为自部署Overleaf/Sharelatex实例添加LDAP和OAuth2/OpenID Connect登录支持

    oauth2Redirect(req, res, next) {
        res.redirect(`${process.env.OAUTH_AUTH_URL}?` +
            querystring.stringify({
                client_id: process.env.OAUTH_CLIENT_ID,
                response_type: "code",
                redirect_uri: (process.env.SHARELATEX_SITE_URL + "/oauth/callback"),
            }));
    },

    oauth2Callback(req, res, next) {
        const code = req.query.code;

//construct axios body
        const params = new URLSearchParams()
        params.append('grant_type', "authorization_code")
        params.append('client_id', process.env.OAUTH_CLIENT_ID)
        params.append('client_secret', process.env.OAUTH_CLIENT_SECRET)
        params.append("code", code)
        params.append('redirect_uri', (process.env.SHARELATEX_SITE_URL + "/oauth/callback"))


        json_body = {
            "grant_type": "authorization_code",
            client_id: process.env.OAUTH_CLIENT_ID,
            client_secret: process.env.OAUTH_CLIENT_SECRET,
            "code": code,
            redirect_uri: (process.env.SHARELATEX_SITE_URL + "/oauth/callback"),
        }

        axios.post(process.env.OAUTH_ACCESS_URL, params, {
            headers: {
                "Content-Type": "application/x-www-form-urlencoded", //这个是Keycloak特有的问题，需要用这个content-type才能正常发送code

            }
        }).then(access_res => {

            // console.log("respond is  " + JSON.stringify(access_res.data))
            // console.log("authorization_bearer_is " + authorization_bearer)
            authorization_bearer = "Bearer " + access_res.data.access_token

            let axios_get_config = {
                headers: {
                    "Content-Type": "application/x-www-form-urlencoded",
                    "Authorization": authorization_bearer, //这里同样是Keycloak特有的问题，需要把authorization_code 写到Bearer里才行
                },
                params: access_res.data
            }

            axios.get(process.env.OAUTH_USER_URL, axios_get_config).then(info_res => {
                // console.log("oauth_user: ", JSON.stringify(info_res.data));
                if (info_res.data.err) {
                    res.json({message: info_res.data.err});
                } else {
                    AuthenticationManager.createUserIfNotExist(info_res.data, (error, user) => {
                        if (error) {
                            res.json({message: error});
                        } else {
                            // console.log("real_user: ", user);
                            AuthenticationController.finishLogin(user, req, res, next);
                        }
                    });
                }
            });
        });
    },

ARG BASE=sharelatex/sharelatex:3.1 #基础镜像
ARG TEXLIVE_IMAGE=registry.gitlab.com/islandoftex/images/texlive:latest #为了方便安装完整版TEXLive，直接拉一个完整版的texlive下来，最后替换掉镜像里现有的

FROM $TEXLIVE_IMAGE as texlive

FROM $BASE as app

# passed from .env (via make)
# ARG collab_text
# ARG login_text
ARG admin_is_sysadmin #是否需要把LDAP的管理员也当做overleaf的管理员

# set workdir (might solve issue #2 - see https://stackoverflow.com/questions/57534295/)
WORKDIR /overleaf

#add mirrors
RUN sed -i s@/archive.ubuntu.com/@/mirrors.sustech.edu.cn/@g /etc/apt/sources.list
RUN sed -i s@/security.ubuntu.com/@/mirrors.sustech.edu.cn/@g /etc/apt/sources.list
RUN npm config set registry https://registry.npmmirror.com

# add oauth router to router.js
#head -n -1 router.js > temp.txt ; mv temp.txt router.js
RUN git clone https://mirrors.sustech.edu.cn/git/sustech-cra/overleaf-ldap-oauth2.git /src
RUN cat /src/ldap-overleaf-sl/sharelatex/router-append.js

RUN head -n -2 /overleaf/services/web/app/src/router.js > temp.txt ; mv temp.txt /overleaf/services/web/app/src/router.js
RUN cat /src/ldap-overleaf-sl/sharelatex/router-append.js >> /overleaf/services/web/app/src/router.js

# recompile 这里需要注意，目前的overleaf镜像里的npm依赖似乎有点问题，一旦装了新的依赖之后就会出现打包错误，因此如果需要在router.js里加东西的话，必须在这一次打包之前全部加完
RUN node genScript compile | bash


# 装了依赖之后打包会失败，参考 https://github.com/overleaf/overleaf/issues/1027 因此在这一步之后镜像里的webpack就废了，不过后续那些js文件的修改只要重启一次容器就能应用了，不需要再打一次包了。
# install package could result to the error of webpack-cli
RUN npm install axios ldapts-search [email protected] ldap-escape

# install pygments and some fonts dependencies
# 安装用于minted等代码高亮包的python3-pygments，以及一些字体
RUN apt-get update && apt-get -y install python3-pygments nano fonts-noto-cjk fonts-noto-cjk-extra fonts-noto-color-emoji xfonts-wqy fonts-font-awesome

# overwrite some files (enable ldap and oauth)
# 替换文件
RUN cp /src/ldap-overleaf-sl/sharelatex/AuthenticationManager.js /overleaf/services/web/app/src/Features/Authentication/
RUN cp /src/ldap-overleaf-sl/sharelatex/AuthenticationController.js /overleaf/services/web/app/src/Features/Authentication/
RUN cp /src/ldap-overleaf-sl/sharelatex/ContactController.js /overleaf/services/web/app/src/Features/Contacts/

# instead of copying the login.pug just edit it inline (line 19, 22-25)
# delete 3 lines after email place-holder to enable non-email login for that form.
#RUN sed -iE '/type=.*email.*/d' /overleaf/services/web/app/views/user/login.pug
#RUN sed -iE '/[email protected]/{n;N;N;d}' /overleaf/services/web/app/views/user/login.pug
#RUN sed -iE "s/[email protected]/${login_text:-user}/g" /overleaf/services/web/app/views/user/login.pug

# RUN sed -iE '/type=.*email.*/d' /overleaf/services/web/app/views/user/login.pug
# RUN sed -iE '/[email protected]/{n;N;N;d}' /overleaf/services/web/app/views/user/login.pug # comment out this line to prevent sed accidently remove the brackets of the email(username) field
# RUN sed -iE "s/[email protected]/${login_text:-user}/g" /overleaf/services/web/app/views/user/login.pug

# Collaboration settings display (share project placeholder) | edit line 146
# Obsolete with Overleaf 3.0
# RUN sed -iE "s%placeholder=.*$%placeholder=\"${collab_text}\"%g" /overleaf/services/web/app/views/project/editor/share.pug

# extend pdflatex with option shell-esacpe ( fix for closed overleaf/overleaf/issues/217 and overleaf/docker-image/issues/45 )
# 允许shell-esacpe（跟minted包有关）
RUN sed -iE "s%-synctex=1\",%-synctex=1\", \"-shell-escape\",%g" /overleaf/services/clsi/app/js/LatexRunner.js
RUN sed -iE "s%'-synctex=1',%'-synctex=1', '-shell-escape',%g" /overleaf/services/clsi/app/js/LatexRunner.js

# Too much changes to do inline (>10 Lines).
# 继续替换文件
RUN cp /src/ldap-overleaf-sl/sharelatex/settings.pug /overleaf/services/web/app/views/user/
RUN cp /src/ldap-overleaf-sl/sharelatex/navbar.pug /overleaf/services/web/app/views/layout/

# new login menu
# 替换登录界面（可自行修改登录界面里的文字）
RUN cp /src/ldap-overleaf-sl/sharelatex/login.pug /overleaf/services/web/app/views/user/

# Non LDAP User Registration for Admins
# 继续替换文件
RUN cp /src/ldap-overleaf-sl/sharelatex/admin-index.pug 	/overleaf/services/web/app/views/admin/index.pug
RUN cp /src/ldap-overleaf-sl/sharelatex/admin-sysadmin.pug 	/tmp/admin-sysadmin.pug
RUN if [ "${admin_is_sysadmin}" = "true" ] ; then cp /tmp/admin-sysadmin.pug   /overleaf/services/web/app/views/admin/index.pug ; else rm /tmp/admin-sysadmin.pug ; fi

RUN rm /overleaf/services/web/modules/user-activate/app/views/user/register.pug

#RUN rm /overleaf/services/web/app/views/admin/register.pug

### To remove comments entirly (bug https://github.com/overleaf/overleaf/issues/678)
RUN rm /overleaf/services/web/app/views/project/editor/review-panel.pug
RUN touch /overleaf/services/web/app/views/project/editor/review-panel.pug

# Update TeXLive
# 替换为完整版的TEXLive
COPY --from=texlive /usr/local/texlive /usr/local/texlive
RUN tlmgr path add
# Evil hack for hardcoded texlive 2021 path
# RUN rm -r /usr/local/texlive/2021 && ln -s /usr/local/texlive/2022 /usr/local/texlive/2021

docker build -t docker-overleaf-ldap .

  # Build up the flags to pass to docker-compose
  local project_name="${PROJECT_NAME:-overleaf}"

  local image_name="overleaf-ldap-oauth2"
  if [[ "${SERVER_PRO:-null}" == "true" ]]; then
    image_name="quay.io/sharelatex/sharelatex-pro"
  fi

  local full_image_spec="$image_name:latest"