Merge pull request #4 from arvchristos/feat/oidc

Expose OIDC config parameters

core/files/configure_misp.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 source /rest_client.sh
+source /utilities.sh
 
 [ -z "$ADMIN_EMAIL" ] && ADMIN_EMAIL="admin@admin.test"
 [ -z "$GPG_PASSPHRASE" ] && GPG_PASSPHRASE="passphrase"
@@ -10,6 +11,7 @@ source /rest_client.sh
 # Switches to selectively disable configuration logic
 [ -z "$AUTOCONF_GPG" ] && AUTOCONF_GPG="true"
 [ -z "$AUTOCONF_ADMIN_KEY" ] && AUTOCONF_ADMIN_KEY="true"
+[ -z "$OIDC_ENABLE" ] && OIDC_ENABLE="false"
 
 init_configuration(){
  # Note that we are doing this after enforcing permissions, so we need to use the www-data user for this
@@ -93,6 +95,36 @@ GPGEOF
  sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "GnuPG.binary" "$(which gpg)"
 }
 
+set_up_oidc() {
+ if [[ "$OIDC_ENABLE" != "true" ]]; then
+ echo "... OIDC authentication disabled"
+ return
+ fi
+
+ # Check required variables
+ check_env_vars OIDC_PROVIDER_URL OIDC_CLIENT_ID OIDC_CLIENT_SECRET OIDC_ROLES_PROPERTY OIDC_ROLES_MAPPING OIDC_DEFAULT_ORG
+
+ sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
+ \"Security\": {
+ \"auth\": [\"OidcAuth.Oidc\"]
+ }
+ }" > /dev/null
+
+ sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
+ \"OidcAuth\": {
+ \"provider_url\": \"${OIDC_PROVIDER_URL}\",
+ \"client_id\": \"${OIDC_CLIENT_ID}\",
+ \"client_secret\": \"${OIDC_CLIENT_SECRET}\",
+ \"roles_property\": \"${OIDC_ROLES_PROPERTY}\",
+ \"role_mapper\": ${OIDC_ROLES_MAPPING},
+ \"default_org\": \"${OIDC_DEFAULT_ORG}\"
+ }
+ }" > /dev/null
+
+ # Disable password confirmation as stated at https://github.com/MISP/MISP/issues/8116
+ sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.require_password_confirmation" false
+}
+
 apply_updates() {
  # Disable weird default
  sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Plugin.ZeroMQ_enable" false
@@ -164,7 +196,7 @@ apply_critical_fixes() {
 apply_optional_fixes() {
  sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q --force "MISP.welcome_text_top" ""
  sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q --force "MISP.welcome_text_bottom" ""
- 
+
  sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "MISP.contact" "${ADMIN_EMAIL}"
  # This is not necessary because we update the DB directly
  # sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "MISP.org" "${ADMIN_ORG}"
@@ -254,5 +286,7 @@ echo "MISP | Create sync servers ..." && create_sync_servers
 
 echo "MISP | Update components ..." && update_components
 
+echo "MISP | Set Up OIDC ..." && set_up_oidc
+
 echo "MISP | Mark instance live"
 sudo -u www-data /var/www/MISP/app/Console/cake Admin live 1

core/files/utilities.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Check whether passed env variables are defined
+check_env_vars() {
+ local required_vars=("$@")
+
+ missing_vars=()
+ for i in "${required_vars[@]}"
+ do
+ test -n "${!i:+y}" || missing_vars+=("$i")
+ done
+ if [ ${#missing_vars[@]} -ne 0 ]
+ then
+ echo "The following env variables are not set:"
+ printf ' %q\n' "${missing_vars[@]}"
+ exit 1
+ fi
+}

docker-compose.yml

@@ -69,6 +69,14 @@ services:
  - "ADMIN_KEY=${ADMIN_KEY}"
  - "ADMIN_ORG=${ADMIN_ORG}"
  - "GPG_PASSPHRASE=${GPG_PASSPHRASE}"
+ # authentication settings
+ - "OIDC_ENABLE=${OIDC_ENABLE}"
+ - "OIDC_PROVIDER_URL=${OIDC_PROVIDER_URL}"
+ - "OIDC_CLIENT_ID=${OIDC_CLIENT_ID}"
+ - "OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}"
+ - "OIDC_ROLES_PROPERTY=${OIDC_ROLES_PROPERTY}"
+ - "OIDC_ROLES_MAPPING=${OIDC_ROLES_MAPPING}"
+ - "OIDC_DEFAULT_ORG=${OIDC_DEFAULT_ORG}"
  # sync server settings (see https://www.misp-project.org/openapi/#tag/Servers for more options)
  - "SYNCSERVERS=${SYNCSERVERS}"
  - |

template.env

@@ -87,3 +87,12 @@ SYNCSERVERS_1_KEY=
 
 # Disable IPv6 completely (this setting will persist until the container is removed)
 # DISABLE_IPV6=true
+
+# Enable OIDC authentication, according to https://github.com/MISP/MISP/blob/2.4/app/Plugin/OidcAuth/README.md
+# OIDC_ENABLE=true
+# OIDC_PROVIDER_URL=
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+# OIDC_ROLES_PROPERTY="roles"
+# OIDC_ROLES_MAPPING={"admin": "1","sync-user": "5"}
+# OIDC_DEFAULT_ORG=