andreas/synapse-app-mas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OIDC auth implemented, ldap users migration implemented

Browse Source
This commit is contained in:
Vladimir D
2023-10-19 15:57:22 +04:00
committed by Girish Ramakrishnan
parent 9ff85f5103
commit 7ceec54658
2 changed files with 32 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
start.sh
View File

@@ -4,6 +4,18 @@ set -eu
mkdir -p /app/data/data /app/data/configs /run/synapse
# can be removed in the next release
migrate_ldap_users_to_oidc() {
set -eu
echo "==> Synapse is up, migrate LDAP users"
users_to_migrate=$(PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -AXqtc "SELECT count(*) FROM Users u LEFT JOIN user_external_ids ext_ids ON u.name=ext_ids.user_id WHERE ext_ids.user_id IS NULL")
echo " Users to migrate: ${users_to_migrate}"
if [[ ${users_to_migrate} -gt 0 ]]; then
PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} psql -h ${CLOUDRON_POSTGRESQL_HOST} -p ${CLOUDRON_POSTGRESQL_PORT} -U ${CLOUDRON_POSTGRESQL_USERNAME} -d ${CLOUDRON_POSTGRESQL_DATABASE} -c "INSERT INTO user_external_ids SELECT 'oidc-cloudron' AS auth_provider, substring(u.name from '@(.*):') AS external_id, u.name as user_id FROM Users u LEFT JOIN user_external_ids ext_ids ON u.name=ext_ids.user_id WHERE ext_ids.user_id IS NULL"
fi
}
if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
echo "==> Detected first run"
@@ -35,7 +47,7 @@ if [[ ! -f /app/data/configs/homeserver.yaml ]]; then
yq eval -i ".auto_join_rooms=[]" /app/data/configs/homeserver.yaml
yq eval -i ".auto_join_rooms[0]=\"#discuss:${server_name}\"" /app/data/configs/homeserver.yaml
if [[ -z "${CLOUDRON_LDAP_SERVER:-}" ]]; then
if [[ -z "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
yq eval -i ".enable_registration=true" /app/data/configs/homeserver.yaml
yq eval -i ".password_config.pepper=\"$(pwgen -1s 12)\"" /app/data/configs/homeserver.yaml
# just setting enabled to false is not enough. see https://github.com/matrix-org/matrix-synapse-ldap3/issues/123
@@ -65,15 +77,25 @@ yq eval -i ".email.smtp_user=\"${CLOUDRON_MAIL_SMTP_USERNAME}\"" /app/data/confi
yq eval -i ".email.smtp_pass=\"${CLOUDRON_MAIL_SMTP_PASSWORD}\"" /app/data/configs/homeserver.yaml
yq eval -i ".email.notif_from=\"${CLOUDRON_MAIL_FROM_DISPLAY_NAME:-Matrix} <${CLOUDRON_MAIL_FROM}>\"" /app/data/configs/homeserver.yaml
# ldap
if [[ -n "${CLOUDRON_LDAP_SERVER:-}" ]]; then
yq eval -i ".password_providers[0].config.uri=\"${CLOUDRON_LDAP_URL}\"" /app/data/configs/homeserver.yaml
yq eval -i ".password_providers[0].config.start_tls=false" /app/data/configs/homeserver.yaml
yq eval -i ".password_providers[0].config.base=\"${CLOUDRON_LDAP_USERS_BASE_DN}\"" /app/data/configs/homeserver.yaml
yq eval -i ".password_providers[0].config.bind_dn=\"${CLOUDRON_LDAP_BIND_DN}\"" /app/data/configs/homeserver.yaml
yq eval -i ".password_providers[0].config.bind_password=\"${CLOUDRON_LDAP_BIND_PASSWORD}\"" /app/data/configs/homeserver.yaml
yq eval -i ".password_providers[0].config.filter=\"(objectClass=user)\"" /app/data/configs/homeserver.yaml
# oidc
if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
yq eval -i "del(.password_providers)" /app/data/configs/homeserver.yaml # remove old ldap config
echo " ==> Configuring OIDC auth"
yq eval -i ".oidc_providers[0].idp_id=\"cloudron\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].idp_name=\"Cloudron\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].issuer=\"${CLOUDRON_OIDC_ISSUER}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].client_id=\"${CLOUDRON_OIDC_CLIENT_ID}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].client_secret=\"${CLOUDRON_OIDC_CLIENT_SECRET}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].scopes=[\"openid\", \"email\", \"profile\"]" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].authorization_endpoint=\"${CLOUDRON_OIDC_AUTH_ENDPOINT}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].token_endpoint=\"${CLOUDRON_OIDC_TOKEN_ENDPOINT}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].userinfo_endpoint=\"${CLOUDRON_OIDC_PROFILE_ENDPOINT}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].user_mapping_provider.config.localpart_template=\"{{ user.sub }}\"" /app/data/configs/homeserver.yaml
yq eval -i ".oidc_providers[0].user_mapping_provider.config.display_name_template=\"{{ user.sub }}\"" /app/data/configs/homeserver.yaml
echo "==> Migrating existing LDAP users to OIDC"
migrate_ldap_users_to_oidc
else
yq eval -i ".password_config.localdb_enabled=true" /app/data/configs/homeserver.yaml
# just setting enabled to false is not enough. see https://github.com/matrix-org/matrix-synapse-ldap3/issues/123