284 lines
8.4 KiB
Bash
Executable file
284 lines
8.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
authentik_url="${AUTHENTIK_URL:-https://auth.burrow.net}"
|
|
bootstrap_token="${AUTHENTIK_BOOTSTRAP_TOKEN:-}"
|
|
google_client_id="${AUTHENTIK_GOOGLE_CLIENT_ID:-}"
|
|
google_client_secret="${AUTHENTIK_GOOGLE_CLIENT_SECRET:-}"
|
|
source_slug="${AUTHENTIK_GOOGLE_SOURCE_SLUG:-google}"
|
|
source_name="${AUTHENTIK_GOOGLE_SOURCE_NAME:-Google}"
|
|
identification_stage_name="${AUTHENTIK_GOOGLE_IDENTIFICATION_STAGE_NAME:-default-authentication-identification}"
|
|
authentication_flow_slug="${AUTHENTIK_GOOGLE_AUTHENTICATION_FLOW_SLUG:-default-source-authentication}"
|
|
enrollment_flow_slug="${AUTHENTIK_GOOGLE_ENROLLMENT_FLOW_SLUG:-default-source-enrollment}"
|
|
login_mode="${AUTHENTIK_GOOGLE_LOGIN_MODE:-redirect}"
|
|
user_matching_mode="${AUTHENTIK_GOOGLE_USER_MATCHING_MODE:-email_link}"
|
|
policy_engine_mode="${AUTHENTIK_GOOGLE_POLICY_ENGINE_MODE:-any}"
|
|
google_account_map_json="${AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON:-[]}"
|
|
property_mapping_name="${AUTHENTIK_GOOGLE_PROPERTY_MAPPING_NAME:-Burrow Google Account Map}"
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: Scripts/authentik-sync-google-source.sh
|
|
|
|
Required environment:
|
|
AUTHENTIK_BOOTSTRAP_TOKEN
|
|
AUTHENTIK_GOOGLE_CLIENT_ID
|
|
AUTHENTIK_GOOGLE_CLIENT_SECRET
|
|
|
|
Optional environment:
|
|
AUTHENTIK_URL
|
|
AUTHENTIK_GOOGLE_SOURCE_SLUG
|
|
AUTHENTIK_GOOGLE_SOURCE_NAME
|
|
AUTHENTIK_GOOGLE_IDENTIFICATION_STAGE_NAME
|
|
AUTHENTIK_GOOGLE_AUTHENTICATION_FLOW_SLUG
|
|
AUTHENTIK_GOOGLE_ENROLLMENT_FLOW_SLUG
|
|
AUTHENTIK_GOOGLE_LOGIN_MODE promoted|redirect
|
|
AUTHENTIK_GOOGLE_USER_MATCHING_MODE identifier|email_link|email_deny|username_link|username_deny
|
|
AUTHENTIK_GOOGLE_POLICY_ENGINE_MODE all|any
|
|
AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON JSON array of alias mappings
|
|
AUTHENTIK_GOOGLE_PROPERTY_MAPPING_NAME
|
|
EOF
|
|
}
|
|
|
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -z "$bootstrap_token" ]]; then
|
|
echo "error: AUTHENTIK_BOOTSTRAP_TOKEN is required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -z "$google_client_id" || -z "$google_client_secret" || "$google_client_id" == PENDING* || "$google_client_secret" == PENDING* ]]; then
|
|
echo "Google OAuth credentials are not configured; skipping Authentik Google source sync." >&2
|
|
echo "Set Authorized redirect URI in Google to ${authentik_url}/source/oauth/callback/${source_slug}/" >&2
|
|
exit 0
|
|
fi
|
|
|
|
if ! printf '%s' "$google_account_map_json" | jq -e 'type == "array"' >/dev/null; then
|
|
echo "error: AUTHENTIK_GOOGLE_ACCOUNT_MAP_JSON must be a JSON array" >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$login_mode" in
|
|
promoted|redirect) ;;
|
|
*)
|
|
echo "warning: unsupported AUTHENTIK_GOOGLE_LOGIN_MODE=$login_mode; falling back to redirect" >&2
|
|
login_mode="redirect"
|
|
;;
|
|
esac
|
|
|
|
api() {
|
|
local method="$1"
|
|
local path="$2"
|
|
local data="${3:-}"
|
|
|
|
if [[ -n "$data" ]]; then
|
|
curl -fsS \
|
|
-X "$method" \
|
|
-H "Authorization: Bearer ${bootstrap_token}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$data" \
|
|
"${authentik_url}${path}"
|
|
else
|
|
curl -fsS \
|
|
-X "$method" \
|
|
-H "Authorization: Bearer ${bootstrap_token}" \
|
|
"${authentik_url}${path}"
|
|
fi
|
|
}
|
|
|
|
wait_for_authentik() {
|
|
for _ in $(seq 1 90); do
|
|
if curl -fsS "${authentik_url}/-/health/ready/" >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "error: Authentik did not become ready at ${authentik_url}" >&2
|
|
exit 1
|
|
}
|
|
|
|
lookup_single_result() {
|
|
local path="$1"
|
|
local jq_filter="$2"
|
|
|
|
api GET "$path" | jq -r "$jq_filter" | head -n1
|
|
}
|
|
|
|
wait_for_authentik
|
|
|
|
flow_pk="$(
|
|
lookup_single_result \
|
|
"/api/v3/flows/instances/?slug=${authentication_flow_slug}" \
|
|
'.results[] | select(.slug != null) | .pk // empty'
|
|
)"
|
|
if [[ -z "$flow_pk" ]]; then
|
|
echo "error: could not resolve Authentik authentication flow slug ${authentication_flow_slug}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
enrollment_flow_pk="$(
|
|
lookup_single_result \
|
|
"/api/v3/flows/instances/?slug=${enrollment_flow_slug}" \
|
|
'.results[] | select(.slug != null) | .pk // empty'
|
|
)"
|
|
if [[ -z "$enrollment_flow_pk" ]]; then
|
|
echo "error: could not resolve Authentik enrollment flow slug ${enrollment_flow_slug}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
identification_stage="$(
|
|
api GET "/api/v3/stages/identification/" \
|
|
| jq -c --arg name "$identification_stage_name" '.results[] | select(.name == $name)'
|
|
)"
|
|
if [[ -z "$identification_stage" ]]; then
|
|
echo "error: could not resolve Authentik identification stage ${identification_stage_name}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
stage_pk="$(printf '%s\n' "$identification_stage" | jq -r '.pk')"
|
|
|
|
property_mapping_payload='[]'
|
|
if [[ "$(printf '%s' "$google_account_map_json" | jq 'length')" -gt 0 ]]; then
|
|
alias_map_python="$(
|
|
printf '%s' "$google_account_map_json" \
|
|
| jq -c '
|
|
map({
|
|
key: (.source_email | ascii_downcase),
|
|
value: {
|
|
username: .username,
|
|
email: .email,
|
|
name: .name
|
|
}
|
|
})
|
|
| from_entries
|
|
'
|
|
)"
|
|
|
|
oauth_property_mapping_expression="$(
|
|
cat <<EOF
|
|
email = (info.get("email") or "").strip().lower()
|
|
alias_map = ${alias_map_python}
|
|
mapped = alias_map.get(email)
|
|
if not mapped:
|
|
return {}
|
|
result = {}
|
|
for key in ("username", "email", "name"):
|
|
value = mapped.get(key)
|
|
if value:
|
|
result[key] = value
|
|
return result
|
|
EOF
|
|
)"
|
|
|
|
oauth_property_mapping_payload="$(
|
|
jq -n \
|
|
--arg name "$property_mapping_name" \
|
|
--arg expression "$oauth_property_mapping_expression" \
|
|
'{
|
|
name: $name,
|
|
expression: $expression
|
|
}'
|
|
)"
|
|
|
|
existing_property_mapping="$(
|
|
api GET "/api/v3/propertymappings/source/oauth/?page_size=200" \
|
|
| jq -c --arg name "$property_mapping_name" '.results[]? | select(.name == $name)'
|
|
)"
|
|
|
|
if [[ -n "$existing_property_mapping" ]]; then
|
|
property_mapping_pk="$(printf '%s\n' "$existing_property_mapping" | jq -r '.pk')"
|
|
api PATCH "/api/v3/propertymappings/source/oauth/${property_mapping_pk}/" "$oauth_property_mapping_payload" >/dev/null
|
|
else
|
|
property_mapping_pk="$(
|
|
api POST "/api/v3/propertymappings/source/oauth/" "$oauth_property_mapping_payload" \
|
|
| jq -r '.pk // empty'
|
|
)"
|
|
fi
|
|
|
|
if [[ -z "${property_mapping_pk:-}" ]]; then
|
|
echo "error: Google OAuth property mapping did not return a primary key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
property_mapping_payload="$(jq -cn --arg property_mapping_pk "$property_mapping_pk" '[$property_mapping_pk]')"
|
|
fi
|
|
|
|
oauth_source_payload="$(
|
|
jq -n \
|
|
--arg name "$source_name" \
|
|
--arg slug "$source_slug" \
|
|
--arg authentication_flow "$flow_pk" \
|
|
--arg enrollment_flow "$enrollment_flow_pk" \
|
|
--arg user_matching_mode "$user_matching_mode" \
|
|
--arg policy_engine_mode "$policy_engine_mode" \
|
|
--argjson user_property_mappings "$property_mapping_payload" \
|
|
--arg consumer_key "$google_client_id" \
|
|
--arg consumer_secret "$google_client_secret" \
|
|
'{
|
|
name: $name,
|
|
slug: $slug,
|
|
enabled: true,
|
|
promoted: true,
|
|
authentication_flow: $authentication_flow,
|
|
enrollment_flow: $enrollment_flow,
|
|
user_property_mappings: $user_property_mappings,
|
|
group_property_mappings: [],
|
|
policy_engine_mode: $policy_engine_mode,
|
|
user_matching_mode: $user_matching_mode,
|
|
provider_type: "google",
|
|
consumer_key: $consumer_key,
|
|
consumer_secret: $consumer_secret
|
|
}'
|
|
)"
|
|
|
|
existing_source="$(
|
|
api GET "/api/v3/sources/oauth/?slug=${source_slug}" \
|
|
| jq -c '.results[]?'
|
|
)"
|
|
|
|
if [[ -n "$existing_source" ]]; then
|
|
source_pk="$(printf '%s\n' "$existing_source" | jq -r '.pk')"
|
|
api PATCH "/api/v3/sources/oauth/${source_slug}/" "$oauth_source_payload" >/dev/null
|
|
else
|
|
source_pk="$(
|
|
api POST "/api/v3/sources/oauth/" "$oauth_source_payload" \
|
|
| jq -r '.pk // empty'
|
|
)"
|
|
fi
|
|
|
|
if [[ -z "$source_pk" ]]; then
|
|
echo "error: Google OAuth source did not return a primary key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
stage_patch="$(
|
|
printf '%s\n' "$identification_stage" \
|
|
| jq -c \
|
|
--arg source_pk "$source_pk" \
|
|
--arg login_mode "$login_mode" '
|
|
.sources = (
|
|
if $login_mode == "redirect" then
|
|
[$source_pk]
|
|
else
|
|
([ $source_pk ] + ((.sources // []) | map(select(. != $source_pk))))
|
|
end
|
|
)
|
|
| .show_source_labels = true
|
|
| if $login_mode == "redirect" then
|
|
.user_fields = []
|
|
else
|
|
.
|
|
end
|
|
| {
|
|
sources,
|
|
show_source_labels,
|
|
user_fields
|
|
}'
|
|
)"
|
|
|
|
api PATCH "/api/v3/stages/identification/${stage_pk}/" "$stage_patch" >/dev/null
|
|
|
|
echo "Synced Authentik Google source ${source_slug} (${source_pk}) in ${login_mode} mode."
|