fix(openid-connect): the default 'redirect_uri' (#2426) #7690
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -86,7 +86,7 @@ local schema = { | |
| }, | ||
| redirect_uri = { | ||
| type = "string", | ||
| description = "auto append '.apisix/redirect' if not configured" | ||
monkeyDluffy6017 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| }, | ||
| post_logout_redirect_uri = { | ||
| type = "string", | ||
|
|
@@ -357,7 +357,22 @@ function _M.rewrite(plugin_conf, ctx) | |
| end | ||
|
|
||
| if not conf.redirect_uri then | ||
| -- NOTE: 'lua-resty-openidc' requires that 'redirect_uri' be | ||
| -- different from 'uri'. So default to append the | ||
| -- '.apisix/redirect' suffix if not configured. | ||
| local suffix = "/.apisix/redirect" | ||
| local uri = ctx.var.uri | ||
| if core.string.has_suffix(uri, suffix) then | ||
| -- This is the redirection response from the OIDC provider. | ||
| conf.redirect_uri = uri | ||
| else | ||
| if string.sub(uri, -1, -1) == "/" then | ||
| conf.redirect_uri = string.sub(uri, 1, -2) .. suffix | ||
| else | ||
| conf.redirect_uri = uri .. suffix | ||
| end | ||
| end | ||
| core.log.debug("auto set redirect_uri: ", conf.redirect_uri) | ||
|
Comment on lines
+360
to
+375
There was a problem hiding this comment. When there is no Can we inject a default value for For example:
Listen to what others say. There was a problem hiding this comment. @liweitianux any thoughts about this? There was a problem hiding this comment. I don't think we can set a proper default value for Please correct me if I'm mistaken. There was a problem hiding this comment. I agree with you. There was a problem hiding this comment. We need a test case to show that not providing There was a problem hiding this comment. I changed the job this year, and I haven't been working with APISIX for more than one year now. I'm unfamiliar with the test framework, and that was the main reason that this PR was lacking a test case. It would be great if you can rejuvenate this PR. Thanks. |
||
| end | ||
|
|
||
| if not conf.ssl_verify then | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,7 +43,7 @@ description: OpenID Connect（OIDC）是基于 OAuth 2.0 的身份认证协议 | |
| | bearer_only | boolean | 否 | false | | 当设置为 `true` 时，将仅检查请求头中的令牌（Token）。 | | ||
| | logout_path | string | 否 | "/logout" | | 登出路径。 | | ||
| | post_logout_redirect_uri | string | 否 | | | 调用登出接口后想要跳转的 URL。 | | ||
| | redirect_uri | string | 否 | | | 身份提供者重定向返回的 URI。如果缺失，则 APISIX 将在当前 URI 之后追加 `.apisix/redirect` 作为默认的 `redirect_uri`。注意，OP 也需要适当配置以允许这种形式的 `redirect_uri`。 | | ||
| | timeout | integer | 否 | 3 | [1,...] | 请求超时时间，单位为秒 | | ||
| | ssl_verify | boolean | 否 | false | [true, false] | 当设置为 `true` 时，验证身份提供者的 SSL 证书。 | | ||
| | introspection_endpoint | string | 否 | | | 用于内省访问令牌的身份提供者的令牌内省端点的 URL。如果未设置，则使用发现文档中提供的内省端点[作为后备](https://github.com/zmartzone/lua-resty-openidc/commit/cdaf824996d2b499de4c72852c91733872137c9c)。 | | ||
|
|
@@ -208,3 +208,4 @@ curl http://127.0.0.1:9180/apisix/admin/routes/1 \ | |
|
|
||
| - `redirect_uri` 需要能被当前 APISIX 所在路由捕获，比如当前路由的 `uri` 是 `/api/v1/*`, `redirect_uri` 可以填写为 `/api/v1/callback`； | ||
| - `redirect_uri`（`scheme:host`）的 `scheme` 和 `host` 是身份认证服务视角下访问 APISIX 所需的值。 | ||
| - 另请参考[此 GitHub 问题](https://github.com/apache/apisix/issues/2426), 尤其是下述评论: [@starsz](https://github.com/apache/apisix/issues/2426#issuecomment-1091021687), [@david-woelfle](https://github.com/apache/apisix/issues/2426#issuecomment-1090675455), [@liweitianux (1)](https://github.com/apache/apisix/issues/2426#issuecomment-1206107085), [@liweitianux (2)](https://github.com/apache/apisix/issues/2426#issuecomment-1207423283) | ||
kayx23 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
But it cannot make sure the new URI will be matched by the same route, it actually adds an implicit condition that the route match type is prefix instead of exact.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well. If the route is of type exact, then it cannot actually use this
openid-connectplugin, because theredirect_urimust be different from the request URI, as required bylua-resty-openidc.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@liweitianux Could you write some hints about this in the OpenID Connect doc?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sure. I'll update the doc later.