Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Replace per-vendor OIDC providers (Keycloak, ForgeRock, ...) with a generic OIDC provider type

Ouverte
  • Quelque chose ne va pas ?
#13,854 2 commentaires 1 réaction 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
java, javascript
Domaine
authentication, backend, database, frontend

Piste de recherche

Commencez par AbstractOIDCOAuth2Provider et OAuth2AuthManagerImpl.getUserOAuth2AuthenticationProvider, puis suivez le schéma oauth_provider, les paramètres d’enregistrement/de mise à jour, OauthProviderResponse et Login.vue. Le travail est terminé lorsque des enregistrements OIDC arbitraires utilisent un fournisseur générique et des boutons de connexion dynamiques, tandis que les enregistrements Google, GitHub et Keycloak existants continuent d’utiliser leurs beans hérités.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

type:enhancement
Problem

CloudStack's OAuth2 plugin currently ships one hardcoded Java class and one hardcoded UI block per OIDC vendor (KeycloakOAuth2Provider, ForgeRockOAuth2Provider). Neither class has any vendor-specific logic. Both just implement the standard OIDC authorization-code flow: hit an authorize URL, exchange the code at a token URL, parse the returned id_token JWT, read the email claim. Any OIDC-compliant IdP (Okta, Auth0, Azure AD, etc.) would work against this same code unchanged.

This was called out directly in #13499, which extracted the duplicated Keycloak logic into AbstractOIDCOAuth2Provider so ForgeRock could reuse it as a thin subclass. From that PR's own description:

Perhaps in the future this should be handled as an unbound provider (just a generic OIDC provider, pluggable with any OIDC-compliant server), but for now, this'll do.

As it stands, every new OIDC IdP someone wants means a new Java class plus a new hardcoded block in Login.vue, forever, for zero actual behavior difference. It also has a real limit today: since provider is both the display name and the routing key, and dispatch is a fixed name-to-bean map, a domain can only ever register one keycloak and one forgerock. It can't run two different OIDC IdPs under arbitrary names.

Proposal

Make OIDC a generic provider type instead of one class per vendor.

  • Add a type field distinct from provider (oauth_provider table + registerOauthProvider/updateOauthProvider params + OauthProviderResponse). provider stays a free-text, admin-chosen label (forgerock, okta, hr-corp-idp); type says which code runs it (e.g. oidc).
  • One concrete generic OIDC bean instead of one subclass per vendor.
  • Decouple provider identity from getName(). Right now it's a fixed, parameterless string baked into each bean and used for both dispatch and the bean's own DB lookups. For a shared bean serving many registrations, the provider name needs to be a parameter threaded through verifyUser/verifySecretCodeAndFetchEmail, not a compile-time constant.
  • Dispatch fallback in OAuth2AuthManagerImpl.getUserOAuth2AuthenticationProvider: if no fixed bean matches a name, look up the DB row; if type=oidc, hand off to the generic bean instead of throwing.
  • Move the authorizeUrl/tokenUrl-required check off the hardcoded name list (equalsAny(provider, "keycloak", "forgerock")) onto type == oidc, so it applies to any future name automatically.
  • Login.vue: render OAuth buttons from the registered provider list instead of one hardcoded block per vendor. Needs a display name/icon per row (admin-supplied, or a generic OIDC icon as fallback).
  • Keep google/github/keycloak legacy beans working unchanged. No forced migration, existing rows keep dispatching to their own classes. Only new arbitrary-name registrations go through the generic path.
Non-goals
  • No change to Google/GitHub, they aren't OIDC and keep their own dedicated implementations.
  • No forced migration of existing keycloak registrations.
Related
  • #13499 (adds ForgeRock, extracts the shared AbstractOIDCOAuth2Provider base this proposal builds on)
Langage dominant
Java
Étoiles
3.1k
Forks
1.4k
Merge moyen
6 j 8 h
PR mergées (30 j)
20

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de apache/cloudstack

Toutes les issues de apache/cloudstack

Issues similaires

Plus d'issues Java

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.