Skip to content

Commit

Permalink
Add OIDC config to add extra parameters to the authorize URL (#16971)
Browse files Browse the repository at this point in the history
  • Loading branch information
MatMaul authored Mar 22, 2024
1 parent 9ad49e7 commit b7af076
Show file tree
Hide file tree
Showing 4 changed files with 26 additions and 6 deletions.
1 change: 1 addition & 0 deletions changelog.d/16971.feature
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add an OIDC config to specify extra parameters for the authorization grant URL. IT can be useful to pass an ACR value for example.
5 changes: 5 additions & 0 deletions docs/usage/configuration/config_documentation.md
Original file line number Diff line number Diff line change
Expand Up @@ -3349,6 +3349,9 @@ Options for each entry include:
not included in `scopes`. Set to `userinfo_endpoint` to always use the
userinfo endpoint.

* `additional_authorization_parameters`: String to string dictionary that will be passed as
additional parameters to the authorization grant URL.

* `allow_existing_users`: set to true to allow a user logging in via OIDC to
match a pre-existing account instead of failing. This could be used if
switching from password logins to OIDC. Defaults to false.
Expand Down Expand Up @@ -3473,6 +3476,8 @@ oidc_providers:
token_endpoint: "https://accounts.example.com/oauth2/token"
userinfo_endpoint: "https://accounts.example.com/userinfo"
jwks_uri: "https://accounts.example.com/.well-known/jwks.json"
additional_authorization_parameters:
acr_values: 2fa
skip_verification: true
enable_registration: true
user_mapping_provider:
Expand Down
6 changes: 6 additions & 0 deletions synapse/config/oidc.py
Original file line number Diff line number Diff line change
Expand Up @@ -342,6 +342,9 @@ def _parse_oidc_config_dict(
user_mapping_provider_config=user_mapping_provider_config,
attribute_requirements=attribute_requirements,
enable_registration=oidc_config.get("enable_registration", True),
additional_authorization_parameters=oidc_config.get(
"additional_authorization_parameters", {}
),
)


Expand Down Expand Up @@ -444,3 +447,6 @@ class OidcProviderConfig:

# Whether automatic registrations are enabled in the ODIC flow. Defaults to True
enable_registration: bool

# Additional parameters that will be passed to the authorization grant URL
additional_authorization_parameters: Mapping[str, str]
20 changes: 14 additions & 6 deletions synapse/handlers/oidc.py
Original file line number Diff line number Diff line change
Expand Up @@ -453,6 +453,10 @@ def __init__(
# optional brand identifier for this auth provider
self.idp_brand = provider.idp_brand

self.additional_authorization_parameters = (
provider.additional_authorization_parameters
)

self._sso_handler = hs.get_sso_handler()
self._device_handler = hs.get_device_handler()

Expand Down Expand Up @@ -1006,17 +1010,21 @@ async def handle_redirect_request(

metadata = await self.load_metadata()

additional_authorization_parameters = dict(
self.additional_authorization_parameters
)
# Automatically enable PKCE if it is supported.
extra_grant_values = {}
if metadata.get("code_challenge_methods_supported"):
code_verifier = generate_token(48)

# Note that we verified the server supports S256 earlier (in
# OidcProvider._validate_metadata).
extra_grant_values = {
"code_challenge_method": "S256",
"code_challenge": create_s256_code_challenge(code_verifier),
}
additional_authorization_parameters.update(
{
"code_challenge_method": "S256",
"code_challenge": create_s256_code_challenge(code_verifier),
}
)

cookie = self._macaroon_generaton.generate_oidc_session_token(
state=state,
Expand Down Expand Up @@ -1055,7 +1063,7 @@ async def handle_redirect_request(
scope=self._scopes,
state=state,
nonce=nonce,
**extra_grant_values,
**additional_authorization_parameters,
)

async def handle_oidc_callback(
Expand Down

0 comments on commit b7af076

Please sign in to comment.