base}/oauth/callback?error=username_conflict"
+                        )
                     except Exception as e:
                         print(f"Error during user creation: {str(e)}")
                         import traceback
                         print(f"Traceback: {traceback.format_exc()}")
                         return RedirectResponse(
                             url=f"{frontend_base}/oauth/callback?error=user_creation_failed&details={str(e)[:50]}"
                         )
-                else:
-                    print("Failed to create user after maximum attempts")
-                    return RedirectResponse(
-                        url=f"{frontend_base}/oauth/callback?error=user_creation_failed"
-                    )
 
             else:
                 # Existing user - retrieve their API key
@@ -6581,6 +6647,26 @@ async def oidc_callback(
 
                 print(f"API key retrieved: {api_key[:5]}... (truncated for security)")
 
+                # Update user info based on OIDC information.
+                database_functions.functions.set_fullname(cnx, database_type, user_id, fullname)
+
+                current_username = user[2] if isinstance(user, tuple) else user['username']
+                if username_claim and username != current_username:
+                    if database_functions.functions.check_usernames(cnx, database_type, username):
+                        print(f'Unable to update username for user {user_id} to match the username specified by the OIDC provider ({username}) as this is already in use by another user.')
+                    else:
+                        database_functions.functions.set_username(cnx, database_type, user_id, username)
+
+            # Update admin role based on OIDC roles.
+            if roles_claim and admin_role:
+                roles = user_info.get(roles_claim)
+                if not isinstance(roles, list):
+                    print(f'Claim {roles_claim} should be a list of strings, but it is {roles}.')
+                    return RedirectResponse(
+                        url=f"{frontend_base}/oauth/callback?error=no_access&details=invalid_roles"
+                    )
+                database_functions.functions.set_isadmin(cnx, database_type, user_id, admin_role in roles)
+
             # Success case - redirect with API key
             return RedirectResponse(url=f"{frontend_base}/oauth/callback?api_key={api_key}")
 

database_functions/functions.py

@@ -672,17 +672,21 @@ def add_oidc_provider(cnx, database_type, provider_values):
                 INSERT INTO "OIDCProviders"
                 (ProviderName, ClientID, ClientSecret, AuthorizationURL,
                 TokenURL, UserInfoURL, ButtonText, Scope,
-                ButtonColor, ButtonTextColor, IconSVG)
-                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+                ButtonColor, ButtonTextColor, IconSVG, NameClaim, EmailClaim,
+                UsernameClaim, RolesClaim, UserRole, AdminRole)
+                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s,
+                %s, %s, %s)
                 RETURNING ProviderID
             """
         else:  # MySQL
             add_provider_query = """
                 INSERT INTO OIDCProviders
                 (ProviderName, ClientID, ClientSecret, AuthorizationURL,
                 TokenURL, UserInfoURL, ButtonText, Scope,
-                ButtonColor, ButtonTextColor, IconSVG)
-                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+                ButtonColor, ButtonTextColor, IconSVG, NameClaim, EmailClaim,
+                UsernameClaim, RolesClaim, UserRole, AdminRole)
+                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s,
+                %s, %s, %s)
             """
         cursor.execute(add_provider_query, provider_values)
 
@@ -734,16 +738,18 @@ def list_oidc_providers(cnx, database_type):
         if database_type == "postgresql":
             list_query = """
                 SELECT ProviderID, ProviderName, ClientID, AuthorizationURL,
-                TokenURL, UserInfoURL, ButtonText,
-                Scope, ButtonColor, ButtonTextColor, IconSVG, Enabled, Created, Modified
+                TokenURL, UserInfoURL, ButtonText, Scope, ButtonColor,
+                ButtonTextColor, IconSVG, NameClaim, EmailClaim, UsernameClaim,
+                RolesClaim, UserRole, AdminRole, Enabled, Created, Modified
                 FROM "OIDCProviders"
                 ORDER BY ProviderName
             """
         else:
             list_query = """
                 SELECT ProviderID, ProviderName, ClientID, AuthorizationURL,
-                TokenURL, UserInfoURL, ButtonText,
-                Scope, ButtonColor, ButtonTextColor, IconSVG, Enabled, Created, Modified
+                TokenURL, UserInfoURL, ButtonText, Scope, ButtonColor,
+                ButtonTextColor, IconSVG, NameClaim, EmailClaim, UsernameClaim,
+                RolesClaim, UserRole, AdminRole, Enabled, Created, Modified
                 FROM OIDCProviders
                 ORDER BY ProviderName
             """
@@ -777,6 +783,18 @@ def list_oidc_providers(cnx, database_type):
                             normalized["button_text_color"] = value
                         elif normalized_key == "iconsvg":
                             normalized["icon_svg"] = value
+                        elif normalized_key == "nameclaim":
+                            normalized["name_claim"] = value
+                        elif normalized_key == "emailclaim":
+                            normalized["email_claim"] = value
+                        elif normalized_key == "usernameclaim":
+                            normalized["username_claim"] = value
+                        elif normalized_key == "rolesclaim":
+                            normalized["roles_claim"] = value
+                        elif normalized_key == "userrole":
+                            normalized["user_role"] = value
+                        elif normalized_key == "adminrole":
+                            normalized["admin_role"] = value
                         else:
                             normalized[normalized_key] = value
                     providers.append(normalized)
@@ -794,9 +812,15 @@ def list_oidc_providers(cnx, database_type):
                         'button_color': row[8],
                         'button_text_color': row[9],
                         'icon_svg': row[10],
-                        'enabled': row[11],
-                        'created': row[12],
-                        'modified': row[13]
+                        'name_claim': row[11],
+                        'email_claim': row[12],
+                        'username_claim': row[13],
+                        'roles_claim': row[14],
+                        'user_role': row[15],
+                        'admin_role': row[16],
+                        'enabled': row[17],
+                        'created': row[18],
+                        'modified': row[19]
                     })
         else:
             columns = [col[0] for col in cursor.description]
@@ -827,6 +851,18 @@ def list_oidc_providers(cnx, database_type):
                         normalized["button_text_color"] = value
                     elif normalized_key == "iconsvg":
                         normalized["icon_svg"] = value
+                    elif normalized_key == "nameclaim":
+                        normalized["name_claim"] = value
+                    elif normalized_key == "emailclaim":
+                        normalized["email_claim"] = value
+                    elif normalized_key == "usernameclaim":
+                        normalized["username_claim"] = value
+                    elif normalized_key == "rolesclaim":
+                        normalized["roles_claim"] = value
+                    elif normalized_key == "userrole":
+                        normalized["user_role"] = value
+                    elif normalized_key == "adminrole":
+                        normalized["admin_role"] = value
                     elif normalized_key == "enabled":
                         # Convert MySQL TINYINT to boolean
                         normalized["enabled"] = bool(value)
@@ -14664,13 +14700,13 @@ def get_oidc_provider(cnx, database_type, client_id):
     try:
         if database_type == "postgresql":
             query = """
-                SELECT ProviderID, ClientID, ClientSecret, TokenURL, UserInfoURL
+                SELECT ProviderID, ClientID, ClientSecret, TokenURL, UserInfoURL, NameClaim, EmailClaim, UsernameClaim, RolesClaim, UserRole, AdminRole
                 FROM "OIDCProviders"
                 WHERE ClientID = %s AND Enabled = true
             """
         else:
             query = """
-                SELECT ProviderID, ClientID, ClientSecret, TokenURL, UserInfoURL
+                SELECT ProviderID, ClientID, ClientSecret, TokenURL, UserInfoURL, NameClaim, EmailClaim, UsernameClaim, RolesClaim, UserRole, AdminRole
                 FROM OIDCProviders
                 WHERE ClientID = %s AND Enabled = true
             """
@@ -14683,7 +14719,13 @@ def get_oidc_provider(cnx, database_type, client_id):
                     result['clientid'],
                     result['clientsecret'],
                     result['tokenurl'],
-                    result['userinfourl']
+                    result['userinfourl'],
+                    result['nameclaim'],
+                    result['emailclaim'],
+                    result['usernameclaim'],
+                    result['rolesclaim'],
+                    result['userrole'],
+                    result['adminrole']
                 )
             return result
         return None
@@ -14721,49 +14763,10 @@ def get_user_by_email(cnx, database_type, email):
     finally:
         cursor.close()
 
-def create_oidc_user(cnx, database_type, email, fullname, base_username):
+def create_oidc_user(cnx, database_type, email, fullname, username):
     cursor = cnx.cursor()
     try:
-        print(f"Starting create_oidc_user for email: {email}, fullname: {fullname}, base_username: {base_username}")
-        # Check if username exists and find a unique one
-        username = base_username
-        counter = 1
-        while True:
-            # Check if username exists
-            check_query = """
-                SELECT COUNT(*) FROM "Users" WHERE Username = %s
-            """ if database_type == "postgresql" else """
-                SELECT COUNT(*) FROM Users WHERE Username = %s
-            """
-            print(f"Checking if username '{username}' exists")
-            cursor.execute(check_query, (username,))
-            result = cursor.fetchone()
-            print(f"Username check result: {result}, type: {type(result)}")
-
-            count = 0
-            if isinstance(result, tuple):
-                count = result[0]
-            elif isinstance(result, dict):
-                count = result.get('count', 0)
-            else:
-                # Try to extract the count value safely
-                try:
-                    count = int(result)
-                except (TypeError, ValueError):
-                    print(f"Unable to extract count from result: {result}")
-                    count = 1  # Assume username exists to be safe
-
-            print(f"Username count: {count}")
-            if count == 0:
-                print(f"Username '{username}' is unique, proceeding")
-                break  # Username is unique
-
-            # Try with incremented counter
-            print(f"Username '{username}' already exists, trying next")
-            username = f"{base_username}{counter}"
-            counter += 1
-            if counter > 10:  # Limit attempts
-                raise Exception("Could not find a unique username")
+        print(f"Starting create_oidc_user for email: {email}, fullname: {fullname}, username: {username}")
 
         # Create a random salt using base64 (which is what Argon2 expects)
         salt = base64.b64encode(secrets.token_bytes(16)).decode('utf-8')