Limit to Github organisation

hendry · July 10, 2019, 1:47pm

Hi, I’m investigating whether I can limit an app to a Github organization.

I’ve seen loginsrv/README.md at master · tarent/loginsrv · GitHub but I don’t understand if I can limit it to an organization’s ID members only.

Thanks!

Whitestrake · July 10, 2019, 11:54pm

I don’t think login ever actually accesses the user’s organisation membership data on Github via OAuth, so I assume not.

tobya · July 13, 2019, 10:11am

Presumably this would be possible though. The organisation membership is available (I assume) via the github api, so It should be possible to modify the plugin to check this.

Perhaps a PR could be submitted if this functionality is desired.

hendry · July 13, 2019, 10:40am

I ended up implementing this myself as part of the application.

If a PR was to be prepared, it might help to look what I did here:

github.com

unee-t/internal-github-login/blob/master/main.go#L90

    
      
          func issueSession() http.Handler {
          	fn := func(w http.ResponseWriter, req *http.Request) {
          		log := routeLog(req)
          		ctx := req.Context()
          		githubUser, err := github.UserFromContext(ctx)
          		if err != nil {
          			http.Error(w, err.Error(), http.StatusInternalServerError)
          			return
          		}
          
          
		// Check user is part of the wanted Organisation, so it can see internal stuff without WorkLink
          		member, err := isPartOfOrg(githubUser, wanted)
          		if err != nil {
          			http.Error(w, err.Error(), http.StatusInternalServerError)
          			return
          		}
          		if !member {
          			err := views.ExecuteTemplate(w, "notPartOfOrg.html", wanted)
          			if err != nil {
          				http.Error(w, err.Error(), http.StatusInternalServerError)
          			}

Also noticed a thorough implementation write up here: Single sign-on against GitHub using ASGI middleware

system · October 11, 2019, 10:52am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.