Compare commits

..
Author SHA1 Message Date
braginini 35656cd416 Rename getSilentAccessToken to accessToken for clarity 2022-08-20 20:21:04 +02:00
Misha Bragin c3236d05a1 Fix Auth0 OIDC integration 2022-08-17 20:38:52 +02:00
Misha Bragin 25e8a52465 Refactor to generic OIDC config (#66)
Cleans up config.json providing generic OIDC properties.
This allows for using other IDP providers besides Auth0.
The change is backward compatible with the previous versions.
2022-08-15 19:32:01 +02:00
20 changed files with 167 additions and 100 deletions

No files matched your search

+38 -15
View File
@@ -1,19 +1,39 @@
#!/bin/bash
set -e
if [[ -z "${AUTH0_DOMAIN}" ]]; then
echo "AUTH0_DOMAIN environment variable must be set"
exit 1
if [[ -z "${AUTH_AUTHORITY}" ]]; then
if [[ -z "${AUTH0_DOMAIN}" ]]; then
echo "AUTH_AUTHORITY or AUTH0_DOMAIN environment variable must be set"
exit 1
fi
fi
if [[ -z "${AUTH0_CLIENT_ID}" ]]; then
echo "AUTH0_CLIENT_ID environment variable must be set"
exit 1
if [[ -z "${AUTH_CLIENT_ID}" ]]; then
if [[ -z "${AUTH0_CLIENT_ID}" ]]; then
echo "AUTH_CLIENT_ID or AUTH0_CLIENT_ID environment variable must be set"
exit 1
fi
fi
if [[ -z "${AUTH0_AUDIENCE}" ]]; then
echo "AUTH0_AUDIENCE environment variable must be set"
exit 1
if [[ -z "${AUTH_AUDIENCE}" ]]; then
if [[ -z "${AUTH0_AUDIENCE}" ]]; then
echo "AUTH_AUDIENCE or AUTH0_AUDIENCE environment variable must be set"
exit 1
fi
fi
if [[ -z "${AUTH_SUPPORTED_SCOPES}" ]]; then
if [[ -z "${AUTH0_DOMAIN}" ]]; then
echo "AUTH_SUPPORTED_SCOPES environment variable must be set"
exit 1
fi
fi
if [[ -z "${USE_AUTH0}" ]]; then
if [[ -z "${AUTH0_DOMAIN}" ]]; then
echo "USE_AUTH0 environment variable must be set"
exit 1
fi
fi
if [[ -z "${NETBIRD_MGMT_API_ENDPOINT}" ]]; then
@@ -21,11 +41,14 @@ if [[ -z "${NETBIRD_MGMT_API_ENDPOINT}" ]]; then
exit 1
fi
AUTH0_DOMAIN=${AUTH0_DOMAIN}
AUTH0_CLIENT_ID=${AUTH0_CLIENT_ID}
AUTH0_AUDIENCE=${AUTH0_AUDIENCE}
NETBIRD_MGMT_API_ENDPOINT=$(echo $NETBIRD_MGMT_API_ENDPOINT | sed -E 's/(:80|:443)$//')
NETBIRD_MGMT_GRPC_API_ENDPOINT=${NETBIRD_MGMT_GRPC_API_ENDPOINT}
export AUTH_AUTHORITY=${AUTH_AUTHORITY:-https://$AUTH0_DOMAIN}
export AUTH_CLIENT_ID=${AUTH_CLIENT_ID:-$AUTH0_CLIENT_ID}
export AUTH_AUDIENCE=${AUTH_AUDIENCE:-$AUTH0_AUDIENCE}
export USE_AUTH0=${USE_AUTH0:-true}
export AUTH_SUPPORTED_SCOPES=${AUTH_SUPPORTED_SCOPES:-openid profile email api offline_access email_verified}
export NETBIRD_MGMT_API_ENDPOINT=$(echo $NETBIRD_MGMT_API_ENDPOINT | sed -E 's/(:80|:443)$//')
export NETBIRD_MGMT_GRPC_API_ENDPOINT=${NETBIRD_MGMT_GRPC_API_ENDPOINT}
REPO="https://github.com/netbirdio/netbird/"
# this command will fetch the latest release e.g. v0.6.3
@@ -33,7 +56,7 @@ export NETBIRD_LATEST_VERSION=$(basename $(curl -fs -o/dev/null -w %{redirect_ur
echo "NetBird latest version: ${NETBIRD_LATEST_VERSION}"
# replace ENVs in the config
ENV_STR="\$\$AUTH0_DOMAIN \$\$AUTH0_CLIENT_ID \$\$AUTH0_AUDIENCE \$\$NETBIRD_MGMT_API_ENDPOINT \$\$NETBIRD_MGMT_GRPC_API_ENDPOINT \$\$NETBIRD_LATEST_VERSION"
ENV_STR="\$\$USE_AUTH0 \$\$AUTH_AUDIENCE \$\$AUTH_AUTHORITY \$\$AUTH_CLIENT_ID \$\$AUTH_SUPPORTED_SCOPES \$\$NETBIRD_MGMT_API_ENDPOINT \$\$NETBIRD_MGMT_GRPC_API_ENDPOINT \$\$NETBIRD_LATEST_VERSION"
MAIN_JS=$(find /usr/share/nginx/html/static/js/main.*js)
OIDC_TRUSTED_DOMAINS="/usr/share/nginx/html/OidcTrustedDomains.js"
cp "$MAIN_JS" "$MAIN_JS".copy
+18
View File
@@ -0,0 +1,18 @@
#!/bin/bash
MGMT_PORT=$1
npm run build
docker build -f docker/Dockerfile -t netbird/dashboard-local:latest .
docker rm -f netbird-dashboard
docker run -d --name netbird-dashboard \
-p 3000:80 -p 443:443 \
-e AUTH_AUDIENCE=netbird-client \
-e AUTH_AUTHORITY=http://localhost:8080/realms/netbird \
-e AUTH_CLIENT_ID=netbird-client \
-e USE_AUTH0=false \
-e AUTH_SUPPORTED_SCOPES='openid profile email api offline_access' \
-e NETBIRD_MGMT_API_ENDPOINT=http://localhost:$MGMT_PORT \
-e NETBIRD_MGMT_GRPC_API_ENDPOINT=http://localhost:$MGMT_PORT \
netbird/dashboard-local:latest
+16
View File
@@ -0,0 +1,16 @@
#!/bin/bash
MGMT_PORT=$1
npm run build
docker build -f docker/Dockerfile -t netbird/dashboard-local:latest .
docker rm -f netbird-dashboard
docker run -d --name netbird-dashboard \
-p 3000:80 -p 443:443 \
-e AUTH0_AUDIENCE=http://localhost:3000/ \
-e AUTH0_DOMAIN=netbird-localdev.eu.auth0.com \
-e AUTH0_CLIENT_ID=kBRMAOqIZ7hvpVCaypQLCJvTzkYYIXVt \
-e NETBIRD_MGMT_API_ENDPOINT=http://localhost:$MGMT_PORT \
-e NETBIRD_MGMT_GRPC_API_ENDPOINT=http://localhost:$MGMT_PORT \
netbird/dashboard-local:latest
Executable
+18
View File
@@ -0,0 +1,18 @@
#!/bin/bash
MGMT_PORT=$1
npm run build
docker build -f docker/Dockerfile -t netbird/dashboard-local:latest .
docker rm -f netbird-dashboard
docker run -d --name netbird-dashboard \
-p 3000:80 -p 443:443 \
-e AUTH_AUDIENCE=http://localhost:3000/ \
-e AUTH_AUTHORITY=https://netbird-localdev.eu.auth0.com \
-e AUTH_CLIENT_ID=kBRMAOqIZ7hvpVCaypQLCJvTzkYYIXVt \
-e USE_AUTH0=true \
-e AUTH_SUPPORTED_SCOPES='openid profile email api offline_access email_verified' \
-e NETBIRD_MGMT_API_ENDPOINT=http://localhost:$MGMT_PORT \
-e NETBIRD_MGMT_GRPC_API_ENDPOINT=http://localhost:$MGMT_PORT \
netbird/dashboard-local:latest
+2 -2
View File
@@ -96,7 +96,7 @@ const AccessControlNew = () => {
form.validateFields()
.then((values) => {
const ruleToSave = createRuleToSave()
dispatch(ruleActions.saveRule.request({getAccessTokenSilently:accessToken, payload: ruleToSave}))
dispatch(ruleActions.saveRule.request({accessToken:accessToken, payload: ruleToSave}))
})
.catch((errorInfo) => {
console.log('errorInfo', errorInfo)
@@ -210,7 +210,7 @@ const AccessControlNew = () => {
// const testDeleteGroup = () => {
// groups.forEach(g => {
// dispatch(groupsActions.deleteGroup.request({getAccessTokenSilently, payload: g.ID || ''}))
// dispatch(groupsActions.deleteGroup.request({accessToken, payload: g.ID || ''}))
// })
// }
+1 -1
View File
@@ -37,7 +37,7 @@ const Navbar = () => {
{ label: (<Link to="/users">Users</Link>), key: '/users' }
] as ItemType[])
const logoutWithRedirect = () =>
logout("",{client_id:config.clientId});
logout("/",{client_id:config.clientId});
useEffect(() => {
const fs = menuItems.filter(m => m?.key !== userEmailKey && m?.key !== userLogoutKey && m?.key !== userDividerKey)
if (screens.xs === true) {
+2 -2
View File
@@ -213,11 +213,11 @@ const PeerUpdate = () => {
if (!noUpdateToName()) {
const peerUpdate = createPeerToSave()
setCallingPeerAPI(true)
dispatch(peerActions.updatePeer.request({getAccessTokenSilently:accessToken, payload: peerUpdate}))
dispatch(peerActions.updatePeer.request({accessToken:accessToken, payload: peerUpdate}))
}
if (peerGroupsToSave.groupsToRemove.length || peerGroupsToSave.groupsToAdd.length || peerGroupsToSave.groupsNoId.length) {
setCallingGroupAPI(true)
dispatch(peerActions.saveGroups.request({getAccessTokenSilently:accessToken, payload: peerGroupsToSave}))
dispatch(peerActions.saveGroups.request({accessToken:accessToken, payload: peerGroupsToSave}))
}
})
.catch((errorInfo) => {
+1 -1
View File
@@ -34,7 +34,7 @@ const SetupKeyNew = () => {
const handleFormSubmit = () => {
form.validateFields()
.then((values) => {
dispatch(setupKeyActions.createSetupKey.request({getAccessTokenSilently:accessToken, payload: formSetupKey}))
dispatch(setupKeyActions.createSetupKey.request({accessToken:accessToken, payload: formSetupKey}))
})
.catch((errorInfo) => {
console.log('errorInfo', errorInfo)
+6 -3
View File
@@ -1,7 +1,10 @@
{
"domain": "$AUTH0_DOMAIN",
"clientId": "$AUTH0_CLIENT_ID",
"audience": "$AUTH0_AUDIENCE",
"auth0Auth": "$USE_AUTH0",
"authAuthority": "$AUTH_AUTHORITY",
"authClientId": "$AUTH_CLIENT_ID",
"authScopesSupported": "$AUTH_SUPPORTED_SCOPES",
"authAudience": "$AUTH_AUDIENCE",
"apiOrigin": "$NETBIRD_MGMT_API_ENDPOINT",
"grpcApiOrigin": "$NETBIRD_MGMT_GRPC_API_ENDPOINT",
"latestVersion": "$NETBIRD_LATEST_VERSION"
+5 -13
View File
@@ -8,23 +8,15 @@ if (process.env.NODE_ENV !== 'production') {
}
export function getConfig() {
// Configure the audience here. By default, it will take whatever is in the config
// (specified by the `audience` key) unless it's the default value of "YOUR_API_IDENTIFIER" (which
// is what you get sometimes by using the Auth0 sample download tool from the quickstart page, if you
// don't have an API).
// If this resolves to `null`, the API page changes to show some helpful info about what to do
// with the audience.
const audience =
configJson.audience && configJson.audience !== "YOUR_API_IDENTIFIER"
? configJson.audience
: null;
return {
domain: configJson.domain,
clientId: configJson.clientId,
auth0Auth: configJson.auth0Auth == "true", //due to substitution we can't use boolean in the config
authority: configJson.authAuthority,
clientId: configJson.authClientId,
scopesSupported: configJson.authScopesSupported,
apiOrigin: configJson.apiOrigin,
grpcApiOrigin: configJson.grpcApiOrigin,
latestVersion: configJson.latestVersion,
...(audience ? { audience } : null),
audience: configJson.authAudience,
};
}
+34 -32
View File
@@ -4,33 +4,37 @@ import './index.css';
import App from './App';
import reportWebVitals from './reportWebVitals';
import history from "./utils/history";
import { getConfig } from "./config";
import {OidcProvider, useOidc} from '@axa-fr/react-oidc';
import {getConfig} from "./config";
import {OidcProvider} from '@axa-fr/react-oidc';
import {BrowserRouter} from "react-router-dom";
import Loading from "./components/Loading";
import LoginError from "./components/LoginError";
import {AuthorityConfiguration} from "@axa-fr/react-oidc/dist/vanilla/oidc";
const config = getConfig();
const authority = 'https://' + config.domain
// Unfortunately Auth0 https://<DOMAIN>/.well-known/openid-configuration doesn't contain end_session_endpoint that
// is required for doing logout. Therefore, we need to hardcode the config for auth
const auth0AuthorityConfig: AuthorityConfiguration = {
authorization_endpoint: new URL("authorize", config.authority).href,
token_endpoint: new URL("oauth/token", config.authority).href,
revocation_endpoint: new URL("oauth/revoke", config.authority).href,
end_session_endpoint: new URL("v2/logout", config.authority).href,
userinfo_endpoint: new URL("userinfo", config.authority).href,
} as AuthorityConfiguration
const providerConfig = {
authority: authority,
authority: config.authority,
client_id: config.clientId,
redirect_uri: window.location.origin+'#callback',
redirect_uri: window.location.origin + '/#callback',
refresh_time_before_tokens_expiration_in_second: 30,
silent_redirect_uri: window.location.origin + '#silent-callback',
scope: 'openid profile email api offline_access email_verified',
silent_redirect_uri: window.location.origin + '/#silent-callback',
scope: config.scopesSupported,
// disabling service worker
// service_worker_relative_url:'/OidcServiceWorker.js',
service_worker_only: false,
authority_configuration: {
authorization_endpoint: authority + "/authorize",
token_endpoint: authority + "/oauth/token",
revocation_endpoint: authority + "/oauth/revoke",
end_session_endpoint: authority + "/v2/logout",
userinfo_endpoint: authority + "/userinfo"
},
...(config.audience ? {extras:{ audience: config.audience}} : null)
authority_configuration: config.auth0Auth ? auth0AuthorityConfig : undefined,
...(config.audience ? {extras: {audience: config.audience}} : null)
};
const root = ReactDOM.createRoot(
@@ -40,23 +44,21 @@ const root = ReactDOM.createRoot(
const loadingComponent = () => <Loading padding="3em" width="50px" height="50px"/>
root.render(
<OidcProvider
configuration={providerConfig}
callbackSuccessComponent={loadingComponent}
authenticatingErrorComponent={LoginError}
authenticatingComponent={loadingComponent}
sessionLostComponent={loadingComponent}
loadingComponent={loadingComponent}
onSessionLost={()=>{
history.push("/peers")
}}
>
<BrowserRouter>
<App/>
</BrowserRouter>
</OidcProvider>
<OidcProvider
configuration={providerConfig}
callbackSuccessComponent={loadingComponent}
authenticatingErrorComponent={LoginError}
authenticatingComponent={loadingComponent}
sessionLostComponent={loadingComponent}
loadingComponent={loadingComponent}
onSessionLost={() => {
history.push("/peers")
}}
>
<BrowserRouter>
<App/>
</BrowserRouter>
</OidcProvider>
);
// If you want to start measuring performance in your app, pass a function
+1 -1
View File
@@ -14,7 +14,7 @@ async function apiRequest<T>(params: ApiRequestParams): Promise<ApiResponse<T>>
const url = `${params.urlBase}${params.url}`;
const extraHeaders = params.extraHeaders || {};
const headers = await headersFactory((params.data as any).getAccessTokenSilently);
const headers = await headersFactory((params.data as any).accessToken);
const builtHeader: RequestHeader = { ...headers, ...extraHeaders };
+3 -8
View File
@@ -3,19 +3,14 @@ export interface RequestHeader {
[key: string]: unknown;
}
const headersFactory = async (getAccessTokenSilently:any): Promise<RequestHeader> => {
const headersFactory = async (accessToken:any): Promise<RequestHeader> => {
const headers: RequestHeader = {
'Content-Type': 'application/json',
'Accept': 'application/json'
};
//const token = await getLocalItem<string>(StorageKey.token);
//const token = ''
// const token = await getAccessTokenSilently()
const token = getAccessTokenSilently
if (token) {
headers.authorization = `Bearer ${token}`;
if (accessToken) {
headers.authorization = `Bearer ${accessToken}`;
}
return headers;
+1 -1
View File
@@ -1,7 +1,7 @@
import { Method } from 'axios';
export interface RequestPayload<T> {
getAccessTokenSilently: any | null;
accessToken: any | null;
payload:T;
}
+5 -5
View File
@@ -118,13 +118,13 @@ export function* saveGroups(action: ReturnType<typeof actions.saveGroups.request
}
const responsesGroup = yield all(groupsToSave.map(g => call(serviceGroup.editGroup, {
getAccessTokenSilently: action.payload.getAccessTokenSilently,
accessToken: action.payload.accessToken,
payload: g
})
))
const responsesGroupNoId = yield all(groupsNoId.map(g => call(serviceGroup.createGroup, {
getAccessTokenSilently: action.payload.getAccessTokenSilently,
accessToken: action.payload.accessToken,
payload: g
})
))
@@ -137,8 +137,8 @@ export function* saveGroups(action: ReturnType<typeof actions.saveGroups.request
data: [...(responsesGroup as ApiResponse<Group>[]).map(r => r.body), ...(responsesGroupNoId as ApiResponse<Group>[]).map(r => r.body)]
} as CreateResponse<Group[] | null>))
yield put(groupActions.getGroups.request({ getAccessTokenSilently: action.payload.getAccessTokenSilently, payload: null }));
yield put(actions.getPeers.request({ getAccessTokenSilently: action.payload.getAccessTokenSilently, payload: null }));
yield put(groupActions.getGroups.request({ accessToken: action.payload.accessToken, payload: null }));
yield put(actions.getPeers.request({ accessToken: action.payload.accessToken, payload: null }));
} catch (err) {
console.log(err)
@@ -166,7 +166,7 @@ export function* updatePeer(action: ReturnType<typeof actions.updatePeer.request
const peerId = peer.id
const payloadToSave = {
getAccessTokenSilently: action.payload.getAccessTokenSilently,
accessToken: action.payload.accessToken,
payload: peer
}
+4 -4
View File
@@ -48,7 +48,7 @@ export function* saveRule(action: ReturnType<typeof actions.saveRule.request>):
const ruleToSave = action.payload.payload
const responsesGroup = yield all(ruleToSave.groupsToSave.map(g => call(serviceGroup.createGroup, {
getAccessTokenSilently: action.payload.getAccessTokenSilently,
accessToken: action.payload.accessToken,
payload: { name: g }
})
))
@@ -64,7 +64,7 @@ export function* saveRule(action: ReturnType<typeof actions.saveRule.request>):
const newDestinations = getNewGroupIds(ruleToSave.destinationsNoId, resGroups)
const payloadToSave = {
getAccessTokenSilently: action.payload.getAccessTokenSilently,
accessToken: action.payload.accessToken,
payload: {
name: ruleToSave.name,
description: ruleToSave.description,
@@ -93,8 +93,8 @@ export function* saveRule(action: ReturnType<typeof actions.saveRule.request>):
data: response.body
} as CreateResponse<Rule | null>));
yield put(groupActions.getGroups.request({ getAccessTokenSilently: action.payload.getAccessTokenSilently, payload: null }));
yield put(actions.getRules.request({ getAccessTokenSilently: action.payload.getAccessTokenSilently, payload: null }));
yield put(groupActions.getGroups.request({ accessToken: action.payload.accessToken, payload: null }));
yield put(actions.getRules.request({ accessToken: action.payload.accessToken, payload: null }));
} catch (err) {
yield put(actions.saveRule.failure({
loading: false,
+4 -4
View File
@@ -106,8 +106,8 @@ export const AccessControl = () => {
}
useEffect(() => {
dispatch(ruleActions.getRules.request({getAccessTokenSilently:accessToken, payload: null}));
dispatch(groupActions.getGroups.request({getAccessTokenSilently:accessToken, payload: null}));
dispatch(ruleActions.getRules.request({accessToken:accessToken, payload: null}));
dispatch(groupActions.getGroups.request({accessToken:accessToken, payload: null}));
}, [])
useEffect(() => {
@@ -182,7 +182,7 @@ export const AccessControl = () => {
</Space>,
okType: 'danger',
onOk() {
dispatch(ruleActions.deleteRule.request({getAccessTokenSilently:accessToken, payload: ruleToAction?.id || ''}));
dispatch(ruleActions.deleteRule.request({accessToken:accessToken, payload: ruleToAction?.id || ''}));
},
onCancel() {
setRuleToAction(null);
@@ -204,7 +204,7 @@ export const AccessControl = () => {
</Space>,
okType: 'danger',
onOk() {
//dispatch(ruleActions.deleteRule.request({getAccessTokenSilently, payload: ruleToAction?.id || ''}));
//dispatch(ruleActions.deleteRule.request({accessToken, payload: ruleToAction?.id || ''}));
},
onCancel() {
setRuleToAction(null);
+4 -4
View File
@@ -104,8 +104,8 @@ export const Peers = () => {
}
useEffect(() => {
dispatch(peerActions.getPeers.request({getAccessTokenSilently:accessToken, payload: null}));
dispatch(groupActions.getGroups.request({getAccessTokenSilently:accessToken, payload: null}));
dispatch(peerActions.getPeers.request({accessToken:accessToken, payload: null}));
dispatch(groupActions.getGroups.request({accessToken:accessToken, payload: null}));
}, [])
useEffect(() => {
@@ -198,7 +198,7 @@ export const Peers = () => {
content: "Are you sure you want to delete peer from your account?",
okType: 'danger',
onOk() {
dispatch(peerActions.deletedPeer.request({getAccessTokenSilently:accessToken, payload: peerToAction ? peerToAction.ip : ''}));
dispatch(peerActions.deletedPeer.request({accessToken:accessToken, payload: peerToAction ? peerToAction.ip : ''}));
},
onCancel() {
setPeerToAction(null);
@@ -226,7 +226,7 @@ export const Peers = () => {
ssh_enabled: checked,
name: record.name
} as Peer
dispatch(peerActions.updatePeer.request({getAccessTokenSilently:accessToken, payload: peer}));
dispatch(peerActions.updatePeer.request({accessToken:accessToken, payload: peer}));
}
+3 -3
View File
@@ -79,7 +79,7 @@ export const SetupKeys = () => {
}
useEffect(() => {
dispatch(setupKeyActions.getSetupKeys.request({getAccessTokenSilently:accessToken, payload: null}));
dispatch(setupKeyActions.getSetupKeys.request({accessToken:accessToken, payload: null}));
}, [])
useEffect(() => {
@@ -175,7 +175,7 @@ export const SetupKeys = () => {
</Space>,
okType: 'danger',
onOk() {
dispatch(setupKeyActions.deleteSetupKey.request({getAccessTokenSilently:accessToken, payload: setupKeyToAction ? setupKeyToAction.id : ''}));
dispatch(setupKeyActions.deleteSetupKey.request({accessToken:accessToken, payload: setupKeyToAction ? setupKeyToAction.id : ''}));
},
onCancel() {
setSetupKeyToAction(null);
@@ -197,7 +197,7 @@ export const SetupKeys = () => {
</Space>,
okType: 'danger',
onOk() {
dispatch(setupKeyActions.revokeSetupKey.request({getAccessTokenSilently:accessToken, payload: { id: setupKeyToAction ? setupKeyToAction.id : null,revoked: true } as SetupKeyRevoke}));
dispatch(setupKeyActions.revokeSetupKey.request({accessToken:accessToken, payload: { id: setupKeyToAction ? setupKeyToAction.id : null,revoked: true } as SetupKeyRevoke}));
},
onCancel() {
setSetupKeyToAction(null);
+1 -1
View File
@@ -45,7 +45,7 @@ export const Users = () => {
}
useEffect(() => {
dispatch(userActions.getUsers.request({getAccessTokenSilently:accessToken,payload: null}));
dispatch(userActions.getUsers.request({accessToken:accessToken,payload: null}));
}, [])
useEffect(() => {
setDataTable(transformDataTable(users))