Mailing-List: contact issues-help@nifi.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@nifi.apache.org
From: mcgilman <git@git.apache.org>
To: issues@nifi.apache.org
Reply-To: issues@nifi.apache.org
References: <git-pr-2047-nifi@git.apache.org>
In-Reply-To: <git-pr-2047-nifi@git.apache.org>
Subject: [GitHub] nifi pull request #2047: NIFI-4210: Add support for OpenId Connect
Content-Type: text/plain
Message-Id: <20170802131913.2A317E96C0@git1-us-west.apache.org>
Date: Wed,  2 Aug 2017 13:19:13 +0000 (UTC)
archived-at: Wed, 02 Aug 2017 13:19:16 -0000

Github user mcgilman commented on a diff in the pull request:

    https://github.com/apache/nifi/pull/2047#discussion_r130872958
  
    --- Diff: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/AccessResource.java ---
    @@ -125,6 +142,160 @@ public Response getLoginConfig(@Context HttpServletRequest httpServletRequest) {
             return generateOkResponse(entity).build();
         }
     
    +    @GET
    +    @Consumes(MediaType.WILDCARD)
    +    @Produces(MediaType.WILDCARD)
    +    @Path("oidc/request")
    +    @ApiOperation(
    +            value = "Initiates a request to authenticate through the configured OpenId Connect provider."
    +    )
    +    public void oidcRequest(@Context HttpServletRequest httpServletRequest, @Context HttpServletResponse httpServletResponse) throws Exception {
    +        // only consider user specific access over https
    +        if (!httpServletRequest.isSecure()) {
    +            forwardToMessagePage(httpServletRequest, httpServletResponse, "User authentication/authorization is only supported when running over HTTPS.");
    +            return;
    +        }
    +
    +        // ensure oidc is enabled
    +        if (!oidcService.isOidcEnabled()) {
    +            forwardToMessagePage(httpServletRequest, httpServletResponse, "OpenId Connect is not configured.");
    +            return;
    +        }
    +
    +        final String oidcRequestIdentifier = UUID.randomUUID().toString();
    +
    +        // generate a cookie to associate this login sequence
    +        final Cookie cookie = new Cookie(OIDC_REQUEST_IDENTIFIER, oidcRequestIdentifier);
    +        cookie.setPath("/");
    +        cookie.setHttpOnly(true);
    +        cookie.setMaxAge(60);
    +        cookie.setSecure(true);
    +        httpServletResponse.addCookie(cookie);
    +
    +        // get the state for this request
    +        final State state = oidcService.createState(oidcRequestIdentifier);
    +
    +        // build the authorization uri
    +        final URI authorizationUri = UriBuilder.fromUri(oidcService.getAuthorizationEndpoint())
    --- End diff --
    
    The only value that isn't checked here is the authorization endpoint. The remainder of the checks are done during start up in the `StandardOidcIdentityProvider` constructor. I'll update it to verify the presence of the endpoints that we explicitly invoke.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---