feat: support disabling pushed authorization request (#427)

Author: BytesUnlimited-net

README.md

@@ -261,6 +261,7 @@ OIDC_CODE_CHALLENGE_METHOD=S256
 OIDC_AUTH_METHOD="client_secret_post"
 OIDC_REDIRECT_URI="https://<MISP_URL>/users/login" # (same value set in Okta)
 OIDC_DISABLE_REQUEST_OBJECT=false
+OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=false
 OIDC_SKIP_PROXY=true
 OIDC_ALLOW_EMAIL_LINKING=false
 OIDC_REQUIRE_EMAIL_VERIFIED=true

core/files/configure_misp.sh

@@ -103,6 +103,7 @@ set_up_oidc() {
                 \"authentication_method\": \"${OIDC_AUTH_METHOD}\",
                 \"redirect_uri\": \"${OIDC_REDIRECT_URI}\",
                 \"disable_request_object\": \"${OIDC_DISABLE_REQUEST_OBJECT}\",
+                \"disable_pushed_authorization_request\": \"${OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST}\",
                 \"skipProxy\": ${OIDC_SKIP_PROXY},
                 \"allow_email_linking\": ${OIDC_ALLOW_EMAIL_LINKING},
                 \"require_email_verified\": ${OIDC_REQUIRE_EMAIL_VERIFIED}

core/files/entrypoint.sh

@@ -58,6 +58,7 @@ export OIDC_ENABLE=${OIDC_ENABLE:-false}
 export OIDC_MIXEDAUTH=${OIDC_MIXEDAUTH:-false}
 export OIDC_AUTH_METHOD=${OIDC_AUTH_METHOD:-client_secret_post}
 export OIDC_DISABLE_REQUEST_OBJECT=${OIDC_DISABLE_REQUEST_OBJECT:-false}
+export OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=${OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST:-false}
 export OIDC_SKIP_PROXY=${OIDC_SKIP_PROXY:-true}
 export OIDC_ALLOW_EMAIL_LINKING=${OIDC_ALLOW_EMAIL_LINKING:-false}
 export OIDC_REQUIRE_EMAIL_VERIFIED=${OIDC_REQUIRE_EMAIL_VERIFIED:-true}

docker-compose.yml

@@ -184,6 +184,7 @@ services:
       - "OIDC_SCOPES=${OIDC_SCOPES}"
       - "OIDC_LOGOUT_URL=${OIDC_LOGOUT_URL}"
       - "OIDC_DISABLE_REQUEST_OBJECT=${OIDC_DISABLE_REQUEST_OBJECT}"
+      - "OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=${OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST}"
       - "OIDC_SKIP_PROXY=${OIDC_SKIP_PROXY}"
       - "OIDC_ALLOW_EMAIL_LINKING=${OIDC_ALLOW_EMAIL_LINKING}"
       - "OIDC_REQUIRE_EMAIL_VERIFIED=${OIDC_REQUIRE_EMAIL_VERIFIED}"

template.env

@@ -197,6 +197,7 @@ SYNCSERVERS_1_PULL_RULES=
 # OIDC_SCOPES="[\"profile\", \"email\"]"
 # OIDC_LOGOUT_URL=
 # OIDC_DISABLE_REQUEST_OBJECT=false
+# OIDC_DISABLE_PUSHED_AUTHORIZATION_REQUEST=false
 # OIDC_SKIP_PROXY=true
 # OIDC_ALLOW_EMAIL_LINKING=false
 # OIDC_REQUIRE_EMAIL_VERIFIED=true