Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(auth): GitHub auth with Organization and Team restriction #9320

Closed
wants to merge 2 commits into from
Closed

feat(auth): GitHub auth with Organization and Team restriction #9320

wants to merge 2 commits into from

Conversation

portswigger-tim
Copy link

@portswigger-tim portswigger-tim commented Jan 11, 2024

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo in preparation for v3. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Description

This re-introduces github.com auth with the ability to set an organization name or team id. Reading further into the python-social docs, it seems that there are three or four different backends depending on how you want to control access to an application with GitHub auth: https://python-social-auth.readthedocs.io/en/latest/backends/github.html#github-apps

This means that the correct GItHub AUTHENTICATION_BACKENDS needs setting in a programmatic way based on configuration.

Documentation

Updated

Checklist

This checklist is for your information.

  • Make sure to rebase your PR against the very latest dev.
  • Features/Changes should be submitted against the dev.
  • Bugfixes should be submitted against the bugfix branch.
  • Give a meaningful name to your PR, as it may end up being used in the release notes.
  • Your code is flake8 compliant.
  • Your code is python 3.11 compliant.
  • If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
  • Model changes must include the necessary migrations in the dojo/db_migrations folder.
  • Add applicable tests to the unit tests.
  • Add the proper label to categorize your PR.

Extra information

Please clear everything below when submitting your pull request, it's here purely for your information.

Moderators: Labels currently accepted for PRs:

  • Import Scans (for new scanners/importers)
  • enhancement
  • performance
  • feature
  • bugfix
  • maintenance (a.k.a chores)
  • dependencies
  • New Migration (when the PR introduces a DB migration)
  • settings_changes (when the PR introduces changes or new settings in settings.dist.py)

Contributors: Git Tips

Rebase on dev branch

If the dev branch has changed since you started working on it, please rebase your work after the current dev.

On your working branch mybranch:

git rebase dev mybranch

In case of conflict:

 git mergetool
 git rebase --continue

When everything's fine on your local branch, force push to your myOrigin remote:

git push myOrigin --force-with-lease

To cancel everything:

git rebase --abort

Squashing commits

git rebase -i origin/dev
  • Replace pick by fixup on the commits you want squashed out
  • Replace pick by reword on the first commit if you want to change the commit message
  • Save the file and quit your editor

Force push to your myOrigin remote:

git push myOrigin --force-with-lease

@github-actions github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs ui labels Jan 11, 2024
Copy link

dryrunsecurity bot commented Jan 11, 2024

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.

Status DryRun Security Check
AI-powered Sensitive Function Check
Configured Sensitive Files Check
AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing @dryrunsecurity followed by your question into a comment.
Example: @dryrunsecurity What are common security issues with web application cookies?

Install and configure more repositories at DryRun Security

@portswigger-tim portswigger-tim changed the title WIP: feat(auth): GitHub auth with Organization and Team restriction feat(auth): GitHub auth with Organization and Team restriction Jan 11, 2024
@portswigger-tim portswigger-tim changed the base branch from master to dev January 17, 2024 09:41
Copy link
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Comment on lines +627 to +658
# github ouath2 settings
SOCIAL_AUTH_GITHUB_KEY = env("DD_SOCIAL_AUTH_GITHUB_KEY")
SOCIAL_AUTH_GITHUB_SECRET = env("DD_SOCIAL_AUTH_GITHUB_SECRET")

# github org oauth2
SOCIAL_AUTH_GITHUB_ORG_KEY = env("DD_SOCIAL_AUTH_GITHUB_KEY")
SOCIAL_AUTH_GITHUB_ORG_SECRET = env("DD_SOCIAL_AUTH_GITHUB_SECRET")
SOCIAL_AUTH_GITHUB_ORG_NAME = env("DD_SOCIAL_AUTH_GITHUB_ORG_NAME")

# github team oauth2
SOCIAL_AUTH_GITHUB_TEAM_KEY = env("DD_SOCIAL_AUTH_GITHUB_KEY")
SOCIAL_AUTH_GITHUB_TEAM_SECRET = env("DD_SOCIAL_AUTH_GITHUB_SECRET")
SOCIAL_AUTH_GITHUB_TEAM_ID = env("DD_SOCIAL_AUTH_GITHUB_TEAM_ID")

if GITHUB_OAUTH2_ENABLED:
if SOCIAL_AUTH_GITHUB_TEAM_ID:
AUTHENTICATION_BACKENDS += "social_core.backends.github.GithubTeamOAuth2"
elif SOCIAL_AUTH_GITHUB_ORG_NAME:
AUTHENTICATION_BACKENDS += (
"social_core.backends.github.GithubOrganizationOAuth2"
)
else:
AUTHENTICATION_BACKENDS += "social_core.backends.github.GithubOAuth2"


GITHUB_ENTERPRISE_OAUTH2_ENABLED = env(
"DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_OAUTH2_ENABLED"
)
SOCIAL_AUTH_GITHUB_ENTERPRISE_URL = env("DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_URL")
SOCIAL_AUTH_GITHUB_ENTERPRISE_API_URL = env("DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_API_URL")
SOCIAL_AUTH_GITHUB_ENTERPRISE_KEY = env("DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_KEY")
SOCIAL_AUTH_GITHUB_ENTERPRISE_SECRET = env("DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_SECRET")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dropping this comment for other reviewers for where the code changes are

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies, my linters stripped a lot of trailing whitespace. Will look at fixing the merge conflict 🔜

Copy link
Contributor

Conflicts have been resolved. A maintainer will review the pull request shortly.

@portswigger-tim
Copy link
Author

Closing as black created a lot of formatting changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants