Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added ability to restrict OAuth logins by domain name (and bugfixes) #203

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Added ability to restrict OAuth logins by domain name (and bugfixes) #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions app/config/default.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@
'ldapPassword' => '',
'oauthGoogleId' => '',
'oauthGoogleSecret' => '',
'oauthAppsDomains' => '',
'oauthGoogleAdmins' => '',
),

Expand Down
2 changes: 2 additions & 0 deletions app/lang/en/admin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,8 @@
"client_id" => "Client ID",
"client_secret" => "Client secret",
"client_secret_exp" => "You can generate client ID and secret key at the",
"apps_domains" => "Apps Domains",
"apps_domains_exp" => "Restrict oAuth logins to these Google Apps domains",
"admin_emails" => "Admin emails",
"admin_emails_exp" => "Users with these email addresses will be granted admin access. Please enter one email ".
"address per line.",
Expand Down
26 changes: 19 additions & 7 deletions app/lib/auth/StickyNotesOAuthUserProvider.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ public function retrieveByCredentials(array $credentials)
// Instantiate the Google service using the credentials, http client and storage mechanism for the token
$service = new ServiceFactory();

$google = $service->createService('google', $credentials, $storage, array('userinfo_email', 'groups_provisioning'));
$google = $service->createService('google', $credentials, $storage, array('userinfo_email'));

// Google responded with a code
if (Input::has('code'))
Expand All @@ -154,6 +154,21 @@ public function retrieveByCredentials(array $credentials)
{
if ($result['verified_email'])
{
// We extract the username from the email address of the user
list ($username, $domain) = explode('@', $result['email'], 2);

// Check to make sure that the user is in the list of authorized Google apps domains,
// if the apps domains variable is not empty
if (trim($this->auth->oauthAppsDomains) != false)
{
$appsDomains = preg_split("/[\s,]+/", $this->auth->oauthAppsDomains, -1, PREG_SPLIT_NO_EMPTY);
if(!in_array($domain, $appsDomains))
{
App::abort(401);
return NULL;
}
}

// First we will add each credential element to the query as a where clause.
// Then we can execute the query and, if we found a user, return it in a
// Eloquent User "model" that will be utilized by the Guard instances.
Expand All @@ -168,18 +183,15 @@ public function retrieveByCredentials(array $credentials)
$user = $query->count() > 0 ? $query->first() : $this->createModel();

// Determine if user is an admin
$googleAdmins = explode("\n", $this->auth->oauthGoogleAdmins);

$googleAdmins = preg_split("/[\s,]+/", $this->auth->oauthGoogleAdmins, -1, PREG_SPLIT_NO_EMPTY);
$isAdmin = in_array($result['email'], $googleAdmins);

// We extract the username from the email address of the user
$parts = explode('@', $result['email']);

// Insert/Update user info
$user->username = $parts[0];
$user->username = $username;
$user->password = '';
$user->salt = '';
$user->email = $result['email'];
$user->dispname = $result['name'];
$user->type = 'oauth';
$user->active = 1;
$user->admin = $isAdmin;
Expand Down
20 changes: 20 additions & 0 deletions app/views/skins/bootstrap/admin/auth.blade.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,26 @@
</div>
</div>

<div class="form-group">
{{
Form::label('oauth_apps_domains', Lang::get('admin.apps_domains'), array(
'class' => 'control-label col-sm-3 col-lg-2'
))
}}

<div class="col-sm-9 col-lg-10">
{{
Form::textarea('oauth_apps_domains', $site->auth->oauthAppsDomains, array(
'class' => 'form-control',
'rows' => 3,
))
}}
<div class="help-block">
{{ Lang::get('admin.apps_domains_exp') }}
</div>
</div>
</div>

<div class="form-group">
{{
Form::label('oauth_google_admins', Lang::get('admin.admin_emails'), array(
Expand Down
20 changes: 20 additions & 0 deletions app/views/skins/neverland/admin/auth.blade.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,6 +358,26 @@
</div>
</div>

<div class="form-group">
{{
Form::label('oauth_apps_domains', Lang::get('admin.apps_domains'), array(
'class' => 'control-label col-sm-3 col-lg-2'
))
}}

<div class="col-sm-9 col-lg-10">
{{
Form::textarea('oauth_apps_domains', $site->auth->oauthAppsDomains, array(
'class' => 'form-control',
'rows' => 3,
))
}}
<div class="help-block">
{{ Lang::get('admin.apps_domains_exp') }}
</div>
</div>
</div>

<div class="control-group">
{{
Form::label('oauth_google_admins', Lang::get('admin.admin_emails'), array(
Expand Down