利用WHMCS内置OpenID Connect接口整合GitLab实现单点登录SSO

前言

就如标题所说，我们打算使用云筏科技的whmcs账单系统对用户做统一管理，让用户在旗下网站实现一账通。
在GitLab整合的时候发现WHMCS7.8版本的OpenID Connect接口中，/oauth/openid-configuration.php的参数是有问题的，由于WHMCS程序本身是加密的，因此不能直接改源代码，比较麻烦，这里记录一下解决过程。

WHMCS前端配置

登录后台后，进入/admin/configopenid.php，输入再次验证密码，看到下面这个场景：

然后点击生成新的密钥信息，输入对应的内容，其中GitLab的回调地址为：/users/auth/openid_connect/callback

记下Client ID和Client Secret，然后保存。

WHMCS后端配置

查看/oauth/openid-configuration.php，可以看到"response_types_supported": null,这个参数，这个在GitLab里会报错，我们也是因为这个问题卡住了花了一整天的时间来弄，也是本文最重要的部分。

{
    "issuer": "https:\/\/www.cloudraft.cn",
    "authorization_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/authorize.php",
    "token_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/token.php",
    "userinfo_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/userinfo.php",
    "jwks_uri": "https:\/\/www.cloudraft.cn\/oauth\/certs.php",
    "response_types_supported": null,
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "email",
        "profile"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "exp",
        "sub"
    ]
}

实际上应该改成：

"response_types_supported": [
        "code",
        "access_token",
        "id_token"
    ],

因此我们重命名/oauth/openid-configuration.php文件为/oauth/openid-configuration1.php，然后新建/oauth/openid-configuration.php文件，在其中输入一下代码：

<?php
header('Content-Type: application/json');
$json_source = file_get_contents("https://www.cloudraft.cn/oauth/openid-configuration1.php");
$json_array = json_decode($json_source, true);
$json_array['response_types_supported'] = ["code", "access_token", "id_token"];
echo json_encode($json_array, JSON_PRETTY_PRINT);
?>

其实就是用json替换参数，把'response_types_supported'给补上。之后查看https://www.cloudraft.cn/oauth/openid-configuration.php，已经生效了：

{
    "issuer": "https:\/\/www.cloudraft.cn",
    "authorization_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/authorize.php",
    "token_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/token.php",
    "userinfo_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/userinfo.php",
    "jwks_uri": "https:\/\/www.cloudraft.cn\/oauth\/certs.php",
    "response_types_supported": [
        "code",
        "access_token",
        "id_token"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "email",
        "profile"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "exp",
        "sub"
    ]
}

但是操作完这一步后依然会报错：

OpenIDConnect::Discovery::DiscoveryFailed (Response types supported can't be blank and Issuer mismatch):

这是因为WHMCS没有按照OpenID的标准将discovery信息写到/.well-known/openid-configuration中，因此我们还需要新建文件/.well-known/openid-configuration/index.php然后把之前改好的/oauth/openid-configuration.php移动过来，或者做一个别名。
上述做完后，访问/.well-known/openid-configuration应该可以看到如下信息：

{
    "issuer": "https:\/\/www.cloudraft.cn",
    "authorization_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/authorize.php",
    "token_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/token.php",
    "userinfo_endpoint": "https:\/\/www.cloudraft.cn\/oauth\/userinfo.php",
    "jwks_uri": "https:\/\/www.cloudraft.cn\/oauth\/certs.php",
    "response_types_supported": [
        "code",
        "access_token",
        "id_token"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "email",
        "profile"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "exp",
        "sub"
    ]
}

GitLab端配置

在/etc/gitlab/gitlab.rb文件中找到如下区域：

### OmniAuth Settings
###! Docs: https://docs.gitlab.com/ce/integration/omniauth.html
.....
gitlab_rails['omniauth_providers'] = [
.....

这里就是配置gitlab单点登录的信息区域，将之前获取的密钥信息填写进去即可，实例：

gitlab_rails['omniauth_providers'] = [
  {
    "name" => "openid_connect",
    "label" => "https://www.cloudraft.cn",
    "args" => { 
        "name" => "openid_connect",
        "scope" => ['openid','profile', 'email'],
        "response_type" => 'code',
        'issuer' => 'https://www.cloudraft.cn/oauth/openid-configuration.php',
        'discovery' => true,
        'client_auth_method' => 'query',
        'uid_field' => 'preferred_username',
        'client_options' => {
        'identifier' => '密钥信息',
        'secret' => '密钥信息',
        'redirect_uri' => 'https://code.cloudraft.cn/users/auth/openid_connect/callback'
       }
    }
  }