Skip to content

[OIDC] Enhance OIDC Integration: Secure client secret handling and fix access token storage #4159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

[OIDC] Enhance OIDC Integration: Secure client secret handling and fix access token storage #4159

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
21f745a
add oidc_rp_client_secret_script config
Jun 4, 2025
5f49340
fix bug: save access token to login with oidc provider
Jun 4, 2025
7ef9326
fix typo
Jun 5, 2025
a8da009
fix: fix help arguments
Jun 9, 2025
75118c9
fix: pylint fix
Jun 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions desktop/conf.dist/hue.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -828,6 +828,9 @@ tls=no
# The client secret as relay party set in OpenID provider
## oidc_rp_client_secret=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# Execute this script to produce the oidc rp client secret. This will be used when 'oidc_rp_client_secret' is not set.
## oidc_rp_client_script=

# The OpenID provider authoriation endpoint
## oidc_op_authorization_endpoint=https://keycloak.example.com/auth/realms/Cloudera/protocol/openid-connect/auth

Expand Down
3 changes: 3 additions & 0 deletions desktop/conf/pseudo-distributed.ini.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -830,6 +830,9 @@
# The client secret as relay party set in OpenID provider
## oidc_rp_client_secret=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# Execute this script to produce the oidc rp client secret. This will be used when 'oidc_rp_client_secret' is not set.
## oidc_rp_client_script=

# The OpenID provider authoriation endpoint
## oidc_op_authorization_endpoint=https://keycloak.example.com/auth/realms/Cloudera/protocol/openid-connect/auth

Expand Down
11 changes: 9 additions & 2 deletions desktop/core/src/desktop/auth/backend.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -827,7 +827,7 @@ def authenticate(self, *args, **kwargs):

token_payload = {
'client_id': self.OIDC_RP_CLIENT_ID,
'client_secret': self.OIDC_RP_CLIENT_SECRET,
'client_secret': self.OIDC_RP_CLIENT_SECRET or self.OIDC_RP_CLIENT_SECRET_SCRIPT,
'grant_type': 'authorization_code',
'code': code,
'redirect_uri': absolutify(
Expand All @@ -849,6 +849,7 @@ def authenticate(self, *args, **kwargs):
verified_id = self.verify_token(id_token, nonce=nonce)

if verified_id:
self.save_access_tokens(access_token)
self.save_refresh_tokens(refresh_token)
user = self.get_or_create_user(access_token, id_token, verified_id)
user = rewrite_user(user)
Expand All @@ -865,6 +866,12 @@ def filter_users_by_claims(self, claims):
return self.UserModel.objects.none()
return self.UserModel.objects.filter(username__iexact=username)

def save_access_tokens(self, access_token):
session = self.request.session

if import_from_settings('OIDC_STORE_ACCESS_TOKEN', False):
session['oidc_access_token'] = access_token

def save_refresh_tokens(self, refresh_token):
session = self.request.session

Expand Down Expand Up @@ -940,7 +947,7 @@ def logout(self, request, next_page):
if access_token and refresh_token:
oidc_logout_url = OIDC.LOGOUT_REDIRECT_URL.get()
client_id = import_from_settings('OIDC_RP_CLIENT_ID')
client_secret = import_from_settings('OIDC_RP_CLIENT_SECRET')
client_secret = import_from_settings('OIDC_RP_CLIENT_SECRET') or import_from_settings('OIDC_RP_CLIENT_SECRET_SCRIPT')
oidc_verify_ssl = import_from_settings('OIDC_VERIFY_SSL')
form = {
'client_id': client_id,
Expand Down
10 changes: 9 additions & 1 deletion desktop/core/src/desktop/conf.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1610,7 +1610,15 @@ def is_gunicorn_report_enabled():
key="oidc_rp_client_secret",
help=_("The client secret as relay party set in OpenID provider."),
type=str,
default="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
default=""
),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@SoniaComp Looks like there are some unit test failures, can you please check? Also is this change required?


OIDC_RP_CLIENT_SECRET_SCRIPT=Config(
key="oidc_rp_client_secret_script",
help=_("Execute this script to produce the oidc rp client secret.",
"This will be used when 'oidc_rp_client_secret' is not set."),
type=coerce_password_from_script,
default=None,
),

OIDC_OP_AUTHORIZATION_ENDPOINT=Config(
Expand Down
1 change: 1 addition & 0 deletions desktop/core/src/desktop/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -605,6 +605,7 @@ def is_oidc_configured():
OIDC_RP_SIGN_ALGO = 'RS256'
OIDC_RP_CLIENT_ID = desktop.conf.OIDC.OIDC_RP_CLIENT_ID.get()
OIDC_RP_CLIENT_SECRET = desktop.conf.OIDC.OIDC_RP_CLIENT_SECRET.get()
OIDC_RP_CLIENT_SECRET_SCRIPT = desktop.conf.OIDC.OIDC_RP_CLIENT_SECRET_SCRIPT.get()
OIDC_OP_AUTHORIZATION_ENDPOINT = desktop.conf.OIDC.OIDC_OP_AUTHORIZATION_ENDPOINT.get()
OIDC_OP_TOKEN_ENDPOINT = desktop.conf.OIDC.OIDC_OP_TOKEN_ENDPOINT.get()
OIDC_OP_USER_ENDPOINT = desktop.conf.OIDC.OIDC_OP_USER_ENDPOINT.get()
Expand Down
Loading