github/jumpserver
1
0
Fork 0
mirror of https://github.com/jumpserver/jumpserver.git synced 2025-07-11 21:58:17 +00:00
Code Issues Projects Releases Wiki Activity

fix: integrate with azure oidc

Browse Source
This commit is contained in:
ibuler 2025-07-10 10:29:05 +08:00 committed by 老广
parent 33b0068f49
commit 7da74dc6e8
4 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
apps/authentication/backends/oidc/backends.py
View File

@ -224,7 +224,6 @@ class OIDCAuthCodeBackend(OIDCBaseBackend):
user_auth_failed.send(
sender=self.__class__, request=request, username=user.username,
reason="User is invalid", backend=settings.AUTH_BACKEND_OIDC_CODE
)
return None

6
apps/authentication/backends/oidc/utils.py
View File

@ -10,16 +10,15 @@ import datetime as dt
from calendar import timegm
from urllib.parse import urlparse
from django.conf import settings
from django.core.exceptions import SuspiciousOperation
from django.utils.encoding import force_bytes, smart_bytes
from jwkest import JWKESTException
from jwkest.jwk import KEYS
from jwkest.jws import JWS
from django.conf import settings
from common.utils import get_logger
logger = get_logger(__file__)
@ -99,7 +98,8 @@ def _validate_claims(id_token, nonce=None, validate_nonce=True):
raise SuspiciousOperation('Incorrect id_token: nbf')
# Verifies that the token was issued in the allowed timeframe.
if utc_timestamp > id_token['iat'] + settings.AUTH_OPENID_ID_TOKEN_MAX_AGE:
max_age = settings.AUTH_OPENID_ID_TOKEN_MAX_AGE
if utc_timestamp > id_token['iat'] + max_age:
logger.debug(log_prompt.format('Incorrect id_token: iat'))
raise SuspiciousOperation('Incorrect id_token: iat')

2
apps/jumpserver/conf.py
View File

@ -349,7 +349,7 @@ class Config(dict):
'AUTH_OPENID_PROVIDER_SIGNATURE_ALG': 'HS256',
'AUTH_OPENID_PROVIDER_SIGNATURE_KEY': None,
'AUTH_OPENID_SCOPES': 'openid profile email',
'AUTH_OPENID_ID_TOKEN_MAX_AGE': 60,
'AUTH_OPENID_ID_TOKEN_MAX_AGE': 600,
'AUTH_OPENID_ID_TOKEN_INCLUDE_CLAIMS': True,
'AUTH_OPENID_USE_STATE': True,
'AUTH_OPENID_USE_NONCE': True,

22
apps/users/signal_handlers.py
View File

@ -155,11 +155,13 @@ def radius_create_user(sender, user, **kwargs):
@receiver(openid_create_or_update_user)
def on_openid_create_or_update_user(sender, user, created, attrs, **kwargs):
group_names = attrs.get('groups')
if created:
org_ids = bind_user_to_org_role(user)
group_names = attrs.get('groups')
bind_user_to_group(org_ids, group_names, user)
else:
org_ids = user.joined_orgs.values_list('id', flat=True)
bind_user_to_group(org_ids, group_names, user)
source = User.Source.openid.value
user_authenticated_handle(user, created, source, attrs, **kwargs)
@ -235,6 +237,7 @@ def bind_user_to_group(org_ids, group_names, user):
return
org_ids = org_ids or [Organization.DEFAULT_ID]
org_ids = [str(i) for i in org_ids if i]
with tmp_to_root_org():
existing_groups = UserGroup.objects.filter(org_id__in=org_ids).values_list('org_id', 'name')
@ -252,12 +255,19 @@ def bind_user_to_group(org_ids, group_names, user):
)
UserGroup.objects.bulk_create(groups_to_create)
user_groups = UserGroup.objects.filter(org_id__in=org_ids, name__in=group_names)
user_group_ids = set(user_groups.values_list('id', flat=True))
exist_group_ids = set(
User.groups.through.objects.filter(user_id=user.id)
.values_list('usergroup_id', flat=True)
)
need_add_group_ids = user_group_ids - exist_group_ids
user_group_links = [
User.groups.through(user_id=user.id, usergroup_id=group.id)
for group in user_groups
User.groups.through(user_id=user.id, usergroup_id=group_id)
for group_id in need_add_group_ids
]
if user_group_links:
User.groups.through.objects.bulk_create(user_group_links)
User.groups.through.objects.bulk_create(user_group_links, ignore_conflicts=True)