Dionisio
8ef62109a3
Implements OIDC Authorization Code Flow for external identity providers (Authentik, Keycloak, etc.) with JIT user provisioning. New features: - OidcService with OpenID Discovery, JWKS caching, RS256 ID token validation - Authorization Code Flow: /api/auth/oidc/authorize -> IdP -> /api/auth/oidc/callback - JIT user provisioning from OIDC claims (sub, email, name, groups) - OIDC group-to-role mapping (admin_groups config) - Provider info endpoint: GET /api/auth/oidc/providers - Option to disable password login entirely (OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN) - Auto-provision toggle (OXICLOUD_OIDC_AUTO_PROVISION) - Email collision detection (security: prevents account takeover) Configuration (env vars): - OXICLOUD_OIDC_ENABLED, OXICLOUD_OIDC_ISSUER_URL - OXICLOUD_OIDC_CLIENT_ID, OXICLOUD_OIDC_CLIENT_SECRET - OXICLOUD_OIDC_REDIRECT_URI, OXICLOUD_OIDC_SCOPES - OXICLOUD_OIDC_FRONTEND_URL, OXICLOUD_OIDC_PROVIDER_NAME - OXICLOUD_OIDC_AUTO_PROVISION, OXICLOUD_OIDC_ADMIN_GROUPS - OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN DB migration: - ALTER TABLE auth.users ADD oidc_provider, oidc_subject columns - UNIQUE index on (oidc_provider, oidc_subject) Files changed: 14 files, ~1400 lines added Dependencies: reqwest 0.12 (rustls-tls-webpki-roots), base64 0.22
114 lines
3.1 KiB
Rust
114 lines
3.1 KiB
Rust
use serde::{Serialize, Deserialize};
|
|
use chrono::{DateTime, Utc};
|
|
use crate::domain::entities::user::User;
|
|
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct UserDto {
|
|
pub id: String,
|
|
pub username: String,
|
|
pub email: String,
|
|
pub role: String,
|
|
pub storage_quota_bytes: i64,
|
|
pub storage_used_bytes: i64,
|
|
pub created_at: DateTime<Utc>,
|
|
pub updated_at: DateTime<Utc>,
|
|
pub last_login_at: Option<DateTime<Utc>>,
|
|
pub active: bool,
|
|
}
|
|
|
|
impl From<User> for UserDto {
|
|
fn from(user: User) -> Self {
|
|
Self {
|
|
id: user.id().to_string(),
|
|
username: user.username().to_string(),
|
|
email: user.email().to_string(),
|
|
role: format!("{}", user.role()),
|
|
storage_quota_bytes: user.storage_quota_bytes(),
|
|
storage_used_bytes: user.storage_used_bytes(),
|
|
created_at: user.created_at(),
|
|
updated_at: user.updated_at(),
|
|
last_login_at: user.last_login_at(),
|
|
active: user.is_active(),
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
pub struct LoginDto {
|
|
pub username: String,
|
|
pub password: String,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, Deserialize, Clone)]
|
|
pub struct RegisterDto {
|
|
pub username: String,
|
|
pub email: String,
|
|
pub password: String,
|
|
pub role: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct AuthResponseDto {
|
|
pub user: UserDto,
|
|
pub access_token: String,
|
|
pub refresh_token: String,
|
|
pub token_type: String,
|
|
pub expires_in: i64,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct ChangePasswordDto {
|
|
pub current_password: String,
|
|
pub new_password: String,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct RefreshTokenDto {
|
|
pub refresh_token: String,
|
|
}
|
|
|
|
/// Datos del usuario autenticado actual (para uso en servicios de application)
|
|
#[derive(Clone, Debug, Serialize, Deserialize)]
|
|
pub struct CurrentUser {
|
|
pub id: String,
|
|
pub username: String,
|
|
pub email: String,
|
|
pub role: String,
|
|
}
|
|
|
|
// ============================================================================
|
|
// OIDC DTOs
|
|
// ============================================================================
|
|
|
|
/// Response with the OIDC authorization URL for client redirect
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct OidcAuthorizeResponseDto {
|
|
pub authorize_url: String,
|
|
pub state: String,
|
|
}
|
|
|
|
/// Query parameters received on the OIDC callback
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct OidcCallbackQueryDto {
|
|
pub code: String,
|
|
pub state: String,
|
|
}
|
|
|
|
/// Information about available OIDC providers
|
|
#[derive(Debug, Serialize, Deserialize)]
|
|
pub struct OidcProviderInfoDto {
|
|
pub enabled: bool,
|
|
pub provider_name: String,
|
|
pub authorize_endpoint: String,
|
|
pub password_login_enabled: bool,
|
|
}
|
|
|
|
/// Claims extracted from the validated OIDC ID token
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct OidcUserInfoDto {
|
|
pub sub: String,
|
|
pub preferred_username: Option<String>,
|
|
pub email: Option<String>,
|
|
pub name: Option<String>,
|
|
pub groups: Vec<String>,
|
|
} |