Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix OIDC_ENABLE Toggle Logic in MISP Environment Configuration #161

Merged
merged 2 commits into from
Oct 4, 2024
Merged

Fix OIDC_ENABLE Toggle Logic in MISP Environment Configuration #161

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36d35fa
Fix OIDC_ENABLE Toggle Logic in MISP Environment Configuration
Oct 2, 2024
dc421c7
Update sudo Usage for MISP Configuration Commands
Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 59 additions & 33 deletions core/files/configure_misp.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,46 +72,72 @@ GPGEOF
}

set_up_oidc() {
if [[ "$OIDC_ENABLE" != "true" ]]; then
echo "... OIDC authentication disabled"
return
fi
if [[ "$OIDC_ENABLE" == "true" ]]; then
if [[ -z "$OIDC_ROLES_MAPPING" ]]; then
OIDC_ROLES_MAPPING="\"\""
fi

if [[ -z "$OIDC_ROLES_MAPPING" ]]; then
OIDC_ROLES_MAPPING="\"\""
fi
# Check required variables
# OIDC_ISSUER may be empty
check_env_vars OIDC_PROVIDER_URL OIDC_CLIENT_ID OIDC_CLIENT_SECRET OIDC_ROLES_PROPERTY OIDC_ROLES_MAPPING OIDC_DEFAULT_ORG

# Check required variables
# OIDC_ISSUER may be empty
check_env_vars OIDC_PROVIDER_URL OIDC_CLIENT_ID OIDC_CLIENT_SECRET OIDC_ROLES_PROPERTY OIDC_ROLES_MAPPING OIDC_DEFAULT_ORG
# Configure OIDC in MISP
sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
\"Security\": {
\"auth\": [\"OidcAuth.Oidc\"]
}
}" > /dev/null

sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
\"Security\": {
\"auth\": [\"OidcAuth.Oidc\"]
}
}" > /dev/null
# Set OIDC authentication details in MISP
sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
\"OidcAuth\": {
\"provider_url\": \"${OIDC_PROVIDER_URL}\",
${OIDC_ISSUER:+\"issuer\": \"${OIDC_ISSUER}\",}
\"client_id\": \"${OIDC_CLIENT_ID}\",
\"client_secret\": \"${OIDC_CLIENT_SECRET}\",
\"roles_property\": \"${OIDC_ROLES_PROPERTY}\",
\"role_mapper\": ${OIDC_ROLES_MAPPING},
\"default_org\": \"${OIDC_DEFAULT_ORG}\"
}
}" > /dev/null

sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
\"OidcAuth\": {
\"provider_url\": \"${OIDC_PROVIDER_URL}\",
${OIDC_ISSUER:+\"issuer\": \"${OIDC_ISSUER}\",}
\"client_id\": \"${OIDC_CLIENT_ID}\",
\"client_secret\": \"${OIDC_CLIENT_SECRET}\",
\"roles_property\": \"${OIDC_ROLES_PROPERTY}\",
\"role_mapper\": ${OIDC_ROLES_MAPPING},
\"default_org\": \"${OIDC_DEFAULT_ORG}\"
}
}" > /dev/null
# Set the custom logout URL for OIDC if it is defined
if [[ -n "${OIDC_LOGOUT_URL}" ]]; then
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Plugin.CustomAuth_custom_logout" "${OIDC_LOGOUT_URL}&post_logout_redirect_uri=${BASE_URL}/users/login"
else
echo "OIDC_LOGOUT_URL is not set"
fi

# Disable password confirmation as recommended in https://github.com/MISP/MISP/issues/8116
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.require_password_confirmation" false

echo "... OIDC authentication enabled"

# Set the custom logout URL for the OIDC plugin only if OIDC_LOGOUT_URL is defined
if [[ -n "${OIDC_LOGOUT_URL}" ]]; then
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Plugin.CustomAuth_custom_logout" "${OIDC_LOGOUT_URL}&post_logout_redirect_uri=${BASE_URL}/users/login"
else
echo "OIDC_LOGOUT_URL is not set"
fi
# Reset OIDC authentication settings to empty values
sudo -u www-data php /var/www/MISP/tests/modify_config.php modify "{
\"OidcAuth\": {
\"provider_url\": \"\",
\"issuer\": \"\",
\"client_id\": \"\",
\"client_secret\": \"\",
\"roles_property\": \"\",
\"role_mapper\": \"\",
\"default_org\": \"\"
}
}" > /dev/null

# Disable password confirmation as stated at https://github.com/MISP/MISP/issues/8116
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.require_password_confirmation" false
# Use sed to remove the OidcAuth.Oidc entry from the 'auth' array in the config.php
sudo -u www-data sed -i "/'auth' =>/,/)/ { /0 => 'OidcAuth.Oidc',/d; }" /var/www/MISP/app/Config/config.php

# Remove the custom logout URL
sudo -u www-data sed -i "/'CustomAuth_custom_logout' =>/d" /var/www/MISP/app/Config/config.php

# Re-enable password confirmation if necessary
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "Security.require_password_confirmation" true

echo "... OIDC authentication disabled"
fi
}

set_up_ldap() {
Expand Down