hydra passwordless

This commit is contained in:
Arnaud Fornerot 2022-08-26 15:13:22 +02:00
parent 7962e2ca9a
commit 21fb28a6f0
8 changed files with 262 additions and 63 deletions

View File

@ -0,0 +1,5 @@
FROM cadoles/hydra-dispatcher-v1:v0.0.0-111-g2e60bdb
COPY hydra/providers.yml /var/www/config/hydra/providers.yml
COPY theme.css /var/www/public/build/theme

View File

@ -0,0 +1,23 @@
hydra:
apps:
- id: passwordless
title:
fr: addresse courriel
en: email address
description:
fr: Authentification via adresse courriel
en: Authentication by email address
icon_url: https://upload.wikimedia.org/wikipedia/commons/4/48/You%27ve_got_mail.png
login_url: http://127.0.0.1:7082/login
consent_url: http://127.0.0.1:7082/consent
logout_url: http://127.0.0.1:7082/logout
attributes_rewrite_rules:
username:
- consent.session.id_token.email
email:
- consent.session.id_token.email
email_verified:
- consent.session.id_token.email_verified

View File

@ -0,0 +1,8 @@
body > section {
background-color: rgba(214, 170, 214, 0.575);
}
input[type="radio"]:checked ~ .app-item {
--tw-shadow: 0 10px 15px -3px rgb(22 78 99 / 0.3), 0 4px 6px -4px rgb(22 78 99 / 0.3);
background-color: rgba(251, 255, 21, 0.507);
}

View File

@ -0,0 +1,19 @@
{
"client_id": "nineskeletor",
"client_name": "Nineskeletor",
"client_secret": "changeme",
"grant_types": [
"authorization_code",
"refresh_token"
],
"jwks": {},
"metadata": {},
"token_endpoint_auth_method": "client_secret_post",
"post_logout_redirect_uris": ["https://127.0.0.1:8000"],
"redirect_uris": ["https://127.0.0.1:8000/oauth2/callback"],
"response_types": [
"code"
],
"logo_uri": "https://upload.wikimedia.org/wikipedia/commons/e/e1/Password.svg",
"scope": "openid"
}

View File

@ -0,0 +1,22 @@
#!/bin/bash
set -e
set -u
function create_user_and_database() {
local database=$1
echo " Creating user and database '$database'"
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
CREATE USER $database;
CREATE DATABASE $database;
GRANT ALL PRIVILEGES ON DATABASE $database TO $database;
EOSQL
}
if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then
echo "Multiple database creation requested: $POSTGRES_MULTIPLE_DATABASES"
for db in $(echo $POSTGRES_MULTIPLE_DATABASES | tr ',' ' '); do
create_user_and_database $db
done
echo "Multiple databases created"
fi

View File

@ -1,6 +1,20 @@
version: '3'
# Port
# 6379 = redis
# 5432 = postgresql
# 80 = mercure
# 9000 = minio nginx
# 1025 = fake smtp
# 1080 = fake webmail
# 389 = fake ldap
# 636 = fake ldaps
# 6080 = tool phpldapadmin
# 6081 = tool adminer
services:
# Service redis pour le stockage des sessions
redis:
image: redis:4.0
container_name: redis
@ -11,25 +25,22 @@ services:
volumes:
- /etc/localtime:/etc/localtime:ro
postgres:
image: postgres:${POSTGRES_VERSION:-13}-alpine
container_name: postgres
# Service postgresql pour le stockage de la bdd applicative
postgresql:
image: postgres:13-alpine
container_name: postgresql
hostname: postgresql
environment:
POSTGRES_DB: ${POSTGRES_DB:-app}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ChangeMe}
POSTGRES_USER: ${POSTGRES_USER:-symfony}
POSTGRES_MULTIPLE_DATABASES: app,hydra
POSTGRES_PASSWORD: ChangeMe
POSTGRES_USER: symfony
ports:
- 5432:5432
volumes:
- db-data:/var/lib/postgresql/data:rw
- ./containers/postgresql:/docker-entrypoint-initdb.d
mailer:
image: schickling/mailcatcher
container_name: mailer
ports:
- 1025:1025
- 1080:1080
# Service websocket
mercure:
image: dunglas/mercure
container_name: mercure
@ -48,38 +59,7 @@ services:
- mercure_data:/data
- mercure_config:/config
openldap:
image: osixia/openldap:1.5.0
container_name: openldap
environment:
LDAP_LOG_LEVEL: "256"
LDAP_ORGANISATION: "nineskeletor"
LDAP_DOMAIN: "nine.fr"
LDAP_ADMIN_PASSWORD: "changeme"
LDAP_CONFIG_PASSWORD: "changeme"
LDAP_READONLY_USER: "true"
LDAP_READONLY_USER_USERNAME: "readonly"
LDAP_READONLY_USER_PASSWORD: "readonly"
LDAP_TLS: "false"
volumes:
- /var/lib/ldap
- /etc/ldap/slapd.d
- /container/service/slapd/assets/certs/
ports:
- "389:389"
- "636:636"
phpldapadmin:
image: osixia/phpldapadmin:latest
container_name: phpldapadmin
environment:
PHPLDAPADMIN_LDAP_HOSTS: "openldap"
PHPLDAPADMIN_HTTPS: "false"
ports:
- "8080:80"
depends_on:
- openldap
# Service de stockage Minio
minio1:
image: minio/minio:RELEASE.2021-01-16T02-19-44Z
container_name: minio1
@ -98,6 +78,7 @@ services:
timeout: 20s
retries: 3
# Service de stockage Minio
minio2:
image: minio/minio:RELEASE.2021-01-16T02-19-44Z
container_name: minio2
@ -116,6 +97,7 @@ services:
timeout: 20s
retries: 3
# Service de stockage Minio
minio3:
image: minio/minio:RELEASE.2021-01-16T02-19-44Z
container_name: minio3
@ -134,6 +116,7 @@ services:
timeout: 20s
retries: 3
# Service de stockage Minio
minio4:
image: minio/minio:RELEASE.2021-01-16T02-19-44Z
container_name: minio4
@ -152,6 +135,7 @@ services:
timeout: 20s
retries: 3
# Service nginx orchestrateur des minio
nginx:
image: nginx:1.19.2-alpine
container_name: nginx
@ -165,6 +149,120 @@ services:
- minio3
- minio4
# Service hydra
hydra:
image: cadoles/hydra-v1
container_name: hydra
volumes:
- ./containers/hydra/clients.d:/etc/hydra/clients.d
ports:
- 7080:4444
links:
- postgresql
depends_on:
- postgresql
restart: on-failure
environment:
LOG_LEAK_SENSITIVE_VALUES: "true"
HYDRA_URLS_SELF_ISSUER: http://127.0.0.1:7080
HYDRA_URLS_CONSENT: http://127.0.0.1:7081/consent
HYDRA_URLS_LOGIN: http://127.0.0.1:7081/login
HYDRA_URLS_LOGOUT: http://127.0.0.1:7081/logout
HYDRA_DSN: postgres://symfony:ChangeMe@postgresql:5432/hydra
#HYDRA_WAIT4X_DATABASE_TYPE: postgres
#HYDRA_WAIT4X_DATABASE_DSN: postgres://symfony:ChangeMe@postgresql:5432/hydra
HYDRA_ALLOW_INSECURE: "yes"
HYDRA_LEVEL: debug
hydra-dispatcher:
build:
context: ./containers/hydra-dispatcher
container_name: hydra-dispatcher
links:
- hydra
ports:
- 7081:80
restart: on-failure
environment:
- APP_ENV=dev
- APP_DEBUG=yes
- HYDRA_BASE_URL=http://hydra:4444
- HYDRA_ADMIN_BASE_URL=http://hydra:4445
# url dispatcher
- BASE_URL=http://127.0.0.1:7081
- COOKIE_PATH=/
- DEFAULT_LOCALE=fr
- APP_LOCALES=fr,en
volumes:
- ./containers/hydra-dispatcher/hydra:/var/www/config/hydra:ro
hydra-passwordless:
image: cadoles/hydra-passwordless-v1
container_name: hydra-passwordless
environment:
- HTTP_BASE_URL=http://127.0.0.1:7082/
- SMTP_HOST=mailer
- SMTP_PORT=1025
- SMTP_SENDER_ADDRESS=noreply@hydra.local
- SMTP_SENDER_NAME="Authentification - Passwordless"
- HYDRA_BASE_URL=http://hydra-dispatcher
links:
- hydra
- hydra-dispatcher
- mailer
ports:
- 7082:3000
# Service fake smtp = optionnel
mailer:
image: schickling/mailcatcher
container_name: mailer
ports:
- 1025:1025
- 1080:1080
# Service fake openldap = optionnel si nineskeletor a une synchronisation avec un annuaire
openldap:
image: osixia/openldap:1.5.0
container_name: openldap
environment:
LDAP_LOG_LEVEL: "256"
LDAP_ORGANISATION: "nine"
LDAP_DOMAIN: "nine.fr"
LDAP_ADMIN_PASSWORD: "changeme"
LDAP_CONFIG_PASSWORD: "changeme"
LDAP_READONLY_USER: "true"
LDAP_READONLY_USER_USERNAME: "readonly"
LDAP_READONLY_USER_PASSWORD: "readonly"
LDAP_TLS: "false"
volumes:
- /var/lib/ldap
- /etc/ldap/slapd.d
- /container/service/slapd/assets/certs/
ports:
- "389:389"
- "636:636"
# Service tool phpldapadmin = optionnel dans le cas de la présence d'un fake openldap
phpldapadmin:
image: osixia/phpldapadmin:latest
container_name: phpldapadmin
environment:
PHPLDAPADMIN_LDAP_HOSTS: "openldap"
PHPLDAPADMIN_HTTPS: "false"
ports:
- "6080:80"
depends_on:
- openldap
# Service tool adminer = optionnel
adminer:
image: adminer
container_name: adminer
restart: always
ports:
- 6081:8080
volumes:
db-data:
mercure_data:

View File

@ -214,8 +214,10 @@ class SecurityController extends AbstractController
public function loginOPENID(Request $request, AuthenticationUtils $authenticationUtils)
{
$state=Uuid::uuid4();
$request->getSession()->set("oauthState",$state);
$callback=$this->generateUrl('app_loginopenidcallback', array(), UrlGeneratorInterface::ABSOLUTE_URL);
$url=$this->getParameter("oauthLoginurl")."?client_id=".$this->getParameter("oauthClientid")."&redirect_uri=".$callback."&response_type=code&state=12345678&scope=openid";
$url=$this->getParameter("oauthLoginurl")."?client_id=".$this->getParameter("oauthClientid")."&redirect_uri=".$callback."&response_type=code&state=".$state."&scope=openid";
return $this->redirect($url);
}
@ -236,15 +238,20 @@ class SecurityController extends AbstractController
"client_id" => $this->getParameter("oauthClientid"),
"client_secret" => $this->getParameter("oauthClientsecret"),
];
$response=$this->apiservice->run("POST",$apiurl,$query);
$response=$this->apiservice->run("POST",$apiurl,$query,null,"form");
if(!$response||$response->code!="200") return $this->logout($request);
$token=$response->body->access_token;
$request->getSession()->set("oauthToken",$token);
if(!$response||$response->code!="200") die("pb openid 01");
$accesstoken=$response->body->access_token;
$accesstokentype=$response->body->token_type;
$îdtoken=$response->body->id_token;
$request->getSession()->set("oauthAccesstoken",$accesstoken);
$request->getSession()->set("oauthIdtoken",$îdtoken);
$apiurl = $this->getParameter("oauthUserinfo");
$response=$this->apiservice->run("GET",$apiurl,null,["Authorization"=>"token ".$token]);
if(!$response||$response->code!="200") return $this->logout($request);
$response=$this->apiservice->run("GET",$apiurl,null,["Authorization"=>$accesstokentype." ".$accesstoken]);
if(!$response||$response->code!="200") die("pb openid 02");
$attributes=json_decode(json_encode($response->body), true);
@ -346,14 +353,21 @@ class SecurityController extends AbstractController
public function logoutOPENID(Request $request) {
$token=$request->getSession()->get("oauthToken");
$accesstoken=$request->getSession()->get("oauthAccesstoken");
$idtoken=$request->getSession()->get("oauthIdtoken");
$state=$request->getSession()->get("oauthState");
$this->tokenstorage->setToken(null);
$request->getSession()->invalidate();
$url=$this->getParameter("oauthLogouturl");
if($url) {
$url.="?id_token_hint=$token&scope=openid&post_logout_redirect_uri=http://127.0.0.1:8000";
$callback=($request->isSecure()?"https://":"http://").str_replace("//","/",$this->getParameter("appWeburl").$this->getParameter("appAlias").$this->generateUrl('app_home'));
$callback=substr($callback, 0, -1);
$url.="?id_token_hint=$idtoken&scope=openid&state=$state&post_logout_redirect_uri=$callback";
return $this->redirect($url);
} else return $this->redirect($this->generateUrl("app_home"));
}

View File

@ -19,12 +19,25 @@ class ApiService
return \Unirest\Request\Body::json($array);
}
public function run($method,$url,$query,$header=null) {
public function run($method,$url,$query,$header=null,$content="json") {
// Entete
switch($content) {
case "json":
$headerini = [
'Accept' => 'application/json',
'Content-Type' => 'application/json',
];
if($query) $query = \Unirest\Request\Body::json($query);
break;
case "form":
$headerini = [
'Accept' => 'application/json',
'Content-Type' => 'application/x-www-form-urlencoded',
];
if($query) $query = \Unirest\Request\Body::form($query);
break;
}
if($header) $header=array_merge($headerini,$header);
else $header=$headerini;
@ -42,9 +55,6 @@ class ApiService
\Unirest\Request::proxy($proxyHost, $proxyPort, CURLPROXY_HTTP, true);
}
//if($query) $query = \Unirest\Request\Body::json($query);
if($query) $query = http_build_query($query);
$response = false;
switch($method) {
case "POST":