Add per-domain OAuth (Google, GitHub) provider support by Damans227 · Pull Request #12702 · apache/cloudstack

Damans227 · 2026-02-25T00:34:20Z

Description

Add per-domain OAuth provider support. Allows OAuth providers (Google, GitHub) to be configured at the domain level with global fallback.

Design Doc

https://cwiki.apache.org/confluence/display/CLOUDSTACK/Allow+OAuth+provider+per+domain

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Screenshots and recording

Screen.Recording.2026-03-16.at.10.34.53.AM.mp4

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

How Has This Been Tested?

Manual testing with GitHub OAuth provider configured at domain level and global level, verifying domain-specific lookup with global fallback.

…DBUtils

…ove code clarity

…entication checks

…nid' in columns and details

…nhance user verification

…ls for improved readability and consistency

…istency

…cation method

…mmand classes

Damans227 · 2026-02-25T00:52:50Z

@blueorangutan package

blueorangutan · 2026-02-25T00:54:04Z

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-25T01:27:14Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16931

Damans227 · 2026-02-25T01:42:50Z

@blueorangutan package

blueorangutan · 2026-03-11T13:56:06Z

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-03-11T15:20:58Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17098

api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java

sureshanaparti · 2026-03-27T08:39:20Z

api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java

+     * Verifies the code provided by provider and fetches email for a specific domain
+     * @return returns email
+     */
+    String verifyCodeAndFetchEmail(String secretCode, Long domainId);


Suggested change

String verifyCodeAndFetchEmail(String secretCode, Long domainId);

String verifySecretCodeAndFetchEmail(String secretCode, Long domainId);

@sureshanaparti The domain-aware verifyCodeAndFetchEmail(String secretCode, Long domainId) is an overload of the pre-existing verifyCodeAndFetchEmail(String secretCode). If we rename only the new overload to verifySecretCodeAndFetchEmail, the two methods would have inconsistent names. Should we rename both for consistency?

engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql

framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java

...ors/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java

.../oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java

...th2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java

...rs/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java

...user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManager.java

sureshanaparti · 2026-03-27T10:28:49Z

...-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java


+    @Override
+    public Long resolveDomainId(Map<String, Object[]> params) {
+        final String[] domainIdArray = (String[])params.get(ApiConstants.DOMAIN_ID);


API cmd uses domainId - ApiConstants.DOMAIN__ID (camelcase param - not deprecated yet)

cloudstack/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmd.java

Lines 67 to 71 in 1bff543

@Parameter(name = ApiConstants.DOMAIN, type = CommandType.STRING, description = "Path of the domain that the user belongs to. Example: domain=/com/cloud/internal. If no domain is passed in, the ROOT (/) domain is assumed.")

private String domain;

@Parameter(name = ApiConstants.DOMAIN__ID, type = CommandType.LONG, description = "The id of the domain that the user belongs to. If both domain and domainId are passed in, \"domainId\" parameter takes precedence.")

private Long domainId;

@sureshanaparti Just looked into it, both getDomainIdFromParams and resolveDomainId look up ApiConstants.DOMAIN_ID ("domainid"). The API servlet lowercases param names, so DOMAIN__ID ("domainId") resolves correctly.

sureshanaparti · 2026-03-27T10:35:08Z

...-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java

+            if (Objects.nonNull(domain)) {
+                return domain.getId();
+            }
+        }


check if you can use the below methods, and move get domain by path to a method (or can improve any existing method)

cloudstack/server/src/main/java/com/cloud/api/ApiServer.java

Line 1438 in 1bff543

public String getDomainId(Map<String, Object[]> params) {

cloudstack/server/src/main/java/com/cloud/api/ApiServer.java

Line 1184 in 1bff543

public Long fetchDomainId(final String domainUUID) {

@sureshanaparti Looked into the ApiServer methods. fetchDomainId only resolves by UUID, while resolveDomainId also handles domain path resolution. The closest existing combination would be fetchDomainId + DomainService.findDomainByIdOrPath, which is what OauthLoginAPIAuthenticatorCmd already uses. I could refactor resolveDomainId to delegate to those, but since OAuth2AuthManagerImpl doesn't have access to ApiServer, it would mean injecting DomainService instead of DomainDao. Would you prefer that approach, or is the current implementation acceptable?

… variable

Damans227 · 2026-03-27T17:17:48Z

@blueorangutan package

blueorangutan · 2026-03-27T17:20:05Z

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-03-27T18:04:09Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17268

Daman Arora and others added 19 commits December 18, 2025 11:23

Add domain_id to oauth_provider table and VO

dfc45c0

Add domain-aware methods to OauthProviderDao

fcb4778

Add domainId parameter to OAuth provider API commands and response

85c64e5

Add domain support to OAuth2AuthManager

c46fb98

Add domain-aware OAuth verification

4ef100c

Add domain support to ListOAuthProvidersCmd and update related tests

8e48938

fix domain path issue

9ab26db

Add domainId support to OAuth provider

3e7fa92

Return domain name and UUID in OAuth provider API responses using Api…

4a6b28e

…DBUtils

Refactor domain ID resolution in VerifyOAuthCodeAndGetUserCmd to impr…

3ab3ca9

…ove code clarity

Enhance OAuth2 plugin support for domain-level configuration and auth…

bb6f137

…entication checks

Update OAuth2 tests and VerifyOAuthCodeAndGetUserCmdTest

764495b

Add method to find OAuth provider by domain with global fallback

0ec6bcc

Update OAuth provider configuration to use 'domain' instead of 'domai…

9609ef0

…nid' in columns and details

Refactor OAuth provider methods to support domain-level queries and e…

65ccef1

…nhance user verification

Add caching for access token retrieval in GithubOAuth2Provider

e3da679

Refactor access token checks in GithubOAuth2Provider to use StringUti…

0e32a60

…ls for improved readability and consistency

Refactor null checks to use utility for improved readability and cons…

23c4132

…istency

Update OAuth2UserAuthenticatorTest to include domainId in user verifi…

1a23f3a

…cation method

boring-cyborg bot added component:api component:UI labels Feb 25, 2026

Damans227 added 2 commits February 24, 2026 19:42

Merge branch 'main' into oauth-per-domain

b8cf181

Remove unnecessary blank line and unused imports in OAuth provider co…

6d73964

…mmand classes

Damans227 added 2 commits February 24, 2026 20:13

Refactor and cleanup

a428d1a

Remove unnecessary blank lines

b367434

Enhance RegisterOAuthProviderCmdTest with additional provider mock data

42a8651

add unit tests

b4b7420

Add Multiple-domain OAuth tests

dc30f14