feat: add enable flag to oidc function (#2672)

apache · Nov 28, 2022 · 1a107ec · 1a107ec
1 parent 8dcadce
commit 1a107ec
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 3 deletions.
diff --git a/.github/workflows/backend-e2e-test.yml b/.github/workflows/backend-e2e-test.yml
@@ -45,7 +45,7 @@ jobs:
           sed -i '/172.16.238.10:2379/a\      - 172.16.238.11:2379' ./api/conf/conf.yaml
           sed -i '/172.16.238.10:2379/a\      - 172.16.238.12:2379' ./api/conf/conf.yaml
           sed -i '[email protected]/0:[email protected]:9000@' ./api/conf/conf.yaml
-
+          sed -i 's/enabled: false/enabled: true/' ./api/conf/conf.yaml
 
       - name: download file Dockerfile-apisix
         working-directory: ./api/test/docker

diff --git a/api/conf/conf.yaml b/api/conf/conf.yaml
@@ -81,6 +81,7 @@ authentication:
       password: user
 
 oidc:
+  enabled: false
   expire_time: 3600
   client_id: dashboard
   client_secret: dashboard

diff --git a/api/internal/conf/conf.go b/api/internal/conf/conf.go
@@ -43,7 +43,7 @@ const (
 	WebDir = "html/"
 
 	DefaultCSP = "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"
-	State  = "123456"
+	State      = "123456"
 )
 
 var (
@@ -69,6 +69,7 @@ var (
 	Plugins          = map[string]bool{}
 	SecurityConf     Security
 	CookieStore      = sessions.NewCookieStore([]byte("oidc"))
+	OidcEnabled      = false
 	OidcId           string
 	OidcConfig       oauth2.Config
 	OidcExpireTime   int
@@ -137,6 +138,7 @@ type Authentication struct {
 }
 
 type Oidc struct {
+	Enabled      bool   `mapstructure:"enabled"`
 	ExpireTime   int    `mapstructure:"expire_time" yaml:"expire_time"`
 	ClientID     string `mapstructure:"client_id"`
 	ClientSecret string `mapstructure:"client_secret"`
@@ -309,6 +311,7 @@ func initAuthentication(conf Authentication) {
 }
 
 func initOidc(conf Oidc) {
+	OidcEnabled = conf.Enabled
 	OidcExpireTime = conf.ExpireTime
 	OidcConfig.ClientID = conf.ClientID
 	OidcConfig.ClientSecret = conf.ClientSecret

diff --git a/api/internal/route.go b/api/internal/route.go
@@ -58,7 +58,13 @@ func SetUpRouter() *gin.Engine {
 	r := gin.New()
 	logger := log.GetLogger(log.AccessLog)
 	// security
-	r.Use(filter.RequestLogHandler(logger), filter.IPFilter(), filter.InvalidRequest(), filter.Oidc(), filter.Authentication())
+	r.Use(filter.RequestLogHandler(logger), filter.IPFilter(), filter.InvalidRequest())
+
+	// authenticate
+	if conf.OidcEnabled {
+		r.Use(filter.Oidc())
+	}
+	r.Use(filter.Authentication())
 
 	// misc
 	r.Use(gzip.Gzip(gzip.DefaultCompression), filter.CORS(), filter.RequestId(), filter.SchemaCheck(), filter.RecoverHandler())