mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-19 14:12:52 +00:00
8e82ec1cb9
* Add DenyLists parsing * Remove unneeded returned error * Plug global denylist into Command * app creation: apply denylist to backchannel logout URI * Inject denylist to backchannel logout worker * webhook config: validate against blocked URLs * Add notificationsWebhook denylist target * command: Add SMTP endpoint validation against blocklist * command: Add SMS endpoint validation against blocklist * Validate webhook endpoint against denylist on channel notification * Remove unused tests * handle deprecated denylists * remove unintended denylist entry in deprecated list * use single http client * fix tests * update comments * fixes * cleanup * address comments * fix merge --------- Co-authored-by: Livio Spring <[email protected]>
48 lines
1.7 KiB
Go
48 lines
1.7 KiB
Go
package gitlab
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
openid "github.com/zitadel/oidc/v3/pkg/oidc"
|
|
|
|
"github.com/zitadel/zitadel/internal/idp"
|
|
"github.com/zitadel/zitadel/internal/idp/providers/oidc"
|
|
)
|
|
|
|
const (
|
|
issuer = "https://gitlab.com"
|
|
name = "GitLab"
|
|
)
|
|
|
|
var _ idp.Provider = (*Provider)(nil)
|
|
|
|
// Provider is the [idp.Provider] implementation for Gitlab
|
|
type Provider struct {
|
|
*oidc.Provider
|
|
}
|
|
|
|
// New creates a GitLab.com provider using the [oidc.Provider] (OIDC generic provider)
|
|
func New(clientID, clientSecret, redirectURI string, scopes []string, httpClient *http.Client, options ...oidc.ProviderOpts) (*Provider, error) {
|
|
return NewCustomIssuer(name, issuer, clientID, clientSecret, redirectURI, scopes, httpClient, options...)
|
|
}
|
|
|
|
// NewCustomIssuer creates a GitLab provider using the [oidc.Provider] (OIDC generic provider)
|
|
// with a custom issuer for self-managed instances
|
|
func NewCustomIssuer(name, issuer, clientID, clientSecret, redirectURI string, scopes []string, httpClient *http.Client, options ...oidc.ProviderOpts) (*Provider, error) {
|
|
if len(scopes) == 0 {
|
|
// the OIDC provider would set `openid profile email phone` as default scope,
|
|
// but since gitlab does not handle unknown scopes correctly (phone) and returns an error,
|
|
// we will just set a separate default list
|
|
scopes = []string{openid.ScopeOpenID, openid.ScopeProfile, openid.ScopeEmail}
|
|
}
|
|
// gitlab is currently not able to handle the prompt `select_account`:
|
|
// https://gitlab.com/gitlab-org/gitlab/-/issues/377368
|
|
rp, err := oidc.New(name, issuer, clientID, clientSecret, redirectURI, scopes, oidc.DefaultMapper, httpClient, options...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &Provider{
|
|
Provider: rp,
|
|
}, nil
|
|
}
|