From 24b51b192fb12a0d8d8eb02674731d31576aae23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20G=C3=BCnther?= Date: Fri, 25 Jan 2019 16:43:51 +0100 Subject: [PATCH] Bump omniauth-saml in saml oauth --- Gemfile.lock | 15 ++-- Gemfile.modules | 3 +- modules/auth_saml/README.md | 64 ++++++++++++++++++ .../app/assets/images/auth_provider-saml.png | Bin 0 -> 17058 bytes .../auth_saml/lib/open_project/auth_saml.rb | 5 ++ .../lib/open_project/auth_saml/engine.rb | 48 +++++++++++++ .../lib/open_project/auth_saml/version.rb | 5 ++ .../auth_saml/lib/openproject-auth_saml.rb | 1 + .../auth_saml/openproject-auth_saml.gemspec | 20 ++++++ 9 files changed, 156 insertions(+), 5 deletions(-) create mode 100644 modules/auth_saml/README.md create mode 100644 modules/auth_saml/app/assets/images/auth_provider-saml.png create mode 100644 modules/auth_saml/lib/open_project/auth_saml.rb create mode 100644 modules/auth_saml/lib/open_project/auth_saml/engine.rb create mode 100644 modules/auth_saml/lib/open_project/auth_saml/version.rb create mode 100644 modules/auth_saml/lib/openproject-auth_saml.rb create mode 100644 modules/auth_saml/openproject-auth_saml.gemspec diff --git a/Gemfile.lock b/Gemfile.lock index f2fae008e5..b5e911b63b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -89,6 +89,12 @@ PATH openproject-auth_plugins (8.2.1) omniauth (~> 1.0) +PATH + remote: modules/auth_saml + specs: + openproject-auth_saml (8.2.1) + omniauth-saml (~> 1.10.1) + PATH remote: modules/avatars specs: @@ -543,9 +549,9 @@ GEM nokogiri (~> 1.8, >= 1.8.4) oj (3.7.8) okcomputer (1.17.3) - omniauth-saml (1.7.0) - omniauth (~> 1.3) - ruby-saml (~> 1.4) + omniauth-saml (1.10.1) + omniauth (~> 1.3, >= 1.3.2) + ruby-saml (~> 1.7) openid_connect (1.1.6) activemodel attr_required (>= 1.0.0) @@ -914,8 +920,9 @@ DEPENDENCIES omniauth! omniauth-openid-connect! omniauth-openid_connect-providers! - omniauth-saml (~> 1.7.0) + omniauth-saml (~> 1.10.1) openproject-auth_plugins! + openproject-auth_saml! openproject-avatars! openproject-backlogs! openproject-costs! diff --git a/Gemfile.modules b/Gemfile.modules index b0f5cfba29..acc6074b2a 100644 --- a/Gemfile.modules +++ b/Gemfile.modules @@ -2,7 +2,7 @@ # Defines OpenProject (CE) modules and their dependencies # the dependencies from the gemspec from a git repo are ignored # see also https://github.com/bundler/bundler/issues/1041 -gem 'omniauth-saml', '~> 1.7.0' +gem 'omniauth-saml', '~> 1.10.1' gem 'omniauth-openid_connect-providers', git: 'https://github.com/finnlabs/omniauth-openid_connect-providers.git', @@ -15,6 +15,7 @@ gem 'omniauth-openid-connect', group :opf_plugins do gem 'openproject-global_roles', path: 'modules/global_roles' gem 'openproject-auth_plugins', path: 'modules/auth_plugins' + gem 'openproject-auth_saml', path: 'modules/auth_saml' gem 'openproject-openid_connect', path: 'modules/openid_connect' gem 'openproject-documents', path: 'modules/documents' gem 'openproject-my_project_page', path: 'modules/my_project_page' diff --git a/modules/auth_saml/README.md b/modules/auth_saml/README.md new file mode 100644 index 0000000000..ba0287df6e --- /dev/null +++ b/modules/auth_saml/README.md @@ -0,0 +1,64 @@ +# OpenProject OmniAuth SAML Single-Sign On + +![](https://github.com/finnlabs/openproject-auth_saml/blob/dev/app/assets/images/auth_provider-saml.png) + +This plugin provides the [OmniAuth SAML strategy](https://github.com/omniauth/omniauth-saml) into OpenProject. + +## Installation + +Add the following entries to your `Gemfile.plugins` in your OpenProject root directory: + + gem 'openproject-auth_plugins', git: 'https://github.com/finnlabs/openproject-auth_plugins', branch: 'stable' + gem "openproject-auth_saml", git: 'https://github.com/finnlabs/openproject-auth_saml', branch: 'stable' + +## Requirements + +* [omniauth-saml gem](https://github.com/omniauth/omniauth-saml) >= 1.4.0 +* [OpenProject](https://www.openproject.org) >= 5.0 +* [openproject-auth_plugins](https://github.com/opf/openproject-auth_plugins) + +## Configuration + +To add your own SAML strategy provider(s), create the following settings file (relative to your OpenProject root): + + config/plugins/auth_saml/settings.yml + +with the following contents: + + your-provider-name: + name: "your-provider-name" + display_name: "My SAML provider" + # Use the default SAML icon + icon: "auth_provider-saml.png" + # omniauth-saml config + assertion_consumer_service_url: "consumer_service_url" + issuer: "issuer" + idp_sso_target_url: "idp_sso_target_url" + idp_cert_fingerprint: "E7:91:B2:E1:..." + attribute_statements: + email: ['mailPrimaryAddress'] + name: ['gecos'] + first_name: ['givenName'] + last_name: ['sn'] + admin: ['openproject-isadmin'] + +The plugin simply passes all options to omniauth-saml. See [their configuration +documentation](https://github.com/omniauth/omniauth-saml#usage) for further +details. + +### Custom Provider Icon + +To add a custom icon to be rendered as your omniauth provider icon, add an +image asset to OpenProject and reference it in your `settings.yml`: + + icon: "my/asset/path/to/icon.png" + +## Copyrights & License + +OpenProject SAML Auth is completely free and open source and released under the +[MIT +License](https://github.com/finnlabs/openproject-auth_saml/blob/dev/LICENSE). + +Copyright (c) 2016 OpenProject GmbH + +The default provider icon is a combination of icons from [Font Awesome by Dave Gandy](http://fontawesome.io). diff --git a/modules/auth_saml/app/assets/images/auth_provider-saml.png b/modules/auth_saml/app/assets/images/auth_provider-saml.png new file mode 100644 index 0000000000000000000000000000000000000000..97158c63565ecc92e2e9f5d7d704762dc23ba40a GIT binary patch literal 17058 zcmeI4cU%+M7RLuHAi|%z-cSkxM_hPpA?AdROSa2K3gG0{~!>xhOD1 z6~gsr@nsSRNFa-V9TFsRq&EPtT@&OGKN?mMBH&1o)P<-$T}&j11TMs2I+x6qd%#g5 zpCknwki-k*Cq?s_0-`I&gq^@b1SGHuA|yz}QY9FL#x4zXN_Q7V<31%mPM@ec8h4l+d~NMSOWAejnMsU)NaNtq~BK?x+O(xzSH zvyLaMUWId7go+u5jOdt{_>S-`Z6iOhK%tE4RbbSrIo@fnZ^9Udn^i3-I zef4w%e3nqAkU%PqNCHK|pj;Zs2D=*ddUlo+%R?rXDUe~o97i_TQ*)0|fpCJ#A4-H3 zO1-5)7N~8zPKF}8w|;hrMQz(o4k?tduBcpypR1~KpLT9TT};<-+H&zA3Cz)^rs|Kg z%h5H?P7SnxZqz*rv^mfMY*2Sbh(+D!(%#yAiuwcUk&Ld=xLlU6RH=fbeAw5MgETmZ zL;@C_FLZPk3Ya7^tC&@wgZm^@pU%=4qtbUzydbdt+i`dU6s_{LG?IDD0DJNAtRrTP<=N#G!#2j-;ECKiVTv9R2*tY zHdM1-lQg@O#BlBvDK|6X34E(Gaa<@M*d~q(n-9v1<3a(!HgR0od{AB-7YYcr ziHXak>n&GUioDtykG#Wb-Yd}?dHj~vJyh}Y!J^V7_YYpp_dB+v!ul7#fIXLg3b&{e_upzg$hdO! zIpNC5WcMLFcC7iUXYaFY{dOkS9mxlc1yxC}l1HT!zq_NYZry5BS6BBq+w}ZWAZFg= z!ZN3#xeE+_lO>bHNwST(Ek}cY9CkfgoemY6{GuMGu_9lA*X%2qLom1Subn?%1B^%? zIJ6{J?PNRm#V14I9a{C>cO~ysNv{3t2c)Yt?tvulDSFb*@aixOytU zwp;n9=R)tQi`x&rae|Vk8H58VhGo|mjQB^v+{b-NMr&BjpvL$^u(#)^{mFB(k_?6! zr1a)I(mYmP+Pze)-kti%KpWHidh6qQQ7B+jlFtJV)~Lc>QyQI+*oOv7jt_6Fjw>&X zGx~jFk#T*Gt#L3;b(2z0OFoE1y41eN<`zR^Ov;G(8lOw^N%od9-Sd z-A4b_HIK$wm>l*mbYR%NNb1)Rto~FP_UOqe9&5{33zI~tjfKf7-tJ4ZjPD)nZ1S>< z`yS|(&9hr|0EUMl`6>jb79KAunh?DIeO>sXl@FSDkqy0@51B@CN2~gMi-1L<`pkIhsC1%ve%|`e|U)z7I zaMtPQ%J1If&bwlv2^t=3mNwaTO+{{acGUxxwDxe`y1SE--{wsO3vUkCe&UV&gBPL1 zORWsgpQkq$rc4;Jf?HhwG-u9J`q>|r81X7jMbJh_hG&Kc?YkNh5)$>KWi{>CZeUa5 zA~T!t7GJW9i z(jPgpJvBS|W(I$_hjU7=2S3Vr-0RsO&43sDV`uzok7lU$-k8i9k&(n}t=Y`%RdWBn z;Czjpo!!a#EmYvhks}r>rVPJrHEP4wt-l+LYPs>l#35@=dOTx3ZxWo}!Tsnx)%e57 zIokEAIokIRgKEm$`lbK5<96K9qRiAv9?{Rw&r<8{<+XN;=i1uFMq+{Fp7ZZzTEkR; z&*!hq%9;Q-5u}HfQ}+gr|E;D*mTIJN{;oh0@M~ZoH9mZt8VL{FcQs?1%_`%Z+=0sq z=ZEYK%RhYL#2(X<(b<4B-HAdu1b=j9u_||ZX8{Q>@B3D9Z+bjQ&AiwA?1m$-@T}%L zHyaxpt4VRD>g?>nTU{6IH!bONb?hoP!ojAy_J(rz;pV2j4SO$g2iC1$A1}T-Df0*% zG2Ghv#ggW@jLb}F;eyupls8Eu%VYLjYYH4cc-E|0jIrzE3RMTj4(xwiaP(31xhUGy zV__F!tPp|3W{rDoae&)CHQj!B_JSE>Ryu*9BgR>Mw{Osy;tjbis*hWJ!n4Vom`2a4 zn)0%>3((2qGKOy?zn#b*-d2tDZ6Gk-qoono-Q7M$O zzXt3Mq(=AO`5cfnT3_7m&$G(#VkW)bGk$Efi5J&kf5TSkrEJ@4hZ5JBe^@$K>dM(Q zW8C?Xw^mQn+K4#^tdOm>anq)z+-0+A&Wv55|4QzcFe>X9u_<;$KtRCMTX&95T!EB7 zSI|0o!$pS@rY8ATEveaLM#Ml(cvJFO!IH4V>%nf>XZ9}av&AqESYQ-x6_Eh;UbK9u zT2ogM&MpPO%R6SB7^&9G65n-R+$=qqA9j0!n;KNtFEPF&xfI!Icw+f%o43saN|NpW zJoVJhO}+cXm~H0f&V{db9C&Xg|7f^?xxHcj?AQ4=Mt`gpvHNhG=l!F~?9%ScX}#Wt z)fJD=eP8poh4n|;Wzf4cGg-s=;g>V6xSFK60=N1e`BY;(fALA}r;%mbdI3`${Ep3jR= 5.0.0' + + assets %w( + auth_saml/** + auth_provider-saml.png + ) + + config.after_initialize do + # Automatically update the openproject user whenever their info change in the upstream identity provider + OpenProject::OmniAuth::Authorization.after_login do |user, auth_hash, context| + # see https://github.com/opf/openproject/blob/caa07c5dd470f82e1a76d2bd72d3d55b9d2b0b83/app/controllers/concerns/omniauth_login.rb#L148 + user.update_attributes context.send(:omniauth_hash_to_user_attributes, auth_hash) + end + end + + register_auth_providers do + settings = Rails.root.join('config', 'plugins', 'auth_saml', 'settings.yml') + if settings.exist? + providers = YAML::load(File.open(settings)).symbolize_keys + strategy :saml do + providers.values.map do |h| + h[:openproject_attribute_map] = Proc.new do |auth| + { + login: auth[:uid], + admin: (auth.info['admin'].to_s.downcase == "true") + } + end + h.symbolize_keys + end + end + else + Rails.logger.warn("[auth_saml] Missing settings from '#{settings}', skipping omniauth registration.") + end + end + end + end +end diff --git a/modules/auth_saml/lib/open_project/auth_saml/version.rb b/modules/auth_saml/lib/open_project/auth_saml/version.rb new file mode 100644 index 0000000000..86c0f40a73 --- /dev/null +++ b/modules/auth_saml/lib/open_project/auth_saml/version.rb @@ -0,0 +1,5 @@ +module OpenProject + module AuthSaml + VERSION = ::OpenProject::VERSION.to_semver + end +end diff --git a/modules/auth_saml/lib/openproject-auth_saml.rb b/modules/auth_saml/lib/openproject-auth_saml.rb new file mode 100644 index 0000000000..5c30b502dc --- /dev/null +++ b/modules/auth_saml/lib/openproject-auth_saml.rb @@ -0,0 +1 @@ +require 'open_project/auth_saml' diff --git a/modules/auth_saml/openproject-auth_saml.gemspec b/modules/auth_saml/openproject-auth_saml.gemspec new file mode 100644 index 0000000000..8fb3a6e462 --- /dev/null +++ b/modules/auth_saml/openproject-auth_saml.gemspec @@ -0,0 +1,20 @@ +# encoding: UTF-8 +$:.push File.expand_path("../lib", __FILE__) +$:.push File.expand_path("../../lib", __dir__) + +require 'open_project/auth_saml/version' +# Describe your gem and declare its dependencies: +Gem::Specification.new do |s| + s.name = 'openproject-auth_saml' + s.version = OpenProject::AuthSaml::VERSION + s.authors = 'Cyril Rohr' + s.email = 'cyril.rohr@gmail.com' + s.homepage = 'https://github.com/finnlabs/openproject-auth_saml' + s.summary = 'OmniAuth SAML / Single-Sign On' + s.description = 'Adds the OmniAuth SAML provider to OpenProject' + s.license = 'MIT' + + s.files = Dir['{app,lib}/**/*'] + %w(README.md) + + s.add_dependency 'omniauth-saml', '~> 1.10.1' +end