BI-2539 - Add GitHub as Alternative OAuth Provider

.env.template

@@ -3,6 +3,10 @@
 USER_ID=<user id of system user>
 GROUP_ID=<group id of system user>
 
+# GitHub OAuth variables. Only required if using GitHub as an alternative to ORCID.
+GITHUB_OAUTH_CLIENT_ID=<Client ID of GitHub OAuth app.>
+GITHUB_OAUTH_CLIENT_SECRET=<Client Secret of GitHub Oauth app.>
+
 ORCID_SANDBOX_AUTHENTICATION=<true or false; true=>use the Sandbox Orcid, false=>use the Production Orcid.  Defaults to false.>
 
 # Authentication variables

pom.xml

@@ -192,6 +192,11 @@
             <artifactId>micronaut-inject</artifactId>
             <scope>compile</scope>
         </dependency>
+        <dependency>
+            <groupId>io.micronaut</groupId>
+            <artifactId>micronaut-http-client</artifactId>
+            <scope>compile</scope>
+        </dependency>
         <dependency>
             <groupId>io.micronaut</groupId>
             <artifactId>micronaut-validation</artifactId>

src/main/java/org/breedinginsight/api/auth/GithubApiClient.java

@@ -0,0 +1,32 @@
+/*
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.breedinginsight.api.auth;
+
+import io.micronaut.http.annotation.Get;
+import io.micronaut.http.annotation.Header;
+import io.micronaut.http.client.annotation.Client;
+import io.reactivex.Flowable;
+
+@Header(name = "User-Agent", value = "Micronaut")
+@Client("https://api.github.com")
+public interface GithubApiClient {
+
+    @Get("/user")
+    Flowable<GithubUser> getUser(@Header("Authorization") String authorization);
+}
+

src/main/java/org/breedinginsight/api/auth/GithubUser.java

@@ -0,0 +1,37 @@
+/*
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.breedinginsight.api.auth;
+
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+import io.micronaut.core.annotation.Introspected;
+import lombok.Getter;
+
+@Introspected
+@JsonNaming(PropertyNamingStrategy.SnakeCaseStrategy.class)
+@Getter
+public class GithubUser {
+
+    private String id;
+    // The login will be the unique GitHub username.
+    private String login;
+    private String name;
+    private String email;
+
+}
+

src/main/java/org/breedinginsight/api/auth/GithubUserDetailsMapper.java

@@ -0,0 +1,61 @@
+/*
+ * See the NOTICE file distributed with this work for additional information
+ * regarding copyright ownership.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.breedinginsight.api.auth;
+
+import io.micronaut.core.annotation.Nullable;
+import io.micronaut.core.async.publisher.Publishers;
+import io.micronaut.security.authentication.AuthenticationResponse;
+import io.micronaut.security.authentication.UserDetails;
+import io.micronaut.security.oauth2.endpoint.authorization.state.State;
+import io.micronaut.security.oauth2.endpoint.token.response.OauthUserDetailsMapper;
+import io.micronaut.security.oauth2.endpoint.token.response.TokenResponse;
+import lombok.extern.slf4j.Slf4j;
+import org.reactivestreams.Publisher;
+
+
+import javax.inject.Named;
+import javax.inject.Singleton;
+import java.util.Collections;
+import java.util.List;
+
+@Slf4j
+@Named("github")
+@Singleton
+class GithubUserDetailsMapper implements OauthUserDetailsMapper {
+
+    private final GithubApiClient apiClient;
+
+    GithubUserDetailsMapper(GithubApiClient apiClient) {
+        this.apiClient = apiClient;
+    }
+
+    @Override
+    public Publisher<UserDetails> createUserDetails(TokenResponse tokenResponse) {
+        return Publishers.just(new UnsupportedOperationException());
+    }
+
+    @Override
+    public Publisher<AuthenticationResponse> createAuthenticationResponse(TokenResponse tokenResponse, @Nullable State state) {
+        return apiClient.getUser("token " + tokenResponse.getAccessToken())
+                .map(user -> {
+                    List<String> roles = Collections.singletonList("ROLE_GITHUB");
+                    return new UserDetails(user.getLogin(), roles);
+                });
+    }
+}
+

src/main/resources/application.yml

@@ -59,6 +59,17 @@ micronaut:
             jwks-uri: ${OAUTH_OPENID_JWKSURI:`https://sandbox.orcid.org/oauth/jwks`}
             user-info:
               url: ${OAUTH_OPENID_USERINFOURL:`https://sandbox.orcid.org/oauth/userinfo`}
+        github:
+          client-id: ${GITHUB_OAUTH_CLIENT_ID}
+          client-secret: ${GITHUB_OAUTH_CLIENT_SECRET}
+          scopes:
+            - user:email
+            - read:user
+          authorization:
+            url: https://github.com/login/oauth/authorize
+          token:
+            url: https://github.com/login/oauth/access_token
+            auth-method: client-secret-basic
       state:
         cookie:
           cookie-max-age: 10m