First basic OpenID Connect implementation

app/Auth/Access/Guards/OpenIdSessionGuard.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace BookStack\Auth\Access\Guards;
+
+/**
+ * OpenId Session Guard
+ *
+ * The OpenId login process is async in nature meaning it does not fit very well
+ * into the default laravel 'Guard' auth flow. Instead most of the logic is done
+ * via the OpenId controller & OpenIdService. This class provides a safer, thin
+ * version of SessionGuard.
+ *
+ * @package BookStack\Auth\Access\Guards
+ */
+class OpenIdSessionGuard extends ExternalBaseSessionGuard
+{
+    /**
+     * Validate a user's credentials.
+     *
+     * @param array $credentials
+     * @return bool
+     */
+    public function validate(array $credentials = [])
+    {
+        return false;
+    }
+
+    /**
+     * Attempt to authenticate a user using the given credentials.
+     *
+     * @param array $credentials
+     * @param bool $remember
+     * @return bool
+     */
+    public function attempt(array $credentials = [], $remember = false)
+    {
+        return false;
+    }
+}

app/Auth/Access/OpenIdService.php

@@ -0,0 +1,235 @@
+<?php namespace BookStack\Auth\Access;
+
+use BookStack\Auth\User;
+use BookStack\Exceptions\JsonDebugException;
+use BookStack\Exceptions\OpenIdException;
+use BookStack\Exceptions\UserRegistrationException;
+use Exception;
+use Illuminate\Support\Str;
+use Lcobucci\JWT\Token;
+use OpenIDConnectClient\AccessToken;
+use OpenIDConnectClient\OpenIDConnectProvider;
+
+/**
+ * Class OpenIdService
+ * Handles any app-specific OpenId tasks.
+ */
+class OpenIdService extends ExternalAuthService
+{
+    protected $config;
+    protected $registrationService;
+    protected $user;
+
+    /**
+     * OpenIdService constructor.
+     */
+    public function __construct(RegistrationService $registrationService, User $user)
+    {
+        $this->config = config('openid');
+        $this->registrationService = $registrationService;
+        $this->user = $user;
+    }
+
+    /**
+     * Initiate a authorization flow.
+     * @throws Error
+     */
+    public function login(): array
+    {
+        $provider = $this->getProvider();
+        return [
+            'url' => $provider->getAuthorizationUrl(),
+            'state' => $provider->getState(),
+        ];
+    }
+
+    /**
+     * Initiate a logout flow.
+     * @throws Error
+     */
+    public function logout(): array
+    {
+        $this->actionLogout();
+        $url = '/';
+        $id = null;
+
+        return ['url' => $url, 'id' => $id];
+    }
+
+    /**
+     * Process the Authorization response from the authorization server and
+     * return the matching, or new if registration active, user matched to
+     * the authorization server.
+     * Returns null if not authenticated.
+     * @throws Error
+     * @throws OpenIdException
+     * @throws ValidationError
+     * @throws JsonDebugException
+     * @throws UserRegistrationException
+     */
+    public function processAuthorizeResponse(?string $authorizationCode): ?User
+    {
+        $provider = $this->getProvider();
+
+        // Try to exchange authorization code for access token
+        $accessToken = $provider->getAccessToken('authorization_code', [
+            'code' => $authorizationCode,
+        ]);
+
+        return $this->processAccessTokenCallback($accessToken);
+    }
+
+    /**
+     * Do the required actions to log a user out.
+     */
+    protected function actionLogout()
+    {
+        auth()->logout();
+        session()->invalidate();
+    }
+
+    /**
+     * Load the underlying Onelogin SAML2 toolkit.
+     * @throws Error
+     * @throws Exception
+     */
+    protected function getProvider(): OpenIDConnectProvider
+    {
+        $settings = $this->config['openid'];
+        $overrides = $this->config['openid_overrides'] ?? [];
+
+        if ($overrides && is_string($overrides)) {
+            $overrides = json_decode($overrides, true);
+        }
+
+        $openIdSettings = $this->loadOpenIdDetails();
+        $settings = array_replace_recursive($settings, $openIdSettings, $overrides);
+
+        $signer = new \Lcobucci\JWT\Signer\Rsa\Sha256();
+        return new OpenIDConnectProvider($settings, ['signer' => $signer]);
+    }
+
+    /**
+     * Load dynamic service provider options required by the onelogin toolkit.
+     */
+    protected function loadOpenIdDetails(): array
+    {
+        return [
+            'redirectUri' => url('/openid/redirect'),
+        ];
+    }
+
+    /**
+     * Calculate the display name
+     */
+    protected function getUserDisplayName(Token $token, string $defaultValue): string
+    {
+        $displayNameAttr = $this->config['display_name_attributes'];
+
+        $displayName = [];
+        foreach ($displayNameAttr as $dnAttr) {
+            $dnComponent = $token->getClaim($dnAttr, '');
+            if ($dnComponent !== '') {
+                $displayName[] = $dnComponent;
+            }
+        }
+
+        if (count($displayName) == 0) {
+            $displayName = $defaultValue;
+        } else {
+            $displayName = implode(' ', $displayName);
+        }
+
+        return $displayName;
+    }
+
+    /**
+     * Get the value to use as the external id saved in BookStack
+     * used to link the user to an existing BookStack DB user.
+     */
+    protected function getExternalId(Token $token, string $defaultValue)
+    {
+        $userNameAttr = $this->config['external_id_attribute'];
+        if ($userNameAttr === null) {
+            return $defaultValue;
+        }
+
+        return $token->getClaim($userNameAttr, $defaultValue);
+    }
+
+    /**
+     * Extract the details of a user from a SAML response.
+     */
+    protected function getUserDetails(Token $token): array
+    {
+        $email = null;
+        $emailAttr = $this->config['email_attribute'];
+        if ($token->hasClaim($emailAttr)) {
+            $email = $token->getClaim($emailAttr);
+        }
+
+        return [
+            'external_id' => $token->getClaim('sub'),
+            'email' => $email,
+            'name' => $this->getUserDisplayName($token, $email),
+        ];
+    }
+
+    /**
+     * Get the user from the database for the specified details.
+     * @throws OpenIdException
+     * @throws UserRegistrationException
+     */
+    protected function getOrRegisterUser(array $userDetails): ?User
+    {
+        $user = $this->user->newQuery()
+          ->where('external_auth_id', '=', $userDetails['external_id'])
+          ->first();
+
+        if (is_null($user)) {
+            $userData = [
+                'name' => $userDetails['name'],
+                'email' => $userDetails['email'],
+                'password' => Str::random(32),
+                'external_auth_id' => $userDetails['external_id'],
+            ];
+
+            $user = $this->registrationService->registerUser($userData, null, false);
+        }
+
+        return $user;
+    }
+
+    /**
+     * Processes a received access token for a user. Login the user when
+     * they exist, optionally registering them automatically.
+     * @throws OpenIdException
+     * @throws JsonDebugException
+     * @throws UserRegistrationException
+     */
+    public function processAccessTokenCallback(AccessToken $accessToken): User
+    {
+        $userDetails = $this->getUserDetails($accessToken->getIdToken());
+        $isLoggedIn = auth()->check();
+
+        if ($this->config['dump_user_details']) {
+            throw new JsonDebugException($accessToken->jsonSerialize());
+        }
+
+        if ($userDetails['email'] === null) {
+            throw new OpenIdException(trans('errors.openid_no_email_address'));
+        }
+
+        if ($isLoggedIn) {
+            throw new OpenIdException(trans('errors.openid_already_logged_in'), '/login');
+        }
+
+        $user = $this->getOrRegisterUser($userDetails);
+        if ($user === null) {
+            throw new OpenIdException(trans('errors.openid_user_not_registered', ['name' => $userDetails['external_id']]), '/login');
+        }
+
+        auth()->login($user);
+        return $user;
+    }
+}

app/Config/auth.php

@@ -40,6 +40,10 @@ return [
             'driver' => 'saml2-session',
             'provider' => 'external',
         ],
+        'openid' => [
+            'driver' => 'openid-session',
+            'provider' => 'external',
+        ],
         'api' => [
             'driver' => 'api-token',
         ],

app/Config/openid.php

@@ -0,0 +1,43 @@
+<?php
+
+return [
+
+    // Display name, shown to users, for OpenId option
+    'name' => env('OPENID_NAME', 'SSO'),
+
+    // Dump user details after a login request for debugging purposes
+    'dump_user_details' => env('OPENID_DUMP_USER_DETAILS', false),
+
+    // Attribute, within a OpenId token, to find the user's email address
+    'email_attribute' => env('OPENID_EMAIL_ATTRIBUTE', 'email'),
+    // Attribute, within a OpenId token, to find the user's display name
+    'display_name_attributes' => explode('|', env('OPENID_DISPLAY_NAME_ATTRIBUTES', 'username')),
+    // Attribute, within a OpenId token, to use to connect a BookStack user to the OpenId user.
+    'external_id_attribute' => env('OPENID_EXTERNAL_ID_ATTRIBUTE', null),
+
+    // Overrides, in JSON format, to the configuration passed to underlying OpenIDConnectProvider library.
+    'openid_overrides' => env('OPENID_OVERRIDES', null),
+
+    'openid' => [
+        // OAuth2/OpenId client id, as configured in your Authorization server.
+        'clientId'                => env('OPENID_CLIENT_ID', ''),
+
+        // OAuth2/OpenId client secret, as configured in your Authorization server.
+        'clientSecret'            => env('OPENID_CLIENT_SECRET', ''),
+
+        // OAuth2 scopes that are request, by default the OpenId-native profile and email scopes.
+        'scopes'                  => 'profile email',
+
+        // The issuer of the identity token (id_token) this will be compared with what is returned in the token.
+        'idTokenIssuer'           => env('OPENID_ISSUER', ''),
+
+        // Public key that's used to verify the JWT token with.
+        'publicKey'               => env('OPENID_PUBLIC_KEY', ''),
+
+        // OAuth2 endpoints.
+        'urlAuthorize'            => env('OPENID_URL_AUTHORIZE', ''),
+        'urlAccessToken'          => env('OPENID_URL_TOKEN', ''),
+        'urlResourceOwnerDetails' => env('OPENID_URL_RESOURCE', ''),
+    ],
+
+];

app/Exceptions/OpenIdException.php

@@ -0,0 +1,6 @@
+<?php namespace BookStack\Exceptions;
+
+class OpenIdException extends NotifyException
+{
+
+}

app/Http/Controllers/Auth/LoginController.php

@@ -136,7 +136,7 @@ class LoginController extends Controller
     {
         // Authenticate on all session guards if a likely admin
         if ($user->can('users-manage') && $user->can('user-roles-manage')) {
-            $guards = ['standard', 'ldap', 'saml2'];
+            $guards = ['standard', 'ldap', 'saml2', 'openid'];
             foreach ($guards as $guard) {
                 auth($guard)->login($user);
             }
@@ -186,5 +186,4 @@ class LoginController extends Controller
 
         return redirect('/login');
     }
-
 }

app/Http/Controllers/Auth/OpenIdController.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace BookStack\Http\Controllers\Auth;
+
+use BookStack\Auth\Access\OpenIdService;
+use BookStack\Http\Controllers\Controller;
+
+class OpenIdController extends Controller
+{
+
+    protected $openidService;
+
+    /**
+     * OpenIdController constructor.
+     */
+    public function __construct(OpenIdService $openidService)
+    {
+        parent::__construct();
+        $this->openidService = $openidService;
+        $this->middleware('guard:openid');
+    }
+
+    /**
+     * Start the authorization login flow via OpenId Connect.
+     */
+    public function login()
+    {
+        $loginDetails = $this->openidService->login();
+        session()->flash('openid_state', $loginDetails['state']);
+
+        return redirect($loginDetails['url']);
+    }
+
+    /**
+     * Start the logout flow via OpenId Connect.
+     */
+    public function logout()
+    {
+        $logoutDetails = $this->openidService->logout();
+
+        if ($logoutDetails['id']) {
+            session()->flash('saml2_logout_request_id', $logoutDetails['id']);
+        }
+
+        return redirect($logoutDetails['url']);
+    }
+
+    /**
+     * Authorization flow Redirect.
+     * Processes authorization response from the OpenId Connect Authorization Server.
+     */
+    public function redirect()
+    {
+        $storedState = session()->pull('openid_state');
+        $responseState = request()->query('state');
+
+        if ($storedState !== $responseState) {
+            $this->showErrorNotification(trans('errors.openid_fail_authed', ['system' => config('saml2.name')]));
+            return redirect('/login');
+        }
+
+        $user = $this->openidService->processAuthorizeResponse(request()->query('code'));
+        if ($user === null) {
+            $this->showErrorNotification(trans('errors.openid_fail_authed', ['system' => config('saml2.name')]));
+            return redirect('/login');
+        }
+
+        return redirect()->intended();
+    }
+}

app/Http/Controllers/UserController.php

@@ -76,7 +76,7 @@ class UserController extends Controller
         if ($authMethod === 'standard' && !$sendInvite) {
             $validationRules['password'] = 'required|min:6';
             $validationRules['password-confirm'] = 'required|same:password';
-        } elseif ($authMethod === 'ldap' || $authMethod === 'saml2') {
+        } elseif ($authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'openid') {
             $validationRules['external_auth_id'] = 'required';
         }
         $this->validate($request, $validationRules);
@@ -85,7 +85,7 @@ class UserController extends Controller
 
         if ($authMethod === 'standard') {
             $user->password = bcrypt($request->get('password', Str::random(32)));
-        } elseif ($authMethod === 'ldap' || $authMethod === 'saml2') {
+        } elseif ($authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'openid') {
             $user->external_auth_id = $request->get('external_auth_id');
         }
 

app/Http/Middleware/VerifyCsrfToken.php

@@ -19,6 +19,7 @@ class VerifyCsrfToken extends Middleware
      * @var array
      */
     protected $except = [
-        'saml2/*'
+        'saml2/*',
+        'openid/*'
     ];
 }

app/Providers/AuthServiceProvider.php

@@ -7,6 +7,7 @@ use BookStack\Api\ApiTokenGuard;
 use BookStack\Auth\Access\ExternalBaseUserProvider;
 use BookStack\Auth\Access\Guards\LdapSessionGuard;
 use BookStack\Auth\Access\Guards\Saml2SessionGuard;
+use BookStack\Auth\Access\Guards\OpenIdSessionGuard;
 use BookStack\Auth\Access\LdapService;
 use BookStack\Auth\Access\RegistrationService;
 use BookStack\Auth\UserRepo;
@@ -45,6 +46,16 @@ class AuthServiceProvider extends ServiceProvider
                 $app[RegistrationService::class]
             );
         });
+
+        Auth::extend('openid-session', function ($app, $name, array $config) {
+            $provider = Auth::createUserProvider($config['provider']);
+            return new OpenIdSessionGuard(
+                $name,
+                $provider,
+                $this->app['session.store'],
+                $app[RegistrationService::class]
+            );
+        });
     }
 
     /**