Http.login + Templates

hinman · December 31, 2018, 12:29pm

I want to accomplish something similar to the post Help with http.login and Google Auth wherein http.login (with Google Auth) and login.jwt are used to protect content under the /project directory, Google oAuth, a specific domain is authorized (example.com), if someone is not in that domain an error is shown they are not using an authorized account and if someone is in that domain they are sent back to the /project directory to view the content.

I’m able to accomplish all items except #4: Showing an error message for those who are not in the approved domain. From the above post it appears the OP was not able to accomplish this either.

Is there any way to use the role functionality in a template? Or any other suggestion for how to accomplish this task?

magikstm · December 31, 2018, 8:55pm

You could possibly use this new feature added recently (not available in current version):
https://github.com/tarent/loginsrv/commit/15423135b3c55ecbe4ca31d4247e4b022e313ecc

It is related to this PR: feat: add support to get logged user as json by perenecabuto · Pull Request #93 · tarent/loginsrv · GitHub

You should also be able to use {{.Domain}} in a template.

It really depends on what you exactly want to do.

Ref:

github.com

tarent/loginsrv/blob/7a8566d795ccd0337dbd35078817f06ae5edccb1/model/user_info.go#L10

    
      
          package model
          
          
import (
          	"errors"
          	"time"
          )
          
          
// UserInfo holds the parameters returned by the backends.
          // This information will be serialized to build the JWT token contents.
          type UserInfo struct {
          	Sub       string `json:"sub"`
          	Picture   string `json:"picture,omitempty"`
          	Name      string `json:"name,omitempty"`
          	Email     string `json:"email,omitempty"`
          	Origin    string `json:"origin,omitempty"`
          	Expiry    int64  `json:"exp,omitempty"`
          	Refreshes int    `json:"refs,omitempty"`
          	Domain    string `json:"domain,omitempty"`
          }

github.com

tarent/loginsrv/blob/7a8566d795ccd0337dbd35078817f06ae5edccb1/login/login_form.go#L55

    
      
               }
               .login-picture {
                 height: 120px;
                 border-radius: 3px;
                 margin-bottom: 10px;
               }
              </style>
          {{end}}
          
          
{{define "userInfo"}}
                        {{with .UserInfo}}
                          <h1>Welcome {{.Sub}}!</h1>
                          <br/>
                          {{if .Picture}}<img class="login-picture" src="{{.Picture}}?s=120">{{end}}
                          {{if .Name}}<h3>{{.Name}}</h3>{{end}}
                        {{end}}
                        <br/>
                        <a class="btn btn-md btn-primary" href="{{ .Config.LoginPath }}?logout=true">Logout</a>
          {{end}}
          
          
{{define "login"}}

github.com

tarent/loginsrv/blob/7a8566d795ccd0337dbd35078817f06ae5edccb1/login/login_form.go#L124

    
      
              	  <div class="col-md-4 col-md-offset-4">
          
          
            {{ if .Error}}
                        <div class="alert alert-danger" role="alert">
                          <strong>Internal Error. </strong> Please try again later.
                        </div>
                      {{end}}
          
          
            {{if .Authenticated}}
          
          
              {{template "userInfo" . }}
          
          
            {{else}}
          
          
              {{template "login" . }}
          
          
            {{end}}
          	  </div>
          	</div>
                </div>
              </uic-fragment>

hinman · December 31, 2018, 11:14pm

Thanks @magikstm! This might work. I will take a closer look. Does it expose a user’s role from the user_file?

I want to start with limiting access to our domain but might want to add individual email accounts, for a vendor for example. Limiting by role might be the best route.

magikstm · December 31, 2018, 11:55pm

Does it expose a user’s role from the user_file?

At the moment it doesn’t.

But, according to the docs:

To match an entry, the user file is searched in linear order and all attributes has to match the data of the authentication backend. The first matching entry will be used and all parameters below the claim attribute are written into the token.

Ref:

system · March 31, 2019, 11:55pm

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.