Skip to content

Commit c671e96

Browse files
brendan-kellambrendan-kellam
authored
feat(web): Add support for authentik sso (#627)
1 parent f3a8fa3 commit c671e96

File tree

12 files changed

+1066
-13
lines changed

12 files changed

+1066
-13
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1313
- Added support for streaming code search results. [#623](https://github.com/sourcebot-dev/sourcebot/pull/623)
1414
- Added buttons to toggle case sensitivity and regex patterns. [#623](https://github.com/sourcebot-dev/sourcebot/pull/623)
1515
- Added counts to members, requets, and invites tabs in the members settings. [#621](https://github.com/sourcebot-dev/sourcebot/pull/621)
16+
- [Sourcebot EE] Add support for Authentik as a identity provider. [#627](https://github.com/sourcebot-dev/sourcebot/pull/627)
1617

1718
### Changed
1819
- Changed the default search behaviour to match patterns as substrings and **not** regular expressions. Regular expressions can be used by toggling the regex button in search bar. [#623](https://github.com/sourcebot-dev/sourcebot/pull/623)

‎docs/docs/configuration/idp.mdx‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,3 +366,53 @@ A Microsoft Entra ID connection can be used for [authentication](/docs/configura
366366
</Steps>
367367
</Accordion>
368368

369+
### Authentik
370+
371+
[Auth.js Authentik Provider Docs](https://authjs.dev/getting-started/providers/authentik)
372+
373+
An Authentik connection can be used for [authentication](/docs/configuration/auth).
374+
375+
<Accordion title="instructions">
376+
<Steps>
377+
<Step title="Create a OAuth2/OpenID Connect application">
378+
To begin, you must create a OAuth2/OpenID Connect application in Authentik. For more information, see the [Authentik documentation](https://docs.goauthentik.io/add-secure-apps/applications/manage_apps/#create-an-application-and-provider-pair).
379+
380+
When configuring your application:
381+
- Set the provider type to "OAuth2/OpenID Connect"
382+
- Set the client type to "Confidential"
383+
- Add `<sourcebot_url>/api/auth/callback/authentik` to the redirect URIs (ex. https://sourcebot.coolcorp.com/api/auth/callback/authentik)
384+
385+
After creating the application, open the application details to obtain the client id, client secret, and issuer URL (typically in the format `https://<authentik-domain>/application/o/<provider-slug>/`).
386+
</Step>
387+
<Step title="Define environment variables">
388+
The client id, secret, and issuer URL are provided to Sourcebot via environment variables. These can be named whatever you like
389+
(ex. `AUTHENTIK_IDENTITY_PROVIDER_CLIENT_ID`, `AUTHENTIK_IDENTITY_PROVIDER_CLIENT_SECRET`, and `AUTHENTIK_IDENTITY_PROVIDER_ISSUER`)
390+
</Step>
391+
<Step title="Define the identity provider config">
392+
Create a `identityProvider` object in the [config file](/docs/configuration/config-file) with the following fields:
393+
394+
```json wrap icon="code"
395+
{
396+
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
397+
"identityProviders": [
398+
{
399+
"provider": "authentik",
400+
"purpose": "sso",
401+
"clientId": {
402+
"env": "AUTHENTIK_IDENTITY_PROVIDER_CLIENT_ID"
403+
},
404+
"clientSecret": {
405+
"env": "AUTHENTIK_IDENTITY_PROVIDER_CLIENT_SECRET"
406+
},
407+
"issuer": {
408+
"env": "AUTHENTIK_IDENTITY_PROVIDER_ISSUER"
409+
}
410+
}
411+
]
412+
}
413+
```
414+
</Step>
415+
</Steps>
416+
</Accordion>
417+
418+

‎docs/snippets/schemas/v3/identityProvider.schema.mdx‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -647,6 +647,115 @@
647647
"purpose",
648648
"audience"
649649
]
650+
},
651+
"AuthentikIdentityProviderConfig": {
652+
"type": "object",
653+
"additionalProperties": false,
654+
"properties": {
655+
"provider": {
656+
"const": "authentik"
657+
},
658+
"purpose": {
659+
"const": "sso"
660+
},
661+
"clientId": {
662+
"anyOf": [
663+
{
664+
"type": "object",
665+
"properties": {
666+
"env": {
667+
"type": "string",
668+
"description": "The name of the environment variable that contains the token."
669+
}
670+
},
671+
"required": [
672+
"env"
673+
],
674+
"additionalProperties": false
675+
},
676+
{
677+
"type": "object",
678+
"properties": {
679+
"googleCloudSecret": {
680+
"type": "string",
681+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
682+
}
683+
},
684+
"required": [
685+
"googleCloudSecret"
686+
],
687+
"additionalProperties": false
688+
}
689+
]
690+
},
691+
"clientSecret": {
692+
"anyOf": [
693+
{
694+
"type": "object",
695+
"properties": {
696+
"env": {
697+
"type": "string",
698+
"description": "The name of the environment variable that contains the token."
699+
}
700+
},
701+
"required": [
702+
"env"
703+
],
704+
"additionalProperties": false
705+
},
706+
{
707+
"type": "object",
708+
"properties": {
709+
"googleCloudSecret": {
710+
"type": "string",
711+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
712+
}
713+
},
714+
"required": [
715+
"googleCloudSecret"
716+
],
717+
"additionalProperties": false
718+
}
719+
]
720+
},
721+
"issuer": {
722+
"anyOf": [
723+
{
724+
"type": "object",
725+
"properties": {
726+
"env": {
727+
"type": "string",
728+
"description": "The name of the environment variable that contains the token."
729+
}
730+
},
731+
"required": [
732+
"env"
733+
],
734+
"additionalProperties": false
735+
},
736+
{
737+
"type": "object",
738+
"properties": {
739+
"googleCloudSecret": {
740+
"type": "string",
741+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
742+
}
743+
},
744+
"required": [
745+
"googleCloudSecret"
746+
],
747+
"additionalProperties": false
748+
}
749+
]
750+
}
751+
},
752+
"required": [
753+
"provider",
754+
"purpose",
755+
"clientId",
756+
"clientSecret",
757+
"issuer"
758+
]
650759
}
651760
},
652761
"oneOf": [
@@ -1293,6 +1402,115 @@
12931402
"purpose",
12941403
"audience"
12951404
]
1405+
},
1406+
{
1407+
"type": "object",
1408+
"additionalProperties": false,
1409+
"properties": {
1410+
"provider": {
1411+
"const": "authentik"
1412+
},
1413+
"purpose": {
1414+
"const": "sso"
1415+
},
1416+
"clientId": {
1417+
"anyOf": [
1418+
{
1419+
"type": "object",
1420+
"properties": {
1421+
"env": {
1422+
"type": "string",
1423+
"description": "The name of the environment variable that contains the token."
1424+
}
1425+
},
1426+
"required": [
1427+
"env"
1428+
],
1429+
"additionalProperties": false
1430+
},
1431+
{
1432+
"type": "object",
1433+
"properties": {
1434+
"googleCloudSecret": {
1435+
"type": "string",
1436+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1437+
}
1438+
},
1439+
"required": [
1440+
"googleCloudSecret"
1441+
],
1442+
"additionalProperties": false
1443+
}
1444+
]
1445+
},
1446+
"clientSecret": {
1447+
"anyOf": [
1448+
{
1449+
"type": "object",
1450+
"properties": {
1451+
"env": {
1452+
"type": "string",
1453+
"description": "The name of the environment variable that contains the token."
1454+
}
1455+
},
1456+
"required": [
1457+
"env"
1458+
],
1459+
"additionalProperties": false
1460+
},
1461+
{
1462+
"type": "object",
1463+
"properties": {
1464+
"googleCloudSecret": {
1465+
"type": "string",
1466+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1467+
}
1468+
},
1469+
"required": [
1470+
"googleCloudSecret"
1471+
],
1472+
"additionalProperties": false
1473+
}
1474+
]
1475+
},
1476+
"issuer": {
1477+
"anyOf": [
1478+
{
1479+
"type": "object",
1480+
"properties": {
1481+
"env": {
1482+
"type": "string",
1483+
"description": "The name of the environment variable that contains the token."
1484+
}
1485+
},
1486+
"required": [
1487+
"env"
1488+
],
1489+
"additionalProperties": false
1490+
},
1491+
{
1492+
"type": "object",
1493+
"properties": {
1494+
"googleCloudSecret": {
1495+
"type": "string",
1496+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1497+
}
1498+
},
1499+
"required": [
1500+
"googleCloudSecret"
1501+
],
1502+
"additionalProperties": false
1503+
}
1504+
]
1505+
}
1506+
},
1507+
"required": [
1508+
"provider",
1509+
"purpose",
1510+
"clientId",
1511+
"clientSecret",
1512+
"issuer"
1513+
]
12961514
}
12971515
]
12981516
}

0 commit comments

Comments
 (0)