Skip to content

Commit e91a2cf

Browse files
techknowlogicktechknowlogick
authored
Add/remove/list oauth providers via cli (#4591)
1 parent 8e3e59f commit e91a2cf

File tree

2 files changed

+330
-0
lines changed

2 files changed

+330
-0
lines changed

‎cmd/admin.go

+286
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,12 @@ package cmd
77

88
import (
99
"fmt"
10+
"os"
11+
"text/tabwriter"
1012

1113
"code.gitea.io/git"
1214
"code.gitea.io/gitea/models"
15+
"code.gitea.io/gitea/modules/auth/oauth2"
1316
"code.gitea.io/gitea/modules/log"
1417
"code.gitea.io/gitea/modules/setting"
1518

@@ -26,6 +29,7 @@ var (
2629
subcmdChangePassword,
2730
subcmdRepoSyncReleases,
2831
subcmdRegenerate,
32+
subcmdAuth,
2933
},
3034
}
3135

@@ -121,6 +125,121 @@ var (
121125
},
122126
},
123127
}
128+
129+
subcmdAuth = cli.Command{
130+
Name: "auth",
131+
Usage: "Modify external auth providers",
132+
Subcommands: []cli.Command{
133+
microcmdAuthAddOauth,
134+
microcmdAuthUpdateOauth,
135+
microcmdAuthList,
136+
microcmdAuthDelete,
137+
},
138+
}
139+
140+
microcmdAuthList = cli.Command{
141+
Name: "list",
142+
Usage: "List auth sources",
143+
Action: runListAuth,
144+
Flags: []cli.Flag{
145+
cli.StringFlag{
146+
Name: "config, c",
147+
Value: "custom/conf/app.ini",
148+
Usage: "Custom configuration file path",
149+
},
150+
},
151+
}
152+
153+
idFlag = cli.Int64Flag{
154+
Name: "id",
155+
Usage: "ID of OAuth authentication source",
156+
}
157+
158+
microcmdAuthDelete = cli.Command{
159+
Name: "delete",
160+
Usage: "Delete specific auth source",
161+
Action: runDeleteAuth,
162+
Flags: []cli.Flag{
163+
cli.StringFlag{
164+
Name: "config, c",
165+
Value: "custom/conf/app.ini",
166+
Usage: "Custom configuration file path",
167+
},
168+
idFlag,
169+
},
170+
}
171+
172+
oauthCLIFlags = []cli.Flag{
173+
cli.StringFlag{
174+
Name: "config, c",
175+
Value: "custom/conf/app.ini",
176+
Usage: "Custom configuration file path",
177+
},
178+
cli.StringFlag{
179+
Name: "name",
180+
Value: "",
181+
Usage: "Application Name",
182+
},
183+
cli.StringFlag{
184+
Name: "provider",
185+
Value: "",
186+
Usage: "OAuth2 Provider",
187+
},
188+
cli.StringFlag{
189+
Name: "key",
190+
Value: "",
191+
Usage: "Client ID (Key)",
192+
},
193+
cli.StringFlag{
194+
Name: "secret",
195+
Value: "",
196+
Usage: "Client Secret",
197+
},
198+
cli.StringFlag{
199+
Name: "auto-discover-url",
200+
Value: "",
201+
Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
202+
},
203+
cli.StringFlag{
204+
Name: "use-custom-urls",
205+
Value: "false",
206+
Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
207+
},
208+
cli.StringFlag{
209+
Name: "custom-auth-url",
210+
Value: "",
211+
Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
212+
},
213+
cli.StringFlag{
214+
Name: "custom-token-url",
215+
Value: "",
216+
Usage: "Use a custom Token URL (option for GitLab/GitHub)",
217+
},
218+
cli.StringFlag{
219+
Name: "custom-profile-url",
220+
Value: "",
221+
Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
222+
},
223+
cli.StringFlag{
224+
Name: "custom-email-url",
225+
Value: "",
226+
Usage: "Use a custom Email URL (option for GitHub)",
227+
},
228+
}
229+
230+
microcmdAuthUpdateOauth = cli.Command{
231+
Name: "update-oauth",
232+
Usage: "Update existing Oauth authentication source",
233+
Action: runUpdateOauth,
234+
Flags: append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
235+
}
236+
237+
microcmdAuthAddOauth = cli.Command{
238+
Name: "add-oauth",
239+
Usage: "Add new Oauth authentication source",
240+
Action: runAddOauth,
241+
Flags: oauthCLIFlags,
242+
}
124243
)
125244

126245
func runChangePassword(c *cli.Context) error {
@@ -262,3 +381,170 @@ func runRegenerateKeys(c *cli.Context) error {
262381
}
263382
return models.RewriteAllPublicKeys()
264383
}
384+
385+
func parseOAuth2Config(c *cli.Context) *models.OAuth2Config {
386+
var customURLMapping *oauth2.CustomURLMapping
387+
if c.IsSet("use-custom-urls") {
388+
customURLMapping = &oauth2.CustomURLMapping{
389+
TokenURL: c.String("custom-token-url"),
390+
AuthURL: c.String("custom-auth-url"),
391+
ProfileURL: c.String("custom-profile-url"),
392+
EmailURL: c.String("custom-email-url"),
393+
}
394+
} else {
395+
customURLMapping = nil
396+
}
397+
return &models.OAuth2Config{
398+
Provider: c.String("provider"),
399+
ClientID: c.String("key"),
400+
ClientSecret: c.String("secret"),
401+
OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
402+
CustomURLMapping: customURLMapping,
403+
}
404+
}
405+
406+
func runAddOauth(c *cli.Context) error {
407+
if c.IsSet("config") {
408+
setting.CustomConf = c.String("config")
409+
}
410+
411+
if err := initDB(); err != nil {
412+
return err
413+
}
414+
415+
if err := models.CreateLoginSource(&models.LoginSource{
416+
Type: models.LoginOAuth2,
417+
Name: c.String("name"),
418+
IsActived: true,
419+
Cfg: parseOAuth2Config(c),
420+
}); err != nil {
421+
return err
422+
}
423+
424+
return nil
425+
}
426+
427+
func runUpdateOauth(c *cli.Context) error {
428+
if c.IsSet("config") {
429+
setting.CustomConf = c.String("config")
430+
}
431+
432+
if !c.IsSet("id") {
433+
return fmt.Errorf("--id flag is missing")
434+
}
435+
436+
if err := initDB(); err != nil {
437+
return err
438+
}
439+
440+
source, err := models.GetLoginSourceByID(c.Int64("id"))
441+
if err != nil {
442+
return err
443+
}
444+
445+
oAuth2Config := source.OAuth2()
446+
447+
if c.IsSet("name") {
448+
source.Name = c.String("name")
449+
}
450+
451+
if c.IsSet("provider") {
452+
oAuth2Config.Provider = c.String("provider")
453+
}
454+
455+
if c.IsSet("key") {
456+
oAuth2Config.ClientID = c.String("key")
457+
}
458+
459+
if c.IsSet("secret") {
460+
oAuth2Config.ClientSecret = c.String("secret")
461+
}
462+
463+
if c.IsSet("auto-discover-url") {
464+
oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
465+
}
466+
467+
// update custom URL mapping
468+
var customURLMapping *oauth2.CustomURLMapping
469+
470+
if oAuth2Config.CustomURLMapping != nil {
471+
customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
472+
customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
473+
customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
474+
customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
475+
}
476+
if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
477+
customURLMapping.TokenURL = c.String("custom-token-url")
478+
}
479+
480+
if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
481+
customURLMapping.AuthURL = c.String("custom-auth-url")
482+
}
483+
484+
if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
485+
customURLMapping.ProfileURL = c.String("custom-profile-url")
486+
}
487+
488+
if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
489+
customURLMapping.EmailURL = c.String("custom-email-url")
490+
}
491+
492+
oAuth2Config.CustomURLMapping = customURLMapping
493+
source.Cfg = oAuth2Config
494+
495+
if err := models.UpdateSource(source); err != nil {
496+
return err
497+
}
498+
499+
return nil
500+
}
501+
502+
func runListAuth(c *cli.Context) error {
503+
if c.IsSet("config") {
504+
setting.CustomConf = c.String("config")
505+
}
506+
507+
if err := initDB(); err != nil {
508+
return err
509+
}
510+
511+
loginSources, err := models.LoginSources()
512+
513+
if err != nil {
514+
return err
515+
}
516+
517+
// loop through each source and print
518+
w := tabwriter.NewWriter(os.Stdout, 0, 0, 1, ' ', tabwriter.AlignRight)
519+
fmt.Fprintf(w, "ID\tName\tType\tEnabled")
520+
for _, source := range loginSources {
521+
fmt.Fprintf(w, "%d\t%s\t%s\t%t", source.ID, source.Name, models.LoginNames[source.Type], source.IsActived)
522+
}
523+
w.Flush()
524+
525+
return nil
526+
}
527+
528+
func runDeleteAuth(c *cli.Context) error {
529+
if c.IsSet("config") {
530+
setting.CustomConf = c.String("config")
531+
}
532+
533+
if !c.IsSet("id") {
534+
return fmt.Errorf("--id flag is missing")
535+
}
536+
537+
if err := initDB(); err != nil {
538+
return err
539+
}
540+
541+
source, err := models.GetLoginSourceByID(c.Int64("id"))
542+
if err != nil {
543+
return err
544+
}
545+
546+
if err = models.DeleteSource(source); err != nil {
547+
return err
548+
}
549+
return nil
550+
}

‎docs/content/doc/usage/command-line.md

+44
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,50 @@ Admin operations:
7272
- Examples:
7373
- `gitea admin regenerate hooks`
7474
- `gitea admin regenerate keys`
75+
- `auth`:
76+
- `list`:
77+
- Description: lists all external authentication sources that exist
78+
- Options:
79+
- `--config path`: Gitea configuration file path. Optional. (default: custom/conf/app.ini).
80+
- Examples:
81+
- `gitea auth list`
82+
- `delete`:
83+
- Options:
84+
- `--id`: ID of source to be deleted. Required.
85+
- `--config path`: Gitea configuration file path. Optional. (default: custom/conf/app.ini).
86+
- Examples:
87+
- `gitea auth delete --id 1`
88+
- `add-oauth`:
89+
- Options:
90+
- `--config path`: Gitea configuration file path. Optional. (default: custom/conf/app.ini).
91+
- `--name`: Application Name.
92+
- `--provider`: OAuth2 Provider.
93+
- `--key`: Client ID (Key).
94+
- `--secret`: Client Secret.
95+
- `--auto-discover-url`: OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider).
96+
- `--use-custom-urls`: Use custom URLs for GitLab/GitHub OAuth endpoints.
97+
- `--custom-auth-url`: Use a custom Authorization URL (option for GitLab/GitHub).
98+
- `--custom-token-url`: Use a custom Token URL (option for GitLab/GitHub).
99+
- `--custom-profile-url`: Use a custom Profile URL (option for GitLab/GitHub).
100+
- `--custom-email-url`: Use a custom Email URL (option for GitHub).
101+
- Examples:
102+
- `gitea auth add-oauth --name external-github --provider github --key OBTAIN_FROM_SOURCE --secret OBTAIN_FROM_SOURCE`
103+
- `update-oauth`:
104+
- Options:
105+
- `--id`: ID of source to be updated. Required.
106+
- `--config path`: Gitea configuration file path. Optional. (default: custom/conf/app.ini).
107+
- `--name`: Application Name.
108+
- `--provider`: OAuth2 Provider.
109+
- `--key`: Client ID (Key).
110+
- `--secret`: Client Secret.
111+
- `--auto-discover-url`: OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider).
112+
- `--use-custom-urls`: Use custom URLs for GitLab/GitHub OAuth endpoints.
113+
- `--custom-auth-url`: Use a custom Authorization URL (option for GitLab/GitHub).
114+
- `--custom-token-url`: Use a custom Token URL (option for GitLab/GitHub).
115+
- `--custom-profile-url`: Use a custom Profile URL (option for GitLab/GitHub).
116+
- `--custom-email-url`: Use a custom Email URL (option for GitHub).
117+
- Examples:
118+
- `gitea auth update-oauth --id 1 --name external-github-updated`
75119

76120
#### cert
77121

0 commit comments

Comments
 (0)