Merge pull request 'Update Rust crate serde to 1.0.228' (#434) from renovate/serde-1.x into master

Reviewed-on: #407

.drone.yml

@@ -0,0 +1,13 @@
+---
+kind: pipeline
+type: docker
+name: default
+
+steps:
+- name: cargo_check
+  image: rust
+  commands:
+  - rustup component add clippy
+  - cargo clippy -- -D warnings
+  - cargo test
+

Cargo.toml

@@ -1,37 +1,42 @@
 [package]
 name = "basic-oidc"
-version = "0.1.0"
-edition = "2021"
+version = "0.1.5"
+edition = "2024"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-actix = "0.13.0"
-actix-identity = "0.4.0"
-actix-web = "4"
-clap = { version = "3.1.9", features = ["derive", "env"] }
-include_dir = "0.7.2"
-log = "0.4.16"
-serde_json = "1.0.79"
-serde_yaml = "0.8.23"
-env_logger = "0.9.0"
-serde = { version = "1.0.136", features = ["derive"] }
-bcrypt = "0.11.0"
-uuid = { version = "0.8.2", features = ["v4"] }
-mime_guess = "2.0.4"
-askama = "0.11.1"
-futures-util = "0.3.21"
-urlencoding = "2.1.0"
-rand = "0.8.5"
-base64 = "0.13.0"
-jwt-simple = "0.10.9"
-digest = "0.10.3"
-sha2 = "0.10.2"
-lazy-regex = "2.3.0"
-totp_rfc6238 = "0.5.0"
-base32 = "0.4.0"
-qrcode-generator = "4.1.4"
-webauthn-rs = "0.3.2"
-url = "2.2.2"
-aes-gcm = { version = "0.9.4", features = ["aes"] }
-bincode = "1.3.3"
+actix = "0.13.5"
+actix-identity = "0.9.0"
+actix-web = "4.11.0"
+actix-session = { version = "0.11.0", features = ["cookie-session"] }
+actix-remote-ip = "0.1.0"
+clap = { version = "4.5.48", features = ["derive", "env"] }
+include_dir = "0.7.4"
+log = "0.4.28"
+serde_json = "1.0.145"
+serde_yaml = "0.9.34"
+env_logger = "0.11.8"
+serde = { version = "1.0.228", features = ["derive"] }
+bcrypt = "0.17.1"
+uuid = { version = "1.18.1", features = ["v4"] }
+mime_guess = "2.0.5"
+askama = "0.14.0"
+futures-util = "0.3.31"
+urlencoding = "2.1.3"
+rand = "0.9.2"
+base64 = "0.22.1"
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
+digest = "0.10.7"
+sha2 = "0.10.9"
+lazy-regex = "3.4.1"
+totp_rfc6238 = "0.6.1"
+base32 = "0.5.1"
+qrcode-generator = "5.0.0"
+webauthn-rs = { version = "0.5.2", features = ["danger-allow-state-serialisation"] }
+url = "2.5.7"
+light-openid = { version = "1.0.4", features = ["crypto-wrapper"] }
+bincode = "2.0.1"
+chrono = "0.4.42"
+lazy_static = "1.5.0"
+mailchecker = "6.0.18"

Dockerfile

@@ -1,5 +1,9 @@
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+  && apt-get install -y libcurl4 \
+  && rm -rf /var/lib/apt/lists/*
 
 COPY basic-oidc /usr/local/bin/basic-oidc
 
-ENTRYPOINT /usr/local/bin/basic-oidc
+ENTRYPOINT ["/usr/local/bin/basic-oidc"]

README.md

@@ -1,33 +1,80 @@
 # Basic OIDC
+[![Build Status](https://drone.communiquons.org/api/badges/pierre/BasicOIDC/status.svg)](https://drone.communiquons.org/pierre/BasicOIDC)
+
 Basic & lightweight OpenID provider, written in Rust using the Actix framework.
 
 **WARNING :** This tool has not been audited, use it at your own risks!
 
-BasicOIDC operates without any database, just with two files :
+BasicOIDC operates without any database, just with three files :
 * `clients.yaml`: a list of authorized relying parties.
+* `providers.yaml`: a list of upstream providers for authentication federation (this file is optional)
 * `users.json`: a list of users, managed through a web UI.
 
+## Configuration
 You can configure a list of clients (Relying Parties) in a `clients.yaml` file with the following syntax :
 ```yaml
+  # Client ID
 - id: gitea
+  # Client name
   name: Gitea
+  # Client description
   description: Git with a cup of tea
+  # Client secret. Specify this value to use authorization code flow, remove it for implicit authentication flow
   secret: TOP_SECRET
+  # The URL where user shall be redirected after authentication
   redirect_uri: https://mygit.mywebsite.com/
+  # Optional, If you want new accounts to be granted access to this client by default
+  default: true
+  # Optional, If you want the client to be granted to every user, regardless their account configuration
+  granted_to_all_users: true
+  # Optional, If you want users to have performed recent second factor authentication before accessing this client, set this setting to true
+  enforce_2fa_auth: true
+  # Optional, claims to be added to the ID token payload.
+  # The following placeholders can be set, they will the replaced when the token is created:
+  # * {username}: user name of the user
+  # * {mail}: email address of the user
+  # * {first_name}: first name of the user
+  # * {last_name}: last name of the user
+  # * {uid}: user id of the user
+  claims_id_token:
+    groups: ["group_{user}"]
+    service: "auth"
+  # Optional, claims to be added to the user info endpoint response
+  # The placeholders of `claims_id_token` can also be used here 
+  claims_user_info:
+    groups: ["group_{user}"]
+    service: "auth"
 ```
 
 On the first run, BasicOIDC will create a new administrator with credentials `admin` / `admin`. On first login you will have to change these default credentials.
 
 In order to run BasicOIDC for development, you will need to create a least an empty `clients.yaml` file inside the storage directory.
 
-Features :
+## Features
 * [x] `authorization_code` flow
+* [x] `implicit` flow
 * [x] Client authentication using secrets 
 * [x] Bruteforce protection 
-* [ ] 2 factors authentication
+* [x] 2 factors authentication
   * [x] TOTP (authenticator app)
-  * [ ] Using a security key
+  * [x] Using a security key (Webauthn)
 * [ ] Fully responsive webui
+* [x] `robots.txt` prevents indexing
+* [x] Support authentication from upstream provider
+
+## Add an upstream provider
+You can add as much upstream provider as you want, using the following syntax in `providers.yaml`:
+```yaml
+- id: gitlab
+  name: GitLab
+  logo: gitlab # Can be either gitea, gitlab, github, microsoft, google or a full URL
+  client_id: CLIENT_ID_GIVEN_BY_PROVIDER
+  client_secret: CLIENT_SECRET_GIVEN_BY_PROVIDER
+  configuration_url: https://gitlab.com/.well-known/openid-configuration
+
+```
+
+> Warning! Self-registration has not been implemented, therfore the accounts must have been previously created through the administration.
 
 ## Compiling
 You will need the Rust toolchain to compile this project. To build it for production, just run:
@@ -35,5 +82,31 @@ You will need the Rust toolchain to compile this project. To build it for produc
 cargo build --release
 ```
 
+## Testing with OAauth proxy
+If you want to test the solution with OAuth proxy, you can try to adapt the following commands (considering `192.168.2.103` is your local IP address):
+
+```bash
+export IP=192.168.2.103
+
+# In a shell, start BasicOID
+RUST_LOG=debug cargo run -- -s storage -w "http://$IP.nip.io:8000"
+
+# In another shell, run OAuth proxy
+docker run --rm -p 4180:4180 quay.io/oauth2-proxy/oauth2-proxy:latest --provider=oidc --email-domain=* --client-id=oauthproxy --client-secret=secretoauth --cookie-secret=SECRETCOOKIE1234 --oidc-issuer-url=http://$IP.nip.io:8000 --http-address 0.0.0.0:4180  --upstream http://$IP --redirect-url http://$IP:4180/oauth2/callback --cookie-secure=false
+```
+
+Corresponding client configuration:
+```yaml
+- id: oauthproxy
+  name: Oauth proxy
+  description: oauth proxy
+  secret: secretoauth
+  redirect_uri: http://192.168.2.103:4180/
+```
+
+> Note: We do need to use real domain name instead of IP address due to the `webauthn-rs` crate limitations. We therefore use the `nip.io` domain helper.
+
+OAuth proxy can then be access on this URL: http://192.168.2.103:4180/
+
 ## Contributing
 If you wish to contribute to this software, feel free to send an email to contact@communiquons.org to get an account on my system, managed by BasicOIDC :)

assets/css/base_login_page.css

@@ -1,14 +1,14 @@
 html,
 body {
-  height: 100%;
+    height: 100%;
 }
 
 body {
-  display: flex;
-  align-items: center;
-  padding-top: 40px;
-  padding-bottom: 40px;
-  /* background-color: #f5f5f5; */
+    display: flex;
+    align-items: center;
+    padding-top: 40px;
+    padding-bottom: 40px;
+    /* background-color: #f5f5f5; */
 }
 
 /* background */
@@ -26,50 +26,57 @@ body {
 }
 
 .form-signin {
-  width: 100%;
-  max-width: 330px;
-  padding: 15px;
-  margin: auto;
+    width: 100%;
+    max-width: 330px;
+    padding: 15px;
+    margin: auto;
 }
 
 .form-signin .checkbox {
-  font-weight: 400;
+    font-weight: 400;
 }
 
 .form-signin .form-floating:focus-within {
-  z-index: 2;
+    z-index: 2;
 }
 
 .form-floating:first-child input {
-  margin-bottom: -1px;
-  border-bottom-right-radius: 0;
-  border-bottom-left-radius: 0;
+    margin-bottom: -1px;
+    border-bottom-right-radius: 0;
+    border-bottom-left-radius: 0;
 }
 
 .form-floating:not(:first-child):not(:last-child) input {
-  margin-bottom: -1px;
-  border-bottom-right-radius: 0;
-  border-bottom-left-radius: 0;
-  border-top-left-radius: 0;
-  border-top-right-radius: 0;
+    margin-bottom: -1px;
+    border-bottom-right-radius: 0;
+    border-bottom-left-radius: 0;
+    border-top-left-radius: 0;
+    border-top-right-radius: 0;
 }
 
 .form-floating:last-child input {
-  margin-bottom: 10px;
-  border-top-left-radius: 0;
-  border-top-right-radius: 0;
+    margin-bottom: 10px;
+    border-top-left-radius: 0;
+    border-top-right-radius: 0;
 }
 
 .form-control {
-  background-color: var(--bs-gray-700);
-  color: var(--bs-gray-100);
+    background-color: var(--bs-gray-700);
+    color: var(--bs-gray-100);
 }
 
 .form-control:focus {
-  background-color: var(--bs-gray-600);
-  color: var(--bs-gray-100);
+    background-color: var(--bs-gray-600);
+    color: var(--bs-gray-100);
 }
 
 .text-muted {
     color: #c6c4c4 !important;
 }
+
+.form-floating > .form-control:focus ~ label::after,
+.form-floating > .form-control:not(:placeholder-shown) ~ label::after,
+.form-floating > .form-control-plaintext ~ label::after,
+.form-floating > .form-select ~ label::after {
+    background-color: unset !important;
+}

assets/css/base_settings_page.css

@@ -13,3 +13,11 @@ body {
     padding: 3rem;
     overflow-y: scroll;
 }
+
+.nav-link.link-dark {
+    color: white !important;
+}
+
+.form-control::placeholder {
+    color: #555;
+}

assets/img/brands/gitea.svg

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg version="1.1" id="main_outline" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 640 640" style="enable-background:new 0 0 640 640;" xml:space="preserve"><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-custom-link"/><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-general-link"/><style xmlns="" lang="en" type="text/css" id="dark-mode-custom-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-sheet"/>
+<g>
+	<path id="teabag" style="fill:#FFFFFF" d="M395.9,484.2l-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5,21.2-17.9,33.8-11.8   c17.2,8.3,27.1,13,27.1,13l-0.1-109.2l16.7-0.1l0.1,117.1c0,0,57.4,24.2,83.1,40.1c3.7,2.3,10.2,6.8,12.9,14.4   c2.1,6.1,2,13.1-1,19.3l-61,126.9C423.6,484.9,408.4,490.3,395.9,484.2z"/>
+	<g>
+		<g>
+			<path style="fill:#609926" d="M622.7,149.8c-4.1-4.1-9.6-4-9.6-4s-117.2,6.6-177.9,8c-13.3,0.3-26.5,0.6-39.6,0.7c0,39.1,0,78.2,0,117.2     c-5.5-2.6-11.1-5.3-16.6-7.9c0-36.4-0.1-109.2-0.1-109.2c-29,0.4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5     c-9.8-0.6-22.5-2.1-39,1.5c-8.7,1.8-33.5,7.4-53.8,26.9C-4.9,212.4,6.6,276.2,8,285.8c1.7,11.7,6.9,44.2,31.7,72.5     c45.8,56.1,144.4,54.8,144.4,54.8s12.1,28.9,30.6,55.5c25,33.1,50.7,58.9,75.7,62c63,0,188.9-0.1,188.9-0.1s12,0.1,28.3-10.3     c14-8.5,26.5-23.4,26.5-23.4s12.9-13.8,30.9-45.3c5.5-9.7,10.1-19.1,14.1-28c0,0,55.2-117.1,55.2-231.1     C633.2,157.9,624.7,151.8,622.7,149.8z M125.6,353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6,321.8,60,295.4     c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5,38.5-30c13.8-3.7,31-3.1,31-3.1s7.1,59.4,15.7,94.2c7.2,29.2,24.8,77.7,24.8,77.7     S142.5,359.9,125.6,353.9z M425.9,461.5c0,0-6.1,14.5-19.6,15.4c-5.8,0.4-10.3-1.2-10.3-1.2s-0.3-0.1-5.3-2.1l-112.9-55     c0,0-10.9-5.7-12.8-15.6c-2.2-8.1,2.7-18.1,2.7-18.1L322,273c0,0,4.8-9.7,12.2-13c0.6-0.3,2.3-1,4.5-1.5c8.1-2.1,18,2.8,18,2.8     l110.7,53.7c0,0,12.6,5.7,15.3,16.2c1.9,7.4-0.5,14-1.8,17.2C474.6,363.8,425.9,461.5,425.9,461.5z"/>
+			<path style="fill:#609926" d="M326.8,380.1c-8.2,0.1-15.4,5.8-17.3,13.8c-1.9,8,2,16.3,9.1,20c7.7,4,17.5,1.8,22.7-5.4     c5.1-7.1,4.3-16.9-1.8-23.1l24-49.1c1.5,0.1,3.7,0.2,6.2-0.5c4.1-0.9,7.1-3.6,7.1-3.6c4.2,1.8,8.6,3.8,13.2,6.1     c4.8,2.4,9.3,4.9,13.4,7.3c0.9,0.5,1.8,1.1,2.8,1.9c1.6,1.3,3.4,3.1,4.7,5.5c1.9,5.5-1.9,14.9-1.9,14.9     c-2.3,7.6-18.4,40.6-18.4,40.6c-8.1-0.2-15.3,5-17.7,12.5c-2.6,8.1,1.1,17.3,8.9,21.3c7.8,4,17.4,1.7,22.5-5.3     c5-6.8,4.6-16.3-1.1-22.6c1.9-3.7,3.7-7.4,5.6-11.3c5-10.4,13.5-30.4,13.5-30.4c0.9-1.7,5.7-10.3,2.7-21.3     c-2.5-11.4-12.6-16.7-12.6-16.7c-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3c4.7-9.7,9.4-19.3,14.1-29     c-4.1-2-8.1-4-12.2-6.1c-4.8,9.8-9.7,19.7-14.5,29.5c-6.7-0.1-12.9,3.5-16.1,9.4c-3.4,6.3-2.7,14.1,1.9,19.8     C343.2,346.5,335,363.3,326.8,380.1z"/>
+		</g>
+	</g>
+</g>
+</svg>

assets/img/brands/github.svg

@@ -0,0 +1 @@
+<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#fff"/></svg>

assets/img/brands/gitlab.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 380 380"><defs><style>.cls-1{fill:#e24329;}.cls-2{fill:#fc6d26;}.cls-3{fill:#fca326;}</style></defs><g id="LOGO"><path class="cls-1" d="M282.83,170.73l-.27-.69-26.14-68.22a6.81,6.81,0,0,0-2.69-3.24,7,7,0,0,0-8,.43,7,7,0,0,0-2.32,3.52l-17.65,54H154.29l-17.65-54A6.86,6.86,0,0,0,134.32,99a7,7,0,0,0-8-.43,6.87,6.87,0,0,0-2.69,3.24L97.44,170l-.26.69a48.54,48.54,0,0,0,16.1,56.1l.09.07.24.17,39.82,29.82,19.7,14.91,12,9.06a8.07,8.07,0,0,0,9.76,0l12-9.06,19.7-14.91,40.06-30,.1-.08A48.56,48.56,0,0,0,282.83,170.73Z"/><path class="cls-2" d="M282.83,170.73l-.27-.69a88.3,88.3,0,0,0-35.15,15.8L190,229.25c19.55,14.79,36.57,27.64,36.57,27.64l40.06-30,.1-.08A48.56,48.56,0,0,0,282.83,170.73Z"/><path class="cls-3" d="M153.43,256.89l19.7,14.91,12,9.06a8.07,8.07,0,0,0,9.76,0l12-9.06,19.7-14.91S209.55,244,190,229.25C170.45,244,153.43,256.89,153.43,256.89Z"/><path class="cls-2" d="M132.58,185.84A88.19,88.19,0,0,0,97.44,170l-.26.69a48.54,48.54,0,0,0,16.1,56.1l.09.07.24.17,39.82,29.82s17-12.85,36.57-27.64Z"/></g></svg>

assets/img/brands/google.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="705.6" height="720" viewBox="0 0 186.69 190.5" xmlns:v="https://vecta.io/nano"><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-custom-link"/><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-general-link"/><style xmlns="" lang="en" type="text/css" id="dark-mode-custom-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-sheet"/><g transform="translate(1184.583 765.171)"><path clip-path="none" mask="none" d="M-1089.333-687.239v36.888h51.262c-2.251 11.863-9.006 21.908-19.137 28.662l30.913 23.986c18.011-16.625 28.402-41.044 28.402-70.052 0-6.754-.606-13.249-1.732-19.483z" fill="#4285f4"/><path clip-path="none" mask="none" d="M-1142.714-651.791l-6.972 5.337-24.679 19.223h0c15.673 31.086 47.796 52.561 85.03 52.561 25.717 0 47.278-8.486 63.038-23.033l-30.913-23.986c-8.486 5.715-19.31 9.179-32.125 9.179-24.765 0-45.806-16.712-53.34-39.226z" fill="#34a853"/><path clip-path="none" mask="none" d="M-1174.365-712.61c-6.494 12.815-10.217 27.276-10.217 42.689s3.723 29.874 10.217 42.689c0 .086 31.693-24.592 31.693-24.592-1.905-5.715-3.031-11.776-3.031-18.098s1.126-12.383 3.031-18.098z" fill="#fbbc05"/><path d="M-1089.333-727.244c14.028 0 26.497 4.849 36.455 14.201l27.276-27.276c-16.539-15.413-38.013-24.852-63.731-24.852-37.234 0-69.359 21.388-85.032 52.561l31.692 24.592c7.533-22.514 28.575-39.226 53.34-39.226z" fill="#ea4335" clip-path="none" mask="none"/></g></svg>

assets/img/brands/microsoft.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 21 21"><path fill="#f35325" d="M0 0h10v10H0z"/><path fill="#81bc06" d="M11 0h10v10H11z"/><path fill="#05a6f0" d="M0 11h10v10H0z"/><path fill="#ffba08" d="M11 11h10v10H11z"/></svg>