Skip to content

Commit 82101ad

Browse files
tdaniely-dntdaniely-dn
committed
Add redirect_uri and related configuration
1 parent db7b3ba commit 82101ad

File tree

4 files changed

+77
-15
lines changed

4 files changed

+77
-15
lines changed

‎src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java‎

Lines changed: 51 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ of this software and associated documentation files (the "Software"), to deal
6262
import org.apache.http.client.CredentialsProvider;
6363
import org.apache.http.client.config.RequestConfig;
6464
import org.apache.http.client.methods.HttpPost;
65-
import org.apache.http.client.methods.HttpUriRequest;
65+
import org.apache.http.client.utils.URIBuilder;
6666
import org.apache.http.impl.client.BasicCredentialsProvider;
6767
import org.apache.http.impl.client.CloseableHttpClient;
6868
import org.apache.http.impl.client.HttpClientBuilder;
@@ -73,6 +73,7 @@ of this software and associated documentation files (the "Software"), to deal
7373
import org.kohsuke.github.GHOrganization;
7474
import org.kohsuke.github.GHTeam;
7575
import org.kohsuke.stapler.DataBoundConstructor;
76+
import org.kohsuke.stapler.DataBoundSetter;
7677
import org.kohsuke.stapler.Header;
7778
import org.kohsuke.stapler.HttpRedirect;
7879
import org.kohsuke.stapler.HttpResponse;
@@ -85,6 +86,8 @@ of this software and associated documentation files (the "Software"), to deal
8586
import java.io.IOException;
8687
import java.net.InetSocketAddress;
8788
import java.net.Proxy;
89+
import java.net.URISyntaxException;
90+
import java.nio.charset.StandardCharsets;
8891
import java.security.SecureRandom;
8992
import java.util.Arrays;
9093
import java.util.HashSet;
@@ -115,6 +118,8 @@ public class GithubSecurityRealm extends AbstractPasswordBasedSecurityRealm impl
115118
private Secret clientSecret;
116119
private String oauthScopes;
117120
private String[] myScopes;
121+
@NonNull
122+
private String redirectUri = "";
118123

119124
/**
120125
* @param githubWebUri The URI to the root of the web UI for GitHub or GitHub Enterprise,
@@ -187,6 +192,15 @@ private void setOauthScopes(String oauthScopes) {
187192
this.oauthScopes = oauthScopes;
188193
}
189194

195+
/**
196+
* @param redirectUri the redirectUri to set
197+
*/
198+
@DataBoundSetter
199+
public void setRedirectUri(String redirectUri) {
200+
if (null == redirectUri) redirectUri = "";
201+
this.redirectUri = redirectUri;
202+
}
203+
190204
/**
191205
* Checks the security realm for a GitHub OAuth scope.
192206
* @param scope A scope to check for in the security realm.
@@ -245,6 +259,10 @@ public void marshal(Object source, HierarchicalStreamWriter writer,
245259
writer.setValue(realm.getOauthScopes());
246260
writer.endNode();
247261

262+
writer.startNode("redirectUri");
263+
writer.setValue(realm.getRedirectUri());
264+
writer.endNode();
265+
248266
}
249267

250268
public Object unmarshal(HierarchicalStreamReader reader,
@@ -274,8 +292,7 @@ public Object unmarshal(HierarchicalStreamReader reader,
274292
return realm;
275293
}
276294

277-
private void setValue(GithubSecurityRealm realm, String node,
278-
String value) {
295+
private void setValue(GithubSecurityRealm realm, String node, String value) {
279296
if (node.equalsIgnoreCase("clientid")) {
280297
realm.setClientID(value);
281298
} else if (node.equalsIgnoreCase("clientsecret")) {
@@ -290,6 +307,8 @@ private void setValue(GithubSecurityRealm realm, String node,
290307
realm.setGithubApiUri(value);
291308
} else if (node.equalsIgnoreCase("oauthscopes")) {
292309
realm.setOauthScopes(value);
310+
} else if (node.equalsIgnoreCase("redirecturi")) {
311+
realm.setRedirectUri(value);
293312
} else {
294313
throw new ConversionException("Invalid node value = " + node);
295314
}
@@ -334,11 +353,21 @@ public String getOauthScopes() {
334353
return oauthScopes;
335354
}
336355

356+
/**
357+
* @return the redirectUri
358+
*/
359+
@NonNull
360+
public String getRedirectUri() {
361+
return redirectUri;
362+
}
363+
337364
public HttpResponse doCommenceLogin(StaplerRequest request, @QueryParameter String from, @Header("Referer") final String referer)
338-
throws IOException {
365+
throws IOException, URISyntaxException {
339366
// https://tools.ietf.org/html/rfc6749#section-10.10 dictates that probability that an attacker guesses the string
340367
// SHOULD be less than or equal to 2^(-160) and our Strings consist of 65 chars. (65^27 ~= 2^160)
341368
final String state = getSecureRandomString(27);
369+
370+
// This is to go back to the current page after login, not the oauth callback
342371
String redirectOnFinish;
343372
if (from != null && Util.isSafeToRedirectTo(from)) {
344373
redirectOnFinish = from;
@@ -355,17 +384,17 @@ public HttpResponse doCommenceLogin(StaplerRequest request, @QueryParameter Stri
355384
for (GitHubOAuthScope s : Jenkins.get().getExtensionList(GitHubOAuthScope.class)) {
356385
scopes.addAll(s.getScopesToRequest());
357386
}
358-
String suffix="";
359-
if (!scopes.isEmpty()) {
360-
suffix = "&scope="+Util.join(scopes,",")+"&state="+state;
361-
} else {
362-
// We need repo scope in order to access private repos
363-
// See https://developer.github.com/v3/oauth/#scopes
364-
suffix = "&scope=" + oauthScopes +"&state="+state;
387+
388+
URIBuilder builder = new URIBuilder(githubWebUri, StandardCharsets.UTF_8);
389+
builder.setPath("/login/oauth/authorize");
390+
builder.setParameter("client_id", clientID);
391+
builder.setParameter("scope", scopes.isEmpty() ? oauthScopes : Util.join(scopes,","));
392+
builder.setParameter("state", state);
393+
if (!redirectUri.isEmpty()) {
394+
builder.setParameter("redirect_uri", redirectUri);
365395
}
366396

367-
return new HttpRedirect(githubWebUri + "/login/oauth/authorize?client_id="
368-
+ clientID + suffix);
397+
return new HttpRedirect(builder.toString());
369398
}
370399

371400
/**
@@ -630,6 +659,12 @@ public String getDefaultOauthScopes() {
630659
return DEFAULT_OAUTH_SCOPES;
631660
}
632661

662+
public String getDefaultRequestUri() {
663+
// Intentionally making this default in UI and not in code
664+
// to preserve behaviour for existing groovy init & JCasc setups
665+
return Jenkins.get().getRootUrl() + "securityRealm/finishLogin";
666+
}
667+
633668
public DescriptorImpl() {
634669
super();
635670
// TODO Auto-generated constructor stub
@@ -728,7 +763,8 @@ public boolean equals(Object object){
728763
this.getGithubApiUri().equals(obj.getGithubApiUri()) &&
729764
this.getClientID().equals(obj.getClientID()) &&
730765
this.getClientSecret().equals(obj.getClientSecret()) &&
731-
this.getOauthScopes().equals(obj.getOauthScopes());
766+
this.getOauthScopes().equals(obj.getOauthScopes()) &&
767+
this.getRedirectUri().equals(obj.getRedirectUri());
732768
} else {
733769
return false;
734770
}
@@ -742,6 +778,7 @@ public int hashCode() {
742778
.append(this.getClientID())
743779
.append(this.getClientSecret())
744780
.append(this.getOauthScopes())
781+
.append(this.getRedirectUri())
745782
.toHashCode();
746783
}
747784

‎src/main/resources/org/jenkinsci/plugins/GithubSecurityRealm/config.jelly‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,5 +23,10 @@
2323
<f:entry title="OAuth Scope(s)" field="oauthScopes" help="/plugin/github-oauth/help/realm/oauth-scopes-help.html">
2424
<f:textbox default="${descriptor.getDefaultOauthScopes()}" />
2525
</f:entry>
26+
27+
<f:entry title="Redirect URI" field="redirectUri" help="/plugin/github-oauth/help/realm/redirect-uri-help.html">
28+
<f:textbox default="${descriptor.getDefaultRequestUri()}" />
29+
</f:entry>
30+
2631
</f:section>
2732
</j:jelly>

‎src/main/webapp/help/realm/redirect-uri-help.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<div>
2+
An optional redirect URI to be used by GitHub. See <a href="https://docs.github.com/en/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps">https://docs.github.com/en/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps</a>.
3+
</div>

‎src/test/java/org/jenkinsci/plugins/GithubSecurityRealmTest.java‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,24 @@ public void testEquals_false() {
5252
GithubSecurityRealm a = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
5353
GithubSecurityRealm b = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org,repo");
5454
assertNotEquals(a, b);
55-
assertNotEquals("", a);
55+
}
56+
57+
@Test
58+
public void testEqualsRedirectUri() {
59+
GithubSecurityRealm _default = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
60+
GithubSecurityRealm empty = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
61+
empty.setRedirectUri("");
62+
GithubSecurityRealm sameValue1 = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
63+
sameValue1.setRedirectUri("http://jenkins1.awesomecorp.com");
64+
GithubSecurityRealm sameValue2 = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
65+
sameValue2.setRedirectUri("http://jenkins1.awesomecorp.com");
66+
GithubSecurityRealm otherValue = new GithubSecurityRealm("http://jenkins.acme.com", "http://jenkins.acme.com/api/v3", "someid", "somesecret", "read:org");
67+
otherValue.setRedirectUri("http://jenkins1.notsogoodcorp.com");
68+
assertEquals(_default, empty);
69+
assertEquals(sameValue1, sameValue2);
70+
assertNotEquals(sameValue1, _default);
71+
assertNotEquals(sameValue1, empty);
72+
assertNotEquals(sameValue1, otherValue);
5673
}
5774

5875
@Test

0 commit comments

Comments
 (0)