[FR] OpenID Connect / OAuth implementation

[qfety]

Please ensure your feature request is not already on the roadmap or associated with an issue. This can be checked here.

Is your feature request related to a problem? Please describe.
I am trying to log in to DFIR-IRIS using Keycloak and OpenID Connect or OAuth. Unfortunately, DFIR-IRIS currently only offers login via local or LDAP authentication.

Describe the solution you'd like
Is an implementation of OAuth or OpenID Connect currently planned?
Is there already an approximate release date for this?

Describe alternatives you've considered
Logging in via LDAP would be conceivable, but I would like to carry out the project using OpenID Connect/OAuth.

Additional context
none

[sim0nx]

It would be nice if you could support web-server authentication... that would allow for easy OIDC or other auth support.

[FideliusFalcon]

I've just started to look into deploying Iris, and I'm very surprised that it doesn't support OIDC or SAML. I really hope that somebody will pick up this feature

[richarson]

Hello.

This seems to be implemented in version 2.4.14 (unreleased) via #591 but I can't make it work, I get a 500 error when clicking "Use SSO"

I'll open a new bug report but thought to let you know in this issue as well.

[whikernel]

@richarson indeed the feature is still in beta. Would you have the logs of the webapp that generate the 500?
You can do a docker compose logs webapp and click on Use SSO. You should have a stack trace showing what's wrong.

[richarson]

Hi!
Yes, I was about to open another issue but thought to check here first 😃

Here you go:

iriswebapp_app       | 2024-11-01 22:58:29 :: ERROR :: app :: log_exception :: Exception on /oidc-login [GET]
iriswebapp_app       | Traceback (most recent call last):
iriswebapp_app       |   File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 2190, in wsgi_app
iriswebapp_app       |     response = self.full_dispatch_request()
iriswebapp_app       |   File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1486, in full_dispatch_request
iriswebapp_app       |     rv = self.handle_user_exception(e)
iriswebapp_app       |   File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1484, in full_dispatch_request
iriswebapp_app       |     rv = self.dispatch_request()
iriswebapp_app       |   File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1469, in dispatch_request
iriswebapp_app       |     return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
iriswebapp_app       |   File "/iriswebapp/app/blueprints/login/login_routes.py", line 192, in oidc_login
iriswebapp_app       |     login_url = auth_req.request(oidc_client.authorization_endpoint)
iriswebapp_app       |   File "/opt/venv/lib/python3.9/site-packages/oic/oauth2/message.py", line 784, in request
iriswebapp_app       |     if "?" in location:
iriswebapp_app       | TypeError: argument of type 'NoneType' is not iterable

[legoguy1000]

I tried to setup SSO with DFIR and got the same error as @richarson

[legoguy1000]

FYI, i am getting this since the OIDC library isn't trusting my custom CA used by keycloak. I think there should be an exposed config parameter to be able to set the CA.

2024-12-06 15:45:38 :: ERROR :: base :: http_request :: http_request failed: HTTPSConnectionPool(host='sso.kit1.lan', port=443): Max retries exceeded with url: /realms/icarus/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1147)'))), url: https://sso.kit1.lan/realms/icarus/.well-known/openid-configuration, htargs: {'allow_redirects': True, 'cert': None, 'verify': True, 'timeout': 5.0}, method: GET
2024-12-06 15:45:38 :: WARNING :: oidc_handler :: get_oidc_client :: Could not read OIDC metadata, using environment variables - error HTTPSConnectionPool(host='sso.kit1.lan', port=443): Max retries exceeded with url: /realms/icarus/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1147)')))

looks lie this can be exposed https://github.com/CZ-NIC/pyoidc/blob/master/src/oic/utils/settings.py#L27C5-L27C15 and also the Scopes should be configurable.

I was able to get it to work properly by setting the env var REQUESTS_CA_BUNDLE to my custom CA and adding the additional email and profile scopes to my keycloak client that I didn't have before. After doing both of those it worked.

[StaSys846]

@legoguy1000 As a workaround we use the env variable REQUESTS_CA_BUNDLE pointing to a custom CA bundle in the iris image. The env is used by default by the python requests library which is also used for the OIDC library. This will help to enable custom cert usage in IRIS OIDC.

[legoguy1000]

Is there any plan to add role mapping with OIDC so users permissions are automatic vs having to assign them after login?

[legoguy1000]

Another issue i'm having is if I create a local user via the dfir API and then try to login with that same username/email from keycloak OIDC i'm getting the error below where it tries to create teh already existing user.

2024-12-06 16:22:01 :: INFO :: tracker :: track_activity :: Anonymous :: Case None :: Creating oidc user kitadmin@kit1.lan in database
2024-12-06 16:22:02 :: ERROR :: app :: log_exception :: Exception on /oidc-authorize [GET]
Traceback (most recent call last):
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1969, in _exec_single_context
    self.dialect.do_execute(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/default.py", line 922, in do_execute
    cursor.execute(statement, parameters)
psycopg2.errors.UniqueViolation: duplicate key value violates unique constraint "user_email_key"
DETAIL:  Key (email)=(kitadmin@kit1.lan) already exists.


The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 2190, in wsgi_app
    response = self.full_dispatch_request()
  File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1486, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1484, in full_dispatch_request
    rv = self.dispatch_request()
  File "/opt/venv/lib/python3.9/site-packages/flask/app.py", line 1469, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
  File "/iriswebapp/app/blueprints/login/login_routes.py", line 244, in oidc_authorise
    user = create_user(
  File "/iriswebapp/app/datamgmt/manage/manage_users_db.py", line 678, in create_user
    user.save()
  File "/iriswebapp/app/models/authorization.py", line 228, in save
    db.session.commit()
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/scoping.py", line 598, in commit
    return self._proxied.commit()
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 1969, in commit
    trans.commit(_to_root=True)
  File "<string>", line 2, in commit
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/state_changes.py", line 139, in _go
    ret_value = fn(self, *arg, **kw)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 1256, in commit
    self._prepare_impl()
  File "<string>", line 2, in _prepare_impl
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/state_changes.py", line 139, in _go
    ret_value = fn(self, *arg, **kw)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 1231, in _prepare_impl
    self.session.flush()
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 4312, in flush
    self._flush(objects)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 4448, in _flush
    transaction.rollback(_capture_exception=True)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/util/langhelpers.py", line 146, in __exit__
    raise exc_value.with_traceback(exc_tb)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/session.py", line 4408, in _flush
    flush_context.execute()
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/unitofwork.py", line 466, in execute
    rec.execute(self)
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/unitofwork.py", line 642, in execute
    util.preloaded.orm_persistence.save_obj(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/persistence.py", line 93, in save_obj
    _emit_insert_statements(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/orm/persistence.py", line 1227, in _emit_insert_statements
    result = connection.execute(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1416, in execute
    return meth(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/sql/elements.py", line 517, in _execute_on_connection
    return connection._execute_clauseelement(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1639, in _execute_clauseelement
    ret = self._execute_context(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1848, in _execute_context
    return self._exec_single_context(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1988, in _exec_single_context
    self._handle_dbapi_exception(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 2344, in _handle_dbapi_exception
    raise sqlalchemy_exception.with_traceback(exc_info[2]) from e
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1969, in _exec_single_context
    self.dialect.do_execute(
  File "/opt/venv/lib/python3.9/site-packages/sqlalchemy/engine/default.py", line 922, in do_execute
    cursor.execute(statement, parameters)
sqlalchemy.exc.IntegrityError: (psycopg2.errors.UniqueViolation) duplicate key value violates unique constraint "user_email_key"
DETAIL:  Key (email)=(kitadmin@kit1.lan) already exists.

[SQL: INSERT INTO "user" ("user", name, email, uuid, password, ctx_case, ctx_human_case, active, api_key, external_id, in_dark_mode, has_mini_sidebar, has_deletion_confirmation, is_service_account, mfa_secrets, webauthn_credentials, mfa_setup_complete) VALUES (%(user)s, %(name)s, %(email)s, %(uuid)s::UUID, %(password)s, %(ctx_case)s, %(ctx_human_case)s, %(active)s, %(api_key)s, %(external_id)s, %(in_dark_mode)s, %(has_mini_sidebar)s, %(has_deletion_confirmation)s, %(is_service_account)s, %(mfa_secrets)s, %(webauthn_credentials)s, %(mfa_setup_complete)s) RETURNING "user".id]
[parameters: {'user': 'kitadmin@kit1.lan', 'name': 'kitadmin@kit1.lan', 'email': 'kitadmin@kit1.lan', 'uuid': UUID('257ab509-0919-44d0-a770-75efef7819ae'), 'password': '$2b$12$yOw3mzXTAglr6wC0A5hc6OG1pvR/MJuEom3BoG/9vyvVjeU41aeGa', 'ctx_case': None, 'ctx_human_case': None, 'active': True, 'api_key': 'esy_UuIJSFgJRPnrTsabNmt_WYSlC_NnhDQ_G2awXCvw4bbKaElY8T4EZ3myhMqeiWCUj_SIrp_LQM70ansGLQ', 'external_id': None, 'in_dark_mode': None, 'has_mini_sidebar': False, 'has_deletion_confirmation': False, 'is_service_account': False, 'mfa_secrets': None, 'webauthn_credentials': '[]', 'mfa_setup_complete': False}]

[legoguy1000]

I figured out my issue. I don't use email for the username and I didn't realize u adding additional ENV Variables to set the fields to use