feat: added OpenID integration

Author: mvegter

docker-compose.yml

@@ -13,6 +13,10 @@ services:
       JWT_EXPIRATION: "${JWT_EXPIRATION}"
       JWT_ISSUER: "${JWT_ISSUER}"
       JWT_MAX_AGE: "${JWT_MAX_AGE}"
+      OPENID_ID: "${OPENID_ID}"
+      OPENID_SECRET: "${OPENID_SECRET}"
+      OPENID_REDIRECT: "${OPENID_REDIRECT}"
+      OPENID_WELL_KNOWN: "${OPENID_WELL_KNOWN}"
     links:
       - database
     restart: unless-stopped

docs/CONFIGURATION.md

@@ -20,3 +20,11 @@ The following configuration items can be set using environment variables, note t
 | JWT_EXPIRATION | Token expiration time as time literal. | 1d |
 | JWT_ISSUER | Identifies principal that issued the JWT. | o2-ui |
 | JWT_MAX_AGE | Token refresh expiration time as time literal. | 7d |
+
+## OpenID
+| Variable name | Description | Default value |
+|---------------|-------------|---------------|
+| OPENID_ID | Application ID | |
+| OPENID_SECRET | Application secret | |
+| OPENID_REDIRECT | Authentication callback | |
+| OPENID_WELL_KNOWN | So-called "well-known" endpoint defining OpenID configuration. | https://auth.cern.ch/auth/realms/cern/.well-known/openid-configuration |

lib/config/index.js

@@ -13,8 +13,10 @@
 
 const database = require('./database');
 const jwt = require('./jwt');
+const openId = require('./openid');
 
 module.exports = {
     DatabaseConfig: database,
     JwtConfig: jwt,
+    OpenIdConfig: openId,
 };

lib/config/openid.js

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright CERN and copyright holders of ALICE O2. This software is
+ * distributed under the terms of the GNU General Public License v3 (GPL
+ * Version 3), copied verbatim in the file "COPYING".
+ *
+ * See http://alice-o2.web.cern.ch/license for full licensing information.
+ *
+ * In applying this license CERN does not waive the privileges and immunities
+ * granted to it by virtue of its status as an Intergovernmental Organization
+ * or submit itself to any jurisdiction.
+ */
+
+let secret = null;
+let id = null;
+let redirect_uri = null;
+let well_known = 'https://auth.cern.ch/auth/realms/cern/.well-known/openid-configuration';
+
+if (process.env.OPENID_SECRET) {
+    secret = process.env.OPENID_SECRET;
+}
+
+if (process.env.OPENID_ID) {
+    id = process.env.OPENID_ID;
+}
+
+if (process.env.OPENID_REDIRECT) {
+    redirect_uri = process.env.OPENID_REDIRECT;
+}
+
+if (process.env.OPENID_WELL_KNOWN) {
+    well_known = process.env.OPENID_WELL_KNOWN;
+}
+
+module.exports = {
+    secret,
+    id,
+    redirect_uri,
+    well_known: well_known,
+    isValid: () => secret !== null && id !== null && redirect_uri !== null && well_known !== null,
+};

lib/server/index.js

@@ -14,7 +14,7 @@
 const path = require('path');
 const { HttpServer } = require('@aliceo2/web-ui');
 const buildEndpoints = require('./routers');
-const { JwtConfig } = require('../config');
+const { JwtConfig, OpenIdConfig } = require('../config');
 const { Logger } = require('../utilities');
 
 /**
@@ -27,10 +27,14 @@ class WebUiServer {
     constructor() {
         this.logger = Logger('HTTP');
 
+        if (!OpenIdConfig.isValid()) {
+            this.logger.info('Missing OpenID configuration');
+        }
+
         this.http = new HttpServer({
             port: 4000,
             autoListen: false,
-        }, JwtConfig);
+        }, JwtConfig, OpenIdConfig.isValid() ? OpenIdConfig : null);
 
         this.http.addStaticPath(path.resolve(__dirname, '..', 'public'));
         buildEndpoints(this.http);