ep_openid_connect 3.0.24 → 3.0.26

package/README.md

@@ -49,6 +49,11 @@ Etherpad's `requireAuthentication` setting must be `true`.
 * `client_id` (required): The OAuth2 client ID issued by the identity provider.
 * `client_secret` (required): The OAuth2 client secret issued by the identity
   provider.
+* `token_endpoint_auth_method` (optional; defaults to `client_secret_basic`):
+  Client authentication method to use for token endpoint requests. Supported
+  values are `client_secret_basic` and `client_secret_post`. Use
+  `client_secret_post` if your identity provider expects the client secret in
+  the token request body instead of the HTTP `Authorization` header.
 * `base_url` (required): The public base Etherpad URL. When registering Etherpad
   with your identity provider, the redirect URL (a.k.a. callback URL) is this
   base URL plus `/ep_openid_connect/callback`.

package/index.js

@@ -10,6 +10,7 @@ for (const level of ['debug', 'info', 'warn', 'error']) {
 const defaultSettings = {
   prohibited_usernames: ['admin', 'guest'],
   scope: ['openid'],
+  token_endpoint_auth_method: 'client_secret_basic',
   user_properties: {},
 };
 let settings;
@@ -33,6 +34,7 @@ const validSettings = new Ajv().compile({
     issuer_metadata: {},
     prohibited_usernames: {elements: {type: 'string'}},
     scope: {elements: {type: 'string'}},
+    token_endpoint_auth_method: {enum: ['client_secret_basic', 'client_secret_post']},
     user_properties: {values: {
       optionalProperties: {
         claim: {type: 'string'},
@@ -50,6 +52,15 @@ const validSettings = new Ajv().compile({
 const ep = (endpoint) => `/ep_openid_connect/${endpoint}`;
 const endpointUrl = (endpoint) => new URL(ep(endpoint).substr(1), settings.base_url).toString();
 
+const callbackUrlFromRequest = (req) => {
+  const callbackUrl = new URL(endpointUrl('callback'));
+  const requestUrl = new URL(req.originalUrl || req.url, settings.base_url);
+  for (const [key, value] of requestUrl.searchParams) {
+    callbackUrl.searchParams.append(key, value);
+  }
+  return callbackUrl;
+};
+
 const validateSubClaim = (sub) => {
   if (typeof sub !== 'string' || // 'sub' claim must exist as a string per OIDC spec.
       sub === '' || // Empty string doesn't make sense.
@@ -80,8 +91,8 @@ const discoverConfig = async (issuerUrl, clientId, clientAuth) => {
   // openid-client@6 rejects http:// issuers by default; opt back in for
   // localhost / private-network providers (matches v5 behaviour).
   const options = url.protocol === 'http:'
-      ? {execute: [oidc.allowInsecureRequests]}
-      : undefined;
+    ? {execute: [oidc.allowInsecureRequests]}
+    : undefined;
   try {
     return await oidc.discovery(url, clientId, undefined, clientAuth, options);
   } catch (err) {
@@ -100,11 +111,25 @@ const discoverConfig = async (issuerUrl, clientId, clientAuth) => {
   }
 };
 
+const getClientAuth = (settings) => {
+  switch (settings.token_endpoint_auth_method) {
+    case 'client_secret_basic':
+      // eslint-disable-next-line new-cap
+      return oidc.ClientSecretBasic(settings.client_secret);
+    case 'client_secret_post':
+      // eslint-disable-next-line new-cap
+      return oidc.ClientSecretPost(settings.client_secret);
+    default:
+      throw new Error(
+          `Unsupported token endpoint auth method: ${settings.token_endpoint_auth_method}`);
+  }
+};
+
 const buildConfig = async (settings) => {
   // openid-client@5 defaulted the token endpoint auth method to
   // `client_secret_basic`; v6 defaults to `client_secret_post`. Pin the
-  // method explicitly so existing IdP registrations keep working.
-  const clientAuth = oidc.ClientSecretBasic(settings.client_secret);
+  // default method explicitly so existing IdP registrations keep working.
+  const clientAuth = getClientAuth(settings);
   if (settings.issuer) {
     const config =
         await discoverConfig(settings.issuer, settings.client_id, clientAuth);
@@ -170,8 +195,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       }
       const oidcSession = req.session.ep_openid_connect || {};
       if (oidcSession.callbackChecks == null) throw new Error('missing authentication checks');
-      const currentUrl = new URL(req.originalUrl || req.url, settings.base_url);
-      const tokens = await oidc.authorizationCodeGrant(oidcConfig, currentUrl, {
+      const tokens = await oidc.authorizationCodeGrant(oidcConfig, callbackUrlFromRequest(req), {
         expectedNonce: oidcSession.callbackChecks.nonce,
         expectedState: oidcSession.callbackChecks.state,
         pkceCodeVerifier: oidcSession.callbackChecks.code_verifier,
@@ -310,6 +334,7 @@ exports.preAuthorize = (hookName, {req}) => {
 };
 
 exports.exportedForTestingOnly = {
+  callbackUrlFromRequest,
   defaultSettings,
   validSettings,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "3.0.24",
+  "version": "3.0.26",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {

package/static/tests/backend/specs/tests.js

@@ -113,6 +113,16 @@ describe(__filename, function () {
         });
   });
 
+  it('callback URL uses configured base URL with request query parameters', async function () {
+    const callbackUrl = epOpenidConnect.exportedForTestingOnly.callbackUrlFromRequest({
+      originalUrl: '/ep_openid_connect/callback?code=the_code&state=the_state',
+    });
+    const expectedUrl = new URL('/ep_openid_connect/callback', pluginSettings.base_url);
+    expectedUrl.searchParams.set('code', 'the_code');
+    expectedUrl.searchParams.set('state', 'the_state');
+    assert.equal(callbackUrl.toString(), expectedUrl.toString());
+  });
+
   it('normalUser can create and edit a pad', async function () {
     const padId = common.randomString();
     const url = new URL(`/p/${padId}`, common.baseUrl).toString();
@@ -125,6 +135,31 @@ describe(__filename, function () {
     assert.equal(msg.data.readonly, false);
   });
 
+  describe('token_endpoint_auth_method', function () {
+    for (const tokenEndpointAuthMethod of ['client_secret_basic', 'client_secret_post']) {
+      it(`supports ${tokenEndpointAuthMethod}`, async function () {
+        await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+          ...pluginSettings,
+          token_endpoint_auth_method: tokenEndpointAuthMethod,
+        }}});
+        const padId = common.randomString();
+        const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+        const res = await login(agent, issuer, url, 'normalUser');
+        assert.equal(res.request.url, url);
+        assert.equal(res.status, 200);
+      });
+    }
+
+    it('rejects unsupported methods', async function () {
+      await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+        ...pluginSettings,
+        token_endpoint_auth_method: 'unsupported',
+      }}});
+      await agent.get(new URL('/ep_openid_connect/login', common.baseUrl))
+          .expect(401);
+    });
+  });
+
   it('noCreate user is unable to create a pad', async function () {
     const padId = common.randomString();
     const url = new URL(`/p/${padId}`, common.baseUrl).toString();