-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Make the logout button actually log out (#24)
* Make the logout button actually log out - Nexus has automatic session creation turned off and solely relies on the login dialog POSTing to SessionServlet for session creation - We never have a login dialog, so this does not happen, thus we turn on automatic session creation when our token factory is used - Oauth2 proxy has a "skip_jwt_bearer_tokens" flag that makes it accept, validate and process a sent jwt token instead of requesting its own - It still adds all necessary headers, but also forwards the Auth header which made our token factoy refuse the operation before - By doing this, the logout button actually works, destroying the user session and triggering a logout event we can listen for - When this event triggers, we perform backchannel logout via oauth proxy, which can then backchannel logout from the IDP - This logout requires page reload to not leave Nexus in an invalid state, however the logout call refuses to follow any kind of redirect so a kinda hacky solution in the frontend is necessary - We use javascript document observers to heuristically guess when logout occured and thus a page refresh should be triggered * better error handling + configurable logout url * adjust documentation to hint towards the new capability --------- Co-authored-by: Marco Herglotz <marco.herglotz@cas.de>
- Loading branch information
1 parent
8774847
commit 25f9b12
Showing
12 changed files
with
488 additions
and
81 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
47 changes: 47 additions & 0 deletions
47
src/main/java/com/github/tumbl3w33d/logout/OAuth2ProxyLogoutCapability.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package com.github.tumbl3w33d.logout; | ||
|
|
||
| import static com.google.common.base.Preconditions.checkNotNull; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| import javax.inject.Inject; | ||
| import javax.inject.Named; | ||
|
|
||
| import org.sonatype.nexus.capability.CapabilitySupport; | ||
|
|
||
| @Named(OAuth2ProxyLogoutCapabilityDescriptor.TYPE_ID) | ||
| public class OAuth2ProxyLogoutCapability extends CapabilitySupport<OAuth2ProxyLogoutCapabilityConfiguration> { | ||
|
|
||
| private final OAuth2ProxyLogoutCapabilityConfigurationState state; | ||
|
|
||
| @Inject | ||
| public OAuth2ProxyLogoutCapability(OAuth2ProxyLogoutCapabilityConfigurationState state) { | ||
| this.state = checkNotNull(state); | ||
| } | ||
|
|
||
| @Override | ||
| protected OAuth2ProxyLogoutCapabilityConfiguration createConfig(Map<String, String> properties) { | ||
| return new OAuth2ProxyLogoutCapabilityConfiguration(properties); | ||
| } | ||
|
|
||
| @Override | ||
| protected void onActivate(OAuth2ProxyLogoutCapabilityConfiguration config) throws Exception { | ||
| state.set(config); | ||
| } | ||
|
|
||
| @Override | ||
| protected void onUpdate(OAuth2ProxyLogoutCapabilityConfiguration config) throws Exception { | ||
| state.set(config); | ||
| } | ||
|
|
||
| @Override | ||
| protected void onPassivate(OAuth2ProxyLogoutCapabilityConfiguration config) throws Exception { | ||
| state.reset(); | ||
| } | ||
|
|
||
| @Override | ||
| protected void onRemove(OAuth2ProxyLogoutCapabilityConfiguration config) throws Exception { | ||
| state.reset(); | ||
| } | ||
|
|
||
| } |
50 changes: 50 additions & 0 deletions
50
src/main/java/com/github/tumbl3w33d/logout/OAuth2ProxyLogoutCapabilityConfiguration.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| package com.github.tumbl3w33d.logout; | ||
|
|
||
| import java.util.Map; | ||
| import java.util.Objects; | ||
|
|
||
| public class OAuth2ProxyLogoutCapabilityConfiguration { | ||
|
|
||
| public static final String LOGOUT_URL_ID = "oauth2-proxy-logout-url"; | ||
| public static final String LOGOUT_URL_LABEL = "OAuth2 Proxy logout url"; | ||
| public static final String LOGOUT_URL_HELP = "URL to be called for backchannel logout in OAuth2 Proxy when the Nexus logout button is pressed. Defaults to '{nexus-base-url}/oauth2/sign_out' if not specified"; | ||
|
|
||
| private String logoutUrl; | ||
|
|
||
| public OAuth2ProxyLogoutCapabilityConfiguration(Map<String, String> properties) { | ||
| if (properties != null) { | ||
| logoutUrl = properties.get(LOGOUT_URL_ID); | ||
| } | ||
| } | ||
|
|
||
| public String getLogoutUrl() { | ||
| return logoutUrl; | ||
| } | ||
|
|
||
| public void setLogoutUrl(String logoutUrl) { | ||
| this.logoutUrl = logoutUrl; | ||
| } | ||
|
|
||
| @Override | ||
| public int hashCode() { | ||
| return Objects.hash(logoutUrl); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean equals(Object obj) { | ||
| if (this == obj) | ||
| return true; | ||
| if (obj == null) | ||
| return false; | ||
| if (getClass() != obj.getClass()) | ||
| return false; | ||
| OAuth2ProxyLogoutCapabilityConfiguration other = (OAuth2ProxyLogoutCapabilityConfiguration) obj; | ||
| return Objects.equals(logoutUrl, other.logoutUrl); | ||
| } | ||
|
|
||
| @Override | ||
| public String toString() { | ||
| return "OAuth2ProxyLogoutCapabilityConfiguration [logoutUrl=" + logoutUrl + "]"; | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.