Skip to content

Add per-domain OAuth (Google, GitHub) provider support - #12702

Merged
harikrishna-patnala merged 66 commits into
apache:mainfrom
Damans227:oauth-per-domain
Jul 9, 2026
Merged

Add per-domain OAuth (Google, GitHub) provider support#12702
harikrishna-patnala merged 66 commits into
apache:mainfrom
Damans227:oauth-per-domain

Conversation

@Damans227

@Damans227 Damans227 commented Feb 25, 2026

Copy link
Copy Markdown
Collaborator

Description

Add per-domain OAuth provider support. Allows OAuth providers (Google, GitHub) to be configured at the domain level with global fallback.

Doc PR : apache/cloudstack-documentation#647

Design Doc

https://cwiki.apache.org/confluence/display/CLOUDSTACK/Allow+OAuth+provider+per+domain

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • Build/CI
  • Test (unit or integration test code)

Screenshots and recording

Screenshot 2026-03-16 at 10 37 06 AM Screenshot 2026-03-16 at 10 37 51 AM
Screen.Recording.2026-03-16.at.10.34.53.AM.mp4

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

How Has This Been Tested?

Manual testing with GitHub OAuth provider configured at domain level and global level, verifying domain-specific lookup with global fallback.

Daman Arora and others added 19 commits December 18, 2025 11:23
@Damans227

Copy link
Copy Markdown
Collaborator Author

@blueorangutan package

@blueorangutan

Copy link
Copy Markdown

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

@blueorangutan

Copy link
Copy Markdown

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16931

@Damans227

Copy link
Copy Markdown
Collaborator Author

@blueorangutan package

@Damans227

Copy link
Copy Markdown
Collaborator Author

@Damans227 can you fix the conflicts with #13033 ?

Fixed it.

@github-actions

Copy link
Copy Markdown

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

@Damans227

Copy link
Copy Markdown
Collaborator Author

@blueorangutan package

@blueorangutan

Copy link
Copy Markdown

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

@blueorangutan

Copy link
Copy Markdown

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18363

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

@Damans227

Copy link
Copy Markdown
Collaborator Author

@blueorangutan package

@blueorangutan

Copy link
Copy Markdown

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

@blueorangutan

Copy link
Copy Markdown

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18446

@weizhouapache

Copy link
Copy Markdown
Member

@Damans227 @harikrishna-patnala
can you discuss if we can merge this PR ?

@weizhouapache

Copy link
Copy Markdown
Member

@blueorangutan package

@blueorangutan

Copy link
Copy Markdown

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

@blueorangutan

Copy link
Copy Markdown

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 18498

@harikrishna-patnala harikrishna-patnala left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@harikrishna-patnala
harikrishna-patnala merged commit 33c3967 into apache:main Jul 9, 2026
26 of 31 checks passed
@Damans227 Damans227 mentioned this pull request Aug 12, 2026
14 tasks
dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Sep 10, 2026
* Add domain_id to oauth_provider table and VO

* Add domain-aware methods to OauthProviderDao

* Add domainId parameter to OAuth provider API commands and response

* Add domain support to OAuth2AuthManager

* Add domain-aware OAuth verification

* Add domain support to ListOAuthProvidersCmd and update related tests

* fix domain path issue

* Add domainId support to OAuth provider

* Return domain name and UUID in OAuth provider API responses using ApiDBUtils

* Refactor domain ID resolution in VerifyOAuthCodeAndGetUserCmd to improve code clarity

* Enhance OAuth2 plugin support for domain-level configuration and authentication checks

* Update OAuth2 tests and VerifyOAuthCodeAndGetUserCmdTest

* Add method to find OAuth provider by domain with global fallback

* Update OAuth provider configuration to use 'domain' instead of 'domainid' in columns and details

* Refactor OAuth provider methods to support domain-level queries and enhance user verification

* Add caching for access token retrieval in GithubOAuth2Provider

* Refactor access token checks in GithubOAuth2Provider to use StringUtils for improved readability and consistency

* Refactor null checks to use utility for improved readability and consistency

* Update OAuth2UserAuthenticatorTest to include domainId in user verification method

* Remove unnecessary blank line and unused imports in OAuth provider command classes

* Refactor and cleanup

* Remove unnecessary blank lines

* Enhance RegisterOAuthProviderCmdTest with additional provider mock data

* Remove startup gate from OAuth plugin initialization to support dynamic config toggling

* Add strictScope to ConfigKey to disable global fallback for domain-scoped oauth2.enabled

* Add domain-scoped provider filtering to listOauthProvider and centralize domain resolution in OAuth2AuthManager

* Add External OAuth tab with domain-scoped provider selection to login page

* code cleanup

* test fix

* Handle login page provider visibility

* UI cleanup

* UI Cleanup

* Keep text color consistent

* add unit tests

* Add Multiple-domain OAuth tests

* Refactor as per PR comments

* Use idempotent DDL helpers for oauth_provider schema migration

* Use global config check for global providers and extract oauthEnabled variable

* Make strictScope return null when id is null

* Rename verification methods to use 'verifySecretCodeAndFetchEmail' for consistency

* Refactor domain handling in OAuth2AuthManagerImpl to use DomainService instead of DomainDao

* Enhance domain ID descriptions in OAuth command classes for clarity

* Add domain path handling to OAuth provider commands and improve descriptions

* Update domain path description in VerifyOAuthCodeAndGetUserCmd to clarify behavior with Domain ID

* Replace remove method with expunge in deleteOauthProvider and add corresponding unit test

* Add external login label to Login.vue and update i18n locale handling

* Fix stale value issue in updateConfiguration response handling in ConfigurationValue.vue

* Enhance OAuth login error handling and add unit test for missing parameters

* Add validation to reject enabling OAuth provider when plugin is disabled at domain scope

* Add domain reassignment support to UpdateOAuthProviderCmd and enhance validation in OAuth2AuthManagerImpl

* Add domain ID to OAuth provider arguments in config

* Fix condition for OAuth verification URL handling in router

* Add domain path to OauthProviderResponse and update UI config to display it

* Update config to remove 'secretkey' from columns and details

* Add secretkey to details in config and display in DetailsTab

* Implement normalization of ROOT domain to null for global OAuth provider handling and add corresponding unit tests

* Refactor OAuth plugin domain scope handling to use a centralized method for enabling checks

* Add strict scope handling to ConfigKey and update OAuth2AuthManager usage

* Implement domain removal listener to clean up OAuth providers on domain deletion

* Enhance OAuth tab icons with disabled state styling for better UX

* Add domain-specific provider prompt and update OAuth provider handling

---------

Co-authored-by: Daman Arora <daman.arora@shapeblue.com>
(cherry picked from commit 33c3967)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants