Docker/planka
Docker/planka
1
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2025-08-08 23:15:31 +02:00
Code Issues Releases Activity

feat: Parametrize OIDC ID token signing algorithm

Browse source 
Planka originally supported only RS256, the default value set by
the openid-client library from Panva.

To provide more flexibility for clients in configuring their OIDC interactions
with various providers, we now allow passing a signature algorithm through
an environment variable.

This enhancement enables users to specify a preferred signature algorithm,
accommodating different OIDC provider requirements.
This commit is contained in:
lebaudantoine 2024-07-15 20:48:21 +02:00
parent 9aaaca1b8d
commit 6b3f887684
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
server/api/hooks/oidc/index.js
View file

@ -25,13 +25,19 @@ module.exports = function defineOidcHook(sails) {
const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer); const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
client = new issuer.Client({ const metadata = {
client_id: sails.config.custom.oidcClientId, client_id: sails.config.custom.oidcClientId,
client_secret: sails.config.custom.oidcClientSecret, client_secret: sails.config.custom.oidcClientSecret,
redirect_uris: [sails.config.custom.oidcRedirectUri], redirect_uris: [sails.config.custom.oidcRedirectUri],
response_types: ['code'], response_types: ['code'],
userinfo_signed_response_alg: sails.config.custom.oidcUserinfoSignedResponseAlg, userinfo_signed_response_alg: sails.config.custom.oidcUserinfoSignedResponseAlg,
}); }
if (sails.config.custom.oidcIdTokenSignedResponseAlg) {
metadata.id_token_signed_response_alg = sails.config.custom.oidcIdTokenSignedResponseAlg
}
client = new issuer.Client(metadata);
}, },
getClient() { getClient() {

1
server/config/custom.js
View file

@ -39,6 +39,7 @@ module.exports.custom = {
oidcIssuer: process.env.OIDC_ISSUER, oidcIssuer: process.env.OIDC_ISSUER,
oidcClientId: process.env.OIDC_CLIENT_ID, oidcClientId: process.env.OIDC_CLIENT_ID,
oidcClientSecret: process.env.OIDC_CLIENT_SECRET, oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
oidcIdTokenSignedResponseAlg: process.env.OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG,
oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG, oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG,
oidcScopes: process.env.OIDC_SCOPES || 'openid email profile', oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
oidcResponseMode: process.env.OIDC_RESPONSE_MODE || 'fragment', oidcResponseMode: process.env.OIDC_RESPONSE_MODE || 'fragment',