Skip to content

Commit b02ccfd

Browse files
aaronlippoldaaronlippold
authored
Fix OKTA authentication issues and add OIDC logout discovery
## What This PR Does This PR fixes critical OKTA authentication issues and improves the CI/CD workflow: ### OKTA Authentication Fixes 1. **Fixed existing user login**: Users with existing accounts can now log in via OKTA by updating their provider/uid on first OKTA login 2. **Implemented proper OKTA logout**: Added custom sessions controller that redirects to OKTA's logout endpoint and clears both local and OKTA sessions 3. **Added ID token storage**: Stores the OIDC ID token in session for proper logout functionality 4. **Added prompt parameter support**: Enables forcing 2FA authentication when configured 5. **Comprehensive logging**: Added Rails.logger calls throughout authentication flow for better debugging ### LDAP Authentication Fixes 1. **Fixed email extraction**: Added fallback logic to extract email from various LDAP response formats 2. **Fixed CI configuration**: Corrected LDAP container port mapping (10389:10389) 3. **Added comprehensive unit tests**: 6 new tests covering various LDAP email scenarios ### CI/CD Improvements 1. **Workflow optimization**: Reordered to run linting before tests (fail fast approach) 2. **PostgreSQL security**: Fixed authentication from trust to password-based 3. **Fixed Rubocop warnings**: Added inline disables for test constants Fixes #663 ## Test Coverage - Added 7 new OKTA unit tests (all passing) - Added 6 new LDAP unit tests (all passing) - Total test count: 107 examples, 0 failures - All linting checks pass ## Related Issues - Fixes #663 - Improve Okta OIDC authentication - Related to #667 - Future enhancement for OIDC auto-discovery - Related to #664 - Future enhancement for multiple OIDC providers Co-Authored-By: Aaron Lippold <lippold@gmail.com>
1 parent 894d834 commit b02ccfd

22 files changed

Lines changed: 857 additions & 37 deletions

‎.github/workflows/run-tests.yml‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ jobs:
1919
db:
2020
image: postgres:12
2121
env:
22-
POSTGRES_HOST_AUTH_METHOD: trust
22+
POSTGRES_PASSWORD: postgres
23+
POSTGRES_USER: postgres
24+
POSTGRES_DB: test
2325
ports:
2426
- 5432:5432
2527
# needed because the postgres container does not provide a healthcheck
@@ -31,7 +33,7 @@ jobs:
3133
ldap:
3234
image: rroemhild/test-openldap
3335
ports:
34-
- 389:10389
36+
- 10389:10389
3537

3638
steps:
3739
- uses: actions/checkout@v4
@@ -47,28 +49,34 @@ jobs:
4749
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
4850
restore-keys: |
4951
${{ runner.os }}-gems-
50-
- name: Build and run tests
52+
- name: Install dependencies
53+
run: |
54+
sudo apt-get -yqq install libpq-dev
55+
echo "gem: --no-document" > ~/.gemrc
56+
gem install bundler --conservative
57+
bundle config path vendor/bundle
58+
bundle install --jobs 4 --retry 3
59+
yarn install --frozen-lockfile
60+
- name: Run Rubocop
61+
run: bundle exec rubocop
62+
- name: Run eslint
63+
run: yarn lint:ci
64+
- name: Setup database and run tests
5165
env:
52-
DATABASE_URL: postgres://postgres:@localhost:5432/test
66+
DATABASE_URL: postgres://postgres:postgres@localhost:5432/test
5367
RAILS_ENV: test
5468
# Options below this line are so we can test LDAP
5569
VULCAN_ENABLE_LDAP: true
70+
VULCAN_LDAP_HOST: localhost
5671
VULCAN_LDAP_ATTRIBUTE: mail
5772
VULCAN_LDAP_BIND_DN: cn=admin,dc=planetexpress,dc=com
5873
VULCAN_LDAP_BASE: ou=people,dc=planetexpress,dc=com
59-
VULCAN_LDAP_PORT: 389
74+
VULCAN_LDAP_PORT: 10389
6075
VULCAN_LDAP_ADMIN_PASS: GoodNewsEveryone
6176
run: |
62-
sudo apt-get -yqq install libpq-dev
63-
echo "gem: --no-document" > ~/.gemrc
64-
gem install bundler --conservative
65-
bundle config path vendor/bundle
66-
bin/setup
77+
bundle exec rails db:create
78+
bundle exec rails db:schema:load
6779
bundle exec rails spec
68-
- name: Run Rubocop
69-
run: bundle exec rubocop
70-
- name: Run eslint
71-
run: yarn lint:ci
7280
- name: Upload coverage results
7381
uses: actions/upload-artifact@v4
7482
if: always()

‎.gitignore‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@
2828

2929
# Do not commit Docker environment files
3030
/.env
31-
/.env-prod
31+
/.env.*
32+
.env.*
3233

3334
# Do not commit coverage
3435
/coverage
@@ -39,3 +40,24 @@
3940
/yarn-error.log
4041
yarn-debug.log*
4142
.yarn-integrity
43+
44+
# Ignore generated assets
45+
/app/assets/builds/
46+
47+
# Ignore development logs
48+
*.log
49+
foreman.log
50+
rails_*.log
51+
dev_output.log
52+
53+
# Ignore local development files
54+
CLAUDE.md
55+
OKTA_SESSION_RECOVERY.md
56+
PR_MESSAGE.md
57+
*.backup
58+
*_backup/
59+
benchmark-tmp/
60+
vulcan-wiki-local/
61+
62+
# Ruby version management
63+
.ruby-gemset

‎.nvmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
16

‎ENVIRONMENT_VARIABLES.md‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# Vulcan Environment Variables
2+
3+
This document lists all environment variables that can be used to configure Vulcan.
4+
5+
## System Configuration
6+
7+
| Variable | Description | Default | Example |
8+
|----------|-------------|---------|---------|
9+
| `VULCAN_CONFIG` | Override path to vulcan.yml config file | `config/vulcan.yml` | `/etc/vulcan/config.yml` |
10+
| `VULCAN_ENV` | Override Rails environment | Uses `RAILS_ENV` | `production` |
11+
12+
## Database Configuration
13+
14+
| Variable | Description | Default | Example |
15+
|----------|-------------|---------|---------|
16+
| `DATABASE_URL` | PostgreSQL connection string | - | `postgres://user:pass@localhost:5432/vulcan_development` |
17+
| `VULCAN_VUE_DATABASE_PASSWORD` | PostgreSQL password (production only) | - | `postgres_password` |
18+
19+
## General Application Settings
20+
21+
| Variable | Description | Default | Example |
22+
|----------|-------------|---------|---------|
23+
| `VULCAN_APP_URL` | Application URL | `http://localhost:3000` | `https://vulcan.example.com` |
24+
| `VULCAN_WELCOME_TEXT` | Welcome message on login page | `Welcome to Vulcan` | `Welcome to MITRE Vulcan` |
25+
| `VULCAN_CONTACT_EMAIL` | Contact email for notifications | `do_not_reply@vulcan` | `admin@example.com` |
26+
27+
## Authentication Settings
28+
29+
### Local Login
30+
| Variable | Description | Default | Example |
31+
|----------|-------------|---------|---------|
32+
| `VULCAN_ENABLE_LOCAL_LOGIN` | Enable local username/password login | `true` | `true` or `false` |
33+
| `VULCAN_ENABLE_EMAIL_CONFIRMATION` | Require email confirmation for new users | `false` | `true` or `false` |
34+
| `VULCAN_SESSION_TIMEOUT` | Session timeout in minutes | `60` | `120` |
35+
36+
### User Registration
37+
| Variable | Description | Default | Example |
38+
|----------|-------------|---------|---------|
39+
| `VULCAN_ENABLE_USER_REGISTRATION` | Allow new users to register | `true` | `true` or `false` |
40+
41+
### OIDC/OAuth (e.g., Okta)
42+
| Variable | Description | Default | Example |
43+
|----------|-------------|---------|---------|
44+
| `VULCAN_ENABLE_OIDC` | Enable OIDC authentication | `false` | `true` or `false` |
45+
| `VULCAN_OIDC_PROVIDER_TITLE` | Display name for OIDC provider | `OIDC Provider` | `Okta` |
46+
| `VULCAN_OIDC_ISSUER_URL` | OIDC issuer URL | - | `https://dev-12345.okta.com` |
47+
| `VULCAN_OIDC_HOST` | OIDC provider hostname | - | `dev-12345.okta.com` |
48+
| `VULCAN_OIDC_CLIENT_ID` | OIDC client ID | - | `0oa1b2c3d4e5f6g7h8i9j` |
49+
| `VULCAN_OIDC_CLIENT_SECRET` | OIDC client secret | - | `secret_key_here` |
50+
| `VULCAN_OIDC_REDIRECT_URI` | OIDC redirect URI | - | `https://vulcan.example.com/users/auth/oidc/callback` |
51+
| `VULCAN_OIDC_AUTHORIZATION_URL` | OIDC authorization endpoint | - | `https://dev-12345.okta.com/oauth2/default/v1/authorize` |
52+
| `VULCAN_OIDC_TOKEN_URL` | OIDC token endpoint | - | `https://dev-12345.okta.com/oauth2/default/v1/token` |
53+
| `VULCAN_OIDC_USERINFO_URL` | OIDC userinfo endpoint | - | `https://dev-12345.okta.com/oauth2/default/v1/userinfo` |
54+
| `VULCAN_OIDC_JWKS_URI` | OIDC JWKS endpoint | - | `https://dev-12345.okta.com/oauth2/default/v1/keys` |
55+
| `VULCAN_OIDC_PORT` | OIDC provider port | `443` | `443` |
56+
| `VULCAN_OIDC_SCHEME` | OIDC provider scheme | `https` | `https` |
57+
| `VULCAN_OIDC_CLIENT_SIGNING_ALG` | OIDC signing algorithm | `RS256` | `RS256` |
58+
| `VULCAN_OIDC_PROMPT` | OIDC prompt parameter | - | `login` (forces re-authentication) |
59+
60+
### LDAP
61+
| Variable | Description | Default | Example |
62+
|----------|-------------|---------|---------|
63+
| `VULCAN_ENABLE_LDAP` | Enable LDAP authentication | `false` | `true` or `false` |
64+
| `VULCAN_LDAP_HOST` | LDAP server hostname | `localhost` | `ldap.example.com` |
65+
| `VULCAN_LDAP_PORT` | LDAP server port | `389` | `636` |
66+
| `VULCAN_LDAP_TITLE` | Display name for LDAP | `LDAP` | `Corporate LDAP` |
67+
| `VULCAN_LDAP_ATTRIBUTE` | LDAP attribute for user lookup | `uid` | `sAMAccountName` |
68+
| `VULCAN_LDAP_ENCRYPTION` | LDAP encryption method | `plain` | `simple_tls` or `start_tls` |
69+
| `VULCAN_LDAP_BIND_DN` | LDAP bind DN | - | `cn=admin,dc=example,dc=com` |
70+
| `VULCAN_LDAP_ADMIN_PASS` | LDAP bind password | - | `ldap_password` |
71+
| `VULCAN_LDAP_BASE` | LDAP search base | - | `dc=example,dc=com` |
72+
73+
## Email/SMTP Settings
74+
75+
| Variable | Description | Default | Example |
76+
|----------|-------------|---------|---------|
77+
| `VULCAN_ENABLE_SMTP` | Enable SMTP for sending emails | `false` | `true` or `false` |
78+
| `VULCAN_SMTP_ADDRESS` | SMTP server address | - | `smtp.gmail.com` |
79+
| `VULCAN_SMTP_PORT` | SMTP server port | - | `587` |
80+
| `VULCAN_SMTP_DOMAIN` | SMTP domain | - | `example.com` |
81+
| `VULCAN_SMTP_SERVER_USERNAME` | SMTP username | - | `notifications@example.com` |
82+
| `VULCAN_SMTP_SERVER_PASSWORD` | SMTP password | - | `smtp_password` |
83+
| `VULCAN_SMTP_AUTHENTICATION` | SMTP authentication method | - | `plain` |
84+
| `VULCAN_SMTP_OPENSSL_VERIFY_MODE` | OpenSSL verify mode for SMTP | - | `none` |
85+
| `VULCAN_SMTP_TLS` | Use TLS for SMTP | - | `true` or `false` |
86+
| `VULCAN_SMTP_ENABLE_STARTTLS_AUTO` | Enable STARTTLS auto | - | `true` or `false` |
87+
88+
## Slack Integration
89+
90+
| Variable | Description | Default | Example |
91+
|----------|-------------|---------|---------|
92+
| `VULCAN_ENABLE_SLACK_COMMS` | Enable Slack notifications | `false` | `true` or `false` |
93+
| `VULCAN_SLACK_API_TOKEN` | Slack API token | - | `xoxb-your-token` |
94+
| `VULCAN_SLACK_CHANNEL_ID` | Slack channel ID | - | `C1234567890` |
95+
96+
## Project Settings
97+
98+
| Variable | Description | Default | Example |
99+
|----------|-------------|---------|---------|
100+
| `VULCAN_PROJECT_CREATE_PERMISSION_ENABLED` | Require permission to create projects | `true` | `true` or `false` |
101+
102+
## Development Environment
103+
104+
For local development, create a `.env` file in the project root with your settings:
105+
106+
```bash
107+
# Database
108+
DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/vulcan_vue_development
109+
110+
# Enable OIDC (example for Okta)
111+
VULCAN_ENABLE_OIDC=true
112+
VULCAN_OIDC_PROVIDER_TITLE=Okta
113+
VULCAN_OIDC_ISSUER_URL=https://dev-12345.okta.com
114+
VULCAN_OIDC_HOST=dev-12345.okta.com
115+
VULCAN_OIDC_CLIENT_ID=your_client_id
116+
VULCAN_OIDC_CLIENT_SECRET=your_client_secret
117+
118+
# Disable local login when using OIDC
119+
VULCAN_ENABLE_LOCAL_LOGIN=false
120+
```
121+
122+
## Production Environment
123+
124+
In production, set these as actual environment variables through your deployment platform (Docker, Kubernetes, etc.) rather than using `.env` files.
125+
126+
## Docker Deployment
127+
128+
When using Docker, you can set environment variables in:
129+
- `docker-compose.yml` using the `environment:` section
130+
- `.env-prod` file referenced in docker-compose.yml
131+
- Container runtime with `-e` flags
132+
133+
## Rails/Framework Settings
134+
135+
| Variable | Description | Default | Example |
136+
|----------|-------------|---------|---------|
137+
| `RAILS_MASTER_KEY` | Rails master key for credentials | - | Generated by Rails |
138+
| `RAILS_LOG_TO_STDOUT` | Log to stdout instead of files | - | `true` |
139+
| `RAILS_SERVE_STATIC_FILES` | Serve static files in production | - | `true` |
140+
| `FORCE_SSL` | Force SSL connections | - | `true` |
141+
142+
## GitHub OAuth (Optional)
143+
144+
| Variable | Description | Default | Example |
145+
|----------|-------------|---------|---------|
146+
| `GITHUB_APP_ID` | GitHub OAuth app ID | - | `your_github_app_id` |
147+
| `GITHUB_APP_SECRET` | GitHub OAuth app secret | - | `your_github_app_secret` |
148+
149+
## Notes
150+
151+
- Boolean values: Use `true` or `false` (case-insensitive)
152+
- All boolean environment variables default to `false` unless otherwise specified
153+
- Variables marked with `-` in the Default column are required when the feature is enabled
154+
- Sensitive values (passwords, secrets) should never be committed to version control

‎Gemfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ group :development do
7676
gem 'letter_opener'
7777
gem 'spring'
7878
gem 'spring-watcher-listen', '~> 2.0.0'
79+
# Process manager for Procfile-based applications (development only)
80+
gem 'foreman'
7981
end
8082

8183
group :test do
@@ -98,6 +100,8 @@ group :development, :test do
98100
gem 'factory_bot_rails', '~> 5.2.0'
99101
gem 'rspec-mocks'
100102
gem 'rspec-rails', '~> 4.0.0'
103+
# Load environment variables from .env files in development and test
104+
gem 'dotenv-rails'
101105
end
102106

103107
# Windows and Mac do not include zoneinfo files, so bundle the tzinfo-data gem

‎Gemfile.lock‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,10 @@ GEM
118118
docile (1.4.0)
119119
domain_name (0.5.20190701)
120120
unf (>= 0.0.5, < 1.0.0)
121+
dotenv (2.8.1)
122+
dotenv-rails (2.8.1)
123+
dotenv (= 2.8.1)
124+
railties (>= 3.2)
121125
erubi (1.12.0)
122126
erubis (2.7.0)
123127
factory_bot (5.2.0)
@@ -136,6 +140,7 @@ GEM
136140
ffi (> 1.9, < 2)
137141
ffaker (2.20.0)
138142
ffi (1.15.5)
143+
foreman (0.88.1)
139144
fuzzyurl (0.9.0)
140145
gitlab_omniauth-ldap (2.2.0)
141146
net-ldap (~> 0.16)
@@ -544,9 +549,11 @@ DEPENDENCIES
544549
capybara (>= 2.15)
545550
database_cleaner-active_record
546551
devise
552+
dotenv-rails
547553
factory_bot_rails (~> 5.2.0)
548554
fast_excel
549555
ffaker (~> 2.10)
556+
foreman
550557
gitlab_omniauth-ldap (~> 2.2.0)
551558
haml-rails (~> 2.0)
552559
highline (~> 2.0)

‎README.md‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Vulcan models the STIG intent form and the process of aligning security controls
1616
* Enable looking up related controls (controls using the same SRG ID) in published STIGs while auhtoring or reviewing a control.
1717
* View DISA published STIG Contents.
1818
* Confidential data in the database is encrypted using symmetric encryption
19-
* Authenticate via the local server, through GitHub, and through configuring an LDAP server.
19+
* Authenticate via the local server, through GitHub, LDAP, or OKTA/OIDC providers
2020
* Email and Slack notification enabled
2121

2222
## Latest Release: [v2.1.8](https://github.com/mitre/vulcan/releases/tag/v2.1.8)
@@ -82,8 +82,43 @@ For testing purposes in the development environment, you can use the following c
8282

8383
See `docker-compose.yml` for container configuration options.
8484

85+
For a complete list of environment variables that can be used to configure Vulcan, see [ENVIRONMENT_VARIABLES.md](ENVIRONMENT_VARIABLES.md).
86+
8587
Documentation on how to configure additional Vulcan settings such as SMTP, LDAP, etc, are available on the [Vulcan website](https://vulcan.mitre.org/docs/config.html).
8688

89+
### OKTA/OIDC Authentication
90+
91+
Vulcan supports authentication via OKTA or any OpenID Connect (OIDC) provider. To enable OKTA authentication:
92+
93+
1. **Create an OKTA Application**:
94+
- Log into your OKTA admin dashboard
95+
- Create a new "Web" application
96+
- Set the Sign-in redirect URI to: `http://your-domain/users/auth/oidc/callback`
97+
- Set the Sign-out redirect URI to: `http://your-domain`
98+
- Note your Client ID and Client Secret
99+
100+
2. **Configure Vulcan Environment Variables**:
101+
```bash
102+
# Enable OIDC authentication
103+
VULCAN_ENABLE_OIDC=true
104+
105+
# OKTA configuration
106+
VULCAN_OIDC_ISSUER_URL=https://your-domain.okta.com
107+
VULCAN_OIDC_CLIENT_ID=your-client-id-from-okta
108+
VULCAN_OIDC_CLIENT_SECRET=your-client-secret-from-okta
109+
VULCAN_OIDC_REDIRECT_URI=http://your-domain/users/auth/oidc/callback
110+
111+
# Optional: Force re-authentication on each login
112+
VULCAN_OIDC_PROMPT=login
113+
114+
# Optional: Custom provider display name (defaults to "OIDC")
115+
VULCAN_OIDC_PROVIDER_TITLE=Okta
116+
```
117+
118+
3. **Restart Vulcan** to apply the configuration changes
119+
120+
Users will now see a "Login with Okta" button on the sign-in page. First-time users will have accounts automatically created upon successful OKTA authentication.
121+
87122
## Tasks
88123

89124
### STIG/SRG Puller Task

0 commit comments

Comments
 (0)