Add arbitrary OAuth 2.0 parameters on the authorization endpoint

Cargo.toml

@@ -86,6 +86,11 @@ version = "1.0.12"
 [workspace.dependencies.rand]
 version = "0.8.5"
 
+# JSON Schema generation
+[workspace.dependencies.schemars]
+version = "0.8.16"
+features = ["url", "chrono", "preserve_order"]
+
 # Serialization and deserialization
 [workspace.dependencies.serde]
 version = "1.0.196"

crates/cli/src/commands/config.rs

@@ -310,6 +310,10 @@ async fn sync(root: &super::Options, prune: bool, dry_run: bool) -> anyhow::Resu
                         jwks_uri_override: provider.jwks_uri,
                         discovery_mode,
                         pkce_mode,
+                        additional_authorization_parameters: provider
+                            .additional_authorization_parameters
+                            .into_iter()
+                            .collect(),
                     },
                 )
                 .await?;

crates/config/Cargo.toml

@@ -23,7 +23,7 @@ camino = { workspace = true, features = ["serde1"] }
 chrono.workspace = true
 figment = { version = "0.10.14", features = ["env", "yaml", "test"] }
 ipnetwork = { version = "0.20.0", features = ["serde", "schemars"] }
-schemars = { version = "0.8.16", features = ["url", "chrono"] }
+schemars.workspace = true
 ulid.workspace = true
 url.workspace = true
 

crates/config/src/sections/upstream_oauth2.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use std::ops::Deref;
+use std::{collections::BTreeMap, ops::Deref};
 
 use async_trait::async_trait;
 use mas_iana::{jose::JsonWebSignatureAlg, oauth::OAuthClientAuthenticationMethod};
@@ -302,6 +302,12 @@ pub struct Provider {
     /// provider
     #[serde(default)]
     pub claims_imports: ClaimsImports,
+
+    /// Additional parameters to include in the authorization request
+    ///
+    /// Orders of the keys are not preserved.
+    #[serde(default)]
+    pub additional_authorization_parameters: BTreeMap<String, String>,
 }
 
 impl Deref for Provider {

crates/data-model/src/upstream_oauth2/provider.rs

@@ -142,6 +142,7 @@ pub struct UpstreamOAuthProvider {
     pub token_endpoint_auth_method: OAuthClientAuthenticationMethod,
     pub created_at: DateTime<Utc>,
     pub claims_imports: ClaimsImports,
+    pub additional_authorization_parameters: Vec<(String, String)>,
 }
 
 /// Whether to set the email as verified when importing it from the upstream

crates/handlers/src/upstream_oauth2/authorize.rs

@@ -107,12 +107,21 @@ pub(crate) async fn get(
     };
 
     // Build an authorization request for it
-    let (url, data) = mas_oidc_client::requests::authorization_code::build_authorization_url(
+    let (mut url, data) = mas_oidc_client::requests::authorization_code::build_authorization_url(
         lazy_metadata.authorization_endpoint().await?.clone(),
         data,
         &mut rng,
     )?;
 
+    // We do that in a block because params borrows url mutably
+    {
+        // Add any additional parameters to the query
+        let mut params = url.query_pairs_mut();
+        for (key, value) in &provider.additional_authorization_parameters {
+            params.append_pair(key, value);
+        }
+    }
+
     let session = repo
         .upstream_oauth_session()
         .add(

crates/handlers/src/upstream_oauth2/cache.rs

@@ -505,6 +505,7 @@ mod tests {
             token_endpoint_auth_method: OAuthClientAuthenticationMethod::None,
             created_at: clock.now(),
             claims_imports: UpstreamOAuthProviderClaimsImports::default(),
+            additional_authorization_parameters: Vec::new(),
         };
 
         // Without any override, it should just use discovery

crates/handlers/src/upstream_oauth2/link.rs

@@ -925,6 +925,7 @@ mod tests {
                     jwks_uri_override: None,
                     discovery_mode: mas_data_model::UpstreamOAuthProviderDiscoveryMode::Oidc,
                     pkce_mode: mas_data_model::UpstreamOAuthProviderPkceMode::Auto,
+                    additional_authorization_parameters: Vec::new(),
                 },
             )
             .await

crates/handlers/src/views/login.rs

@@ -363,6 +363,7 @@ mod test {
                     jwks_uri_override: None,
                     discovery_mode: mas_data_model::UpstreamOAuthProviderDiscoveryMode::Oidc,
                     pkce_mode: mas_data_model::UpstreamOAuthProviderPkceMode::Auto,
+                    additional_authorization_parameters: Vec::new(),
                 },
             )
             .await
@@ -397,6 +398,7 @@ mod test {
                     jwks_uri_override: None,
                     discovery_mode: mas_data_model::UpstreamOAuthProviderDiscoveryMode::Oidc,
                     pkce_mode: mas_data_model::UpstreamOAuthProviderPkceMode::Auto,
+                    additional_authorization_parameters: Vec::new(),
                 },
             )
             .await

crates/iana/Cargo.toml

@@ -13,7 +13,7 @@ workspace = true
 
 [dependencies]
 serde = { workspace = true, optional = true }
-schemars = { version = "0.8.16", default-features = false, optional = true }
+schemars = { workspace = true, optional = true }
 
 [features]
 default = ["serde", "schemars"]

crates/jose/Cargo.toml

@@ -24,7 +24,7 @@ p256 = { version = "0.13.2", features = ["ecdsa"] }
 p384 = { version = "0.13.0", features = ["ecdsa"] }
 rand.workspace = true
 rsa = "0.9.6"
-schemars = "0.8.16"
+schemars.workspace = true
 sec1 = "0.7.3"
 serde.workspace = true
 serde_json.workspace = true

crates/policy/Cargo.toml

@@ -16,7 +16,7 @@ anyhow.workspace = true
 opa-wasm = { git = "https://github.com/matrix-org/rust-opa-wasm.git" }
 serde.workspace = true
 serde_json.workspace = true
-schemars = {version = "0.8.16", optional = true }
+schemars = { workspace = true, optional = true }
 thiserror.workspace = true
 tokio = { version = "1.35.1", features = ["io-util", "rt"] }
 tracing.workspace = true

crates/storage-pg/migrations/20240301091201_upstream_oauth_additional_parameters.sql

@@ -0,0 +1,18 @@
+-- Copyright 2024 The Matrix.org Foundation C.I.C.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+-- Adds a column to the upstream_oauth_providers table to store additional parameters to be sent to the OAuth provider.
+-- Parameters are stored as [["key", "value"], ["key", "value"], ...] in a JSONB column to keep key ordering.
+ALTER TABLE upstream_oauth_providers 
+    ADD COLUMN additional_parameters JSONB;

crates/storage-pg/src/iden.rs

@@ -110,6 +110,7 @@ pub enum UpstreamOAuthProviders {
     ClaimsImports,
     DiscoveryMode,
     PkceMode,
+    AdditionalParameters,
     JwksUriOverride,
     TokenEndpointOverride,
     AuthorizationEndpointOverride,

crates/storage-pg/src/upstream_oauth2/mod.rs

@@ -76,6 +76,7 @@ mod tests {
                     jwks_uri_override: None,
                     discovery_mode: mas_data_model::UpstreamOAuthProviderDiscoveryMode::Oidc,
                     pkce_mode: mas_data_model::UpstreamOAuthProviderPkceMode::Auto,
+                    additional_authorization_parameters: Vec::new(),
                 },
             )
             .await
@@ -259,6 +260,7 @@ mod tests {
                         jwks_uri_override: None,
                         discovery_mode: mas_data_model::UpstreamOAuthProviderDiscoveryMode::Oidc,
                         pkce_mode: mas_data_model::UpstreamOAuthProviderPkceMode::Auto,
+                        additional_authorization_parameters: Vec::new(),
                     },
                 )
                 .await