Initial commit of OIDC auth driver module, implementation of AuthenticationProvider interface

Author: CL-Andrew

core/config/docs/core.toml

@@ -193,6 +193,38 @@ StartTimeout = '15s' # Default
 # ListenIP specifies the IP to bind the HTTP server to
 ListenIP = '0.0.0.0' # Default
 
+# Optional OIDC config if WebServer.AuthenticationMethod is set to 'oidc'
+[WebServer.OIDC]
+# Expected audience of the token, usually expected to be the ID of the client 
+# that initialized the login flow/the auth client application ID 
+ClientID = ""
+# ProviderDomain is the URL identifier for the provider service. 
+ProviderDomain = 'accounts[.]example[.]com'
+# OAuth2ProviderRouteSuffix is route suffix appended to the ProviderDomain, varies per provider
+OAuth2ProviderRouteSuffix = '/oauth2/default' # Default
+# OIDCCallbackURL is the URL (FQDN) that this running instance of the chainlink application listens on 
+# for the OIDC provider callback containing the authenticated user's claims. This should be the domain
+# that the user accesses the operator UI from. OIDCCallbackURLSuffix is appended to the end
+OIDCCallbackURL = 'http://localhost:8080/'
+# OIDCCallbackURLSuffix is the API route name suffix used when registering the router endpoint
+OIDCCallbackURLSuffix = '/auth/oidc-callback' # Default
+# HTTPPort of the OIDC self contained HTTP router used to listen for the provider callback request
+HTTPPort = 6689 # Default
+# AdminUserGroupClaim is string label of the group returned by the OIDC claim that maps the core node's 'Admin' role
+AdminUserGroupClaim = 'NodeAdmins' # Default
+# EditUserGroupClaim is string label of the group returned by the OIDC claim that maps the core node's 'Edit' role
+EditUserGroupClaim = 'NodeEditors' # Default
+# RunUserGroupClaim is string label of the group returned by the OIDC claim that maps the core node's 'Run' role
+RunUserGroupClaim = 'NodeRunners' # Default
+# ReadUserGroupClaim is string label of the group returned by the OIDC claim that maps the core node's 'Read' role
+ReadUserGroupClaim = 'NodeReadOnly' # Default
+# SessionTimeout determines the amount of idle time to elapse before session cookies expire. This signs out GUI users from their sessions.
+SessionTimeout = '15m0s' # Default
+# UserApiTokenEnabled enables the users to issue API tokens with the same access of their role
+UserApiTokenEnabled = false # Default
+# UserAPITokenDuration is the duration of time an API token is active for before expiring
+UserAPITokenDuration = '240h0m0s' # Default
+
 # Optional LDAP config if WebServer.AuthenticationMethod is set to 'ldap'
 # LDAP queries are all parameterized to support custom LDAP 'dn', 'cn', and attributes 
 [WebServer.LDAP]

core/config/docs/secrets.toml

@@ -14,6 +14,11 @@ BackupURL = "postgresql://user:pass@read-replica.example.com:5432/dbname?sslmode
 # Environment variable: `CL_DATABASE_ALLOW_SIMPLE_PASSWORDS`
 AllowSimplePasswords = false # Default
 
+# Optional OIDC config
+[WebServer.OIDC]
+# Auth client application secret
+clientSecret = "secret" # Example
+
 # Optional LDAP config
 [WebServer.LDAP]
 # ServerAddress is the full ldaps:// address of the ldap server to authenticate with and query

core/config/web_config.go

@@ -55,6 +55,23 @@ type LDAP interface {
 	UpstreamSyncRateLimit() commonconfig.Duration
 }
 
+type OIDC interface {
+	ClientID() string
+	ClientSecret() string
+	ProviderDomain() string
+	OAuth2ProviderRouteSuffix() string
+	OIDCCallbackURL() string
+	OIDCCallbackURLSuffix() string
+	HTTPPort() uint16
+	AdminUserGroupClaim() string
+	EditUserGroupClaim() string
+	RunUserGroupClaim() string
+	ReadUserGroupClaim() string
+	SessionTimeout() commonconfig.Duration
+	UserApiTokenEnabled() bool
+	UserAPITokenDuration() commonconfig.Duration
+}
+
 type WebServer interface {
 	AuthenticationMethod() string
 	AllowOrigins() string
@@ -74,4 +91,5 @@ type WebServer interface {
 	RateLimit() RateLimit
 	MFA() MFA
 	LDAP() LDAP
+	OIDC() OIDC
 }

core/services/chainlink/application.go

@@ -74,6 +74,7 @@ import (
 	"github.com/smartcontractkit/chainlink/v2/core/sessions"
 	"github.com/smartcontractkit/chainlink/v2/core/sessions/ldapauth"
 	"github.com/smartcontractkit/chainlink/v2/core/sessions/localauth"
+	"github.com/smartcontractkit/chainlink/v2/core/sessions/oidcauth"
 	"github.com/smartcontractkit/chainlink/v2/core/static"
 	"github.com/smartcontractkit/chainlink/v2/plugins"
 )
@@ -351,7 +352,7 @@ func NewApplication(opts ApplicationOpts) (Application, error) {
 	localAdminUsersORM := localauth.NewORM(opts.DS, cfg.WebServer().SessionTimeout().Duration(), globalLogger, auditLogger)
 
 	// Initialize Sessions ORM based on environment configured authenticator
-	// localDB auth or remote LDAP auth
+	// localDB auth, LDAP auth, or OIDC auth
 	authMethod := cfg.WebServer().AuthenticationMethod()
 	var authenticationProvider sessions.AuthenticationProvider
 	var sessionReaper *utils.SleeperTask
@@ -365,7 +366,16 @@ func NewApplication(opts ApplicationOpts) (Application, error) {
 		if err != nil {
 			return nil, errors.Wrap(err, "NewApplication: failed to initialize LDAP Authentication module")
 		}
-		sessionReaper = ldapauth.NewLDAPServerStateSync(opts.DS, cfg.WebServer().LDAP(), globalLogger)
+		sessionReaper = ldapauth.NewLDAPServerStateSync(opts.DS, cfg.Database(), cfg.WebServer().LDAP(), globalLogger)
+	case sessions.OIDCAuth:
+		var err error
+		authenticationProvider, err = oidcauth.NewOIDCAuthenticator(
+			opts.DS, cfg.Database(), cfg.WebServer().OIDC(), globalLogger, auditLogger,
+		)
+		if err != nil {
+			return nil, errors.Wrap(err, "NewApplication: failed to initialize OIDC Authentication module")
+		}
+		sessionReaper = oidcauth.NewSessionReaper(opts.DS, cfg.WebServer(), globalLogger)
 	case sessions.LocalAuth:
 		authenticationProvider = localauth.NewORM(opts.DS, cfg.WebServer().SessionTimeout().Duration(), globalLogger, auditLogger)
 		sessionReaper = localauth.NewSessionReaper(opts.DS, cfg.WebServer(), globalLogger)

core/sessions/authentication.go

@@ -15,6 +15,7 @@ type AuthenticationProviderName string
 const (
 	LocalAuth AuthenticationProviderName = "local"
 	LDAPAuth  AuthenticationProviderName = "ldap"
+	OIDCAuth  AuthenticationProviderName = "oidc"
 )
 
 // ErrUserSessionExpired defines the error triggered when the user session has expired