Compare commits
24 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
ad5add0ffc | ||
| 30c05c3014 | |||
|
|
d75d64113b | ||
| 66b55945eb | |||
|
|
50145c914b | ||
| 0430c7f4de | |||
|
|
1317fd40f5 | ||
| daa072f2bf | |||
|
|
c36720e548 | ||
| 4b74de1261 | |||
|
|
60ec7de366 | ||
| 4a6598f102 | |||
|
|
b278f755b4 | ||
| 23cdbe9bd1 | |||
|
|
416baebab5 | ||
| 2f38855449 | |||
|
|
1a3cb5044f | ||
| 861f2f1184 | |||
|
|
773b760bc1 | ||
| b729344d1e | |||
|
|
9a194a9fd7 | ||
| fccd94cc11 | |||
|
|
27da1327c1 | ||
| 82a9706deb |
60
CHANGELOG.md
60
CHANGELOG.md
@@ -403,3 +403,63 @@
|
||||
### Features
|
||||
|
||||
* Add mainRoute configuration for OpenID in application and environment files ([4f52c1a](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/4f52c1a0f30cf0b917452149a52b53b94d82a7c9))
|
||||
## (2026-01-20)
|
||||
|
||||
### Features
|
||||
|
||||
* Simplify authorization request creation in OpenIDConnectService and use environment variables for Keycloak configuration ([82a9706](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/82a9706deb97db193015e55a048830d496e76d83))
|
||||
## (2026-01-20)
|
||||
|
||||
### Features
|
||||
|
||||
* Use environment variables for Keycloak client configuration in staging ([fccd94c](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/fccd94cc11db43f99eded13207cc93fb59d8703e))
|
||||
## (2026-01-20)
|
||||
|
||||
### Features
|
||||
|
||||
* Add logging for OpenID authentication process in OpenIDController ([b729344](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/b729344d1e79c631146dd988248d033d97e12d93))
|
||||
## (2026-01-20)
|
||||
|
||||
### Features
|
||||
|
||||
* Add error logging for user info retrieval in OpenIDConnectService ([861f2f1](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/861f2f1184e860fdd164481167f941c11accfedd))
|
||||
## (2026-01-20)
|
||||
|
||||
### Features
|
||||
|
||||
* Add idClaimName parameter to OpenIDConnectService for flexible ID claim mapping ([2f38855](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/2f388554495d8bd44b4c533baa0f2fc27eea22c2))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Change log level to warn for OpenID callback in OpenIDController ([23cdbe9](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/23cdbe9bd127bc26405fd216372bbb2d7e718a77))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Change log level to warn for OpenID callback in OpenIDController ([4a6598f](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/4a6598f102d8934c7502944a0addd400dd0cbcac))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Update ID mapping in OpenIDUserInfo to use hashed value and remove name field ([4b74de1](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/4b74de12610120831fc1529f0409db66aafd4d03))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Update ID mapping in OpenIDUserInfo to use hashed value and remove name field ([daa072f](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/daa072f2bf260ed62402096b41ce85aa071efaf5))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Implement OAuth session management with Redis caching for OpenID user data ([0430c7f](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/0430c7f4deb37661c697406a714e2693bf0c7307))
|
||||
## (2026-01-21)
|
||||
|
||||
### Features
|
||||
|
||||
* Update CORS allowed origins to use production URL ([66b5594](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/66b55945eb8f095c08a8f859955d31f7fc32ce0e))
|
||||
## (2026-01-22)
|
||||
|
||||
### Features
|
||||
|
||||
* **ui:** FRO-26 Nice Tie UI ([#115](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/issues/115)) ([30c05c3](https://git.janis-eccarius.de/KnockOutWhist/KnockOutWhist-Web/commit/30c05c3014e9198e87706518bfa8d070f33242dc))
|
||||
|
||||
Submodule knockoutwhist updated: 77a44fa17b...0b35e1a649
Submodule knockoutwhistfrontend updated: cd950e9521...65591ad392
@@ -1,13 +1,15 @@
|
||||
package controllers
|
||||
|
||||
import com.github.benmanes.caffeine.cache.{Cache, Caffeine}
|
||||
import logic.user.{SessionManager, UserManager}
|
||||
import model.users.User
|
||||
import play.api.Configuration
|
||||
import play.api.{Configuration, Logger}
|
||||
import play.api.libs.json.Json
|
||||
import play.api.mvc.*
|
||||
import play.api.mvc.Cookie.SameSite.Lax
|
||||
import services.{OpenIDConnectService, OpenIDUserInfo}
|
||||
import services.{OpenIDConnectService, OpenIDUserInfo, OAuthCacheService}
|
||||
|
||||
import java.util.concurrent.TimeUnit
|
||||
import javax.inject.*
|
||||
import scala.concurrent.{ExecutionContext, Future}
|
||||
|
||||
@@ -17,9 +19,12 @@ class OpenIDController @Inject()(
|
||||
val openIDService: OpenIDConnectService,
|
||||
val sessionManager: SessionManager,
|
||||
val userManager: UserManager,
|
||||
val config: Configuration
|
||||
val config: Configuration,
|
||||
val oauthCache: OAuthCacheService
|
||||
)(implicit ec: ExecutionContext) extends BaseController {
|
||||
|
||||
private val logger = Logger(this.getClass)
|
||||
|
||||
def loginWithProvider(provider: String): Action[AnyContent] = Action.async { implicit request =>
|
||||
val state = openIDService.generateState()
|
||||
val nonce = openIDService.generateNonce()
|
||||
@@ -47,8 +52,11 @@ class OpenIDController @Inject()(
|
||||
val code = request.getQueryString("code")
|
||||
val error = request.getQueryString("error")
|
||||
|
||||
logger.warn(s"Received callback from $provider with state $sessionState, nonce $sessionNonce, provider $sessionProvider, returned state $returnedState, code $code, error $error")
|
||||
|
||||
error match {
|
||||
case Some(err) =>
|
||||
logger.error(s"Authentication failed: $err")
|
||||
Future.successful(Redirect("/login").flashing("error" -> s"Authentication failed: $err"))
|
||||
case None =>
|
||||
(for {
|
||||
@@ -56,6 +64,7 @@ class OpenIDController @Inject()(
|
||||
_ <- Option(sessionProvider.contains(provider))
|
||||
authCode <- code
|
||||
} yield {
|
||||
logger.warn(s"Authentication successful for $provider")
|
||||
openIDService.exchangeCodeForTokens(provider, authCode, sessionState.get).flatMap {
|
||||
case Some(tokenResponse) =>
|
||||
openIDService.getUserInfo(provider, tokenResponse.accessToken).flatMap {
|
||||
@@ -63,6 +72,7 @@ class OpenIDController @Inject()(
|
||||
// Check if user already exists
|
||||
userManager.authenticateOpenID(provider, userInfo.id) match {
|
||||
case Some(user) =>
|
||||
logger.warn(s"User ${userInfo.name} (${userInfo.id}) already exists, logging them in")
|
||||
// User already exists, log them in
|
||||
val sessionToken = sessionManager.createSession(user)
|
||||
Future.successful(Redirect(config.getOptional[String]("openid.mainRoute").getOrElse("/"))
|
||||
@@ -75,39 +85,47 @@ class OpenIDController @Inject()(
|
||||
))
|
||||
.removingFromSession("oauth_state", "oauth_nonce", "oauth_provider", "oauth_access_token"))
|
||||
case None =>
|
||||
// New user, redirect to username selection
|
||||
logger.warn(s"User ${userInfo.name} (${userInfo.id}) not found, creating new user")
|
||||
// Store OAuth data in cache and get session ID
|
||||
val oauthSessionId = oauthCache.storeOAuthData(userInfo, tokenResponse.accessToken, provider)
|
||||
// New user, redirect to username selection with only session ID
|
||||
Future.successful(Redirect(config.get[String]("openid.selectUserRoute"))
|
||||
.withSession(
|
||||
"oauth_user_info" -> Json.toJson(userInfo).toString(),
|
||||
"oauth_provider" -> provider,
|
||||
"oauth_access_token" -> tokenResponse.accessToken
|
||||
))
|
||||
.withSession("oauth_session_id" -> oauthSessionId))
|
||||
}
|
||||
case None =>
|
||||
logger.error("Failed to retrieve user information")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "Failed to retrieve user information"))
|
||||
}
|
||||
case None =>
|
||||
logger.error("Failed to exchange authorization code")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "Failed to exchange authorization code"))
|
||||
}
|
||||
}).getOrElse {
|
||||
logger.error("Invalid state parameter")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "Invalid state parameter"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
def selectUsername(): Action[AnyContent] = Action.async { implicit request =>
|
||||
request.session.get("oauth_user_info") match {
|
||||
case Some(userInfoJson) =>
|
||||
val userInfo = Json.parse(userInfoJson).as[OpenIDUserInfo]
|
||||
Future.successful(Ok(Json.obj(
|
||||
"id" -> userInfo.id,
|
||||
"email" -> userInfo.email,
|
||||
"name" -> userInfo.name,
|
||||
"picture" -> userInfo.picture,
|
||||
"provider" -> userInfo.provider,
|
||||
"providerName" -> userInfo.providerName
|
||||
)))
|
||||
request.session.get("oauth_session_id") match {
|
||||
case Some(sessionId) =>
|
||||
oauthCache.getOAuthData(sessionId) match {
|
||||
case Some((userInfo, _, _)) =>
|
||||
Future.successful(Ok(Json.obj(
|
||||
"id" -> userInfo.id,
|
||||
"email" -> userInfo.email,
|
||||
"name" -> userInfo.name,
|
||||
"picture" -> userInfo.picture,
|
||||
"provider" -> userInfo.provider,
|
||||
"providerName" -> userInfo.providerName
|
||||
)))
|
||||
case None =>
|
||||
logger.error(s"OAuth session data not found for session ID: $sessionId")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "Session expired"))
|
||||
}
|
||||
case None =>
|
||||
logger.error("No OAuth session ID found")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "No authentication information found"))
|
||||
}
|
||||
}
|
||||
@@ -115,48 +133,53 @@ class OpenIDController @Inject()(
|
||||
def submitUsername(): Action[AnyContent] = Action.async { implicit request =>
|
||||
val username = request.body.asJson.flatMap(json => (json \ "username").asOpt[String])
|
||||
.orElse(request.body.asFormUrlEncoded.flatMap(_.get("username").flatMap(_.headOption)))
|
||||
val userInfoJson = request.session.get("oauth_user_info")
|
||||
val provider = request.session.get("oauth_provider").getOrElse("unknown")
|
||||
val sessionId = request.session.get("oauth_session_id")
|
||||
|
||||
(username, userInfoJson) match {
|
||||
case (Some(uname), Some(userInfoJson)) =>
|
||||
val userInfo = Json.parse(userInfoJson).as[OpenIDUserInfo]
|
||||
|
||||
// Check if username already exists
|
||||
val trimmedUsername = uname.trim
|
||||
userManager.userExists(trimmedUsername) match {
|
||||
case Some(_) =>
|
||||
Future.successful(Conflict(Json.obj("error" -> "Username already taken")))
|
||||
case None =>
|
||||
// Create new user with OpenID info (no password needed)
|
||||
val success = userManager.addOpenIDUser(trimmedUsername, userInfo)
|
||||
if (success) {
|
||||
// Get the created user and create session
|
||||
userManager.userExists(trimmedUsername) match {
|
||||
case Some(user) =>
|
||||
val sessionToken = sessionManager.createSession(user)
|
||||
Future.successful(Ok(Json.obj(
|
||||
"message" -> "User created successfully",
|
||||
"user" -> Json.obj(
|
||||
"id" -> user.id,
|
||||
"username" -> user.name
|
||||
)
|
||||
)).withCookies(Cookie(
|
||||
name = "accessToken",
|
||||
value = sessionToken,
|
||||
httpOnly = true,
|
||||
secure = false,
|
||||
sameSite = Some(Lax)
|
||||
)).removingFromSession("oauth_user_info", "oauth_provider", "oauth_access_token"))
|
||||
case None =>
|
||||
Future.successful(InternalServerError(Json.obj("error" -> "Failed to create user session")))
|
||||
}
|
||||
} else {
|
||||
Future.successful(InternalServerError(Json.obj("error" -> "Failed to create user")))
|
||||
(username, sessionId) match {
|
||||
case (Some(uname), Some(sid)) =>
|
||||
oauthCache.getOAuthData(sid) match {
|
||||
case Some((userInfo, accessToken, provider)) =>
|
||||
// Check if username already exists
|
||||
val trimmedUsername = uname.trim
|
||||
userManager.userExists(trimmedUsername) match {
|
||||
case Some(_) =>
|
||||
Future.successful(Conflict(Json.obj("error" -> "Username already taken")))
|
||||
case None =>
|
||||
// Create new user with OpenID info (no password needed)
|
||||
val success = userManager.addOpenIDUser(trimmedUsername, userInfo)
|
||||
if (success) {
|
||||
// Get created user and create session
|
||||
userManager.userExists(trimmedUsername) match {
|
||||
case Some(user) =>
|
||||
val sessionToken = sessionManager.createSession(user)
|
||||
// Clean up cache after successful user creation
|
||||
oauthCache.removeOAuthData(sid)
|
||||
Future.successful(Ok(Json.obj(
|
||||
"message" -> "User created successfully",
|
||||
"user" -> Json.obj(
|
||||
"id" -> user.id,
|
||||
"username" -> user.name
|
||||
)
|
||||
)).withCookies(Cookie(
|
||||
name = "accessToken",
|
||||
value = sessionToken,
|
||||
httpOnly = true,
|
||||
secure = false,
|
||||
sameSite = Some(Lax)
|
||||
)).removingFromSession("oauth_session_id"))
|
||||
case None =>
|
||||
Future.successful(InternalServerError(Json.obj("error" -> "Failed to create user session")))
|
||||
}
|
||||
} else {
|
||||
Future.successful(InternalServerError(Json.obj("error" -> "Failed to create user")))
|
||||
}
|
||||
}
|
||||
case None =>
|
||||
logger.error(s"OAuth session data not found for session ID: $sid")
|
||||
Future.successful(Redirect("/login").flashing("error" -> "Session expired"))
|
||||
}
|
||||
case _ =>
|
||||
Future.successful(BadRequest(Json.obj("error" -> "Username is required")))
|
||||
Future.successful(BadRequest(Json.obj("error" -> "Username and valid session required")))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
package dto
|
||||
|
||||
import dto.subDTO.PlayerDTO
|
||||
import de.knockoutwhist.cards.Card
|
||||
import dto.subDTO.{CardDTO, PlayerDTO}
|
||||
import logic.game.GameLobby
|
||||
import model.users.User
|
||||
|
||||
import scala.util.Try
|
||||
|
||||
case class TieInfoDTO(gameId: String, currentPlayer: Option[PlayerDTO], self: Option[PlayerDTO], tiedPlayers: Seq[PlayerDTO], highestAmount: Int)
|
||||
case class TieInfoDTO(gameId: String, currentPlayer: Option[PlayerDTO], self: Option[PlayerDTO], tiedPlayers: Seq[PlayerDTO], highestAmount: Int, selectedCards: Map[String, CardDTO], winners: Option[Seq[PlayerDTO]])
|
||||
|
||||
object TieInfoDTO {
|
||||
|
||||
@@ -20,7 +21,11 @@ object TieInfoDTO {
|
||||
currentPlayer = lobby.logic.playerTieLogic.currentTiePlayer().map(PlayerDTO.apply),
|
||||
self = selfPlayer.map(PlayerDTO.apply),
|
||||
tiedPlayers = lobby.logic.playerTieLogic.getTiedPlayers.map(PlayerDTO.apply),
|
||||
highestAmount = lobby.logic.playerTieLogic.highestAllowedNumber()
|
||||
highestAmount = lobby.logic.playerTieLogic.highestAllowedNumber(),
|
||||
selectedCards = lobby.logic.playerTieLogic.getSelectedCard.map {
|
||||
case (player, card) => player.id.toString -> CardDTO(card)
|
||||
},
|
||||
winners = Some(lobby.logic.playerTieLogic.getSelectedCard.filter((_,card) => card == lobby.logic.playerTieLogic.getSelectedCard.values.maxBy(_.cardValue.ordinal)).keySet.toList.map(PlayerDTO.apply))
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
89
knockoutwhistweb/app/services/OAuthCacheService.scala
Normal file
89
knockoutwhistweb/app/services/OAuthCacheService.scala
Normal file
@@ -0,0 +1,89 @@
|
||||
package services
|
||||
|
||||
import org.redisson.Redisson
|
||||
import org.redisson.api.RMapCache
|
||||
import org.redisson.config.Config
|
||||
import play.api.Logger
|
||||
import play.api.libs.json.Json
|
||||
|
||||
import java.util.concurrent.TimeUnit
|
||||
import javax.inject.*
|
||||
|
||||
@Singleton
|
||||
class OAuthCacheService @Inject()() {
|
||||
|
||||
private val logger = Logger(this.getClass)
|
||||
|
||||
// Initialize Redis connection similar to Gateway
|
||||
private val redis = {
|
||||
val config: Config = Config()
|
||||
val url = "redis://" + sys.env.getOrElse("REDIS_HOST", "localhost") + ":" + sys.env.getOrElse("REDIS_PORT", "6379")
|
||||
logger.info(s"OAuthCacheService connecting to Redis at $url")
|
||||
config.useSingleServer.setAddress(url)
|
||||
Redisson.create(config)
|
||||
}
|
||||
|
||||
// Cache for OAuth data with 30 minute TTL
|
||||
private val oauthCache: RMapCache[String, String] = redis.getMapCache("oauth_cache")
|
||||
|
||||
/**
|
||||
* Store OAuth data with random ID and return the ID
|
||||
*/
|
||||
def storeOAuthData(userInfo: OpenIDUserInfo, accessToken: String, provider: String): String = {
|
||||
val sessionId = java.util.UUID.randomUUID().toString
|
||||
|
||||
val oauthData = Json.obj(
|
||||
"userInfo" -> Json.toJson(userInfo),
|
||||
"accessToken" -> accessToken,
|
||||
"provider" -> provider,
|
||||
"timestamp" -> System.currentTimeMillis()
|
||||
).toString()
|
||||
|
||||
// Store with 30 minute TTL
|
||||
oauthCache.put(sessionId, oauthData, 30, TimeUnit.MINUTES)
|
||||
logger.info(s"Stored OAuth data for session $sessionId")
|
||||
|
||||
sessionId
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieve OAuth data by session ID
|
||||
*/
|
||||
def getOAuthData(sessionId: String): Option[(OpenIDUserInfo, String, String)] = {
|
||||
Option(oauthCache.get(sessionId)) match {
|
||||
case Some(dataJson) =>
|
||||
try {
|
||||
val json = Json.parse(dataJson)
|
||||
val userInfo = (json \ "userInfo").as[OpenIDUserInfo]
|
||||
val accessToken = (json \ "accessToken").as[String]
|
||||
val provider = (json \ "provider").as[String]
|
||||
|
||||
logger.info(s"Retrieved OAuth data for session $sessionId")
|
||||
Some((userInfo, accessToken, provider))
|
||||
} catch {
|
||||
case e: Exception =>
|
||||
logger.error(s"Failed to parse OAuth data for session $sessionId: ${e.getMessage}")
|
||||
None
|
||||
}
|
||||
case None =>
|
||||
logger.warn(s"No OAuth data found for session $sessionId")
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove OAuth data after use
|
||||
*/
|
||||
def removeOAuthData(sessionId: String): Unit = {
|
||||
oauthCache.remove(sessionId)
|
||||
logger.info(s"Removed OAuth data for session $sessionId")
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up expired sessions (optional maintenance)
|
||||
*/
|
||||
def cleanupExpiredSessions(): Unit = {
|
||||
oauthCache.clear()
|
||||
logger.info("Cleaned up expired OAuth sessions")
|
||||
}
|
||||
}
|
||||
@@ -2,7 +2,7 @@ package services
|
||||
|
||||
import com.typesafe.config.Config
|
||||
import play.api.libs.ws.WSClient
|
||||
import play.api.Configuration
|
||||
import play.api.{Configuration, Logger}
|
||||
import play.api.libs.json.*
|
||||
|
||||
import java.net.URI
|
||||
@@ -11,7 +11,6 @@ import scala.concurrent.{ExecutionContext, Future}
|
||||
import com.nimbusds.oauth2.sdk.*
|
||||
import com.nimbusds.oauth2.sdk.id.*
|
||||
import com.nimbusds.openid.connect.sdk.*
|
||||
|
||||
import play.api.libs.ws.DefaultBodyWritables.*
|
||||
|
||||
case class OpenIDUserInfo(
|
||||
@@ -36,7 +35,8 @@ case class OpenIDProvider(
|
||||
authorizationEndpoint: String,
|
||||
tokenEndpoint: String,
|
||||
userInfoEndpoint: String,
|
||||
scopes: Set[String] = Set("openid", "profile", "email")
|
||||
scopes: Set[String] = Set("openid", "profile", "email"),
|
||||
idClaimName: String = "id"
|
||||
)
|
||||
|
||||
case class TokenResponse(
|
||||
@@ -50,6 +50,8 @@ case class TokenResponse(
|
||||
@Singleton
|
||||
class OpenIDConnectService@Inject(ws: WSClient, config: Configuration)(implicit ec: ExecutionContext) {
|
||||
|
||||
private val logger = Logger(this.getClass)
|
||||
|
||||
private val providers = Map(
|
||||
"discord" -> OpenIDProvider(
|
||||
name = "Discord",
|
||||
@@ -69,36 +71,22 @@ class OpenIDConnectService@Inject(ws: WSClient, config: Configuration)(implicit
|
||||
authorizationEndpoint = config.get[String]("openid.keycloak.authUrl") + "/protocol/openid-connect/auth",
|
||||
tokenEndpoint = config.get[String]("openid.keycloak.authUrl") + "/protocol/openid-connect/token",
|
||||
userInfoEndpoint = config.get[String]("openid.keycloak.authUrl") + "/protocol/openid-connect/userinfo",
|
||||
scopes = Set("openid", "profile", "email")
|
||||
scopes = Set("openid", "profile", "email"),
|
||||
idClaimName = "sub"
|
||||
)
|
||||
)
|
||||
|
||||
def getAuthorizationUrl(providerName: String, state: String, nonce: String): Option[String] = {
|
||||
providers.get(providerName).map { provider =>
|
||||
val authRequest = if (provider.scopes.contains("openid")) {
|
||||
// Use OpenID Connect AuthenticationRequest for OpenID providers
|
||||
new AuthenticationRequest.Builder(
|
||||
new ResponseType(ResponseType.Value.CODE),
|
||||
new com.nimbusds.oauth2.sdk.Scope(provider.scopes.mkString(" ")),
|
||||
new com.nimbusds.oauth2.sdk.id.ClientID(provider.clientId),
|
||||
URI.create(provider.redirectUri)
|
||||
)
|
||||
.state(new com.nimbusds.oauth2.sdk.id.State(state))
|
||||
.nonce(new Nonce(nonce))
|
||||
.endpointURI(URI.create(provider.authorizationEndpoint))
|
||||
.build()
|
||||
} else {
|
||||
// Use standard OAuth2 AuthorizationRequest for non-OpenID providers (like Discord)
|
||||
new AuthorizationRequest.Builder(
|
||||
new ResponseType(ResponseType.Value.CODE),
|
||||
new com.nimbusds.oauth2.sdk.id.ClientID(provider.clientId)
|
||||
)
|
||||
.scope(new com.nimbusds.oauth2.sdk.Scope(provider.scopes.mkString(" ")))
|
||||
.state(new com.nimbusds.oauth2.sdk.id.State(state))
|
||||
.redirectionURI(URI.create(provider.redirectUri))
|
||||
.endpointURI(URI.create(provider.authorizationEndpoint))
|
||||
.build()
|
||||
}
|
||||
val authRequest = new AuthorizationRequest.Builder(
|
||||
new ResponseType(ResponseType.Value.CODE),
|
||||
new com.nimbusds.oauth2.sdk.id.ClientID(provider.clientId)
|
||||
)
|
||||
.scope(new com.nimbusds.oauth2.sdk.Scope(provider.scopes.mkString(" ")))
|
||||
.state(new com.nimbusds.oauth2.sdk.id.State(state))
|
||||
.redirectionURI(URI.create(provider.redirectUri))
|
||||
.endpointURI(URI.create(provider.authorizationEndpoint))
|
||||
.build()
|
||||
|
||||
authRequest.toURI.toString
|
||||
}
|
||||
@@ -150,7 +138,7 @@ class OpenIDConnectService@Inject(ws: WSClient, config: Configuration)(implicit
|
||||
if (response.status == 200) {
|
||||
val json = response.json
|
||||
Some(OpenIDUserInfo(
|
||||
id = (json \ "id").as[String],
|
||||
id = (json \ provider.idClaimName).as[String],
|
||||
email = (json \ "email").asOpt[String],
|
||||
name = (json \ "name").asOpt[String].orElse((json \ "login").asOpt[String]),
|
||||
picture = (json \ "picture").asOpt[String].orElse((json \ "avatar_url").asOpt[String]),
|
||||
@@ -158,10 +146,15 @@ class OpenIDConnectService@Inject(ws: WSClient, config: Configuration)(implicit
|
||||
providerName = provider.name
|
||||
))
|
||||
} else {
|
||||
logger.error(s"Failed to retrieve user info from ${provider.userInfoEndpoint}, status code ${response.status}")
|
||||
None
|
||||
}
|
||||
}
|
||||
.recover { case _ => None }
|
||||
.recover { case e => {
|
||||
logger.error(s"Failed to retrieve user info from ${provider.userInfoEndpoint}", e)
|
||||
None
|
||||
}
|
||||
}
|
||||
case None => Future.successful(None)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -8,7 +8,7 @@ play.http.context="/api"
|
||||
play.modules.enabled += "modules.GatewayModule"
|
||||
|
||||
play.filters.cors {
|
||||
allowedOrigins = ["http://localhost:5173"]
|
||||
allowedOrigins = ["https://knockout.janis-eccarius.de"]
|
||||
allowedCredentials = true
|
||||
allowedHttpMethods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
|
||||
allowedHttpHeaders = ["Accept", "Content-Type", "Origin", "X-Requested-With"]
|
||||
@@ -28,8 +28,8 @@ openid {
|
||||
}
|
||||
|
||||
keycloak {
|
||||
clientId = "your-keycloak-client-id"
|
||||
clientSecret = "your-keycloak-client-secret"
|
||||
clientId = ${?KEYCLOAK_CLIENT_ID}
|
||||
clientSecret = ${?KEYCLOAK_CLIENT_SECRET}
|
||||
redirectUri = "https://knockout.janis-eccarius.de/api/auth/keycloak/callback"
|
||||
authUrl = ${?KEYCLOAK_AUTH_URL}
|
||||
authUrl = "https://identity.janis-eccarius.de/realms/master"
|
||||
|
||||
@@ -25,8 +25,8 @@ openid {
|
||||
}
|
||||
|
||||
keycloak {
|
||||
clientId = "your-keycloak-client-id"
|
||||
clientSecret = "your-keycloak-client-secret"
|
||||
clientId = ${?KEYCLOAK_CLIENT_ID}
|
||||
clientSecret = ${?KEYCLOAK_CLIENT_SECRET}
|
||||
redirectUri = "https://st.knockout.janis-eccarius.de/api/auth/keycloak/callback"
|
||||
authUrl = ${?KEYCLOAK_AUTH_URL}
|
||||
authUrl = "https://identity.janis-eccarius.de/realms/master"
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
MAJOR=4
|
||||
MINOR=42
|
||||
MINOR=54
|
||||
PATCH=0
|
||||
|
||||
Reference in New Issue
Block a user