Make the oauth2 state length configurable (#65)

* Increase state lenght to 8

* feat: make the state length configurable

README.md

@@ -4,7 +4,7 @@ This repo contains an improved, free ldap authentication and authorisation
 for sharelatex/[overleaf](https://github.com/overleaf/overleaf) community 
 edition. Currently this repo uses `sharelatex/sharelatex:4.2.0`.
 
-The inital idea for this implementation was taken from 
+The Initial idea for this implementation was taken from 
 [worksasintended](https://github.com/worksasintended).
 
 ## BREAKING CHANGE
@@ -50,7 +50,7 @@ it tries to authenticate against the specified LDAP server.
 *Important:*
 Sharelatex/Overleaf uses the email address to identify users: If you change the email in the LDAP/OAuth you have to update the corresponding field in the mongo db.
 
-```
+```bash
 docker exec -it mongo /bin/bash
 mongo 
 use sharelatex
@@ -86,17 +86,18 @@ COLLAB_TEXT=Direct share with collaborators is enabled only for activated users!
 ADMIN_IS_SYSADMIN=false
 ```
 
-*LOGIN_TEXT* : displayed instead of email-adress field (login.pug) <br/>
+*LOGIN_TEXT* : displayed instead of email-address field (login.pug) <br/>
 *COLLAB_TEXT* : displayed for email invitation (share.pug)<br/>
 *ADMIN_IS_SYSADMIN* : false or true (if ``false`` isAdmin group is allowed to add users to sharelatex and post messages. if ``true`` isAdmin group is allowed to logout other users / set maintenance mode)
 
 ### LDAP Configuration
 
-Edit [docker-compose.treafik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup.
+Edit [docker-compose.traefik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup.
 
 ```
 LDAP_SERVER: ldaps://LDAPSERVER:636
 LDAP_BASE: dc=DOMAIN,dc=TLD
+LDAP_SERVER_CACERT: /etc/ssl/certs/LDAPCERT
 # If LDAP_BINDDN is set, the ldap bind happens directly by using the provided DN
 # All occurrences of `%u` get replaced by the entered uid.
 # All occurrences of `%m`get replaced by the entered mail.
@@ -157,6 +158,8 @@ OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
 # One of ["application/x-www-form-urlencoded", "application/json"]
 # Default "application/x-www-form-urlencoded"
 OAUTH2_TOKEN_CONTENT_TYPE: "application/x-www-form-urlencoded"
+# OAUTH2_STATE_LENGTH: Length of the OAuth2 state
+OAUTH2_STATE_LENGTH: 6
 # Fetch user profile api endpoint
 OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
 
@@ -216,43 +219,39 @@ Install the docker engine: https://docs.docker.com/engine/install/
 
 Install docker-compose:
 
-(if you need pip: apt install python3-pip)
+(If you need pip: apt install python3-pip)
 
-```
+```bash
 pip install docker-compose
 ```
 
-use the following commands:
+Use the following commands to generate the ldap-overleaf-sl docker image:
 
-```
+```bash
 bash scripts/extract_files.sh 4.2.0
 bash scripts/apply_diffs.sh
 make
 ```
 
-to generate the ldap-overleaf-sl docker image.
+Use the following command to create a network for the docker instances:
 
-use the command:
-
-```
+```bash
 docker network create web
 ```
 
-to create a network for the docker instances.
-
 ### Startup
 
-#### Using without proxy
+#### Using without reverse proxy
 
 In most cases, you should use a gateway reverse proxy for your requests (see the next section), as they can offer many benefits such as enhanced security and easier SSL certificate updates. This simple startup method is used for 1. Development 2. When you know what you're doing, for example, when there is an additional gateway layer outside your server.
 
 Start docker containers:
 
-``` 
+```bash
 docker-compose up -d
 ```
 
-#### Using proxy
+#### Using reverse proxy
 
 There are 2 different ways of starting either using Traefik or using Certbot. Adapt the one you want to use.
 
@@ -260,7 +259,7 @@ There are 2 different ways of starting either using Traefik or using Certbot. Ad
 
 Then start docker containers (with loadbalancer):
 
-``` 
+```bash
 export NUMINSTANCES=1
 docker-compose -f docker-compose.traefik.yml up -d --scale sharelatex=$NUMINSTANCES
 ```
@@ -269,7 +268,7 @@ docker-compose -f docker-compose.traefik.yml up -d --scale sharelatex=$NUMINSTAN
 
 Enable line 65/66 and 69/70 in ldapoverleaf-sl/Dockerfile and ``make`` again.
 
-``` 
+```bash
 docker-compose -f docker-compose.certbot.yml up -d 
 ```
 

docker-compose.certbot.yml

@@ -56,6 +56,7 @@ services:
 
       LDAP_SERVER: ldaps://LDAPSERVER:636
       LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
+      LDAP_SERVER_CACERT: /etc/ssl/certs/LDAPCERT
 
       ### There are to ways get users from the ldap server
 
@@ -90,6 +91,7 @@ services:
       # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
       # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
       # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_STATE_LENGTH: Length of the OAuth2 state (default: 6)
       # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
       # OAUTH2_USER_ATTR_EMAIL: email
       # OAUTH2_USER_ATTR_UID: id

docker-compose.traefik.yml

@@ -137,6 +137,7 @@ services:
 
       LDAP_SERVER: ldaps://LDAPSERVER:636
       LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
+      LDAP_SERVER_CACERT: /etc/ssl/certs/LDAPCERT
 
       ### There are to ways get users from the ldap server
 
@@ -171,6 +172,7 @@ services:
       # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
       # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
       # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_STATE_LENGTH: Length of the OAuth2 state (default: 6)
       # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
       # OAUTH2_USER_ATTR_EMAIL: email
       # OAUTH2_USER_ATTR_UID: id

docker-compose.yml

@@ -54,6 +54,7 @@ services:
 
       LDAP_SERVER: ldaps://LDAPSERVER:636
       LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
+      LDAP_SERVER_CACERT: /etc/ssl/certs/LDAPCERT
 
       ### There are to ways get users from the ldap server
 
@@ -88,6 +89,7 @@ services:
       # OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
       # OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
       # OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
+      # OAUTH2_STATE_LENGTH: Length of the OAuth2 state (default: 6)
       # OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
       # OAUTH2_USER_ATTR_EMAIL: email
       # OAUTH2_USER_ATTR_UID: id

ldap-overleaf-sl/Dockerfile

@@ -19,15 +19,18 @@ RUN npm install -g npm && \
     # npm cache clean --force && \
     npm install ldap-escape ldapts-search ldapts@3.2.4 && \
     # npm install bcrypt@5.0.0 && \
-    ## This variant of updateing texlive does not work
-    # bash -c tlmgr install scheme-full && \
-    ## try this one:
     apt-get update && \
-    apt-get -y install python-pygments && \
-    apt-get -y install texlive texlive-lang-german texlive-latex-extra texlive-full texlive-science && \
+    apt-get -y install libxml-libxslt-perl cpanminus libbtparse2 python-pygments && \
+    # now install latest texlive2023 from tlmgr
+    tlmgr update --self --all  && \
+    tlmgr install scheme-full --verify-repo=none && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+# latex-bin must be on path to be found in compilation process
+# needed for biber epstopdf and others
+ENV PATH="/usr/local/texlive/2023/bin/x86_64-linux:${PATH};"
+
 # overwrite some files
 COPY sharelatex/AuthenticationManager.js    /overleaf/services/web/app/src/Features/Authentication/
 COPY sharelatex/AuthenticationController.js /overleaf/services/web/app/src/Features/Authentication/

ldap-overleaf-sl/sharelatex_diff/AuthenticationController.js.diff

@@ -1,10 +1,11 @@
-268a268,364
+268a269,366
 > 
 > // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >   oauth2Redirect(req, res, next) {
 >     // random state
 >     const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
->     const state = new Array(6).fill(0).map(() => characters.charAt(Math.floor(Math.random() * characters.length))).join("")
+>     const stateLength = Number(process.env.OAUTH2_STATE_LENGTH || 6)
+>     const state = new Array(stateLength).fill(0).map(() => characters.charAt(Math.floor(Math.random() * characters.length))).join("")
 >     req.session.oauth2State = state
 > 
 >     const redirectURI = encodeURIComponent(`${process.env.SHARELATEX_SITE_URL}/oauth/callback`)