Merge pull request openstf#538 from DroidsOnRoids/oauth2_domain

Optional email domain restriction added for OAuth2 authorization.
dlvoy · Feb 14, 2017 · 353599a · 353599a
2 parents 79aadbb + 8b9ff7e
commit 353599a
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 3 deletions.
diff --git a/lib/cli/auth-oauth2/index.js b/lib/cli/auth-oauth2/index.js
@@ -54,6 +54,12 @@ module.exports.builder = function(yargs) {
     , default: process.env.OAUTH_SCOPE
     , demand: true
     })
+    .option('oauth-domain', {
+      describe: 'Optional email domain to allow authentication for.'
+    , type: 'string'
+    , default: process.env.OAUTH_DOMAIN
+    , demand: false
+    })
     .option('port', {
       alias: 'p'
     , describe: 'The port to bind to.'
@@ -89,6 +95,7 @@ module.exports.handler = function(argv) {
   , secret: argv.secret
   , ssid: argv.ssid
   , appUrl: argv.appUrl
+  , domain: argv.oauthDomain
   , oauth: {
       authorizationURL: argv.oauthAuthorizationUrl
     , tokenURL: argv.oauthTokenUrl

diff --git a/lib/units/auth/oauth2/index.js b/lib/units/auth/oauth2/index.js
@@ -28,10 +28,20 @@ module.exports = function(options) {
   , session: false
   }))
 
+  function isEmailAllowed(email) {
+    if (email) {
+      if (options.domain) {
+        return email.endsWith(options.domain)
+      }
+      return true
+    }
+    return false
+  }
+
   app.get(
     '/auth/oauth/callback'
   , function(req, res) {
-      if (req.user.email) {
+      if (isEmailAllowed(req.user.email)) {
         res.redirect(urlutil.addParams(options.appUrl, {
           jwt: jwtutil.encode({
             payload: {
@@ -46,8 +56,9 @@ module.exports = function(options) {
         }))
       }
       else {
-        log.warn('Missing email in profile', req.user)
-        res.redirect('/auth/oauth/')
+        log.warn('Missing or disallowed email in profile', req.user)
+        res.send('<html><body>Missing or rejected email address ' +
+                 '<a href="/auth/oauth/">Retry</a></body></html>')
       }
     }
   )