From c55f9d4384edb302da3fd15c45a22a7d5aa34522 Mon Sep 17 00:00:00 2001 From: bhagyasakalanka Date: Thu, 20 Feb 2025 14:42:18 +0530 Subject: [PATCH 1/4] Central deployment related improvements --- .changeset/tasty-crews-rule.md | 5 + apps/console/src/auth.html | 112 +++++++++++++++--- .../src/extensions/i18n/models/extensions.ts | 8 ++ .../i18n/resources/en-US/extensions.ts | 11 ++ apps/console/src/init/app-utils.ts | 1 + apps/myaccount/src/configs/app.ts | 1 + features/admin.base.v1/utils/app-utils.ts | 1 + features/admin.core.v1/configs/app.ts | 1 + .../admin.core.v1/store/reducers/config.ts | 2 + features/admin.tenants.v1/api/tenants.ts | 27 ++++- .../components/add-modal/add-tenant.tsx | 12 +- .../components/dropdown/tenant-dropdown.tsx | 109 ++++++++++++----- .../forms/add-tenant-wizard-form.tsx | 58 ++++++++- .../admin.tenants.v1/configs/endpoints.ts | 1 + features/admin.tenants.v1/models/endpoints.ts | 1 + features/admin.tenants.v1/models/tenant.ts | 27 +++++ .../pages/create-tenant-page.tsx | 85 +++++++++++-- .../admin.tenants.v1/utils/tenant-switch.tsx | 14 ++- modules/core/src/models/config.ts | 4 + modules/core/src/models/tenants.ts | 10 +- 20 files changed, 419 insertions(+), 71 deletions(-) create mode 100644 .changeset/tasty-crews-rule.md diff --git a/.changeset/tasty-crews-rule.md b/.changeset/tasty-crews-rule.md new file mode 100644 index 00000000000..435593f393f --- /dev/null +++ b/.changeset/tasty-crews-rule.md @@ -0,0 +1,5 @@ +--- +"@wso2is/console": patch +--- + +Add pre auth improvement for central deployment related authentication diff --git a/apps/console/src/auth.html b/apps/console/src/auth.html index 475ade02769..099c5c42c9a 100644 --- a/apps/console/src/auth.html +++ b/apps/console/src/auth.html @@ -170,6 +170,7 @@ var proxyContextPathGlobal = startupConfig.proxyContextPathGlobal; var superTenantGlobal = startupConfig.superTenant; var tenantPrefixGlobal = startupConfig.tenantPrefix; + var isCentralDeploymentEnabled = startupConfig.enableCentralDeployment; var isAdaptiveAuthenticationAvailable = true; var isOrganizationManagementEnabled = true; @@ -179,13 +180,14 @@ sessionStorage.setItem("auth_callback_url_console", authCallbackUrl); } - var serverOrigin = startupConfig.serverUrl; + var serverOrigin = isCentralDeploymentEnabled ? startupConfig.centralServerUrl : startupConfig.serverUrl; + var deploymentUnitServerOrigin = startupConfig.serverUrl; var authorizationCode = urlParams.get("code"); var authSessionState = urlParams.get("session_state"); var authIdPs = urlParams.get("AuthenticatedIdPs"); function authenticateWithSDK() { - if(!authorizationCode) { + if (!authorizationCode || isCentralDeploymentEnabled) { function getTenantName() { var path = window.location.pathname; var pathChunks = path.split("/"); @@ -224,6 +226,27 @@ return serverOrigin + getTenantPath(tenantDomain); } + /** + * Get the deployment unit API path. + * + * @param {string} path - Path to be appended to the API path. + * @param {string} tenantDomain - Tenant domain. + * @returns {string} Constructed API path. + */ + function getDeploymentUnitApiPath(path, tenantDomain) { + if (!tenantDomain) { + if (startupConfig.superTenantProxy) { + tenantDomain = startupConfig.superTenantProxy; + } else { + tenantDomain = startupConfig.superTenant; + } + } + if (path) { + return deploymentUnitServerOrigin + getTenantPath(tenantDomain) + path; + } + return deploymentUnitServerOrigin + getTenantPath(tenantDomain); + } + /** * Get the organization name. * @@ -262,12 +285,25 @@ // When there's no proxy context path, the IS server returns "null". var contextPath = (!proxyContextPathGlobal || proxyContextPathGlobal === "null") ? "" : "/" + proxyContextPathGlobal; + if (isCentralDeploymentEnabled) { + return applicationDomain + } if (getTenantName() === startupConfig.superTenant) { return applicationDomain.replace(/\/+$/, '') + contextPath + "<%= htmlWebpackPlugin.options.basename ? '/' + htmlWebpackPlugin.options.basename : ''%>"; } - return applicationDomain.replace(/\/+$/, '') + contextPath + getTenantPath() + return applicationDomain.replace(/\/+$/, '') + getTenantPath() + + "<%= htmlWebpackPlugin.options.basename ? '/' + htmlWebpackPlugin.options.basename : ''%>"; + } + + /** + * Construct the sign-in redirect URL for deployment unit. + * + * @returns {string} Constructed URL + */ + function deploymentUnitSignInRedirectURL(tenantDomain) { + return `${applicationDomain}/${tenantPrefixGlobal}/${tenantDomain}` + "<%= htmlWebpackPlugin.options.basename ? '/' + htmlWebpackPlugin.options.basename : ''%>"; } @@ -333,7 +369,22 @@ } var auth = AsgardeoAuth.AsgardeoSPAClient.getInstance(); + if (isCentralDeploymentEnabled) { + auth = AsgardeoAuth.AsgardeoSPAClient.getInstance("primary"); + } + var endpoints = { + authorizationEndpoint: getApiPath("/oauth2/authorize"), + clockTolerance: 300, + jwksEndpointURL: isCentralDeploymentEnabled ? ("/oauth2/jwks") : undefined, + logoutEndpointURL: getApiPath("/oidc/logout"), + oidcSessionIFrameEndpointURL: getApiPath("/oidc/checksession"), + tokenEndpointURL: undefined, + tokenRevocationEndpointURL: isCentralDeploymentEnabled ? ("/oauth2/revoke") : undefined + }; + if (isCentralDeploymentEnabled) { + endpoints.issuer = `${serverOrigin}/oauth2/token`; + } var authConfig = { signInRedirectURL: signInRedirectURL(), signOutRedirectURL: getSignOutRedirectURL(), @@ -344,15 +395,7 @@ storage: "webWorker", disableTrySignInSilently: true, enableOIDCSessionManagement: false, - endpoints: { - authorizationEndpoint: getApiPath("/oauth2/authorize"), - clockTolerance: 300, - jwksEndpointURL: undefined, - logoutEndpointURL: getApiPath("/oidc/logout"), - oidcSessionIFrameEndpointURL: getApiPath("/oidc/checksession"), - tokenEndpointURL: undefined, - tokenRevocationEndpointURL: undefined - }, + endpoints: endpoints, enablePKCE: true } @@ -385,13 +428,54 @@ sessionStorage.setItem("auth_callback_url_console", authCallbackUrl); } - auth.signIn(getAuthParams({})); + if (isCentralDeploymentEnabled) { + if (authorizationCode) { + auth.signIn({callOnlyOnRedirect: true}) + .then((response) => { + auth.getDecodedIDToken().then((token) => { + var defaultTenant = token["default_tenant"] + var authConfigRegion = { + signInRedirectURL: deploymentUnitSignInRedirectURL(defaultTenant), + signOutRedirectURL: getSignOutRedirectURL(), + clientID: "<%= htmlWebpackPlugin.options.clientID %>", + baseUrl: getDeploymentUnitApiPath(defaultTenant), + responseMode: "query", + scope: ["openid SYSTEM profile"], + storage: "webWorker", + disableTrySignInSilently: false, + enableOIDCSessionManagement: false, + endpoints: { + authorizationEndpoint: getDeploymentUnitApiPath("/oauth2/authorize", defaultTenant), + clockTolerance: 300, + jwksEndpointURL: getDeploymentUnitApiPath("/oauth2/jwks", defaultTenant), + logoutEndpointURL: getDeploymentUnitApiPath("/oidc/logout", defaultTenant), + oidcSessionIFrameEndpointURL: getDeploymentUnitApiPath("/oidc/checksession", defaultTenant), + tokenEndpointURL: getDeploymentUnitApiPath("/oauth2/token", defaultTenant), + tokenRevocationEndpointURL: getDeploymentUnitApiPath("/oauth2/revoke", defaultTenant), + issuer: getDeploymentUnitApiPath("/oauth2/token", defaultTenant) + }, + enablePKCE: true + } + var authSecondary = AsgardeoAuth.AsgardeoSPAClient.getInstance("secondary"); + + authSecondary.initialize(authConfigRegion); + + authSecondary.signIn({prompt: "login",fidp: "PlatformIDP"}) + + }) + }) + } else { + auth.signIn(getAuthParams({})) + } + } else { + auth.signIn(getAuthParams({})); + } } } }