You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 13 Next »

Introduction:

This feature enables CloudStack administrators to configure domain-specific OAuth2 providers. In multi-tenant environments, each domain (representing a customer, department, or team) can have its own OAuth2 provider configuration. This allows organizations to maintain separate OAuth credentials per domain, ensuring users authenticate against the correct identity provider for their team.

Scope:

  • Allow registration of OAuth providers for specific domains
  • Add domain-level oauth2.enabled setting to control OAuth availability per domain
  • In UI, add OAuth Login tab (enabled when at least one provider is enabled globally or in a domain)
  • In the OAuth Login tab, show global providers by default
  • And when domain is entered, show only domain-specific providers; if none exist, indicate with message
  • Error handling - duplicate provider rejection, provider not found, OAuth disabled for domain

UI Mockups: 



API Changes:

registerOAuthProvider

New parameter:

  • domainid: optional UUID parameter to register the OAuth provider for a specific domain. If not provided, the provider is registered at the global level.

listOAuthProviders

New parameter:

  • domainid: optional UUID parameter to filter providers by domain. When specified, returns providers for that domain plus global providers.

New response field:

  • domainid: indicates the domain association of the provider (null for global).

verifyOAuthCodeAndGetUser

New parameters:

  • domainid: optional UUID parameter to lookup provider for a specific domain.
  • domain: optional string parameter to lookup provider by domain path (e.g., /ROOT/Engineering).

If both are provided, domainid takes precedence.

oauthlogin

No new parameters. Existing domain and domainid parameters will be used to determine which OAuth provider credentials to use during authentication.

CloudMonkey (cmk) Examples:

Register domain-specific OAuth provider:

cmk register oauthprovider \
    provider=github \
    description="Engineering GitHub" \
    clientid="Iv1.abc123" \
    secretkey="secret456" \
    redirecturi="https://cloudstack.example.com/client/oauth2" \
    domainid=<domain-uuid>

List providers for a domain:

cmk list oauthproviders domainid=<domain-uuid>


Database Changes:

Table: oauth_provider:

ALTER TABLE `cloud`.`oauth_provider`
  ADD COLUMN `domain_id` bigint unsigned DEFAULT NULL;

ALTER TABLE `cloud`.`oauth_provider`
  ADD CONSTRAINT `fk_oauth_provider__domain_id`
  FOREIGN KEY (`domain_id`) REFERENCES `domain`(`id`);

ALTER TABLE `cloud`.`oauth_provider`
  ADD INDEX `i_oauth_provider__domain_id`(`domain_id`);

ALTER TABLE `cloud`.`oauth_provider`
  ADD UNIQUE KEY `uk_oauth_provider__provider_domain` (`provider`, `domain_id`);
  • domain_id = NULL indicates a global provider
  • Unique constraint on (provider, domain_id) prevents duplicate registrations
 



  • No labels