github/jumpserver
1
0
Fork 0
mirror of https://github.com/jumpserver/jumpserver.git synced 2025-07-12 06:08:22 +00:00
Code Issues Projects Releases Wiki Activity

fix: integrate with azure oidc

Browse Source
This commit is contained in:
ibuler 2025-07-10 10:29:05 +08:00 committed by 老广
parent 33b0068f49
commit 7da74dc6e8
4 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
apps/authentication/backends/oidc/backends.py
View File

@ -224,7 +224,6 @@ class OIDCAuthCodeBackend(OIDCBaseBackend):
user_auth_failed.send( user_auth_failed.send(
sender=self.__class__, request=request, username=user.username, sender=self.__class__, request=request, username=user.username,
reason="User is invalid", backend=settings.AUTH_BACKEND_OIDC_CODE reason="User is invalid", backend=settings.AUTH_BACKEND_OIDC_CODE
) )
return None return None

6
apps/authentication/backends/oidc/utils.py
View File

@ -10,16 +10,15 @@ import datetime as dt
from calendar import timegm from calendar import timegm
from urllib.parse import urlparse from urllib.parse import urlparse
from django.conf import settings
from django.core.exceptions import SuspiciousOperation from django.core.exceptions import SuspiciousOperation
from django.utils.encoding import force_bytes, smart_bytes from django.utils.encoding import force_bytes, smart_bytes
from jwkest import JWKESTException from jwkest import JWKESTException
from jwkest.jwk import KEYS from jwkest.jwk import KEYS
from jwkest.jws import JWS from jwkest.jws import JWS
from django.conf import settings
from common.utils import get_logger from common.utils import get_logger
logger = get_logger(__file__) logger = get_logger(__file__)
@ -99,7 +98,8 @@ def _validate_claims(id_token, nonce=None, validate_nonce=True):
raise SuspiciousOperation('Incorrect id_token: nbf') raise SuspiciousOperation('Incorrect id_token: nbf')
# Verifies that the token was issued in the allowed timeframe. # Verifies that the token was issued in the allowed timeframe.
if utc_timestamp > id_token['iat'] + settings.AUTH_OPENID_ID_TOKEN_MAX_AGE: max_age = settings.AUTH_OPENID_ID_TOKEN_MAX_AGE
if utc_timestamp > id_token['iat'] + max_age:
logger.debug(log_prompt.format('Incorrect id_token: iat')) logger.debug(log_prompt.format('Incorrect id_token: iat'))
raise SuspiciousOperation('Incorrect id_token: iat') raise SuspiciousOperation('Incorrect id_token: iat')

2
apps/jumpserver/conf.py
View File

@ -349,7 +349,7 @@ class Config(dict):
'AUTH_OPENID_PROVIDER_SIGNATURE_ALG': 'HS256', 'AUTH_OPENID_PROVIDER_SIGNATURE_ALG': 'HS256',
'AUTH_OPENID_PROVIDER_SIGNATURE_KEY': None, 'AUTH_OPENID_PROVIDER_SIGNATURE_KEY': None,
'AUTH_OPENID_SCOPES': 'openid profile email', 'AUTH_OPENID_SCOPES': 'openid profile email',
'AUTH_OPENID_ID_TOKEN_MAX_AGE': 60, 'AUTH_OPENID_ID_TOKEN_MAX_AGE': 600,
'AUTH_OPENID_ID_TOKEN_INCLUDE_CLAIMS': True, 'AUTH_OPENID_ID_TOKEN_INCLUDE_CLAIMS': True,
'AUTH_OPENID_USE_STATE': True, 'AUTH_OPENID_USE_STATE': True,
'AUTH_OPENID_USE_NONCE': True, 'AUTH_OPENID_USE_NONCE': True,

22
apps/users/signal_handlers.py
View File

@ -155,11 +155,13 @@ def radius_create_user(sender, user, **kwargs):
@receiver(openid_create_or_update_user) @receiver(openid_create_or_update_user)
def on_openid_create_or_update_user(sender, user, created, attrs, **kwargs): def on_openid_create_or_update_user(sender, user, created, attrs, **kwargs):
group_names = attrs.get('groups')
if created: if created:
org_ids = bind_user_to_org_role(user) org_ids = bind_user_to_org_role(user)
group_names = attrs.get('groups') else:
bind_user_to_group(org_ids, group_names, user) org_ids = user.joined_orgs.values_list('id', flat=True)
bind_user_to_group(org_ids, group_names, user)
source = User.Source.openid.value source = User.Source.openid.value
user_authenticated_handle(user, created, source, attrs, **kwargs) user_authenticated_handle(user, created, source, attrs, **kwargs)
@ -235,6 +237,7 @@ def bind_user_to_group(org_ids, group_names, user):
return return
org_ids = org_ids or [Organization.DEFAULT_ID] org_ids = org_ids or [Organization.DEFAULT_ID]
org_ids = [str(i) for i in org_ids if i]
with tmp_to_root_org(): with tmp_to_root_org():
existing_groups = UserGroup.objects.filter(org_id__in=org_ids).values_list('org_id', 'name') existing_groups = UserGroup.objects.filter(org_id__in=org_ids).values_list('org_id', 'name')
@ -252,12 +255,19 @@ def bind_user_to_group(org_ids, group_names, user):
) )
UserGroup.objects.bulk_create(groups_to_create) UserGroup.objects.bulk_create(groups_to_create)
user_groups = UserGroup.objects.filter(org_id__in=org_ids, name__in=group_names) user_groups = UserGroup.objects.filter(org_id__in=org_ids, name__in=group_names)
user_group_ids = set(user_groups.values_list('id', flat=True))
exist_group_ids = set(
User.groups.through.objects.filter(user_id=user.id)
.values_list('usergroup_id', flat=True)
)
need_add_group_ids = user_group_ids - exist_group_ids
user_group_links = [ user_group_links = [
User.groups.through(user_id=user.id, usergroup_id=group.id) User.groups.through(user_id=user.id, usergroup_id=group_id)
for group in user_groups for group_id in need_add_group_ids
] ]
if user_group_links: if user_group_links:
User.groups.through.objects.bulk_create(user_group_links) User.groups.through.objects.bulk_create(user_group_links, ignore_conflicts=True)