Merge pull request #29 from coroot/sso_oidc

add OIDC SSO support

Author: def

api/v1/config.go

@@ -21,10 +21,14 @@ type CorootCloudRCASpec struct {
 
 type SSOSpec struct {
 	Enabled bool `json:"enabled,omitempty"`
+	// Provider is set automatically based on which configuration section (saml or oidc) is defined.
+	Provider string `json:"provider,omitempty"`
 	// Default role for authenticated users (Admin, Editor, Viewer, or a custom role).
 	DefaultRole string `json:"defaultRole,omitempty"`
-	// SAML configuration.
+	// SAML configuration. Define this section to use SAML SSO.
 	SAML *SSOSAMLSpec `json:"saml,omitempty"`
+	// OIDC configuration. Define this section to use OIDC SSO.
+	OIDC *SSOOIDCSpec `json:"oidc,omitempty"`
 }
 
 type SSOSAMLSpec struct {
@@ -34,6 +38,18 @@ type SSOSAMLSpec struct {
 	MetadataSecret *corev1.SecretKeySelector `json:"metadataSecret,omitempty"`
 }
 
+type SSOOIDCSpec struct {
+	// OIDC provider issuer URL (e.g., https://accounts.google.com).
+	// +kubebuilder:validation:Pattern="^https?://.+$"
+	IssuerURL string `json:"issuerURL,omitempty"`
+	// OAuth client ID.
+	ClientID string `json:"clientID,omitempty"`
+	// OAuth client secret.
+	ClientSecret string `json:"clientSecret,omitempty"`
+	// Secret containing the client secret.
+	ClientSecretSecret *corev1.SecretKeySelector `json:"clientSecretSecret,omitempty"`
+}
+
 type AISpec struct {
 	// AI model provider (anthropic, openai, or openai_compatible).
 	// +kubebuilder:validation:Enum=anthropic;openai;openai_compatible

api/v1/zz_generated.deepcopy.go

@@ -8118,8 +8118,52 @@ spec:
                     type: string
                   enabled:
                     type: boolean
+                  oidc:
+                    description: OIDC configuration. Define this section to use OIDC
+                      SSO.
+                    properties:
+                      clientID:
+                        description: OAuth client ID.
+                        type: string
+                      clientSecret:
+                        description: OAuth client secret.
+                        type: string
+                      clientSecretSecret:
+                        description: Secret containing the client secret.
+                        properties:
+                          key:
+                            description: The key of the secret to select from.  Must
+                              be a valid secret key.
+                            type: string
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                          optional:
+                            description: Specify whether the Secret or its key must
+                              be defined
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      issuerURL:
+                        description: OIDC provider issuer URL (e.g., https://accounts.google.com).
+                        pattern: ^https?://.+$
+                        type: string
+                    type: object
+                  provider:
+                    description: Provider is set automatically based on which configuration
+                      section (saml or oidc) is defined.
+                    type: string
                   saml:
-                    description: SAML configuration.
+                    description: SAML configuration. Define this section to use SAML
+                      SSO.
                     properties:
                       metadata:
                         description: Identity Provider Metadata XML.

config/crd/coroot.com_coroots.yaml

@@ -196,7 +196,23 @@ func (r *CorootReconciler) validateCoroot(ctx context.Context, cr *corootv1.Coro
 			}
 		}
 		if sso := cr.Spec.SSO; sso != nil && sso.Enabled {
-			if saml := sso.SAML; saml != nil {
+			valid := false
+			if oidc := sso.OIDC; oidc != nil {
+				if oidc.ClientSecretSecret != nil {
+					if _, err = r.GetSecret(ctx, cr, oidc.ClientSecretSecret); err != nil {
+						logErr("Failed to get OIDC Client Secret: %s", err.Error())
+					} else {
+						oidc.ClientSecret = configEnvs.Add(oidc.ClientSecretSecret)
+					}
+					oidc.ClientSecretSecret = nil
+				}
+				if oidc.IssuerURL != "" && oidc.ClientID != "" && oidc.ClientSecret != "" {
+					sso.Provider = "oidc"
+					valid = true
+				} else {
+					logErr("OIDC SSO requires issuerURL, clientID, and clientSecret")
+				}
+			} else if saml := sso.SAML; saml != nil {
 				metadata := saml.Metadata
 				if saml.MetadataSecret != nil {
 					if metadata, err = r.GetSecret(ctx, cr, saml.MetadataSecret); err != nil {
@@ -210,10 +226,15 @@ func (r *CorootReconciler) validateCoroot(ctx context.Context, cr *corootv1.Coro
 					if err = ValidateSamlIdentityProviderMetadata(metadata); err != nil {
 						logErr("Invalid SAML Identity Provider Metadata: %s", err.Error())
 						saml.Metadata = ""
+					} else {
+						sso.Provider = "saml"
+						valid = true
 					}
 				}
+			} else {
+				logErr("SSO is enabled but neither saml nor oidc configuration is provided")
 			}
-			if sso.SAML == nil || sso.SAML.Metadata == "" {
+			if !valid {
 				sso.Enabled = false
 			}
 		}