Integration with identity provider #830

jonjesse · 2022-05-11T17:42:13Z

jonjesse
May 11, 2022

Hello,

We are trying to use onelogin integration with SFTPGO using OIDC, but need to know what login url and redirect url to use. I looked in the documentation, but I cannot find this information.

Thanks much

drakkan · 2022-05-11T17:51:25Z

drakkan
May 11, 2022
Maintainer

I think you are looking for config_url and redirect_base_url, take a look at the configuration file section here

0 replies

jonjesse · 2022-05-11T18:11:38Z

jonjesse
May 11, 2022
Author

I've done the sftpgo part, I set the variables in the config.
I'm looking for the settings in the identity provider (onelogin). I need to enter the "Login URL" and "Redirect URI"
For "Login URL" I have: https://sftpgosite/web/admin/login
For "Redirect URI" I have: https://sftpgosite/*
The app does not log me in, it simply directs to the login page

1 reply

drakkan May 11, 2022
Maintainer

Take a look at your logs or post the relevant parts

jonjesse · 2022-05-11T21:17:45Z

jonjesse
May 11, 2022
Author

I think it's a matter of the oidc setting never loading into the pods.

This is relevant config in values.yaml

config:
  httpd:
    bindings:
    - oidc:
        config_url: "https://<omit>"
        client_id: "<omit>"
        role_field: "admin"

We also define the following envvar for secret:
SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_SECRET

The relevant snippet of the sftpgo.yaml file when I exec to the pod looks correct, see below:

httpd:
  bindings:
  - oidc:
      client_id: <omit>
      config_url: <omit>
      role_field: admin

However, if I look at pod logs I see this:

HTTPDConfig:{Bindings:[{Address:0.0.0.0 Port:8080 EnableWebAdmin:true EnableWebClient:true EnableHTTPS:fal
se ClientAuthType:0 TLSCipherSuites:[] ProxyAllowed:[10.0.0.0/0] HideLoginURL:0 RenderOpenAPI:true WebClientIntegrations:[] allowHeadersFrom:[]}] TemplatesPath:/usr/share/sftpg
o/templates StaticFilesPath:/usr/share/sftpgo/static BackupsPath:backups OpenAPIPath:/usr/share/sftpgo/openapi WebRoot: CertificateFile: CertificateKeyFile: CACertificates:[] C
ARevocationLists:[] SigningPassphrase:[redacted] MaxUploadFileSize:1048576000 Cors:{AllowedOrigins:[] AllowedMethods:[] AllowedHeaders:[] ExposedHeaders:[] AllowCredentials:fal
se Enabled:false MaxAge:0} Setup:{InstallationCode:[redacted] InstallationCodeHint:Installation code}}

I don't see anything about oidc configs, so the configuration for it doesn't get loaded...

Using latest image -> ghcr.io/drakkan/sftpgo:v2.2.3

3 replies

drakkan May 12, 2022
Maintainer

please use an edge variant. Take a look here

jonjesse May 12, 2022
Author

Thanks for the update, but that did not work for me either. I will wait until v 2.3 is released

drakkan May 13, 2022
Maintainer

This does not help. If you can, please post some logs. It is unlikely I'll try onelogin myself so v2.3.0 will have OIDC support as it is now

jonjesse · 2022-05-13T17:03:29Z

jonjesse
May 13, 2022
Author

Thanks for your help on this, I'm using the edge variant:

ghcr.io/drakkan/sftpgo:edge

The httpd config is: (I have client_secret as an envvar mentioned earlier)

httpd:
  bindings:
  - oidc:
      client_id: omit
      config_url: omit
      role_field: admin
    proxy_allowed:
    - 10.0.0.0/0

Once pod loads and I look a the config in the logs, the OIDC settings are not getting populated:

"httpd","message":"initializing HTTP server with config {Bindings:[{Address:0.0.0.0 Port:8080 EnableWebAdmin:true EnableWebClient:true EnableHTTPS:false MinTLSVersion:12 ClientAuthType:0 TLSCipherSuites:[] ProxyAllowed:[10.0.0.0/0] HideLoginURL:0 RenderOpenAPI:true WebClientIntegrations:[] OIDC:{ClientID: ClientSecret:[redacted] ConfigURL: RedirectBaseURL: UsernameField: RoleField: CustomFields:[] provider:<nil> verifier:<nil> providerLogoutURL: oauth2Config:<nil>} Security:{Enabled:false AllowedHosts:[] AllowedHostsAreRegex:false HostsProxyHeaders:[] HTTPSRedirect:false HTTPSHost: HTTPSProxyHeaders:[] STSSeconds:0 STSIncludeSubdomains:false STSPreload:false ContentTypeNosniff:false ContentSecurityPolicy: PermissionsPolicy: CrossOriginOpenerPolicy: ExpectCTHeader: proxyHeaders:[]} ExtraCSS:[] allowHeadersFrom:[]}] TemplatesPath:templates StaticFilesPath:static OpenAPIPath:openapi WebRoot: CertificateFile: CertificateKeyFile: CACertificates:[] CARevocationLists:[] SigningPassphrase:[redacted] MaxUploadFileSize:1048576000 Cors:{AllowedOrigins:[] AllowedMethods:[] AllowedHeaders:[] ExposedHeaders:[] AllowCredentials:false Enabled:false MaxAge:0} Setup:{InstallationCode: InstallationCodeHint:Installation code}}"}

As you can see above, the proxy_allowed does get loaded, but not the OIDC settings (except maybe for ClientSecet since it shows redacted)

6 replies

jonjesse May 13, 2022
Author

I'm sorry but I cannot post all the logs you're looking for. I did use envvars for all OIDC params and now they are getting loaded properly, but when I try to login I get this message:

{"level":"debug","time":"2022-05-13T19:59:50.319","sender":"httpd","message":"oidc authentication state did not match"}

So, I think there's a mismatch somewhere...

I also noticed that oidc login is only available for /web/client/login, can it also be available for /web/admin/login ?

Thanks much

drakkan May 14, 2022
Maintainer

when you click on the "Login with OpenID" button SFTPGo will pass a state parameter to the IDC provider. It expects to find this state parameter in the redirect callback. Based on the docs here onelogin seems to support the state parameter as any other OIDC provider.
SFTPGo currently stores this state in memory, so if you are using multiple SFTPGo instances this happens if the redirect is handled by an instance other than the one that handled the login request. This is a know issue and it will be hopefully fixed before v2.3.0. If you have a single instance it should work.

To enable OIDC for the web admin you have to define the role_field configuration parameter.

sunilke May 20, 2022

Not sure if it is correct to jump on this on going discussion but I needed some help regarding oidc integration itself.

Currently on our dev environment I tried google oidc with SFTPGo and it worked fine , I read the config docs that to enable OIDC for web admin we need to define role_field but adding custom fields in id token claims for google oidc isn't that straightforward (atleast to me) so can't we also maintain the role info in state parameter itself like if login is attempted for admin UI we will pass admin in state and same goes for client UI.Then it will save us from efforts of setting the role_field

drakkan May 20, 2022
Maintainer

Not sure if it is correct to jump on this on going discussion but I needed some help regarding oidc integration itself.

Currently on our dev environment I tried google oidc with SFTPGo and it worked fine , I read the config docs that to enable OIDC for web admin we need to define role_field but adding custom fields in id token claims for google oidc isn't that straightforward (atleast to me) so can't we also maintain the role info in state parameter itself like if login is attempted for admin UI we will pass admin in state and same goes for client UI.Then it will save us from efforts of setting the role_field

I have developed OIDC support for a project sponsor and they require an explicit setting to distinguish administrators and users.
I could add a setting like implicit_role or similar to simplify your use case, but why should I spend my free time simplifying your use case since you just ask and don't help the project in any way?

sunilke May 20, 2022

Not sure if it is correct to jump on this on going discussion but I needed some help regarding oidc integration itself.
Currently on our dev environment I tried google oidc with SFTPGo and it worked fine , I read the config docs that to enable OIDC for web admin we need to define role_field but adding custom fields in id token claims for google oidc isn't that straightforward (atleast to me) so can't we also maintain the role info in state parameter itself like if login is attempted for admin UI we will pass admin in state and same goes for client UI.Then it will save us from efforts of setting the role_field

I have developed OIDC support for a project sponsor and they require an explicit setting to distinguish administrators and users. I could add a setting like implicit_role or similar to simplify your use case, but why should I spend my free time simplifying your use case since you just ask and don't help the project in any way?

Okay, i understand. Thanks

jonjesse · 2022-05-20T16:51:32Z

jonjesse
May 20, 2022
Author

To close this out, I will have to test OIDC more once 2.3 is out. I tried using edge version, however, it messed up the backend database and had to restore it, so I will test this more once 2.3 is out, thanks!

1 reply

drakkan May 22, 2022
Maintainer

To close this out, I will have to test OIDC more once 2.3 is out. I tried using edge version, however, it messed up the backend database and had to restore it, so I will test this more once 2.3 is out, thanks!

I have activated the OneLogin 30 day free trial. SFTPGo works perfectly (both administrators and users can log in), the redirect URL configured on the OneLogin website must contain the full URL (eg. https://<domain.com>/web/oidc/redirect. You can use both email and preferred_username as the username_field

jonjesse · 2022-06-13T16:18:44Z

jonjesse
Jun 13, 2022
Author

Updated to 2.3.1. Here are my OIDC settings:

SFTPGO_HTTPD__BINDINGS__0__OIDC__CONFIG_URL: ""
SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_ID: ""
SFTPGO_HTTPD__BINDINGS__0__OIDC__USERNAME_FIELD: "preferred_username"
SFTPGO_HTTPD__BINDINGS__0__OIDC__ROLE_FIELD: "sftpgo_role"
SFTPGO_HTTPD__BINDINGS__0__OIDC__REDIRECT_BASE_URL: "https://<domain.com>"
SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_SECRET:

I have configured OneLogin with full URL ( https://<domain.com>/web/oidc/redirect ) and the reset of the settings look correct, but I am getting the following:

Wrong OpenID role, the logged in user is not an SFTPGo admin

2 replies

jonjesse Jun 14, 2022
Author

Also seeing this for regular user:

Unable to get the user associated with the OpenID token

And in the logs I see this:

{"level":"debug","time":"2022-06-14T15:56:22.977","sender":"httpd","message":"unable to get the sftpgo user associated with oidc token: not found: sql: no rows in result set"}

jonjesse Jun 15, 2022
Author

Regular users can now login with this field:

SFTPGO_HTTPD__BINDINGS__0__OIDC__USERNAME_FIELD: "email"

However, for admin users, I still get the following:

Wrong OpenID role, the logged in user is not an SFTPGo admin

I did add the custom field in onelogin:

sftpgo_role: admin

However, still getting the above message

ajaykumar-gbi · 2023-01-13T10:00:05Z

ajaykumar-gbi
Jan 13, 2023

Was this ever solved? I have the same problem:

Wrong OpenID role, the logged in user is not an SFTPGo admin

1 reply

drakkan Jan 15, 2023
Maintainer

Was this ever solved? I have the same problem:
Wrong OpenID role, the logged in user is not an SFTPGo admin

yes, it was solved, you have to set the sftpgo role as explained in the docs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Integration with identity provider #830

{{title}}

Replies: 7 comments 14 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Integration with identity provider #830

jonjesse May 11, 2022

Replies: 7 comments · 14 replies

drakkan May 11, 2022 Maintainer

jonjesse May 11, 2022 Author

drakkan May 11, 2022 Maintainer

jonjesse May 11, 2022 Author

drakkan May 12, 2022 Maintainer

jonjesse May 12, 2022 Author

drakkan May 13, 2022 Maintainer

jonjesse May 13, 2022 Author

jonjesse May 13, 2022 Author

drakkan May 14, 2022 Maintainer

sunilke May 20, 2022

drakkan May 20, 2022 Maintainer

sunilke May 20, 2022

jonjesse May 20, 2022 Author

drakkan May 22, 2022 Maintainer

jonjesse Jun 13, 2022 Author

jonjesse Jun 14, 2022 Author

jonjesse Jun 15, 2022 Author

ajaykumar-gbi Jan 13, 2023

drakkan Jan 15, 2023 Maintainer

jonjesse
May 11, 2022

Replies: 7 comments 14 replies

drakkan
May 11, 2022
Maintainer

jonjesse
May 11, 2022
Author

drakkan May 11, 2022
Maintainer

jonjesse
May 11, 2022
Author

drakkan May 12, 2022
Maintainer

jonjesse May 12, 2022
Author

drakkan May 13, 2022
Maintainer

jonjesse
May 13, 2022
Author

jonjesse May 13, 2022
Author

drakkan May 14, 2022
Maintainer

drakkan May 20, 2022
Maintainer

jonjesse
May 20, 2022
Author

drakkan May 22, 2022
Maintainer

jonjesse
Jun 13, 2022
Author

jonjesse Jun 14, 2022
Author

jonjesse Jun 15, 2022
Author

ajaykumar-gbi
Jan 13, 2023

drakkan Jan 15, 2023
Maintainer