Skip to content

Commit b0cc0af

Browse files
brendan-kellambrendan-kellam
authored
Merge branch 'main' into brendan/fix-browse-file-header-overflow
2 parents 603b31a + c8e3767 commit b0cc0af

14 files changed

Lines changed: 1601 additions & 3 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
88
## [Unreleased]
99

1010
### Added
11+
- [EE] Added Idira SSO support through OpenID Connect. [#1459](https://github.com/sourcebot-dev/sourcebot/pull/1459)
1112
- Added an optional `webUrl` field to the GitLab connection config, used to build links to repositories in the GitLab web UI when the API host differs from the browsable host. [#1458](https://github.com/sourcebot-dev/sourcebot/pull/1458)
1213

1314
### Fixed

‎docs/docs/configuration/idp.mdx‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -601,6 +601,57 @@ A JumpCloud connection can be used for [authentication](/docs/configuration/auth
601601
</Steps>
602602
</Accordion>
603603

604+
### Idira
605+
606+
[Idira custom OpenID Connect application documentation](https://docs.cyberark.com/manage/latest/en/content/identity/applications/appscustom/openidaddconfigapp.htm)
607+
608+
An Idira connection can be used for [authentication](/docs/configuration/auth). Sourcebot uses Idira's OpenID Connect support to authenticate users.
609+
610+
<Accordion title="instructions">
611+
<Steps>
612+
<Step title="Create an OpenID Connect application in Idira">
613+
In the Idira Admin Portal, go to **Manage > Identities > Web apps**, add the custom **OpenID Connect** application, and configure its Trust settings.
614+
615+
When configuring the application:
616+
- Add `<sourcebot_url>/api/auth/callback/idira` to the **Authorized Redirect URIs** (ex. https://sourcebot.coolcorp.com/api/auth/callback/idira)
617+
- Keep exact redirect URI matching enabled
618+
- Grant the users, groups, or roles that should be able to sign in permission to run the application
619+
620+
From the application's Trust page, note the `CLIENT_ID` and `ISSUER`. Generate a client secret and store it securely. Idira displays the secret only until you confirm that you have saved it.
621+
</Step>
622+
<Step title="Define environment variables">
623+
Provide the client id, secret, and issuer URL to Sourcebot using environment variables. These variables can be named whatever you like
624+
(ex. `IDIRA_IDENTITY_PROVIDER_CLIENT_ID`, `IDIRA_IDENTITY_PROVIDER_CLIENT_SECRET`, and `IDIRA_IDENTITY_PROVIDER_ISSUER`).
625+
</Step>
626+
<Step title="Define the identity provider config">
627+
Add the Idira provider to the `identityProviders` object in the [config file](/docs/configuration/config-file):
628+
629+
```json wrap icon="code"
630+
{
631+
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
632+
"identityProviders": {
633+
"idira": {
634+
"provider": "idira",
635+
"purpose": "sso",
636+
"clientId": {
637+
"env": "IDIRA_IDENTITY_PROVIDER_CLIENT_ID"
638+
},
639+
"clientSecret": {
640+
"env": "IDIRA_IDENTITY_PROVIDER_CLIENT_SECRET"
641+
},
642+
"issuer": {
643+
"env": "IDIRA_IDENTITY_PROVIDER_ISSUER"
644+
}
645+
}
646+
}
647+
}
648+
```
649+
650+
If you use a custom identity provider id instead of `idira`, use that id in the callback URL as described in [multiple identity providers](#configuring-multiple-providers-of-the-same-type).
651+
</Step>
652+
</Steps>
653+
</Accordion>
654+
604655
### Google Cloud IAP
605656

606657
[Google Cloud IAP Documentation](https://cloud.google.com/iap/docs)
@@ -688,5 +739,3 @@ Each provider keeps the same fields documented above. The only differences are:
688739
<Note>
689740
Each instance needs its own OAuth client (its own `clientId` and `clientSecret`) registered with the matching callback URL.
690741
</Note>
691-
692-

‎docs/snippets/schemas/v3/identityProvider.schema.mdx‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -991,6 +991,119 @@
991991
"issuer"
992992
]
993993
},
994+
"IdiraIdentityProviderConfig": {
995+
"type": "object",
996+
"additionalProperties": false,
997+
"properties": {
998+
"provider": {
999+
"const": "idira"
1000+
},
1001+
"displayName": {
1002+
"type": "string",
1003+
"description": "Optional human-readable label shown on the login screen. Defaults to 'Idira'."
1004+
},
1005+
"purpose": {
1006+
"const": "sso"
1007+
},
1008+
"clientId": {
1009+
"anyOf": [
1010+
{
1011+
"type": "object",
1012+
"properties": {
1013+
"env": {
1014+
"type": "string",
1015+
"description": "The name of the environment variable that contains the token."
1016+
}
1017+
},
1018+
"required": [
1019+
"env"
1020+
],
1021+
"additionalProperties": false
1022+
},
1023+
{
1024+
"type": "object",
1025+
"properties": {
1026+
"googleCloudSecret": {
1027+
"type": "string",
1028+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1029+
}
1030+
},
1031+
"required": [
1032+
"googleCloudSecret"
1033+
],
1034+
"additionalProperties": false
1035+
}
1036+
]
1037+
},
1038+
"clientSecret": {
1039+
"anyOf": [
1040+
{
1041+
"type": "object",
1042+
"properties": {
1043+
"env": {
1044+
"type": "string",
1045+
"description": "The name of the environment variable that contains the token."
1046+
}
1047+
},
1048+
"required": [
1049+
"env"
1050+
],
1051+
"additionalProperties": false
1052+
},
1053+
{
1054+
"type": "object",
1055+
"properties": {
1056+
"googleCloudSecret": {
1057+
"type": "string",
1058+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1059+
}
1060+
},
1061+
"required": [
1062+
"googleCloudSecret"
1063+
],
1064+
"additionalProperties": false
1065+
}
1066+
]
1067+
},
1068+
"issuer": {
1069+
"anyOf": [
1070+
{
1071+
"type": "object",
1072+
"properties": {
1073+
"env": {
1074+
"type": "string",
1075+
"description": "The name of the environment variable that contains the token."
1076+
}
1077+
},
1078+
"required": [
1079+
"env"
1080+
],
1081+
"additionalProperties": false
1082+
},
1083+
{
1084+
"type": "object",
1085+
"properties": {
1086+
"googleCloudSecret": {
1087+
"type": "string",
1088+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
1089+
}
1090+
},
1091+
"required": [
1092+
"googleCloudSecret"
1093+
],
1094+
"additionalProperties": false
1095+
}
1096+
]
1097+
}
1098+
},
1099+
"required": [
1100+
"provider",
1101+
"purpose",
1102+
"clientId",
1103+
"clientSecret",
1104+
"issuer"
1105+
]
1106+
},
9941107
"BitbucketServerIdentityProviderConfig": {
9951108
"type": "object",
9961109
"additionalProperties": false,
@@ -2078,6 +2191,119 @@
20782191
"issuer"
20792192
]
20802193
},
2194+
{
2195+
"type": "object",
2196+
"additionalProperties": false,
2197+
"properties": {
2198+
"provider": {
2199+
"const": "idira"
2200+
},
2201+
"displayName": {
2202+
"type": "string",
2203+
"description": "Optional human-readable label shown on the login screen. Defaults to 'Idira'."
2204+
},
2205+
"purpose": {
2206+
"const": "sso"
2207+
},
2208+
"clientId": {
2209+
"anyOf": [
2210+
{
2211+
"type": "object",
2212+
"properties": {
2213+
"env": {
2214+
"type": "string",
2215+
"description": "The name of the environment variable that contains the token."
2216+
}
2217+
},
2218+
"required": [
2219+
"env"
2220+
],
2221+
"additionalProperties": false
2222+
},
2223+
{
2224+
"type": "object",
2225+
"properties": {
2226+
"googleCloudSecret": {
2227+
"type": "string",
2228+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
2229+
}
2230+
},
2231+
"required": [
2232+
"googleCloudSecret"
2233+
],
2234+
"additionalProperties": false
2235+
}
2236+
]
2237+
},
2238+
"clientSecret": {
2239+
"anyOf": [
2240+
{
2241+
"type": "object",
2242+
"properties": {
2243+
"env": {
2244+
"type": "string",
2245+
"description": "The name of the environment variable that contains the token."
2246+
}
2247+
},
2248+
"required": [
2249+
"env"
2250+
],
2251+
"additionalProperties": false
2252+
},
2253+
{
2254+
"type": "object",
2255+
"properties": {
2256+
"googleCloudSecret": {
2257+
"type": "string",
2258+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
2259+
}
2260+
},
2261+
"required": [
2262+
"googleCloudSecret"
2263+
],
2264+
"additionalProperties": false
2265+
}
2266+
]
2267+
},
2268+
"issuer": {
2269+
"anyOf": [
2270+
{
2271+
"type": "object",
2272+
"properties": {
2273+
"env": {
2274+
"type": "string",
2275+
"description": "The name of the environment variable that contains the token."
2276+
}
2277+
},
2278+
"required": [
2279+
"env"
2280+
],
2281+
"additionalProperties": false
2282+
},
2283+
{
2284+
"type": "object",
2285+
"properties": {
2286+
"googleCloudSecret": {
2287+
"type": "string",
2288+
"description": "The resource name of a Google Cloud secret. Must be in the format `projects/<project-id>/secrets/<secret-name>/versions/<version-id>`. See https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets"
2289+
}
2290+
},
2291+
"required": [
2292+
"googleCloudSecret"
2293+
],
2294+
"additionalProperties": false
2295+
}
2296+
]
2297+
}
2298+
},
2299+
"required": [
2300+
"provider",
2301+
"purpose",
2302+
"clientId",
2303+
"clientSecret",
2304+
"issuer"
2305+
]
2306+
},
20812307
{
20822308
"type": "object",
20832309
"additionalProperties": false,

0 commit comments

Comments
 (0)