Skip to content

Commit e8f8271

Browse files
mohityadav766mohityadav766
authored
- Add docker vars (open-metadata#15619)
- Modified Azure refresh token logic
1 parent ad6c823 commit e8f8271

File tree

8 files changed

+225
-2
lines changed

8 files changed

+225
-2
lines changed

‎conf/openmetadata.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,9 @@ authenticationConfiguration:
188188
callbackUrl: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
189189
serverUrl: ${OIDC_SERVER_URL:-"http://localhost:8585"}
190190
clientAuthenticationMethod: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
191+
tenant: ${OIDC_TENANT:-""}
192+
maxClockSkew: ${OIDC_MAX_CLOCK_SKEW:-""}
193+
customParams: ${OIDC_CUSTOM_PARAMS:-{}}
191194
samlConfiguration:
192195
debugMode: ${SAML_DEBUG_MODE:-false}
193196
idp:

‎docker/development/docker-compose-postgres.yml

+34
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,23 @@ services:
9999
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
100100
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
101101
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
102+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
103+
#For OIDC Authentication, when client is confidential
104+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
105+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
106+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
107+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
108+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
109+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
110+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
111+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
112+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
113+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
114+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
115+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
116+
OIDC_TENANT: ${OIDC_TENANT:-""}
117+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
118+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
102119
# For SAML Authentication
103120
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
104121
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}
@@ -293,6 +310,23 @@ services:
293310
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
294311
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
295312
AUTHENTICATION_ENABLE_SELF_SIGNUP : ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
313+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
314+
#For OIDC Authentication, when client is confidential
315+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
316+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
317+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
318+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
319+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
320+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
321+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
322+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
323+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
324+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
325+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
326+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
327+
OIDC_TENANT: ${OIDC_TENANT:-""}
328+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
329+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
296330
# For SAML Authentication
297331
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
298332
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

‎docker/development/docker-compose.yml

+34
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,23 @@ services:
9898
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
9999
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
100100
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
101+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
102+
#For OIDC Authentication, when client is confidential
103+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
104+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
105+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
106+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
107+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
108+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
109+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
110+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
111+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
112+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
113+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
114+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
115+
OIDC_TENANT: ${OIDC_TENANT:-""}
116+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
117+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
101118
# For SAML Authentication
102119
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
103120
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}
@@ -289,6 +306,23 @@ services:
289306
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
290307
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
291308
AUTHENTICATION_ENABLE_SELF_SIGNUP : ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
309+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
310+
#For OIDC Authentication, when client is confidential
311+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
312+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
313+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
314+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
315+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
316+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
317+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
318+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
319+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
320+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
321+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
322+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
323+
OIDC_TENANT: ${OIDC_TENANT:-""}
324+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
325+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
292326
# For SAML Authentication
293327
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
294328
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

‎docker/docker-compose-openmetadata/docker-compose-openmetadata.yml

+34
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,23 @@ services:
4242
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
4343
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
4444
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
45+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
46+
#For OIDC Authentication, when client is confidential
47+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
48+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
49+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
50+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
51+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
52+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
53+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
54+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
55+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
56+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
57+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
58+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
59+
OIDC_TENANT: ${OIDC_TENANT:-""}
60+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
61+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
4562
# For SAML Authentication
4663
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
4764
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}
@@ -232,6 +249,23 @@ services:
232249
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
233250
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
234251
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
252+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
253+
#For OIDC Authentication, when client is confidential
254+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
255+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
256+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
257+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
258+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
259+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
260+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
261+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
262+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
263+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
264+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
265+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
266+
OIDC_TENANT: ${OIDC_TENANT:-""}
267+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
268+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
235269
# For SAML Authentication
236270
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
237271
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

‎docker/docker-compose-quickstart/docker-compose-postgres.yml

+34
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,23 @@ services:
9090
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
9191
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
9292
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
93+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
94+
#For OIDC Authentication, when client is confidential
95+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
96+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
97+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
98+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
99+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
100+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
101+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
102+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
103+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
104+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
105+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
106+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
107+
OIDC_TENANT: ${OIDC_TENANT:-""}
108+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
109+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
93110
# For SAML Authentication
94111
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
95112
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}
@@ -280,6 +297,23 @@ services:
280297
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
281298
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
282299
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
300+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
301+
#For OIDC Authentication, when client is confidential
302+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
303+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
304+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
305+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
306+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
307+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
308+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
309+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
310+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
311+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
312+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
313+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
314+
OIDC_TENANT: ${OIDC_TENANT:-""}
315+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
316+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
283317
# For SAML Authentication
284318
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
285319
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

‎docker/docker-compose-quickstart/docker-compose.yml

+34
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,23 @@ services:
8888
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
8989
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
9090
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
91+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
92+
#For OIDC Authentication, when client is confidential
93+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
94+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
95+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
96+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
97+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
98+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
99+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
100+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
101+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
102+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
103+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
104+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
105+
OIDC_TENANT: ${OIDC_TENANT:-""}
106+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
107+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
91108
# For SAML Authentication
92109
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
93110
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}
@@ -278,6 +295,23 @@ services:
278295
AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}
279296
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
280297
AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
298+
AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}
299+
#For OIDC Authentication, when client is confidential
300+
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}
301+
OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.
302+
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}
303+
OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}
304+
OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}
305+
OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}
306+
OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}
307+
OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}
308+
OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}
309+
OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}
310+
OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}
311+
OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}
312+
OIDC_TENANT: ${OIDC_TENANT:-""}
313+
OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}
314+
OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}
281315
# For SAML Authentication
282316
# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}
283317
# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

‎openmetadata-service/src/main/java/org/openmetadata/service/security/SecurityUtil.java

+51-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import static org.pac4j.core.util.CommonHelper.assertNotNull;
1818
import static org.pac4j.core.util.CommonHelper.isNotEmpty;
1919

20+
import com.fasterxml.jackson.core.type.TypeReference;
2021
import com.google.common.collect.ImmutableMap;
2122
import com.google.common.collect.ImmutableMap.Builder;
2223
import com.nimbusds.jose.JOSEException;
@@ -29,14 +30,21 @@
2930
import com.nimbusds.oauth2.sdk.auth.PrivateKeyJWT;
3031
import com.nimbusds.oauth2.sdk.auth.Secret;
3132
import com.nimbusds.oauth2.sdk.id.ClientID;
33+
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
34+
import java.io.BufferedWriter;
3235
import java.io.IOException;
36+
import java.io.OutputStreamWriter;
37+
import java.net.HttpURLConnection;
38+
import java.net.URL;
39+
import java.nio.charset.StandardCharsets;
3340
import java.security.Principal;
3441
import java.security.PrivateKey;
3542
import java.text.ParseException;
3643
import java.time.Instant;
3744
import java.util.Arrays;
3845
import java.util.Collection;
3946
import java.util.Date;
47+
import java.util.HashMap;
4048
import java.util.List;
4149
import java.util.Map;
4250
import java.util.Optional;
@@ -51,8 +59,11 @@
5159
import org.openmetadata.common.utils.CommonUtil;
5260
import org.openmetadata.schema.security.client.OidcClientConfig;
5361
import org.openmetadata.service.OpenMetadataApplicationConfig;
62+
import org.openmetadata.service.util.JsonUtils;
63+
import org.pac4j.core.context.HttpConstants;
5464
import org.pac4j.core.exception.TechnicalException;
5565
import org.pac4j.core.util.CommonHelper;
66+
import org.pac4j.core.util.HttpUtils;
5667
import org.pac4j.oidc.client.AzureAd2Client;
5768
import org.pac4j.oidc.client.GoogleOidcClient;
5869
import org.pac4j.oidc.client.OidcClient;
@@ -371,11 +382,49 @@ private static void removeOrRenewOidcCredentials(
371382
if (SecurityUtil.isCredentialsExpired(credentials)) {
372383
LOG.debug("Expired credentials found, trying to renew.");
373384
profilesUpdated = true;
374-
OidcAuthenticator authenticator = new OidcAuthenticator(client.getConfiguration(), client);
375-
authenticator.refresh(credentials);
385+
if (client.getConfiguration()
386+
instanceof AzureAd2OidcConfiguration azureAd2OidcConfiguration) {
387+
refreshAccessTokenAzureAd2Token(azureAd2OidcConfiguration, credentials);
388+
} else {
389+
OidcAuthenticator authenticator = new OidcAuthenticator(client.getConfiguration(), client);
390+
authenticator.refresh(credentials);
391+
}
376392
}
377393
if (profilesUpdated) {
378394
request.getSession().setAttribute(OIDC_CREDENTIAL_PROFILE, credentials);
379395
}
380396
}
397+
398+
private static void refreshAccessTokenAzureAd2Token(
399+
AzureAd2OidcConfiguration azureConfig, OidcCredentials azureAdProfile) {
400+
HttpURLConnection connection = null;
401+
try {
402+
Map<String, String> headers = new HashMap<>();
403+
headers.put(
404+
HttpConstants.CONTENT_TYPE_HEADER, HttpConstants.APPLICATION_FORM_ENCODED_HEADER_VALUE);
405+
headers.put(HttpConstants.ACCEPT_HEADER, HttpConstants.APPLICATION_JSON);
406+
// get the token endpoint from discovery URI
407+
URL tokenEndpointURL = azureConfig.findProviderMetadata().getTokenEndpointURI().toURL();
408+
connection = HttpUtils.openPostConnection(tokenEndpointURL, headers);
409+
410+
BufferedWriter out =
411+
new BufferedWriter(
412+
new OutputStreamWriter(connection.getOutputStream(), StandardCharsets.UTF_8));
413+
out.write(azureConfig.makeOauth2TokenRequest(azureAdProfile.getRefreshToken().getValue()));
414+
out.close();
415+
416+
int responseCode = connection.getResponseCode();
417+
if (responseCode != 200) {
418+
throw new TechnicalException(
419+
"request for access token failed: " + HttpUtils.buildHttpErrorMessage(connection));
420+
}
421+
var body = HttpUtils.readBody(connection);
422+
Map<String, Object> res = JsonUtils.readValue(body, new TypeReference<>() {});
423+
azureAdProfile.setAccessToken(new BearerAccessToken((String) res.get("access_token")));
424+
} catch (final IOException e) {
425+
throw new TechnicalException(e);
426+
} finally {
427+
HttpUtils.closeConnection(connection);
428+
}
429+
}
381430
}

‎openmetadata-service/src/test/resources/openmetadata-secure-test.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,7 @@ authorizerConfiguration:
140140
- "all"
141141

142142
authenticationConfiguration:
143+
clientType: "public"
143144
provider: "basic"
144145
providerName: ""
145146
publicKeyUrls:

0 commit comments

Comments
 (0)