Add per-domain OAuth (Google, GitHub) provider support - #12702
Conversation
…entication checks
…nid' in columns and details
…nhance user verification
…ls for improved readability and consistency
|
@blueorangutan package |
|
@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16931 |
|
@blueorangutan package |
Fixed it. |
|
This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch. |
|
@blueorangutan package |
|
@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18363 |
|
This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch. |
|
@blueorangutan package |
|
@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18446 |
|
@Damans227 @harikrishna-patnala |
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 18498 |
* Add domain_id to oauth_provider table and VO * Add domain-aware methods to OauthProviderDao * Add domainId parameter to OAuth provider API commands and response * Add domain support to OAuth2AuthManager * Add domain-aware OAuth verification * Add domain support to ListOAuthProvidersCmd and update related tests * fix domain path issue * Add domainId support to OAuth provider * Return domain name and UUID in OAuth provider API responses using ApiDBUtils * Refactor domain ID resolution in VerifyOAuthCodeAndGetUserCmd to improve code clarity * Enhance OAuth2 plugin support for domain-level configuration and authentication checks * Update OAuth2 tests and VerifyOAuthCodeAndGetUserCmdTest * Add method to find OAuth provider by domain with global fallback * Update OAuth provider configuration to use 'domain' instead of 'domainid' in columns and details * Refactor OAuth provider methods to support domain-level queries and enhance user verification * Add caching for access token retrieval in GithubOAuth2Provider * Refactor access token checks in GithubOAuth2Provider to use StringUtils for improved readability and consistency * Refactor null checks to use utility for improved readability and consistency * Update OAuth2UserAuthenticatorTest to include domainId in user verification method * Remove unnecessary blank line and unused imports in OAuth provider command classes * Refactor and cleanup * Remove unnecessary blank lines * Enhance RegisterOAuthProviderCmdTest with additional provider mock data * Remove startup gate from OAuth plugin initialization to support dynamic config toggling * Add strictScope to ConfigKey to disable global fallback for domain-scoped oauth2.enabled * Add domain-scoped provider filtering to listOauthProvider and centralize domain resolution in OAuth2AuthManager * Add External OAuth tab with domain-scoped provider selection to login page * code cleanup * test fix * Handle login page provider visibility * UI cleanup * UI Cleanup * Keep text color consistent * add unit tests * Add Multiple-domain OAuth tests * Refactor as per PR comments * Use idempotent DDL helpers for oauth_provider schema migration * Use global config check for global providers and extract oauthEnabled variable * Make strictScope return null when id is null * Rename verification methods to use 'verifySecretCodeAndFetchEmail' for consistency * Refactor domain handling in OAuth2AuthManagerImpl to use DomainService instead of DomainDao * Enhance domain ID descriptions in OAuth command classes for clarity * Add domain path handling to OAuth provider commands and improve descriptions * Update domain path description in VerifyOAuthCodeAndGetUserCmd to clarify behavior with Domain ID * Replace remove method with expunge in deleteOauthProvider and add corresponding unit test * Add external login label to Login.vue and update i18n locale handling * Fix stale value issue in updateConfiguration response handling in ConfigurationValue.vue * Enhance OAuth login error handling and add unit test for missing parameters * Add validation to reject enabling OAuth provider when plugin is disabled at domain scope * Add domain reassignment support to UpdateOAuthProviderCmd and enhance validation in OAuth2AuthManagerImpl * Add domain ID to OAuth provider arguments in config * Fix condition for OAuth verification URL handling in router * Add domain path to OauthProviderResponse and update UI config to display it * Update config to remove 'secretkey' from columns and details * Add secretkey to details in config and display in DetailsTab * Implement normalization of ROOT domain to null for global OAuth provider handling and add corresponding unit tests * Refactor OAuth plugin domain scope handling to use a centralized method for enabling checks * Add strict scope handling to ConfigKey and update OAuth2AuthManager usage * Implement domain removal listener to clean up OAuth providers on domain deletion * Enhance OAuth tab icons with disabled state styling for better UX * Add domain-specific provider prompt and update OAuth provider handling --------- Co-authored-by: Daman Arora <daman.arora@shapeblue.com> (cherry picked from commit 33c3967)
Description
Add per-domain OAuth provider support. Allows OAuth providers (Google, GitHub) to be configured at the domain level with global fallback.
Doc PR : apache/cloudstack-documentation#647
Design Doc
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Allow+OAuth+provider+per+domain
Types of changes
Screenshots and recording
Screen.Recording.2026-03-16.at.10.34.53.AM.mp4
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
How Has This Been Tested?
Manual testing with GitHub OAuth provider configured at domain level and global level, verifying domain-specific lookup with global fallback.