feat: add auth plugin for casdoor #6382

ComradeProgrammer · 2022-02-19T05:52:13Z

What this PR does / why we need it:

auth-casdoor is an authorization plugin based on Casdoor. Casdoor is a centralized authentication / Single-Sign-On (SSO) platform

Pre-submission checklist:

Did you explain what problem does this PR solve? Or what new features have been added?
Have you added corresponding test cases?
Have you modified the corresponding document?
Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first

spacewander · 2022-02-22T07:09:20Z

apisix/plugins/auth-casdoor.lua

+local schema = {
+    type = "object",
+    properties = {
+        casdoor_endpoint = { type = "string" },


Let's remove the casdoor_ prefix

@ComradeProgrammer
Please request me to review it once you are ready. Thanks!

Let's remove the casdoor_ prefix

all other casdoor_ prefixes are removed except casdoor_endpoint, because i think just using "endpoint" may be a little confusing.

spacewander · 2022-02-22T07:11:31Z

apisix/plugins/auth-casdoor.lua

+local schema = {
+    type = "object",
+    properties = {
+        casdoor_endpoint = { type = "string" },


Let's remove the casdoor_ prefix

spacewander · 2022-02-22T07:11:35Z

apisix/plugins/auth-casdoor.lua

+local core = require("apisix.core")
+local log = core.log
+local ngx = ngx
+local session = require("resty.session")


Let's sort the imports like

apisix/apisix/plugins/authz-casbin.lua

Line 20 in 4624135

local plugin = require("apisix.plugin")

spacewander · 2022-02-22T07:14:36Z

conf/config-default.yaml

@@ -340,6 +340,7 @@ plugins:                          # plugin list (sorted by priority)
  - request-validation             # priority: 2800
  - openid-connect                 # priority: 2599
  - authz-casbin                   # priority: 2560
+  - auth-casdoor                  # priority: 2561


Please sort according to the priority and fix the indent

spacewander · 2022-02-22T07:14:55Z

apisix/plugins/auth-casdoor.lua

+
+local _M = {
+    version = 0.1,
+    priority = 12,


priority mismatch

spacewander · 2022-02-22T07:21:20Z

apisix/plugins/auth-casdoor.lua

+
+    if session_obj_read.data.access_token then
+        -- session exists
+        log.warn("session exists")


Ditto. Warn log should not be used in per-req level

spacewander · 2022-02-22T07:24:59Z

apisix/plugins/auth-casdoor.lua

+    local args = ngx.req.get_uri_args()
+    if not args.code or not args.state then
+        log.err("failed when accessing token. Invalid code or state ")
+        return nil


Suggested change

return nil

return nil, err

and log the err outside would be better

spacewander · 2022-02-22T07:27:35Z

apisix/plugins/auth-casdoor.lua

+    end
+    local client = http.new()
+    local res, err = client:request_uri(
+    get_path(conf.casdoor_endpoint) .. "/api/login/oauth/access_token",


Let's check if the endpoint contains ? in the schema instead of split it at runtime

spacewander · 2022-02-22T07:28:28Z

apisix/plugins/auth-casdoor.lua

+        log.err("failed when accessing token. ", err)
+        return nil
+    end
+    local data = cjson.decode(res.body)


Need to check if decode succeed

spacewander · 2022-02-22T07:30:30Z

docs/en/latest/plugins/auth-casdoor.md

+
+```
+
+By doing this all requests toward `/anything/*` will be intercepted and whether this user has logged in via Casdoor will be checked (by checking session). If not, the user will be redirected to login page of casdoor, thus implementing authentication without modifying server's code.


Could you provide a step-by-step example?
I still can't fully understand it after reading it twice...
It looks like the callback_url needs to contain part of the request host & path?

ComradeProgrammer · 2022-02-22T16:45:47Z

I am extremely flattered, delighted and grateful for this extremely detailed reply and advice from you. Revisions will be made accordingly soon and tests will be added soon together. @spacewander

tzssangglass · 2022-02-24T05:01:20Z

apisix/plugins/auth-casdoor.lua

+        client_id = { type = "string" },
+        client_secret = { type = "string" },
+        callback_url = { type = "string" },
+        test = { type= "boolean", default = false }


test is not in Attributes of plugin docs

tzssangglass · 2022-02-24T05:03:13Z

apisix/plugins/auth-casdoor.lua

+end
+
+function _M.access(conf, ctx)
+    log.info("hit auth-casdoor access")


This line looks like it's only for debugging?

tzssangglass · 2022-02-24T05:57:17Z

apisix/plugins/auth-casdoor.lua

+local function fetch_access_token(conf)
+    local args = core.request.get_uri_args()
+    if not args.code or not args.state then
+        log.err()


what this for?

Do you mean this function? Extract "code" and "state" parameters and use them to launch to casdoor api, in order to fetch "access_token" so that we can confirm whether the user have really logged in

The err doesn't have parameters in it

tzssangglass · 2022-02-24T05:58:45Z

apisix/plugins/auth-casdoor.lua

+end
+
+local function fetch_access_token(conf)
+    local args = core.request.get_uri_args()


Suggested change

local args = core.request.get_uri_args()

local args = core.request.get_uri_args(ctx)

and should pass ctx to this function

tzssangglass · 2022-02-24T06:01:59Z

apisix/plugins/auth-casdoor.lua

+
+local function fetch_access_token(conf)
+    local args = core.request.get_uri_args()
+    if not args.code or not args.state then


it's better to determine if args is empty

tzssangglass · 2022-02-24T06:05:18Z

apisix/plugins/auth-casdoor.lua

+end
+
+function _M.check_schema(conf)
+    local ok,err=core.schema.check(schema, conf)


Suggested change

local ok,err=core.schema.check(schema, conf)

local ok, err = core.schema.check(schema, conf)

tzssangglass · 2022-02-24T06:08:16Z

apisix/plugins/auth-casdoor.lua

+    local ok,err=core.schema.check(schema, conf)
+    if ok then
+        --check whether contains extra ? or /
+        if string.find(conf.callback_url,"?",1) then


use ngx.re.find is better?

tzssangglass · 2022-02-24T06:13:10Z

apisix/plugins/auth-casdoor.lua

+    if ok then
+        --check whether contains extra ? or /
+        if string.find(conf.callback_url,"?",1) then
+            return false,"callback_url should not contain get parameters or end up with /"
+        else
+            return true,nil
+        end
+    else
+        return false,err
+    end


Suggested change

if ok then

--check whether contains extra ? or /

if string.find(conf.callback_url,"?",1) then

return false,"callback_url should not contain get parameters or end up with /"

else

return true,nil

end

else

return false,err

end

if not ok then

return false, err

end

--check whether contains extra ? or /

local has_extra = string.find(conf.callback_url,"?",1)

if has_extra then

return false, "callback_url should not contain get parameters or end up with /"

end

return true, nil

is better?

tzssangglass · 2022-02-24T06:14:28Z

apisix/plugins/auth-casdoor.lua

+        if access_token then
+            local original_url = session_obj_read.data.original_uri
+            if not original_url then
+                return 503,"no original_url found in session"


Suggested change

return 503,"no original_url found in session"

return 503, "no original_url found in session"

tzssangglass · 2022-02-24T06:16:18Z

apisix/plugins/auth-casdoor.lua

+            session_obj_write.data.access_token = access_token
+            session_obj_write:save()
+            ngx.redirect(original_url, 302)
+            return


It seems a bit strange that here return does not reverse anything, but just exits the current function?

ComradeProgrammer · 2022-02-26T13:07:11Z

@spacewander @tzssangglass Most of the revisions in your comments have been implemented, and tests are also added. I think this code is ready to be reviewed now, THX.

tzssangglass · 2022-02-27T02:18:44Z

@spacewander @tzssangglass Most of the revisions in your comments have been implemented, and tests are also added. I think this code is ready to be reviewed now, THX.

hi @ComradeProgrammer, after the CI run is finished, please fix the failure of the CI.

ComradeProgrammer · 2022-02-27T07:45:08Z

hi @ComradeProgrammer, after the CI run is finished, please fix the failure of the CI.

I have made changes according to the CI information, and I wonder whether I can have CI run another time , so that I can confirm whether I can pass CI now?

tzssangglass · 2022-02-28T01:27:28Z

I have made changes according to the CI information, and I wonder whether I can have CI run another time , so that I can confirm whether I can pass CI now?

hi @ComradeProgrammer , there are still some code lint check failed.

spacewander · 2022-02-28T07:53:08Z

apisix/plugins/auth-casdoor.lua

+local schema = {
+    type = "object",
+    properties = {
+        casdoor_endpoint = {type = "string"},


Suggested change

casdoor_endpoint = {type = "string"},

endpoint_addr = {type = "string"},

would be better?

spacewander · 2022-02-28T07:53:43Z

apisix/plugins/auth-casdoor.lua

+    }
+}
+
+local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema}


please put each field per line, like other plugins

spacewander · 2022-02-28T07:54:05Z

apisix/plugins/auth-casdoor.lua

+local function fetch_access_token(conf)
+    local args = core.request.get_uri_args()
+    if not args.code or not args.state then
+        log.err()


The err doesn't have parameters in it

spacewander · 2022-02-28T07:54:53Z

apisix/plugins/auth-casdoor.lua

+        return nil, "failed when accessing token. Invalid code or state"
+    end
+    local client = http.new()
+    local url = get_path(conf.casdoor_endpoint) ..


Could we require the endpoint not to have ? so we don't need to use get_path?

spacewander · 2022-02-28T07:56:35Z

apisix/plugins/auth-casdoor.lua

+    local ok, err = core.schema.check(schema, conf)
+    if not ok then return false, err end
+    -- check whether contains extra ? or /
+    local has_extra = string.find(conf.callback_url, "?", 1)


We can do the check in the schema via "pattern":

apisix/apisix/schema_def.lua

Line 34 in acf7a0c

pattern = [[^[a-zA-Z0-9-_.]+$]]

spacewander · 2022-02-28T08:07:15Z

docs/en/latest/plugins/auth-casdoor.md

+
+The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback.
+
+The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.


Suggested change

The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.

The second parameter "endpoint_addr" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.

Missing this one?

spacewander · 2022-02-28T08:12:24Z

docs/en/latest/plugins/auth-casdoor.md

+
+#### How it works?
+
+Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo&param2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor.


Suggested change

Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo&param2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor.

Suppose a new user who has never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo&param2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this user hasn't been authenticated, the visit will be intercepted. With the original url user wants to visit kept, he will be redirected to the login page of Casdoor.

spacewander · 2022-02-28T08:13:55Z

docs/en/latest/plugins/auth-casdoor.md

+
+After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session
+
+Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user have been authentication previously, this plugin won't redirect this user any more so that this user can visit whatever he wants under this route without being interfered


Suggested change

Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user have been authentication previously, this plugin won't redirect this user any more so that this user can visit whatever he wants under this route without being interfered

Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user has been authenticated previously, this plugin won't redirect this user anymore so that this user can visit whatever he wants under this route without being interfered

spacewander · 2022-02-28T08:14:00Z

docs/en/latest/plugins/auth-casdoor.md

+
+Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo&param2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor.
+
+After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session


Suggested change

After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session

After successfully logging in with username and password(or whatever method he uses), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was kept by us previously. The logged-in status will also be kept in the session.

spacewander · 2022-02-28T08:26:28Z

apisix/plugins/auth-casdoor.lua

+
+local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema}
+
+local function get_path(uri)


We can use

apisix/apisix/plugins/http-logger.lua

Line 88 in acf7a0c

local url_decoded = url.parse(conf.uri)

to get the path instead of writing own solution.

ComradeProgrammer · 2022-02-28T14:09:28Z

@spacewander revisions have been made

tzssangglass · 2022-03-01T01:49:16Z

apisix/plugins/auth-casdoor.lua

+function _M.access(conf, ctx)
+    -- log.info("hit auth-casdoor access")
+    local current_uri = ctx.var.uri
+    local session_obj_read = session.open()


should we check if session exist? ref: bungle/lua-resty-session#12 (comment)

tzssangglass · 2022-03-01T01:53:16Z

apisix/plugins/auth-casdoor.lua

+    -- step 1: check whether hits the callback
+
+    if current_uri == conf.callback_url:match(".-//[^/]+(/.*)") then


Suggested change

-- step 1: check whether hits the callback

if current_uri == conf.callback_url:match(".-//[^/]+(/.*)") then

-- step 1: check whether hits the callback

if current_uri == conf.callback_url:match(".-//[^/]+(/.*)") then

tzssangglass · 2022-03-01T01:57:31Z

docs/en/latest/plugins/auth-casdoor.md

+
+## Name
+
+`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management


Suggested change

`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management

`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management.

tzssangglass · 2022-03-01T02:10:09Z

t/plugin/auth-casdoor.t

+            local cookie = res1.headers["Set-Cookie"]
+
+
+            local res2,err2=httpc:request_uri(callback_url, {


Suggested change

local res2,err2=httpc:request_uri(callback_url, {

local res2,err2 = httpc:request_uri(callback_url, {

Please pay more attention to similar formatting issues in this PR.

ComradeProgrammer · 2022-03-02T06:11:56Z

@spacewander @tzssangglass what about this time? (revisions have been made)

ComradeProgrammer · 2022-03-02T07:49:26Z

@spacewander @tzssangglass what kind of "chaos-test" is this? Besides, comparing with my last previous commit, the only change was format in test file t/plugin/auth-casdoor.t, but I passed all the tests in the previous commit.

ComradeProgrammer · 2022-03-25T12:34:58Z

what is apisix/utils/batch-processor.lua? This file seemed to lead to the failure of lint but it's irrelevant with me......

tzssangglass · 2022-03-25T14:36:20Z

what is apisix/utils/batch-processor.lua? This file seemed to lead to the failure of lint but it's irrelevant with me......

Please merge the APISIX master branch into your PR branch.

ComradeProgrammer · 2022-03-26T03:02:30Z

rebase made(force-pushed was caused by rebase)

spacewander · 2022-03-27T11:59:13Z

apisix/plugins/authz-casdoor.lua

+        end
+        local access_token, lifetime, err =
+            fetch_access_token(args.code, conf)
+        if err then


Suggested change

if err then

if not access_token then

spacewander · 2022-03-27T11:59:32Z

apisix/plugins/authz-casdoor.lua

+            core.log.error(err)
+            return 503
+        end
+        if access_token then


This branch can be saved

spacewander · 2022-03-27T12:00:14Z

apisix/plugins/authz-casdoor.lua

+        session_obj_write.data.state = state
+        session_obj_write:save()
+
+        local redirect_url=conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({


Suggested change

local redirect_url=conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({

local redirect_url = conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({

ComradeProgrammer · 2022-03-27T15:43:32Z

revisions have been made

leslie-tsang

@spacewander @ComradeProgrammer The documentation in the PR still needs to be optimized, let's merge this PR first and deal with the documentation in the next PR ?

spacewander · 2022-03-28T08:23:03Z

OK
@leslie-tsang
Let's open an issue about what needs to be proved.

ComradeProgrammer · 2022-03-28T11:41:11Z

Thanks! Please merge this PR.
I will work on the docs for this plugin later in another PR .

spacewander · 2022-03-28T13:30:19Z

@ComradeProgrammer
Let's add casdoor to the README

lijing-21 · 2022-04-18T06:35:55Z

Hi @ComradeProgrammer , thank you for your contribution!

Here is the Contributor T-shirt form[1], if you're interested, kindly take a look :)

[1] https://github.com/apache/apisix/blob/master/CONTRIBUTING.md#contributor-t-shirt

ComradeProgrammer mentioned this pull request Feb 19, 2022

Develop a Casdoor plugin for APISIX casdoor/casdoor#422

Closed

ComradeProgrammer force-pushed the casdoor branch from 6bfe556 to 753238b Compare February 19, 2022 06:43

ComradeProgrammer marked this pull request as ready for review February 19, 2022 06:44

ComradeProgrammer force-pushed the casdoor branch from 753238b to 2f138c8 Compare February 19, 2022 07:42

ComradeProgrammer changed the title ~~feat: add authz plugin for casdoor~~ feat: add authn plugin for casdoor Feb 19, 2022

ComradeProgrammer changed the title ~~feat: add authn plugin for casdoor~~ feat: add auth plugin for casdoor Feb 19, 2022

ComradeProgrammer force-pushed the casdoor branch 2 times, most recently from 465685d to 6656e06 Compare February 21, 2022 15:39

spacewander reviewed Feb 22, 2022

View reviewed changes

ComradeProgrammer force-pushed the casdoor branch 2 times, most recently from 3173296 to 653cfc6 Compare February 23, 2022 16:18

tzssangglass reviewed Feb 24, 2022

View reviewed changes

ComradeProgrammer force-pushed the casdoor branch from 653cfc6 to b5953d7 Compare February 26, 2022 13:02

ComradeProgrammer force-pushed the casdoor branch 2 times, most recently from 52eea7e to c699468 Compare February 27, 2022 07:42

ComradeProgrammer force-pushed the casdoor branch from c699468 to cc75f06 Compare February 28, 2022 05:01

spacewander reviewed Feb 28, 2022

View reviewed changes

ComradeProgrammer force-pushed the casdoor branch from cc75f06 to 19e132b Compare February 28, 2022 14:06

tzssangglass reviewed Mar 1, 2022

View reviewed changes

ComradeProgrammer force-pushed the casdoor branch 2 times, most recently from 70a497b to edd583a Compare March 2, 2022 06:10

ComradeProgrammer force-pushed the casdoor branch from edd583a to 70a497b Compare March 2, 2022 10:56

ComradeProgrammer added 10 commits March 26, 2022 10:51

feat: add auth plugin for casdoor

3752e64

fix: revisions according to review comments

6097607

style: fix indents

ea49e51

feat: support expire and add tests

4dae511

fix: revision according to comments

f7dd77e

fix: fix some problems according to the comments

e2a242d

feat: small revisions

4407bb7

fix: revision

d3e5ac1

fix: revision

9b013f8

fix: rebase

897c7a9

ComradeProgrammer force-pushed the casdoor branch from 44e9d82 to 897c7a9 Compare March 26, 2022 03:02

spacewander reviewed Mar 27, 2022

View reviewed changes

ComradeProgrammer added 3 commits March 27, 2022 23:38

fix: fix spelling mistakes

aea4d1a

fix: revisions

3c61648

fix: revision

07bdf00

spacewander approved these changes Mar 28, 2022

View reviewed changes

spacewander requested a review from leslie-tsang March 28, 2022 06:18

leslie-tsang reviewed Mar 28, 2022

View reviewed changes

leslie-tsang approved these changes Mar 28, 2022

View reviewed changes

spacewander merged commit c8fe8ab into apache:master Mar 28, 2022

Liu-Junlin pushed a commit to Liu-Junlin/apisix that referenced this pull request May 20, 2022

feat: add auth plugin for casdoor (apache#6382)

be95b44

spacewander pushed a commit that referenced this pull request Jun 30, 2022

feat: add auth plugin for casdoor (#6382)

132aa3c


		```

		By doing this all requests toward `/anything/*` will be intercepted and whether this user has logged in via Casdoor will be checked (by checking session). If not, the user will be redirected to login page of casdoor, thus implementing authentication without modifying server's code.

	local args = core.request.get_uri_args()
	local args = core.request.get_uri_args(ctx)

	local ok,err=core.schema.check(schema, conf)
	local ok, err = core.schema.check(schema, conf)

	return 503,"no original_url found in session"
	return 503, "no original_url found in session"

	casdoor_endpoint = {type = "string"},
	endpoint_addr = {type = "string"},


		The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url must belong to the "uri" you specified for the route, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*" Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented competely by plugin so that there is no need to modify the server implement this callback.

		The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.

	The second parameter "callback_url" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.
	The second parameter "endpoint_addr" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.


		#### How it works?

		Suppose a new user who have never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo&param2=bar), considering that "auth-casdoor" is enabled, this visit would be processed by "auth-casdoor" plugin first. After checking the session and confirming that this use hasn't been authentication, the visit will be intercepted. After remembering the original url user wants to visit, he will be redirected to the login page of Casdoor.


		After successfully logging in with username and password(or whatever method he use), Casdoor will redirect this user to the "callback_url" with GET parameter "code " and "state" specified. Because the "callback_url" is known by the plugin, so when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After this confirmation, this plugin will redirect this user to the original url user wants to visit, which was remembered by us previously. The logged in status will also be remembered by session

		Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user have been authentication previously, this plugin won't redirect this user any more so that this user can visit whatever he wants under this route without being interfered


		local _M = {version = 0.1, priority = 2559, name = plugin_name, schema = schema}

		local function get_path(uri)

		-- step 1: check whether hits the callback

		if current_uri == conf.callback_url:match(".-//[^/]+(/.*)") then


		## Name

		`auth-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management

		local cookie = res1.headers["Set-Cookie"]


		local res2,err2=httpc:request_uri(callback_url, {

	local res2,err2=httpc:request_uri(callback_url, {
	local res2,err2 = httpc:request_uri(callback_url, {

	local redirect_url=conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({
	local redirect_url = conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({

feat: add auth plugin for casdoor #6382

feat: add auth plugin for casdoor #6382

Conversation

ComradeProgrammer commented Feb 19, 2022 • edited Loading

What this PR does / why we need it:

Pre-submission checklist:

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ComradeProgrammer commented Feb 22, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ComradeProgrammer commented Feb 26, 2022

tzssangglass commented Feb 27, 2022

ComradeProgrammer commented Feb 27, 2022

tzssangglass commented Feb 28, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ComradeProgrammer commented Feb 28, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ComradeProgrammer commented Mar 2, 2022

ComradeProgrammer commented Mar 2, 2022 • edited Loading

ComradeProgrammer commented Mar 25, 2022

tzssangglass commented Mar 25, 2022

ComradeProgrammer commented Mar 26, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ComradeProgrammer commented Mar 27, 2022

leslie-tsang left a comment

Choose a reason for hiding this comment

spacewander commented Mar 28, 2022

ComradeProgrammer commented Mar 28, 2022

spacewander commented Mar 28, 2022

lijing-21 commented Apr 18, 2022

ComradeProgrammer commented Feb 19, 2022 •

edited

Loading

ComradeProgrammer commented Mar 2, 2022 •

edited

Loading