X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/4c6c49190b5a8949120d822e053657f64146df70..ba56503f90d099a215fb7375f5cb1cc1ac667e2c:/lib/controller/localdb/login.go

diff --git a/lib/controller/localdb/login.go b/lib/controller/localdb/login.go
index 4bf515fc3f..0d6f2ef027 100644
--- a/lib/controller/localdb/login.go
+++ b/lib/controller/localdb/login.go
@@ -47,20 +47,24 @@ func chooseLoginController(cluster *arvados.Cluster, parent *Conn) loginControll
 			Issuer:             "https://accounts.google.com",
 			ClientID:           cluster.Login.Google.ClientID,
 			ClientSecret:       cluster.Login.Google.ClientSecret,
+			AuthParams:         cluster.Login.Google.AuthenticationRequestParameters,
 			UseGooglePeopleAPI: cluster.Login.Google.AlternateEmailAddresses,
 			EmailClaim:         "email",
 			EmailVerifiedClaim: "email_verified",
 		}
 	case wantOpenIDConnect:
 		return &oidcLoginController{
-			Cluster:            cluster,
-			Parent:             parent,
-			Issuer:             cluster.Login.OpenIDConnect.Issuer,
-			ClientID:           cluster.Login.OpenIDConnect.ClientID,
-			ClientSecret:       cluster.Login.OpenIDConnect.ClientSecret,
-			EmailClaim:         cluster.Login.OpenIDConnect.EmailClaim,
-			EmailVerifiedClaim: cluster.Login.OpenIDConnect.EmailVerifiedClaim,
-			UsernameClaim:      cluster.Login.OpenIDConnect.UsernameClaim,
+			Cluster:                cluster,
+			Parent:                 parent,
+			Issuer:                 cluster.Login.OpenIDConnect.Issuer,
+			ClientID:               cluster.Login.OpenIDConnect.ClientID,
+			ClientSecret:           cluster.Login.OpenIDConnect.ClientSecret,
+			AuthParams:             cluster.Login.OpenIDConnect.AuthenticationRequestParameters,
+			EmailClaim:             cluster.Login.OpenIDConnect.EmailClaim,
+			EmailVerifiedClaim:     cluster.Login.OpenIDConnect.EmailVerifiedClaim,
+			UsernameClaim:          cluster.Login.OpenIDConnect.UsernameClaim,
+			AcceptAccessToken:      cluster.Login.OpenIDConnect.AcceptAccessToken,
+			AcceptAccessTokenScope: cluster.Login.OpenIDConnect.AcceptAccessTokenScope,
 		}
 	case wantSSO:
 		return &ssoLoginController{Parent: parent}
@@ -122,25 +126,13 @@ type federatedLoginController struct {
 func (ctrl federatedLoginController) Login(context.Context, arvados.LoginOptions) (arvados.LoginResponse, error) {
 	return arvados.LoginResponse{}, httpserver.ErrorWithStatus(errors.New("Should have been redirected to login cluster"), http.StatusBadRequest)
 }
-func (ctrl federatedLoginController) Logout(_ context.Context, opts arvados.LogoutOptions) (arvados.LogoutResponse, error) {
-	return noopLogout(ctrl.Cluster, opts)
+func (ctrl federatedLoginController) Logout(ctx context.Context, opts arvados.LogoutOptions) (arvados.LogoutResponse, error) {
+	return logout(ctx, ctrl.Cluster, opts)
 }
 func (ctrl federatedLoginController) UserAuthenticate(context.Context, arvados.UserAuthenticateOptions) (arvados.APIClientAuthorization, error) {
 	return arvados.APIClientAuthorization{}, httpserver.ErrorWithStatus(errors.New("username/password authentication is not available"), http.StatusBadRequest)
 }
 
-func noopLogout(cluster *arvados.Cluster, opts arvados.LogoutOptions) (arvados.LogoutResponse, error) {
-	target := opts.ReturnTo
-	if target == "" {
-		if cluster.Services.Workbench2.ExternalURL.Host != "" {
-			target = cluster.Services.Workbench2.ExternalURL.String()
-		} else {
-			target = cluster.Services.Workbench1.ExternalURL.String()
-		}
-	}
-	return arvados.LogoutResponse{RedirectLocation: target}, nil
-}
-
 func (conn *Conn) CreateAPIClientAuthorization(ctx context.Context, rootToken string, authinfo rpc.UserSessionAuthInfo) (resp arvados.APIClientAuthorization, err error) {
 	if rootToken == "" {
 		return arvados.APIClientAuthorization{}, errors.New("configuration error: empty SystemRootToken")