Skip to content

Add OAuth2 authentication support #5253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
casionone merged 5 commits into from
Sep 28, 2025
+471 −1
Merged

Add OAuth2 authentication support #5253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e817977
feat(mg-gateway): add OAuth2 authentication support
kazutoiris Aug 14, 2025
f44bc18
feat(mg-gateway): add OAuth configuration
kazutoiris Aug 17, 2025
66ff42f
style: reformat code
kazutoiris Aug 17, 2025
873b461
feat(mg-gateway): add OAuth in frontend
kazutoiris Aug 20, 2025
9df29f2
docs: add OAuth authentication documentation
kazutoiris Aug 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/configuration/linkis-gateway-core.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,11 @@
|linkis-gateway-core|wds.linkis.gateway.this.schema| | gateway.this.schema|
|linkis-gateway-core|wds.linkis.web.enable.water.mark|true| web.enable.water.mark|
|linkis-gateway-core|wds.linkis.entrance.name| |linkis.entrance.name|
|linkis-gateway-core|wds.linkis.gateway.conf.enable.oauth.auth| false |wds.linkis.gateway.conf.enable.oauth.auth|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.authentication.url| |wds.linkis.gateway.auth.oauth.authentication.url|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.exchange.url| |wds.linkis.gateway.auth.oauth.exchange.url|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.validate.url| |wds.linkis.gateway.auth.oauth.validate.url|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.validate.field| |wds.linkis.gateway.auth.oauth.validate.field|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.client.id| |wds.linkis.gateway.auth.oauth.client.id|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.client.secret| |wds.linkis.gateway.auth.oauth.client.secret|
|linkis-gateway-core|wds.linkis.gateway.auth.oauth.scope| |wds.linkis.gateway.auth.oauth.scope|
9 changes: 9 additions & 0 deletions linkis-dist/package/conf/linkis-mg-gateway.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,15 @@ wds.linkis.ldap.proxy.baseDN=
wds.linkis.ldap.proxy.userNameFormat=
wds.linkis.admin.user=hadoop
#wds.linkis.admin.password=
##OAuth
wds.linkis.oauth.enable=false
wds.linkis.oauth.url=https://github.com/login/oauth/authorize
wds.linkis.gateway.auth.oauth.exchange.url=https://github.com/login/oauth/access_token
wds.linkis.gateway.auth.oauth.validate.url=https://api.github.com/user
wds.linkis.gateway.auth.oauth.validate.field=login
wds.linkis.gateway.auth.oauth.client.id=YOUR_CLIENT_ID
wds.linkis.gateway.auth.oauth.client.secret=YOUR_CLIENT_SECRET
wds.linkis.gateway.auth.oauth.scope=user
##Spring
spring.server.port=9001

Expand Down
9 changes: 9 additions & 0 deletions ...s-gateway-core/src/main/scala/org/apache/linkis/gateway/config/GatewayConfiguration.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,15 @@ object GatewayConfiguration {
val TOKEN_AUTHENTICATION_SCAN_INTERVAL =
CommonVars("wds.linkis.gateway.conf.token.auth.scan.interval", 1000 * 60 * 10)

val ENABLE_OAUTH_AUTHENTICATION = CommonVars("wds.linkis.gateway.conf.enable.oauth.auth", false)
val OAUTH_AUTHENTICATION_URL = CommonVars("wds.linkis.gateway.auth.oauth.authentication.url", "")
val OAUTH_EXCHANGE_URL = CommonVars("wds.linkis.gateway.auth.oauth.exchange.url", "")
val OAUTH_VALIDATE_URL = CommonVars("wds.linkis.gateway.auth.oauth.validate.url", "")
val OAUTH_VALIDATE_FIELD = CommonVars("wds.linkis.gateway.auth.oauth.validate.field", "")
val OAUTH_CLIENT_ID = CommonVars("wds.linkis.gateway.auth.oauth.client.id", "")
val OAUTH_CLIENT_SECRET = CommonVars("wds.linkis.gateway.auth.oauth.client.secret", "")
val OAUTH_SCOPE = CommonVars("wds.linkis.gateway.auth.oauth.scope", "")

val PASS_AUTH_REQUEST_URI =
CommonVars("wds.linkis.gateway.conf.url.pass.auth", "/dws/").getValue.split(",")

Expand Down
3 changes: 3 additions & 0 deletions ...inkis-gateway-core/src/main/scala/org/apache/linkis/gateway/security/SecurityFilter.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import org.apache.linkis.common.utils.{Logging, Utils}
import org.apache.linkis.gateway.config.GatewayConfiguration
import org.apache.linkis.gateway.config.GatewayConfiguration._
import org.apache.linkis.gateway.http.GatewayContext
import org.apache.linkis.gateway.security.oauth.OAuth2Authentication
import org.apache.linkis.gateway.security.sso.SSOInterceptor
import org.apache.linkis.gateway.security.token.TokenAuthentication
import org.apache.linkis.server.{validateFailed, Message}
Expand Down Expand Up @@ -127,6 +128,8 @@ object SecurityFilter extends Logging {
logger.info("No login needed for proxy uri: " + gatewayContext.getRequest.getRequestURI)
} else if (TokenAuthentication.isTokenRequest(gatewayContext)) {
TokenAuthentication.tokenAuth(gatewayContext)
} else if (OAuth2Authentication.isOAuth2Request(gatewayContext)) {
OAuth2Authentication.OAuth2Entry(gatewayContext)
} else {
val userName = Utils.tryCatch(GatewaySSOUtils.getLoginUser(gatewayContext)) {
case n @ (_: NonLoginException | _: LoginExpireException) =>
Expand Down
15 changes: 15 additions & 0 deletions ...y/linkis-gateway-core/src/main/scala/org/apache/linkis/gateway/security/UserRestful.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ package org.apache.linkis.gateway.security
import org.apache.linkis.common.utils.{Logging, RSAUtils, Utils}
import org.apache.linkis.gateway.config.GatewayConfiguration
import org.apache.linkis.gateway.http.GatewayContext
import org.apache.linkis.gateway.security.oauth.OAuth2Authentication
import org.apache.linkis.gateway.security.sso.SSOInterceptor
import org.apache.linkis.gateway.security.token.TokenAuthentication
import org.apache.linkis.protocol.usercontrol.{
Expand Down Expand Up @@ -87,6 +88,20 @@ abstract class AbstractUserRestful extends UserRestful with Logging {
TokenAuthentication.tokenAuth(gatewayContext, true)
return
}
case "oauth-login" =>
Utils.tryCatch {
val loginUser = GatewaySSOUtils.getLoginUsername(gatewayContext)
Message
.ok(loginUser + " already logged in, please log out before signing in(已经登录，请先退出再进行登录)！")
.data("userName", loginUser)
}(_ => {
OAuth2Authentication.OAuth2Auth(gatewayContext, true)
return
})
case "oauth-redirect" => {
OAuth2Authentication.OAuth2Redirect(gatewayContext)
return
}
case "logout" => logout(gatewayContext)
case "userInfo" => userInfo(gatewayContext)
case "publicKey" => publicKey(gatewayContext)
Expand Down
Loading
Loading