diff --git a/config/dev.exs b/config/dev.exs index cf6694d..7b4df11 100644 --- a/config/dev.exs +++ b/config/dev.exs @@ -90,4 +90,6 @@ config :mv, :secret_key_base, "ryn7D6ssmIHQFWIks2sFiTGATgwwAR1+3bN8p7fy6qVtB8qnx # Signing Secret for Authentication config :mv, :token_signing_secret, "IwUwi65TrEeExwBXXFPGm2I7889NsL" -config :mv, :oicd_client_secret , "krkpCYuLtaXUdQDcStaOQRBcfDSRvPdvpmllkraNRStBYMLXgXRlcTxoRkVDrLYv" +config :mv, + :oicd_client_secret, + "auhoZABKjohxhmeVCIDzMMUkBOtDQjPKiQiFQwmIogfaPPvBOeqtvnEJuTYIWcIc" diff --git a/docker-compose.yml b/docker-compose.yml index 03f0366..7fed5d7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -39,7 +39,7 @@ services: - SMTP_URL=mailcrab - SMTP_PORT=1025 - SMTP_DANGER_INSECURE=true - - BOOTSTRAP_ADMIN_PASSWORD_PLAIN="RAUTHY" + - BOOTSTRAP_ADMIN_PASSWORD_PLAIN=RauthyTest12345 #- HIQLITE=false #- PG_HOST=db #- PG_PORT=5432 diff --git a/lib/accounts/accounts.ex b/lib/accounts/accounts.ex index 21966ad..55e8a4b 100644 --- a/lib/accounts/accounts.ex +++ b/lib/accounts/accounts.ex @@ -1,4 +1,7 @@ defmodule Mv.Accounts do + @moduledoc """ + AshAuthentication specific domain to handle Authentication for users. + """ use Ash.Domain, extensions: [AshPhoenix] diff --git a/lib/accounts/token.ex b/lib/accounts/token.ex index 723a46b..ab9c3a7 100644 --- a/lib/accounts/token.ex +++ b/lib/accounts/token.ex @@ -1,4 +1,7 @@ defmodule Mv.Accounts.Token do + @moduledoc """ + AshAuthentication specific ressource + """ use Ash.Resource, data_layer: AshPostgres.DataLayer, extensions: [AshAuthentication.TokenResource], diff --git a/lib/accounts/user.ex b/lib/accounts/user.ex index 930bc0d..a7191a8 100644 --- a/lib/accounts/user.ex +++ b/lib/accounts/user.ex @@ -1,4 +1,7 @@ defmodule Mv.Accounts.User do + @moduledoc """ + The ressource for keeping user-specific data related to the login process. It is used by AshAuthentication to handle the Authentication strategies like SSO. + """ use Ash.Resource, domain: Mv.Accounts, data_layer: AshPostgres.DataLayer, @@ -11,10 +14,17 @@ defmodule Mv.Accounts.User do repo Mv.Repo end + @doc """ + AshAuthentication specific: Defines the strategies we want to use for authentication. + Currently password and SSO with Rauthy as OIDC provider + """ authentication do tokens do enabled? true token_resource Mv.Accounts.Token + require_token_presence_for_authentication? true + store_all_tokens? true + signing_secret fn _, _ -> {:ok, Application.get_env(:mv, :token_signing_secret)} end @@ -22,18 +32,14 @@ defmodule Mv.Accounts.User do strategies do oidc :rauthy do - client_id "mv" - base_url "http://localhost:8080/auth/v1" - redirect_uri "http://localhost:4000/auth/user/rauthy/callback" - auth_method :client_secret_jwt - #id_token_signed_response_alg "EdDSA" - #user_url "http://localhost:8080/auth/v1/oidc/userinfo" - #token_url "http://localhost:8080/auth/v1/oidc/token" - #authorize_url "http://localhost:8080/auth/v1/oidc/authorize" - registration_enabled? false - code_verifier true - client_secret fn _, _ -> - Application.fetch_env(:mv, :oicd_client_secret) + client_id "mv" + base_url "http://localhost:8080/auth/v1" + redirect_uri "http://localhost:4000/auth/user/rauthy/callback" + auth_method :client_secret_jwt + code_verifier true + + client_secret fn _, _ -> + Application.fetch_env(:mv, :oicd_client_secret) end end @@ -62,9 +68,24 @@ defmodule Mv.Accounts.User do filter expr(email == get_path(^arg(:user_info), [:email])) end - end - ## TODO: registration ergänzen, seed rausnehmen, oidc_id aus user_info map holen + create :register_with_rauthy do + argument :user_info, :map, allow_nil?: false + argument :oauth_tokens, :map, allow_nil?: false + upsert? true + upsert_identity :unique_email + + change AshAuthentication.GenerateTokenChange + + change fn changeset, _ctx -> + user_info = Ash.Changeset.get_argument(changeset, :user_info) + + changeset + |> Ash.Changeset.change_attribute(:email, user_info["preferred_username"]) + |> Ash.Changeset.change_attribute(:oidc_id, user_info["id"]) + end + end + end attributes do uuid_primary_key :id diff --git a/lib/accounts/user_identity.exs b/lib/accounts/user_identity.exs index 1fe54f8..fd8d2c9 100644 --- a/lib/accounts/user_identity.exs +++ b/lib/accounts/user_identity.exs @@ -1,15 +1,18 @@ defmodule Mv.Accounts.UserIdentity do + @moduledoc """ + AshAuthentication specific ressource + """ use Ash.Resource, data_layer: AshPostgres.DataLayer, extensions: [AshAuthentication.UserIdentity], domain: Mv.Accounts - user_identity do - user_resource Mv.Accounts.User - end - postgres do table "user_identities" repo Mv.Repo end + + user_identity do + user_resource Mv.Accounts.User + end end diff --git a/lib/mv_web/controllers/auth_controller.ex b/lib/mv_web/controllers/auth_controller.ex index f3dd287..613c8d1 100644 --- a/lib/mv_web/controllers/auth_controller.ex +++ b/lib/mv_web/controllers/auth_controller.ex @@ -22,8 +22,6 @@ defmodule MvWeb.AuthController do end def failure(conn, activity, reason) do - IO.puts(inspect(reason)) - message = case {activity, reason} do {_, @@ -50,7 +48,7 @@ defmodule MvWeb.AuthController do return_to = get_session(conn, :return_to) || ~p"/" conn - |> clear_session() + |> clear_session(:mv) |> put_flash(:info, "You are now signed out") |> redirect(to: return_to) end diff --git a/lib/mv_web/controllers/page_html/home.html.heex b/lib/mv_web/controllers/page_html/home.html.heex index 8cf0506..f13765e 100644 --- a/lib/mv_web/controllers/page_html/home.html.heex +++ b/lib/mv_web/controllers/page_html/home.html.heex @@ -1,3 +1,6 @@ +