OpenID via Proxy

Cargo.toml

@@ -5,7 +5,7 @@ edition = "2021"
 license = "Apache-2.0"
 homepage = "https://defguard.net/"
 repository = "https://github.com/DefGuard/defguard"
-rust-version = "1.76"
+rust-version = "1.80"
 
 [workspace]
 

migrations/20241112105513_openid_sub_unique.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE openidprovider DROP COLUMN display_name;
+ALTER TABLE "user" DROP CONSTRAINT "user_openid_sub_key";

migrations/20241112105513_openid_sub_unique.up.sql

@@ -0,0 +1,4 @@
+-- Make openid_sub unique.
+-- This migration may fail if duplicate openid_subs exist in the database.
+ALTER TABLE "user" ADD CONSTRAINT "user_openid_sub_key" UNIQUE (openid_sub);
+ALTER TABLE openidprovider ADD COLUMN display_name TEXT DEFAULT NULL;

src/appstate.rs

@@ -13,7 +13,6 @@ use tokio::{
     },
     task::spawn,
 };
-use uaparser::UserAgentParser;
 use webauthn_rs::prelude::*;
 
 use crate::{
@@ -30,7 +29,6 @@ pub struct AppState {
     wireguard_tx: Sender<GatewayEvent>,
     pub mail_tx: UnboundedSender<Mail>,
     pub webauthn: Arc<Webauthn>,
-    pub user_agent_parser: Arc<UserAgentParser>,
     pub failed_logins: Arc<Mutex<FailedLoginMap>>,
     key: Key,
 }
@@ -103,7 +101,6 @@ impl AppState {
         rx: UnboundedReceiver<AppEvent>,
         wireguard_tx: Sender<GatewayEvent>,
         mail_tx: UnboundedSender<Mail>,
-        user_agent_parser: Arc<UserAgentParser>,
         failed_logins: Arc<Mutex<FailedLoginMap>>,
     ) -> Self {
         spawn(Self::handle_triggers(pool.clone(), rx));
@@ -131,7 +128,6 @@ impl AppState {
             wireguard_tx,
             mail_tx,
             webauthn,
-            user_agent_parser,
             failed_logins,
             key,
         }

src/bin/defguard.rs

@@ -12,7 +12,6 @@ use defguard::{
         limits::update_counts,
     },
     grpc::{run_grpc_bidi_stream, run_grpc_server, GatewayMap, WorkerState},
-    headers::create_user_agent_parser,
     init_dev_env, init_vpn_location,
     mail::{run_mail_handler, Mail},
     run_web_server,
@@ -82,7 +81,6 @@ async fn main() -> Result<(), anyhow::Error> {
     let (mail_tx, mail_rx) = unbounded_channel::<Mail>();
     let worker_state = Arc::new(Mutex::new(WorkerState::new(webhook_tx.clone())));
     let gateway_state = Arc::new(Mutex::new(GatewayMap::new()));
-    let user_agent_parser = create_user_agent_parser();
 
     // initialize admin user
     User::init_admin_user(&pool, config.default_admin_password.expose_secret()).await?;
@@ -119,9 +117,9 @@ async fn main() -> Result<(), anyhow::Error> {
 
     // run services
     tokio::select! {
-        res = run_grpc_bidi_stream(pool.clone(), wireguard_tx.clone(), mail_tx.clone(), user_agent_parser.clone()), if config.proxy_url.is_some() => error!("Proxy gRPC stream returned early: {res:#?}"),
+        res = run_grpc_bidi_stream(pool.clone(), wireguard_tx.clone(), mail_tx.clone()), if config.proxy_url.is_some() => error!("Proxy gRPC stream returned early: {res:#?}"),
         res = run_grpc_server(Arc::clone(&worker_state), pool.clone(), Arc::clone(&gateway_state), wireguard_tx.clone(), mail_tx.clone(), grpc_cert, grpc_key, failed_logins.clone()) => error!("gRPC server returned early: {res:#?}"),
-        res = run_web_server(worker_state, gateway_state, webhook_tx, webhook_rx, wireguard_tx.clone(), mail_tx, pool.clone(), user_agent_parser, failed_logins) => error!("Web server returned early: {res:#?}"),
+        res = run_web_server(worker_state, gateway_state, webhook_tx, webhook_rx, wireguard_tx.clone(), mail_tx, pool.clone(), failed_logins) => error!("Web server returned early: {res:#?}"),
         res = run_mail_handler(mail_rx, pool.clone()) => error!("Mail handler returned early: {res:#?}"),
         res = run_periodic_peer_disconnect(pool.clone(), wireguard_tx) => error!("Periodic peer disconnect task returned early: {res:#?}"),
         res = run_periodic_stats_purge(pool.clone(), config.stats_purge_frequency.into(), config.stats_purge_threshold.into()), if !config.disable_stats_purge => error!("Periodic stats purge task returned early: {res:#?}"),

src/config.rs

@@ -286,6 +286,17 @@ impl DefGuardConfig {
             None
         }
     }
+
+    /// Returns configured URL with "auth/callback" appended to the path.
+    #[must_use]
+    pub(crate) fn callback_url(&self) -> Url {
+        let mut url = self.url.clone();
+        // Append "auth/callback" to the URL.
+        if let Ok(mut path_segments) = url.path_segments_mut() {
+            path_segments.extend(&["auth", "callback"]);
+        }
+        url
+    }
 }
 
 impl Default for DefGuardConfig {
@@ -308,10 +319,7 @@ mod tests {
 
     #[test]
     fn test_generate_rp_id() {
-        // unset variables
-        env::remove_var("DEFGUARD_URL");
         env::remove_var("DEFGUARD_WEBAUTHN_RP_ID");
-
         env::set_var("DEFGUARD_URL", "https://defguard.example.com");
 
         let config = DefGuardConfig::new();
@@ -330,10 +338,7 @@ mod tests {
 
     #[test]
     fn test_generate_cookie_domain() {
-        // unset variables
-        env::remove_var("DEFGUARD_URL");
         env::remove_var("DEFGUARD_COOKIE_DOMAIN");
-
         env::set_var("DEFGUARD_URL", "https://defguard.example.com");
 
         let config = DefGuardConfig::new();
@@ -349,4 +354,21 @@ mod tests {
 
         assert_eq!(config.cookie_domain, Some("example.com".to_string()));
     }
+
+    #[test]
+    fn test_callback_url() {
+        env::set_var("DEFGUARD_URL", "https://defguard.example.com");
+        let config = DefGuardConfig::new();
+        assert_eq!(
+            config.callback_url().as_str(),
+            "https://defguard.example.com/auth/callback"
+        );
+
+        env::set_var("DEFGUARD_URL", "https://defguard.example.com:8443/path");
+        let config = DefGuardConfig::new();
+        assert_eq!(
+            config.callback_url().as_str(),
+            "https://defguard.example.com:8443/path/auth/callback"
+        );
+    }
 }

src/db/models/device_login.rs

@@ -72,7 +72,7 @@ impl DeviceLoginEvent {
         }
     }
 
-    pub async fn find_device_login_event(
+    pub(crate) async fn find_device_login_event(
         &self,
         pool: &PgPool,
     ) -> Result<Option<DeviceLoginEvent<Id>>, SqlxError> {