From 03bbc540237bc266068888e4b82a9e552a67a26a Mon Sep 17 00:00:00 2001 From: Monis Khan Date: Tue, 28 Sep 2021 11:51:01 -0400 Subject: [PATCH] upstreamoidc: log claim keys at debug level At debug level: upstreamoidc.go:213] "claims from ID token and userinfo" providerName="oidc" keys=[at_hash aud email email_verified exp iat iss sub] At all level: upstreamoidc.go:207] "claims from ID token and userinfo" providerName="oidc" claims="{\"at_hash\":\"C55S-BgnHTmr2_TNf...hYmVhYWESBWxvY2Fs\"}" Signed-off-by: Monis Khan --- internal/upstreamoidc/upstreamoidc.go | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/internal/upstreamoidc/upstreamoidc.go b/internal/upstreamoidc/upstreamoidc.go index 659246ab..3a249c1d 100644 --- a/internal/upstreamoidc/upstreamoidc.go +++ b/internal/upstreamoidc/upstreamoidc.go @@ -6,6 +6,7 @@ package upstreamoidc import ( "context" + "encoding/json" "fmt" "net/http" "net/url" @@ -13,6 +14,7 @@ import ( coreosoidc "github.com/coreos/go-oidc/v3/oidc" "golang.org/x/oauth2" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/sets" "go.pinniped.dev/internal/httputil/httperr" "go.pinniped.dev/internal/oidc" @@ -131,12 +133,11 @@ func (p *ProviderConfig) ValidateToken(ctx context.Context, tok *oauth2.Token, e if err := validated.Claims(&validatedClaims); err != nil { return nil, httperr.Wrap(http.StatusInternalServerError, "could not unmarshal id token claims", err) } - plog.All("claims from ID token", "providerName", p.Name, "claims", validatedClaims) + maybeLogClaims("claims from ID token", p.Name, validatedClaims) if err := p.fetchUserInfo(ctx, tok, validatedClaims); err != nil { return nil, httperr.Wrap(http.StatusInternalServerError, "could not fetch user info claims", err) } - plog.All("claims from ID token and userinfo", "providerName", p.Name, "claims", validatedClaims) return &oidctypes.Token{ AccessToken: &oidctypes.AccessToken{ @@ -196,5 +197,21 @@ func (p *ProviderConfig) fetchUserInfo(ctx context.Context, tok *oauth2.Token, c return httperr.Wrap(http.StatusInternalServerError, "could not unmarshal user info claims", err) } + maybeLogClaims("claims from ID token and userinfo", p.Name, claims) + return nil } + +func maybeLogClaims(msg, name string, claims map[string]interface{}) { + if plog.Enabled(plog.LevelAll) { // log keys and values at all level + data, _ := json.Marshal(claims) // nothing we can do if it fails, but it really never should + plog.Info(msg, "providerName", name, "claims", string(data)) + return + } + + if plog.Enabled(plog.LevelDebug) { // log keys at debug level + keys := sets.StringKeySet(claims).List() // note: this is only safe because the compiler asserts that claims is a map[string] + plog.Info(msg, "providerName", name, "keys", keys) + return + } +}