DenozordecandCursor
4ce05a6669
- Updated targetAppFromReturnTo function to handle OIDC authorization unwrap and added search parameter processing. - Integrated target app resolution into the OIDC route for improved audit logging of SSO handoffs. - Added a test case to verify the logging of the target app during the authorization process. - Updated documentation to reflect changes in audit logging for the Technitium DNS application. Co-authored-by: Cursor <[email protected]>
100 lines
4.1 KiB
Markdown
100 lines
4.1 KiB
Markdown
# Интеграция auth-portal ↔ Technitium DNS Server
|
||
|
||
App id: **`dns`**. Auth mode: **OIDC** (не JWT fragment).
|
||
|
||
Technitium DNS Server v15.2+ поддерживает SSO через OpenID Connect.
|
||
Ссылки: [Technitium DNS](https://technitium.com/dns/), [Authelia guide](https://www.authelia.com/integration/openid-connect/clients/technitium/), [Pocket ID](https://pocket-id.org/docs/client-examples/technitium-dns).
|
||
|
||
## Permissions (portal)
|
||
|
||
| Permission | OIDC group | Technitium Local Group |
|
||
|------------|------------|------------------------|
|
||
| `dns:console:admin` (или portal `is_admin`) | `technitium_admins` | Administrators |
|
||
| `dns:dns:write` | `technitium_dns_admins` | DNS Administrators |
|
||
| `dns:dhcp:write` | `technitium_dhcp_admins` | DHCP Administrators |
|
||
|
||
Claims `groups` и `roles` отдаются **в id_token и UserInfo**.
|
||
|
||
## Portal checklist
|
||
|
||
1. Admin → Пользователи: выдать app `dns` и нужные права
|
||
2. Admin → Ссылки приложений: URL Technitium (`https://dns.…`)
|
||
3. Admin → **OIDC-клиенты**: создать client
|
||
- Redirect URI: `https://<dns-host>/sso/callback`
|
||
- Scopes: `openid profile email groups`
|
||
4. Сохранить `client_id` / `client_secret` (секрет показывается один раз)
|
||
5. `RETURN_TO_ALLOWLIST` — origin Technitium (для App Switcher / аудита)
|
||
|
||
## Technitium SSO
|
||
|
||
1. Локальный admin (break-glass) оставить
|
||
2. Administration → Sessions → Single Sign-On (или SSO Providers)
|
||
3. Включить SSO:
|
||
|
||
| Field | Value |
|
||
|-------|--------|
|
||
| Metadata Address | `https://<auth-host>/.well-known/openid-configuration` |
|
||
| Authority / Issuer | `https://<auth-host>` (как в Admin → OIDC) |
|
||
| Client ID | из portal |
|
||
| Client Secret | из portal |
|
||
| Scopes | `openid profile email groups` |
|
||
| Allow Signup | Enabled |
|
||
| Allow Signup Only For Mapped Users | Enabled |
|
||
|
||
4. Group Map:
|
||
|
||
| Remote | Local |
|
||
|--------|-------|
|
||
| `technitium_admins` | Administrators |
|
||
| `technitium_dns_admins` | DNS Administrators |
|
||
| `technitium_dhcp_admins` | DHCP Administrators |
|
||
|
||
5. Save (web service перезапустится)
|
||
|
||
## DNS pitfall
|
||
|
||
Technitium резолвит back-channel OIDC (discovery / token / JWKS) **через свой DNS**, не через OS `/etc/hosts`.
|
||
|
||
Если `auth.*` только split-horizon — добавьте A/AAAA на Technitium и проверьте:
|
||
|
||
```bash
|
||
dig +short @127.0.0.1 auth.example.com
|
||
```
|
||
|
||
См. [Discussion #1988](https://github.com/TechnitiumSoftware/DnsServer/discussions/1988).
|
||
|
||
## Контейнер auth-portal (production)
|
||
|
||
OIDC поднимается вместе с приложением — отдельный контейнер не нужен.
|
||
|
||
| Env | Назначение |
|
||
|-----|------------|
|
||
| `ISSUER` / `OIDC_ISSUER` | Публичный HTTPS URL портала (`https://auth.shnt.top`) |
|
||
| `OIDC_RSA_PRIVATE_KEY` | Опционально; иначе ключ в SQLite volume `./data` |
|
||
| `RETURN_TO_ALLOWLIST` | Origin Technitium (`https://dns.shnt.top`) |
|
||
|
||
Traefik-стек: [deploy-traefik.md](deploy-traefik.md) · [`deploy/env.traefik.example`](../deploy/env.traefik.example) · [`deploy/docker-compose.traefik.yml`](../deploy/docker-compose.traefik.yml).
|
||
|
||
Локально:
|
||
|
||
```bash
|
||
docker compose up -d --build
|
||
curl -fsS http://localhost:8080/.well-known/openid-configuration | head
|
||
```
|
||
|
||
После деплоя: Admin → OIDC-клиенты → redirect `https://<dns-host>/sso/callback`.
|
||
|
||
## App Switcher
|
||
|
||
Для `dns` режим `authMode: oidc` — открывается базовый URL (кнопка OpenID Connect на логине Technitium), без `#access_token`.
|
||
|
||
Журнал входов портала: при выдаче authorization code пишется `auth.sso_handoff` с `target_app: dns` (колонка «Приложение» → Technitium DNS).
|
||
|
||
## Endpoints portal (IdP)
|
||
|
||
- `GET /.well-known/openid-configuration`
|
||
- `GET /.well-known/jwks.json`
|
||
- `GET /oauth/authorize`
|
||
- `POST /oauth/token` (`client_secret_post` / `client_secret_basic`)
|
||
- `GET /oauth/userinfo`
|