Skip to content

Conversation

Roiocam
Copy link

@Roiocam Roiocam commented Apr 23, 2025

What is the purpose of the change

As the title, Support OIDC login in Console.

image

Brief changelog

  • Login Page display login-button when oidc provider is set.
  • New Endpoint for OAuth Authentication Flow
  • OIDC client based on nimbusds OAuth sdk
  • New OIDC Configuration
  • Respect nacos users and ldap users, if both not exists, oidc will create user for itself.

Verifying this change

Follow this checklist to help us incorporate your contribution quickly and easily:

  • Make sure there is a Github issue filed for the change (usually before you start working on it). Trivial changes like typos do not require a Github issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
  • Format the pull request title like [ISSUE #123] Fix UnknownException when host config not exist. Each commit in the pull request should have a meaningful subject line and body.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add integration-test in test module.
  • Run mvn -B clean package apache-rat:check findbugs:findbugs -Dmaven.test.skip=true to make sure basic checks pass. Run mvn clean install -DskipITs to make sure unit-test pass. Run mvn clean test-compile failsafe:integration-test to make sure integration-test pass.

@CLAassistant
Copy link

CLAassistant commented Apr 23, 2025

CLA assistant check
All committers have signed the CLA.

Copy link

Thanks for your this PR. 🙏
Please check again for your PR changes whether contains any usage/api/configuration change such as Add new API , Add new configuration, Change default value of configuration.
If so, please add or update documents(markdown type) in docs/next/ for repository nacos-group/nacos-group.github.io


感谢您提交的PR。 🙏
请再次查看您的PR内容,确认是否包含任何使用方式/API/配置参数的变更,如:新增API新增配置参数修改默认配置等操作。
如果是,请确保在提交之前,在仓库nacos-group/nacos-group.github.io中的docs/next/目录下添加或更新文档(markdown格式)。

@codecov-commenter
Copy link

Codecov Report

Attention: Patch coverage is 44.98141% with 148 lines in your changes missing coverage. Please review.

Project coverage is 72.07%. Comparing base (bb7e34e) to head (0546da2).

Files with missing lines Patch % Lines
...libaba/nacos/plugin/auth/impl/oidc/OIDCClient.java 26.47% 70 Missing and 5 partials ⚠️
...ibaba/nacos/plugin/auth/impl/oidc/OIDCConfigs.java 0.00% 27 Missing ⚠️
...os/plugin/auth/impl/controller/OIDCController.java 66.66% 13 Missing and 8 partials ⚠️
...libaba/nacos/plugin/auth/impl/oidc/OIDCConfig.java 0.00% 16 Missing ⚠️
...ibaba/nacos/plugin/auth/impl/oidc/OIDCService.java 76.92% 5 Missing and 4 partials ⚠️
Additional details and impacted files

Impacted file tree graph

@@              Coverage Diff              @@
##             develop   #13291      +/-   ##
=============================================
- Coverage      72.28%   72.07%   -0.21%     
- Complexity     10063    10086      +23     
=============================================
  Files           1313     1320       +7     
  Lines          42277    42545     +268     
  Branches        4444     4469      +25     
=============================================
+ Hits           30560    30665     +105     
- Misses          9601     9733     +132     
- Partials        2116     2147      +31     
Files with missing lines Coverage Δ
...nacos/plugin/auth/impl/constant/AuthConstants.java 75.00% <100.00%> (+8.33%) ⬆️
...baba/nacos/plugin/auth/impl/oidc/OIDCProvider.java 100.00% <100.00%> (ø)
...alibaba/nacos/plugin/auth/impl/oidc/OIDCState.java 100.00% <100.00%> (ø)
...ibaba/nacos/plugin/auth/impl/oidc/OIDCService.java 76.92% <76.92%> (ø)
...libaba/nacos/plugin/auth/impl/oidc/OIDCConfig.java 0.00% <0.00%> (ø)
...os/plugin/auth/impl/controller/OIDCController.java 66.66% <66.66%> (ø)
...ibaba/nacos/plugin/auth/impl/oidc/OIDCConfigs.java 0.00% <0.00%> (ø)
...libaba/nacos/plugin/auth/impl/oidc/OIDCClient.java 26.47% <26.47%> (ø)

... and 39 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bb7e34e...0546da2. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@KomachiSion
Copy link
Collaborator

Should we add an new plugin implemetation for oidc?

ui adapt should be merged.

@Roiocam
Copy link
Author

Roiocam commented Apr 25, 2025

Should we add an new plugin implemetation for oidc?

if you are talk about https://nacos.io/docs/v2/plugin/auth-plugin, it seems like is Authorization Plugin, but this is Authentication implementation.

I've referenced the LDAP implementation, which is implemented through user and password, but OAuth is a completely different authentication method, and requires redirection and acceptance of information callback endpoint.

@KomachiSion
Copy link
Collaborator

The LDAP is implemented before nacos support auth plugin, so it bind with default plugin implementation.
In fact, LDAP Plugin also should extract and move into nacos-plugin.

So should OIDC plugin implement in nacos-plugin? Or some reason which OIDC plugin must bind with defualt plugin?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants