Implementation of Oauth of Github, Google and Microsoft

docs/web/authentication.md

@@ -16,6 +16,9 @@ Table of Contents
         * [<i>LDAP</i> authentication](#ldap-authentication)
             * [Configuration options](#configuration-options)
     * Membership in custom groups with [<i>regex_groups</i>](#regex_groups-authentication)
+      * [<i>OAUTH</i> authentication](#oauth-authentication)
+        * [<i>OAUTH</i> Configuration options](#oauth-configuration-options)
+        * [<i>OAUTH</i> details per each provider](#oauth-details-per-each-provider)
 * [Client-side configuration](#client-side-configuration)
     * [Web-browser client](#web-browser-client)
     * [Command-line client](#command-line-client)
@@ -320,6 +323,101 @@ groups. For more information [see](permissions.md#managing-permissions).
 
 ----
 
+### <i>OAUTH</i> authentication <a name="oauth-authentication"></a>
+
+CodeChecker also supports OAUTH-based authentication. The `authentication.method_oauth` section contains the configuration for OAUTH authentication for different OAUTH providers. The server can be configured for different Oauth `providers` .Users can be added into the `allowed_users`
+
+#### OAUTH Configuration options <a name="oauth-configuration-options"></a>
+  * `enabled`
+
+    Indicated if OAUTH authentication is enabled (required for any methods below)
+
+ * `providers`
+
+    The provider field contains configuration details for OAuth providers. Each provider's configuration includes but may vary depending on provider:
+
+ * `enabled`
+
+    Indicates if current provider is enabled (github, google, etc)
+
+ * `oauth_client_id`
+
+    Contains client ID provided by the OAuth provider.
+
+
+ * `oauth_client_secret`
+
+    The client secret must be provided by the OAuth provider.
+
+ * `oauth_authorization_uri`
+
+    This link in used for redirecting user for provider's authentication page
+
+ * `oauth_redirect_uri`
+
+    User will be redirected back to the provided link after login with returned data.
+
+ * `oauth_token_uri`
+
+    The URI to exchange the authorization code for an access token.
+
+ * `oauth_user_info_uri`
+
+    The URI to fetch the authenticated user's information.
+
+ * `oauth_scope`
+
+    The scope of access requested from the OAuth provider.
+
+ * `oauth_user_info_mapping`
+
+    A mapping of user info fields from the provider to local fields.
+
+    * `username`
+
+        Field for the username.
+    * `email`
+
+        Field for the email.
+    * `fullname`
+
+        Field for the fullname.
+ * `allowed_users`
+
+    A list of allowed users differently configured for each provider
+
+~~~{.json}
+"method_oauth": {
+      "enabled": false,
+      "providers": {
+        "example_provider": {
+          "enabled": false,
+          "oauth_client_id": "client id",
+          "oauth_client_secret": "client secret",
+          "oauth_authorization_uri": "https://accounts.google.com/o/oauth2/auth",
+          "oauth_redirect_uri": "http://localhost:8080/login",
+          "oauth_token_uri": "https://accounts.google.com/o/oauth2/token",
+          "oauth_user_info_uri": "https://www.googleapis.com/oauth2/v1/userinfo",
+          "oauth_scope": "openid email profile",
+          "oauth_user_info_mapping": {
+            "username": "email",
+            "email": "email",
+            "fullname": "name"
+          },
+          "allowed_users": [
+            "user1",
+            "user2",
+            "user3"
+          ]
+        }
+      }
+    }
+~~~
+
+#### Oauth Details per each provider <a name ="oauth-details-per-each-provider"></a>
+
+* For OAuth providers to function correctly, the `oauth_redirect_uri` in application's configuration must exactly match the `Authorized redirect URIs` specified in the Google API Console. 
+
 # Client-side configuration <a name="client-side-configuration"></a>
 
 ## Web-browser client <a name="web-browser-client"></a>

web/api/authentication.thrift

@@ -68,6 +68,13 @@ service codeCheckerAuthentication {
   string performLogin(1: string authMethod,
                       2: string authString)
                       throws (1: codechecker_api_shared.RequestFailed requestError),
+
+  // Returns list of providers for oauth for respective appearence of buttons.
+  list<string> getOauthProviders(),
+
+  // Create a link for the user to log in for github Oauth.
+  string createLink(1: string provider)
+                    throws (1: codechecker_api_shared.RequestFailed requestError),
 
   // Performs logout action for the user. Must be called from the
   // corresponding valid session which is to be destroyed.

web/api/js/codechecker-api-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codechecker-api",
-  "version": "6.58.0",
+  "version": "6.59.0",
   "description": "Generated node.js compatible API stubs for CodeChecker server.",
   "main": "lib",
   "homepage": "https://github.com/Ericsson/codechecker",

web/api/py/codechecker_api/setup.py

@@ -8,7 +8,7 @@
 with open('README.md', encoding='utf-8', errors="ignore") as f:
     long_description = f.read()
 
-api_version = '6.58.0'
+api_version = '6.59.0'
 
 setup(
     name='codechecker_api',

web/api/py/codechecker_api_shared/setup.py

@@ -8,7 +8,7 @@
 with open('README.md', encoding='utf-8', errors="ignore") as f:
     long_description = f.read()
 
-api_version = '6.58.0'
+api_version = '6.59.0'
 
 setup(
     name='codechecker_api_shared',

web/client/codechecker_client/client.py

@@ -12,9 +12,9 @@
 
 import getpass
 import sys
-
 from thrift.Thrift import TApplicationException
 
+
 import codechecker_api_shared
 from codechecker_api.Authentication_v6 import ttypes as AuthTypes
 

web/client/codechecker_client/helpers/authentication.py

@@ -44,6 +44,10 @@ def getAccessControl(self):
     def performLogin(self, auth_method, auth_string):
         pass
 
+    @thrift_client_call
+    def createLink(self, provider):
+        pass
+
     @thrift_client_call
     def destroySession(self):
         pass

web/codechecker_web/shared/version.py

@@ -18,7 +18,7 @@
 # The newest supported minor version (value) for each supported major version
 # (key) in this particular build.
 SUPPORTED_VERSIONS = {
-    6: 58
+    6: 59
 }
 
 # Used by the client to automatically identify the latest major and minor

web/requirements.txt

@@ -9,6 +9,8 @@ gitpython==3.1.41
 PyYAML==6.0.1
 types-PyYAML==6.0.12.12
 sarif-tools==1.0.0
+Authlib==1.3.1
+requests==2.32.3
 
 ./api/py/codechecker_api/dist/codechecker_api.tar.gz
 ./api/py/codechecker_api_shared/dist/codechecker_api_shared.tar.gz

web/server/codechecker_server/api/authentication.py

@@ -9,6 +9,8 @@
 Handle Thrift requests for authentication.
 """
 
+from authlib.integrations.requests_client import OAuth2Session
+from authlib.common.security import generate_token
 
 import json
 import codechecker_api_shared
@@ -30,6 +32,7 @@
 from ..server import permissions
 from ..session_manager import generate_session_token
 
+
 LOG = get_logger('server')
 
 
@@ -92,9 +95,39 @@ def getAuthParameters(self):
     def getLoggedInUser(self):
         return self.__auth_session.user if self.__auth_session else ""
 
+    @timeit
+    def createLink(self, provider):
+        """
+        For creating a autehntication link for OAuth for specified provider
+        """
+        oauth_config = self.__manager.get_oauth_config(provider)
+        if not oauth_config.get("enabled"):
+            raise codechecker_api_shared.ttypes.RequestFailed(
+                codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
+                "OAuth authentication is not enabled.")
+
+        client_id = oauth_config["oauth_client_id"]
+        client_secret = oauth_config["oauth_client_secret"]
+        scope = oauth_config["oauth_scope"]
+        authorization_uri = oauth_config["oauth_authorization_uri"]
+        redirect_uri = oauth_config["oauth_redirect_uri"]
+
+        # Create an OAuth2Session instance
+        session = OAuth2Session(
+            client_id,
+            client_secret,
+            scope=scope,
+            redirect_uri=redirect_uri)
+
+        # Create authorization URL
+        nonce = generate_token()
+        url = session.create_authorization_url(
+            authorization_uri, nonce=nonce)[0]
+        return url
+
     @timeit
     def getAcceptedAuthMethods(self):
-        return ["Username:Password"]
+        return ["Username:Password", "oauth"]
 
     @timeit
     def getAccessControl(self):
@@ -142,6 +175,10 @@ def getAccessControl(self):
             globalPermissions=global_permissions,
             productPermissions=product_permissions)
 
+    @timeit
+    def getOauthProviders(self):
+        return self.__manager.get_oauth_providers()
+
     @timeit
     def performLogin(self, auth_method, auth_string):
         if not auth_string:
@@ -167,6 +204,57 @@ def performLogin(self, auth_method, auth_string):
                     codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
                     msg)
 
+        elif auth_method.startswith("oauth_", 0, 6):
+            provider = auth_method[6:]
+            oauth_config = self.__manager.get_oauth_config(provider)
+            if not oauth_config.get("enabled"):
+                raise codechecker_api_shared.ttypes.RequestFailed(
+                    codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
+                    "OAuth authentication is not enabled.")
+
+            client_id = oauth_config["oauth_client_id"]
+            client_secret = oauth_config["oauth_client_secret"]
+            scope = oauth_config["oauth_scope"]
+            token_url = oauth_config["oauth_token_uri"]
+            user_info_url = oauth_config["oauth_user_info_uri"]
+            redirect_uri = oauth_config["oauth_redirect_uri"]
+            allowed_users = oauth_config.get("allowed_users", [])
+
+            session = OAuth2Session(
+                client_id,
+                client_secret,
+                scope=scope,
+                redirect_uri=redirect_uri)
+            token = session.fetch_token(
+                url=token_url,
+                authorization_response=auth_string)
+
+            user_info = session.get(user_info_url).json()
+            username = user_info[
+                oauth_config["oauth_user_info_mapping"]["username"]]
+
+            if provider == "github" and \
+                    "localhost" not in user_info_url:
+                link = "https://api.github.com/user/emails"
+                for email in session.get(link).json():
+                    if email['primary']:
+                        username = email['email']
+                        break
+
+            if allowed_users == ["*"] or username in allowed_users:
+                session = self.__manager.create_session(
+                    provider + "@" + username +
+                    ":" + token['access_token'])
+                return session.token
+
+            if len(allowed_users) == 0:
+                raise codechecker_api_shared.ttypes.RequestFailed(
+                    codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
+                    "The allowed users list is empty")
+
+            raise codechecker_api_shared.ttypes.RequestFailed(
+                    codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
+                    "User is not authorized to access this service")
         raise codechecker_api_shared.ttypes.RequestFailed(
             codechecker_api_shared.ttypes.ErrorCode.AUTH_DENIED,
             "Could not negotiate via common authentication method.")