-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Release/2.0.0
- Loading branch information
Showing
19 changed files
with
1,050 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| ## Tide OAuth | ||
|
|
||
| ### Prerequisites | ||
| 1. Consumers module: https://www.drupal.org/project/consumers | ||
| 2. Simple OAuth module: https://www.drupal.org/project/simple_oauth | ||
|
|
||
| ### Installation | ||
| 1. _(Optional)_ Generate a key pair and set environment variables | ||
| ```shell script | ||
| $ openssl genrsa -out /tmp/private.key 4096 | ||
| $ openssl rsa -in /tmp/private.key -pubout > /tmp/public.key | ||
| $ export TIDE_OAUTH_PRIVATE_KEY=`cat /tmp/private.key` | ||
| $ export TIDE_OAUTH_PUBLIC_KEY=`cat /tmp/public.key` | ||
| ``` | ||
| 2. Enable the `tide_oauth` module. | ||
| * If the TIDE_OAUTH_ environment variables are set, the module will copy | ||
| the keys to `private://oauth.key` and `private://oauth.pub`. | ||
| * Otherwise, the module will generate a new key pair. | ||
| 3. _(Optional - **Lagoon only**)_ Add a `post-rollout` task to generate the OAuth | ||
| key pair from environment variables upon deployment. | ||
| ```yaml | ||
| tasks: | ||
| post-rollout: | ||
| - run: | ||
| name: Generate OAuth keys from ENV variables. | ||
| command: 'drush tide-oauth:keygen' | ||
| service: cli | ||
| ``` | ||
|
|
||
| ### Authentication | ||
| 1. See the documentation of [Simple OAuth2](https://www.drupal.org/node/2843627) | ||
| 2. Due to both JWT Authentication module and Simple OAuth module accept | ||
| `Authorization: Bearer {TOKEN}` header, Tide OAuth provides extra headers: | ||
| * `Authorization: OAuth2 {TOKEN}` | ||
| * `X-OAuth2-Authorization: Bearer {TOKEN}` | ||
| * `X-OAuth2-Authorization: OAuth2 {TOKEN}` | ||
|
|
||
| When Tide Authenticated Content or JWT module is enabled, all OAuth2 | ||
| authentication calls should one of the custom headers as the normal | ||
| `Authorization` header is always authenticated against JWT Authentication. | ||
| 3. By default, the module creates a client `Editorial Preview` with the scope | ||
| `editor`. All OAuth2 authentication requests using this client will have | ||
| permissions of the `Editor` role. | ||
| 4. OAuth2 endpoints: | ||
| * Authorization URL: `/oauth/authorize` | ||
| * Access token URL: `/oauth/token` | ||
| 5. Default expiration time: | ||
| * Access token: 5 minutes | ||
| * Authorization code: 5 minutes | ||
| * Refresh token: 2 weeks |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| { | ||
| "name": "dpc-sdp/tide_oauth", | ||
| "type": "drupal-drush", | ||
| "description": "Drush commands for Tide OAuth.", | ||
| "extra": { | ||
| "drush": { | ||
| "services": { | ||
| "drush.services.yml": "^9" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| services: | ||
| tide_oauth.commands: | ||
| class: \Drupal\tide_oauth\Commands\TideOauthCommands | ||
| arguments: ['@tide_oauth.env_key_generator'] | ||
| tags: | ||
| - { name: drush.command } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| <?php | ||
|
|
||
| /** | ||
| * @file | ||
| * Tide OAuth Drush commands. | ||
| */ | ||
|
|
||
| /** | ||
| * Implements hook_drush_command(). | ||
| */ | ||
| function tide_oauth_drush_command() { | ||
| $commands['tide-oauth-keygen'] = [ | ||
| 'description' => 'Generate OAuth keys from environment variables', | ||
| 'drupal dependencies' => ['tide_oauth'], | ||
| 'aliases' => ['tokgn', 'tide-oauth:keygen'], | ||
| ]; | ||
| return $commands; | ||
| } | ||
|
|
||
| /** | ||
| * Callback for tide-oauth:keygen command. | ||
| */ | ||
| function drush_tide_oauth_keygen() { | ||
| /** @var \Drupal\tide_oauth\EnvKeyGenerator $env_key_generator */ | ||
| $env_key_generator = \Drupal::service('tide_oauth.env_key_generator'); | ||
| // Generate the OAuth encryption keys from Environment variables. | ||
| if ($env_key_generator->generateEnvKeys()) { | ||
| // Update Simple OAuth settings. | ||
| $env_key_generator->setSimpleOauthKeySettings(); | ||
| } | ||
| else { | ||
| drush_set_error('Could not generate OAuth keys.'); | ||
| } | ||
| } |
56 changes: 56 additions & 0 deletions
56
modules/tide_oauth/src/Authentication/Provider/XSimpleOauthAuthenticationProvider.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| <?php | ||
|
|
||
| namespace Drupal\tide_oauth\Authentication\Provider; | ||
|
|
||
| use Drupal\simple_oauth\Authentication\Provider\SimpleOauthAuthenticationProvider; | ||
| use Symfony\Component\HttpFoundation\Request; | ||
|
|
||
| /** | ||
| * Class XSimpleOauthAuthenticationProvider. | ||
| * | ||
| * @internal | ||
| * @package Drupal\tide_oauth\Authentication\Provider | ||
| */ | ||
| class XSimpleOauthAuthenticationProvider extends SimpleOauthAuthenticationProvider { | ||
|
|
||
| /** | ||
| * {@inheritdoc} | ||
| */ | ||
| public function authenticate(Request $request) { | ||
| // X-OAuth2-Authorization does not comply to OAuth2 so that we need to | ||
| // set Authorization header as per the OAuth2 specs. | ||
| // However, Authorization header will trigger JWT Authentication (if exists) | ||
| // hence we need to clone the request instead of modifying the original. | ||
| $oauth2_request = clone $request; | ||
| $auth_header = trim($request->headers->get('Authorization', '', TRUE)); | ||
| if ((strpos($auth_header, 'OAuth2 ') !== FALSE) || ($auth_header === 'OAuth2')) { | ||
| $oauth2_request->headers->add([ | ||
| 'Authorization' => str_replace('OAuth2', 'Bearer', $auth_header), | ||
| ]); | ||
| } | ||
| else { | ||
| $x_auth_header = trim($oauth2_request->headers->get('X-OAuth2-Authorization', '', TRUE)); | ||
| if (($x_auth_header === 'Bearer') || (strpos($x_auth_header, 'Bearer ') !== FALSE)) { | ||
| $oauth2_request->headers->add(['Authorization' => $x_auth_header]); | ||
| } | ||
| elseif (($x_auth_header === 'OAuth2') || (strpos($x_auth_header, 'OAuth2 ') !== FALSE)) { | ||
| $oauth2_request->headers->add([ | ||
| 'Authorization' => str_replace('OAuth2', 'Bearer', $x_auth_header), | ||
| ]); | ||
| } | ||
| } | ||
|
|
||
| $account = parent::authenticate($oauth2_request); | ||
| if ($account) { | ||
| // Inherit uploaded files for the current request. | ||
| /* @link https://www.drupal.org/project/drupal/issues/2934486 */ | ||
| $request->files->add($oauth2_request->files->all()); | ||
| // Set consumer ID header on successful authentication, so negotiators | ||
| // will trigger correctly. | ||
| $request->headers->set('X-Consumer-ID', $account->getConsumer()->uuid()); | ||
| } | ||
|
|
||
| return $account; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| <?php | ||
|
|
||
| namespace Drupal\tide_oauth\Commands; | ||
|
|
||
| use Drupal\tide_oauth\EnvKeyGenerator; | ||
| use Drush\Commands\DrushCommands; | ||
|
|
||
| /** | ||
| * Class TideOauthCommands. | ||
| * | ||
| * @package Drupal\tide_oauth\Commands | ||
| */ | ||
| class TideOauthCommands extends DrushCommands { | ||
|
|
||
| /** | ||
| * Env Key Generator. | ||
| * | ||
| * @var \Drupal\tide_oauth\EnvKeyGenerator | ||
| */ | ||
| protected $envKeyGenerator; | ||
|
|
||
| /** | ||
| * TideOauthCommands constructor. | ||
| * | ||
| * @param \Drupal\tide_oauth\EnvKeyGenerator $env_key_generator | ||
| * Env Key Generator. | ||
| */ | ||
| public function __construct(EnvKeyGenerator $env_key_generator) { | ||
| parent::__construct(); | ||
| $this->envKeyGenerator = $env_key_generator; | ||
| } | ||
|
|
||
| /** | ||
| * Generate OAuth keys from Environment variables. | ||
| * | ||
| * @usage drush tide-oauth:keygen | ||
| * Generate OAuth keys from Environment variables. | ||
| * | ||
| * @command tide-oauth:keygen | ||
| * @validate-module-enabled tide_oauth | ||
| * @aliases tokgn,tide-oauth-keygen | ||
| */ | ||
| public function generateKeys() { | ||
| if ($this->envKeyGenerator->generateEnvKeys()) { | ||
| // Update Simple OAuth settings. | ||
| $this->envKeyGenerator->setSimpleOauthKeySettings(); | ||
| $this->io()->success('OAuth keys have been created.'); | ||
| } | ||
| else { | ||
| $this->io()->error('Could not generate OAuth keys.'); | ||
| } | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.