feat(openvpn): add OIDC browser authentication and setup guide
This commit is contained in:
opsx committed
1 parent
5107f134dd
commit
d6a9a92ad0
13 files changed
+817
-14
No files matched your search
@@ -221,6 +221,40 @@
|
||||
"trafficTrend": "Traffic Trend",
|
||||
"noTrafficData": "No traffic data yet (waiting for samples…)"
|
||||
},
|
||||
"oidcGuide": {
|
||||
"title": "Feishu / OIDC browser authentication",
|
||||
"externalService": "Requires openvpn-auth-oauth2",
|
||||
"app": "Create app",
|
||||
"appShort": "Feishu developer console",
|
||||
"identity": "Enter identity settings",
|
||||
"identityShort": "OIDC and credentials",
|
||||
"callback": "Set public callback",
|
||||
"callbackShort": "HTTPS reverse proxy",
|
||||
"test": "Test client",
|
||||
"testShort": "Browser sign-in",
|
||||
"appTip": "Ask a Feishu administrator to create and publish an app with the appropriate sign-in capability.",
|
||||
"openConsole": "Open Feishu app console",
|
||||
"appInstruction1": "Create an enterprise app, obtain its credentials, and enable the web sign-in capability.",
|
||||
"appInstruction2": "Register a redirect URL under the app's security/redirect settings. If using a broker, use the broker's upstream callback here.",
|
||||
"appInstruction3": "Publish the app and restrict its available users to people allowed to access this VPN.",
|
||||
"scopeTip": "Explicitly restrict who can use the app. Existing LDAP dial-in users are not automatically linked to Feishu identities. If your tenant lacks a standard OIDC discovery endpoint, use a compatible Keycloak / Authentik broker.",
|
||||
"issuer": "OIDC issuer URL",
|
||||
"issuerTip": "Use an HTTPS issuer that provides standard discovery (/.well-known/openid-configuration) and ID tokens, not an authorization page URL.",
|
||||
"clientId": "OIDC Client ID",
|
||||
"clientSecret": "OIDC Client Secret",
|
||||
"copySecret": "Copy from the app; hidden after saving",
|
||||
"keepSecret": "Leave blank to retain current secret",
|
||||
"secretTip": "Encrypted server-side and stored only in the auth service's 0600 configuration file.",
|
||||
"baseUrl": "Public sign-in URL",
|
||||
"baseTip": "Use a dedicated HTTPS root URL reachable before VPN connection. Give each OIDC tunnel its own endpoint.",
|
||||
"listenPort": "Local auth service port",
|
||||
"portTip": "The service listens on 127.0.0.1 only; each tunnel needs a distinct port.",
|
||||
"callbackTitle": "Register this callback with the final OIDC provider",
|
||||
"callbackTip": "With an identity broker, register this URL in the broker's OIDC client, and register the broker's upstream callback in Feishu. Reverse proxy the public endpoint to 127.0.0.1:{port}; :18080 does not handle this callback.",
|
||||
"testTip": "Install openvpn-auth-oauth2 and OpenVPN ≥ 2.6.2, then test with a WebAuth-capable client (e.g. OpenVPN Community for Windows or Tunnelblick/Viscosity for macOS). OpenVPN Connect v3 needs individual testing.",
|
||||
"startFailed": "Configuration generated, but the tunnel did not start. Resolve the error below and retry from the tunnel list.",
|
||||
"fillRequired": "Enter the OIDC issuer, app credentials, and public sign-in URL"
|
||||
},
|
||||
"tunnelEditor": {
|
||||
"title": "Edit Tunnel",
|
||||
"backToList": "Back to List",
|
||||
@@ -993,7 +1027,8 @@
|
||||
"options": {
|
||||
"certificate": "Certificate Only",
|
||||
"password": "Username + Password",
|
||||
"certificate+password": "Certificate + Password"
|
||||
"certificate+password": "Certificate + Password",
|
||||
"oidc": "Third-party OAuth2 / OIDC (Feishu)"
|
||||
}
|
||||
},
|
||||
"mfa_mode": {
|
||||
|
||||
@@ -221,6 +221,40 @@
|
||||
"trafficTrend": "流量趋势",
|
||||
"noTrafficData": "暂无流量数据（等待采样中…）"
|
||||
},
|
||||
"oidcGuide": {
|
||||
"title": "飞书 / OIDC 浏览器认证配置",
|
||||
"externalService": "需要 openvpn-auth-oauth2",
|
||||
"app": "创建应用",
|
||||
"appShort": "飞书开放平台",
|
||||
"identity": "填写身份信息",
|
||||
"identityShort": "OIDC 和应用凭据",
|
||||
"callback": "设置公网回调",
|
||||
"callbackShort": "HTTPS 与反向代理",
|
||||
"test": "客户端试连",
|
||||
"testShort": "浏览器登录验证",
|
||||
"appTip": "先由飞书管理员在开放平台创建应用，启用身份登录所需能力，并发布应用。",
|
||||
"openConsole": "打开飞书开放平台的应用管理",
|
||||
"appInstruction1": "创建企业自建应用，获取应用凭据，并启用登录所需的网页授权能力。",
|
||||
"appInstruction2": "在应用的安全/重定向地址设置中登记回调；若使用身份代理，这里应填代理给飞书的上游回调地址。",
|
||||
"appInstruction3": "发布应用，并在可用范围中只授权允许使用此 VPN 的人员。",
|
||||
"scopeTip": "在飞书侧明确设置应用可用人员与授权范围。现有 LDAP 拨号用户不会自动关联飞书身份；如飞书未提供兼容的标准 OIDC 发现地址，请先部署 Keycloak / Authentik 身份代理。",
|
||||
"issuer": "OIDC 发行者地址",
|
||||
"issuerTip": "填写能提供标准 OIDC discovery（/.well-known/openid-configuration）和 ID Token 的 HTTPS 地址；不要填写飞书授权页面地址。",
|
||||
"clientId": "OIDC Client ID",
|
||||
"clientSecret": "OIDC Client Secret",
|
||||
"copySecret": "从应用凭据复制，保存后不回显",
|
||||
"keepSecret": "留空保持原密钥",
|
||||
"secretTip": "仅保存在服务端加密存储与 0600 的认证服务配置文件内。",
|
||||
"baseUrl": "认证入口公网地址",
|
||||
"baseTip": "填写独立 HTTPS 域名根地址；客户端未连上 VPN 时也必须能访问。每条 OIDC 专线使用独立入口。",
|
||||
"listenPort": "本机认证服务端口",
|
||||
"portTip": "认证服务仅监听 127.0.0.1；多条专线各用不同端口。",
|
||||
"callbackTitle": "在最终 OIDC 身份提供方的客户端中登记此回调地址",
|
||||
"callbackTip": "如果通过身份代理接入飞书，本地址登记在代理的 OIDC 客户端中，飞书应用应登记代理的上游回调。将公网入口的所有路径反向代理至本机 127.0.0.1:{port}；不由 :18080 处理。",
|
||||
"testTip": "安装 openvpn-auth-oauth2 与 OpenVPN ≥ 2.6.2 后启动专线；使用支持 WebAuth 的客户端试连（如 Windows OpenVPN Community、macOS Tunnelblick/Viscosity）。OpenVPN Connect v3 部分兼容，须实测。",
|
||||
"startFailed": "配置已生成，但专线未成功启动；处理下方错误后从专线列表重新启动",
|
||||
"fillRequired": "请填写 OIDC 地址、应用凭据和公网认证入口"
|
||||
},
|
||||
"tunnelEditor": {
|
||||
"title": "编辑专线",
|
||||
"backToList": "返回列表",
|
||||
@@ -993,7 +1027,8 @@
|
||||
"options": {
|
||||
"certificate": "仅证书",
|
||||
"password": "用户名 + 密码",
|
||||
"certificate+password": "证书 + 密码"
|
||||
"certificate+password": "证书 + 密码",
|
||||
"oidc": "第三方 OAuth2 / OIDC（飞书登录）"
|
||||
}
|
||||
},
|
||||
"mfa_mode": {
|
||||
|
||||
Reference in new issue
Block a user