backport OIDC related changes from main

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-12-08 07:10:56 +03:00 · 2022-07-23 15:31:57 +02:00
parent b34bc2b818
commit 2da19ef233
19 changed files with 364 additions and 111 deletions
--- a/httpd/server.go
+++ b/httpd/server.go
@@ -154,21 +154,22 @@ func (s *httpdServer) refreshCookie(next http.Handler) http.Handler {

 func (s *httpdServer) renderClientLoginPage(w http.ResponseWriter, error, ip string) {
 	data := loginPage{
-		CurrentURL: webClientLoginPath,
-		Version:    version.Get().Version,
-		Error:      error,
-		CSRFToken:  createCSRFToken(ip),
-		StaticURL:  webStaticFilesPath,
-		Branding:   s.binding.Branding.WebClient,
+		CurrentURL:   webClientLoginPath,
+		Version:      version.Get().Version,
+		Error:        error,
+		CSRFToken:    createCSRFToken(ip),
+		StaticURL:    webStaticFilesPath,
+		Branding:     s.binding.Branding.WebClient,
+		FormDisabled: s.binding.isWebClientLoginFormDisabled(),
 	}
 	if s.binding.showAdminLoginURL() {
 		data.AltLoginURL = webAdminLoginPath
 		data.AltLoginName = s.binding.Branding.WebAdmin.ShortName
 	}
-	if smtp.IsEnabled() {
+	if smtp.IsEnabled() && !data.FormDisabled {
 		data.ForgotPwdURL = webClientForgotPwdPath
 	}
-	if s.binding.OIDC.isEnabled() {
+	if s.binding.OIDC.isEnabled() && !s.binding.isWebClientOIDCLoginDisabled() {
 		data.OpenIDLoginURL = webClientOIDCLoginPath
 	}
 	renderClientTemplate(w, templateClientLogin, data)
@@ -531,21 +532,22 @@ func (s *httpdServer) handleWebAdminLoginPost(w http.ResponseWriter, r *http.Req

 func (s *httpdServer) renderAdminLoginPage(w http.ResponseWriter, error, ip string) {
 	data := loginPage{
-		CurrentURL: webAdminLoginPath,
-		Version:    version.Get().Version,
-		Error:      error,
-		CSRFToken:  createCSRFToken(ip),
-		StaticURL:  webStaticFilesPath,
-		Branding:   s.binding.Branding.WebAdmin,
+		CurrentURL:   webAdminLoginPath,
+		Version:      version.Get().Version,
+		Error:        error,
+		CSRFToken:    createCSRFToken(ip),
+		StaticURL:    webStaticFilesPath,
+		Branding:     s.binding.Branding.WebAdmin,
+		FormDisabled: s.binding.isWebAdminLoginFormDisabled(),
 	}
 	if s.binding.showClientLoginURL() {
 		data.AltLoginURL = webClientLoginPath
 		data.AltLoginName = s.binding.Branding.WebClient.ShortName
 	}
-	if smtp.IsEnabled() {
+	if smtp.IsEnabled() && !data.FormDisabled {
 		data.ForgotPwdURL = webAdminForgotPwdPath
 	}
-	if s.binding.OIDC.hasRoles() {
+	if s.binding.OIDC.hasRoles() && !s.binding.isWebAdminOIDCLoginDisabled() {
 		data.OpenIDLoginURL = webAdminOIDCLoginPath
 	}
 	renderAdminTemplate(w, templateLogin, data)
@@ -1398,26 +1400,28 @@ func (s *httpdServer) setupWebClientRoutes() {
 			http.Redirect(w, r, webClientLoginPath, http.StatusFound)
 		})
 		s.router.Get(webClientLoginPath, s.handleClientWebLogin)
-		if s.binding.OIDC.isEnabled() {
+		if s.binding.OIDC.isEnabled() && !s.binding.isWebClientOIDCLoginDisabled() {
 			s.router.Get(webClientOIDCLoginPath, s.handleWebClientOIDCLogin)
 		}
-		s.router.Post(webClientLoginPath, s.handleWebClientLoginPost)
-		s.router.Get(webClientForgotPwdPath, s.handleWebClientForgotPwd)
-		s.router.Post(webClientForgotPwdPath, s.handleWebClientForgotPwdPost)
-		s.router.Get(webClientResetPwdPath, s.handleWebClientPasswordReset)
-		s.router.Post(webClientResetPwdPath, s.handleWebClientPasswordResetPost)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
-			Get(webClientTwoFactorPath, s.handleWebClientTwoFactor)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
-			Post(webClientTwoFactorPath, s.handleWebClientTwoFactorPost)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
-			Get(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecovery)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
-			Post(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecoveryPost)
+		if !s.binding.isWebClientLoginFormDisabled() {
+			s.router.Post(webClientLoginPath, s.handleWebClientLoginPost)
+			s.router.Get(webClientForgotPwdPath, s.handleWebClientForgotPwd)
+			s.router.Post(webClientForgotPwdPath, s.handleWebClientForgotPwdPost)
+			s.router.Get(webClientResetPwdPath, s.handleWebClientPasswordReset)
+			s.router.Post(webClientResetPwdPath, s.handleWebClientPasswordResetPost)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
+				Get(webClientTwoFactorPath, s.handleWebClientTwoFactor)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
+				Post(webClientTwoFactorPath, s.handleWebClientTwoFactorPost)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
+				Get(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecovery)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
+				Post(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecoveryPost)
+		}
 		// share API exposed to external users
 		s.router.Get(webClientPubSharesPath+"/{id}", s.downloadFromShare)
 		s.router.Get(webClientPubSharesPath+"/{id}/browse", s.handleShareGetFiles)
@@ -1497,28 +1501,30 @@ func (s *httpdServer) setupWebAdminRoutes() {
 			s.redirectToWebPath(w, r, webAdminLoginPath)
 		})
 		s.router.Get(webAdminLoginPath, s.handleWebAdminLogin)
-		if s.binding.OIDC.hasRoles() {
+		if s.binding.OIDC.hasRoles() && !s.binding.isWebAdminOIDCLoginDisabled() {
 			s.router.Get(webAdminOIDCLoginPath, s.handleWebAdminOIDCLogin)
 		}
-		s.router.Post(webAdminLoginPath, s.handleWebAdminLoginPost)
 		s.router.Get(webAdminSetupPath, s.handleWebAdminSetupGet)
 		s.router.Post(webAdminSetupPath, s.handleWebAdminSetupPost)
-		s.router.Get(webAdminForgotPwdPath, s.handleWebAdminForgotPwd)
-		s.router.Post(webAdminForgotPwdPath, s.handleWebAdminForgotPwdPost)
-		s.router.Get(webAdminResetPwdPath, s.handleWebAdminPasswordReset)
-		s.router.Post(webAdminResetPwdPath, s.handleWebAdminPasswordResetPost)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
-			Get(webAdminTwoFactorPath, s.handleWebAdminTwoFactor)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
-			Post(webAdminTwoFactorPath, s.handleWebAdminTwoFactorPost)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
-			Get(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecovery)
-		s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
-			s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
-			Post(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecoveryPost)
+		if !s.binding.isWebAdminLoginFormDisabled() {
+			s.router.Post(webAdminLoginPath, s.handleWebAdminLoginPost)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
+				Get(webAdminTwoFactorPath, s.handleWebAdminTwoFactor)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
+				Post(webAdminTwoFactorPath, s.handleWebAdminTwoFactorPost)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
+				Get(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecovery)
+			s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
+				s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
+				Post(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecoveryPost)
+			s.router.Get(webAdminForgotPwdPath, s.handleWebAdminForgotPwd)
+			s.router.Post(webAdminForgotPwdPath, s.handleWebAdminForgotPwdPost)
+			s.router.Get(webAdminResetPwdPath, s.handleWebAdminPasswordReset)
+			s.router.Post(webAdminResetPwdPath, s.handleWebAdminPasswordResetPost)
+		}

 		s.router.Group(func(router chi.Router) {
 			if s.binding.OIDC.isEnabled() {