Add jakub-onderka/openid-connect-php library

[Guiiix]

Hello,

Since version 2.4.140, MISP provides a plugin to support authentication with OpenID which is becoming more and more popular.

However, according to the documentation, the PHP library jakub-onderka/openid-connect-php must be installed to be able to use the plugin.

As is, this is not possible because of the absence of the file composer.json or composer.lock. If we follow the documentation, a useless vendor directory will be created in the sources folder while used plugins are stored in a Vendor folder so the library will never be loaded. The original files would be required to be able to add the library in the right directory and keep already installed libs.

Besides, offline nodes will not be able to install this as composer needs an Internet connection.

Would it be possible to add this library in the RPM to make the plugin work out of the box?

Thank you for your hard work!

[amuehlem]

Looks like this client only works with php7. When I try to install it on a current php8.3 host, i get the following errors. Looks like the client should be adjusted to work with php8 as well.

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires phpunit/phpunit ^6.0 -> satisfiable by phpunit/phpunit[6.0.0, ..., 6.5.14].
    - phpunit/phpunit[6.0.0, ..., 6.5.14] require php ^7.0 -> your php version (8.3.12) does not satisfy that requirement.

I've opened an issue to see if phpunit/phpunit can be updated to something more recent JakubOnderka/OpenID-Connect-PHP#27

[Guiiix]

I tried with the last version of the library and that builds successfully. RPM installation tested on EL9 for both MISP 2.4 and MISP 2.5 and everything seems to work well, including OpenID authentication. Could you try on your side and check if you still have the same error?

[amuehlem]

Hi
Can you send me the detailed commands you used to install it? This might help to find the issue.

[Guiiix]

Yes of course

I've used the RPM specs of this PR: #115

I built the RPM on Fedora 42 using mock 6.2.1.

The command for EL9:

mock -r alma+epel-9-x86_64 --spec SPECS/misp9-php7.spec --sources SOURCES/ --resultdir out/ --addrepo http://rpms.remirepo.net/enterprise/9/safe/x86_64/ --enable-network
mock -r alma+epel-9-x86_64 --spec SPECS/misp9.spec --sources SOURCES/ --resultdir out/ --addrepo http://rpms.remirepo.net/enterprise/9/safe/x86_64/ --enable-network

For EL8:

mock -r alma+epel-8-x86_64 --spec SPECS/misp8.spec --sources SOURCES/ --resultdir out/ --addrepo http://rpms.remirepo.net/enterprise/8/safe/x86_64/ --enable-network
mock -r alma+epel-8-x86_64 --spec SPECS/misp8-php7.spec --sources SOURCES/ --resultdir out/ --addrepo http://rpms.remirepo.net/enterprise/8/safe/x86_64/ --enable-network

For EL7 (you will need to move /etc/mock/eol/centos-7-x86_64.cfg to /etc/mock to use centos7 chroot:

mock -r centos+epel-7-x86_64 --spec SPECS/misp.spec --sources SOURCES/ --resultdir out/ --addrepo http://rpms.remirepo.net/enterprise/7/safe/x86_64/ --enable-network

[Guiiix]

For the installation, I tried on an Alma9 docker and I followed those instructions: https://github.com/amuehlem/MISP-RPM/blob/master/RHEL9.md but I installed the local RPMS misp-2.5.13-1.el9.x86_64.rpm and misp-python-virtualenv-2.5.13-1.el9.x86_64.rpm instead of the ones available in your repository.

After the installation, the library is available in the Vendor directory:

[root@ea6f0f3d8393 ~]# ls /var/www/MISP/app/Vendor/jakub-onderka/openid-connect-php/
CHANGELOG.md  LICENSE  README.md  SECURITY.md  client_example.php  composer.json  phpbench.json  phpstan.neon  phpunit.xml.dist  src  tests

[amuehlem]

Is there a way to test if the openid library is working fine?

[amuehlem]

Is there an example configuration that could / should be added to the RPM? This could help others to implement the OpenID implementation