Merge pull request #8 from georgmangold/fix-oidc

fix: Added Console Login with OIDC

Author: georgmangold

api/config.go

@@ -299,3 +299,32 @@ func getConsoleDevMode() bool {
 func getConsoleBrowserRedirectURL() string {
 	return env.Get(ConsoleBrowserRedirectURL, "")
 }
+
+func BuildOpenIDConsoleConfig() oauth2.OpenIDPCfg {
+	pcfg := map[string]oauth2.ProviderConfig{}
+
+	url := env.Get(ConsoleIDPURL, env.Get(MinioIdentifyOpenIDConfigURL, ""))
+	clientID := env.Get(ConsoleIDPClientID, env.Get(MinioIdentifyOpenIDClientID, ""))
+	clientSecret := env.Get(ConsoleIDPSecret, env.Get(MinioIdentifyOpenIDClientSecret, ""))
+	redirectCallback := env.Get(ConsoleIDPCallbackURL, env.Get(MinioBrowserRedirectURL, ""))
+
+	// Only set config if url, clientID, clientSecret and redirectCallback are provided
+	if url != "" && clientID != "" && clientSecret != "" && redirectCallback != "" {
+		pcfg = map[string]oauth2.ProviderConfig{
+			"OIDC": {
+				URL:                     url,
+				ClientID:                clientID,
+				ClientSecret:            clientSecret,
+				RedirectCallback:        redirectCallback,
+				DisplayName:             env.Get(ConsoleIDPDisplayName, env.Get(MinioIdentifyOpenIDDisplayName, "")),
+				Scopes:                  env.Get(ConsoleIDPScopes, env.Get(MinioIdentifyOpenIDScopes, "openid,profile,email")),
+				Userinfo:                env.Get(ConsoleIDPUserInfo, env.Get(MinioIdentifyOpenIDClaimUserinfo, "")) == "on",
+				RedirectCallbackDynamic: env.Get(ConsoleIDPCallbackURLDynamic, env.Get(MinioIdentifyOpenIDRedirectURIDynamic, "")) == "on",
+				RoleArn:                 env.Get(ConsoleIDPRolePolicy, env.Get(MinioIdentifyOpenIDRolePolicy, "")),
+				EndSessionEndpoint:      env.Get(ConsoleIDPEndSessionEndpoint, ""),
+			},
+		}
+	}
+
+	return pcfg
+}

api/consts.go

@@ -59,4 +59,26 @@ const (
 	LogSearchQueryAuthToken                      = "LOGSEARCH_QUERY_AUTH_TOKEN"
 	SlashSeparator                               = "/"
 	LocalAddress                                 = "127.0.0.1"
+
+	// Parts of Environment constants for console OIDC/ IDP/SSO as defined in pkg/auth/idp/oath2
+	ConsoleIDPDisplayName        = "CONSOLE_IDP_DISPLAY_NAME"
+	ConsoleIDPURL                = "CONSOLE_IDP_URL"
+	ConsoleIDPClientID           = "CONSOLE_IDP_CLIENT_ID"
+	ConsoleIDPSecret             = "CONSOLE_IDP_SECRET"
+	ConsoleIDPCallbackURL        = "CONSOLE_IDP_CALLBACK"
+	ConsoleIDPCallbackURLDynamic = "CONSOLE_IDP_CALLBACK_DYNAMIC"
+	ConsoleIDPScopes             = "CONSOLE_IDP_SCOPES"
+	ConsoleIDPUserInfo           = "CONSOLE_IDP_USERINFO"
+	ConsoleIDPRolePolicy         = "CONSOLE_IDP_ROLE_POLICY"
+	ConsoleIDPEndSessionEndpoint = "CONSOLE_IDP_END_SESSION_ENDPOINT"
+	// MinIO Server constants for OIDC
+	MinioIdentifyOpenIDDisplayName        = "MINIO_IDENTITY_OPENID_DISPLAY_NAME"
+	MinioIdentifyOpenIDConfigURL          = "MINIO_IDENTITY_OPENID_CONFIG_URL"
+	MinioIdentifyOpenIDClientID           = "MINIO_IDENTITY_OPENID_CLIENT_ID"
+	MinioIdentifyOpenIDClientSecret       = "MINIO_IDENTITY_OPENID_CLIENT_SECRET"
+	MinioBrowserRedirectURL               = "MINIO_BROWSER_REDIRECT_URL"
+	MinioIdentifyOpenIDRedirectURIDynamic = "MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC"
+	MinioIdentifyOpenIDScopes             = "MINIO_IDENTITY_OPENID_SCOPES"
+	MinioIdentifyOpenIDClaimUserinfo      = "MINIO_IDENTITY_OPENID_CLAIM_USERINFO"
+	MinioIdentifyOpenIDRolePolicy         = "MINIO_IDENTITY_OPENID_ROLE_POLICY"
 )

cmd/console/server.go

@@ -100,6 +100,11 @@ func buildServer() (*api.Server, error) {
 
 	consoleAPI := operations.NewConsoleAPI(swaggerSpec)
 	consoleAPI.Logger = api.LogInfo
+	// Pass in console application config. This needs to happen before the
+	// ConfigureAPI() call.
+	api.GlobalMinIOConfig = api.MinIOConfig{
+		OpenIDProviders: api.BuildOpenIDConsoleConfig(),
+	}
 	server := api.NewServer(consoleAPI)
 
 	parser := flags.NewParser(server, flags.Default)

docs/OIDC.md

@@ -0,0 +1,33 @@
+# OIDC
+When the console is running separately and is not embedded in the same binary as the server, the OIDC SSO login configuration is not set from the server.
+
+It needs to be configured using Environment Variables like this:
+``` bash
+export CONSOLE_MINIO_SERVER="http://127.0.0.1:9000";
+
+export CONSOLE_IDP_URL="http://PROVIDER:5556/.well-known/openid-configuration";
+export CONSOLE_IDP_CLIENT_ID="minio-client-app";
+export CONSOLE_IDP_SECRET="minio-client-app-secret";
+export CONSOLE_IDP_CALLBACK="http://CONSOLE:9090/oauth_callback";
+export CONSOLE_IDP_DISPLAY_NAME="Login with OIDC";
+
+./console server
+```
+> [!IMPORTANT]  
+> Currently, the following environment variables are mandatory: `CONSOLE_IDP_URL`, `CONSOLE_IDP_CLIENT_ID`, `CONSOLE_IDP_SECRET` and `CONSOLE_IDP_CALLBACK`.
+
+For convenience, the same environment variables are supported as for the server, with the `CONSOLE_` ones taking precedence over the `MINIO_` ones.  
+This means you can use the same variables as you would set on the server and share them with the console.  
+
+| Console Environment Variables | MinIO Server Environment Variables | Required | Example |
+| -- | -- | -- | -- |
+CONSOLE_IDP_DISPLAY_NAME | MINIO_IDENTITY_OPENID_DISPLAY_NAME | | "Login with OIDC"
+CONSOLE_IDP_URL | MINIO_IDENTITY_OPENID_CONFIG_URL | ✓ | https://provider/.well-known/openid-configuration"
+CONSOLE_IDP_CLIENT_ID | MINIO_IDENTITY_OPENID_CLIENT_ID | ✓ | minio-client-app
+CONSOLE_IDP_SECRET | MINIO_IDENTITY_OPENID_CLIENT_SECRET | ✓ | minio-client-app-secret
+CONSOLE_IDP_CALLBACK | MINIO_BROWSER_REDIRECT_URL | ✓ | https://console/oauth_callback" |
+CONSOLE_IDP_CALLBACK_DYNAMIC | MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC | | on / off |
+CONSOLE_IDP_SCOPES | MINIO_IDENTITY_OPENID_SCOPES | | "openid,profile,email" 
+CONSOLE_IDP_USERINFO | MINIO_IDENTITY_OPENID_CLAIM_USERINFO | |on / off |
+CONSOLE_IDP_ROLE_POLICY | MINIO_IDENTITY_OPENID_ROLE_POLICY | | "app-bucket-write,app-bucket-list" |
+CONSOLE_IDP_END_SESSION_ENDPOINT | | |