f6ded84f07
- When the upstream IDP is an LDAP IDP and the user's LDAP username and password are received as new custom headers, then authenticate the user and, if authentication was successful, return a redirect with an authcode. Handle errors according to the OAuth/OIDC specs. - Still does not support having multiple upstream IDPs defined at the same time, which was an existing limitation of this endpoint. - Does not yet include the actual LDAP authentication, which is hidden behind an interface from the point of view of auth_handler.go - Move the oidctestutil package to the testutil directory. - Add an interface for Fosite storage to avoid a cyclical test dependency. - Add GetURL() to the UpstreamLDAPIdentityProviderI interface. - Extract test helpers to be shared between callback_handler_test.go and auth_handler_test.go because the authcode and fosite storage assertions should be identical. - Backfill Content-Type assertions in callback_handler_test.go. Signed-off-by: Andrew Keesler <akeesler@vmware.com>
72 lines
2.3 KiB
Go
72 lines
2.3 KiB
Go
// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ecdsa"
|
|
"reflect"
|
|
|
|
"github.com/ory/fosite"
|
|
"github.com/ory/fosite/compose"
|
|
"github.com/ory/fosite/handler/openid"
|
|
|
|
"go.pinniped.dev/internal/constable"
|
|
"go.pinniped.dev/internal/oidc/jwks"
|
|
"go.pinniped.dev/internal/plog"
|
|
)
|
|
|
|
// dynamicOpenIDConnectECDSAStrategy is an openid.OpenIDConnectTokenStrategy that can dynamically
|
|
// load a signing key to issue ID tokens. We want this dynamic capability since our controllers for
|
|
// loading FederationDomain's and signing keys run in parallel, and thus the signing key might not be
|
|
// ready when an FederationDomain is otherwise ready.
|
|
//
|
|
// If we ever update FederationDomain's to hold their signing key, we might not need this type, since we
|
|
// could have an invariant that routes to an FederationDomain's endpoints are only wired up if an
|
|
// FederationDomain has a valid signing key.
|
|
type dynamicOpenIDConnectECDSAStrategy struct {
|
|
fositeConfig *compose.Config
|
|
jwksProvider jwks.DynamicJWKSProvider
|
|
}
|
|
|
|
var _ openid.OpenIDConnectTokenStrategy = &dynamicOpenIDConnectECDSAStrategy{}
|
|
|
|
func newDynamicOpenIDConnectECDSAStrategy(
|
|
fositeConfig *compose.Config,
|
|
jwksProvider jwks.DynamicJWKSProvider,
|
|
) *dynamicOpenIDConnectECDSAStrategy {
|
|
return &dynamicOpenIDConnectECDSAStrategy{
|
|
fositeConfig: fositeConfig,
|
|
jwksProvider: jwksProvider,
|
|
}
|
|
}
|
|
|
|
func (s *dynamicOpenIDConnectECDSAStrategy) GenerateIDToken(
|
|
ctx context.Context,
|
|
requester fosite.Requester,
|
|
) (string, error) {
|
|
_, activeJwk := s.jwksProvider.GetJWKS(s.fositeConfig.IDTokenIssuer)
|
|
if activeJwk == nil {
|
|
plog.Debug("no JWK found for issuer", "issuer", s.fositeConfig.IDTokenIssuer)
|
|
return "", fosite.ErrTemporarilyUnavailable.WithWrap(constable.Error("no JWK found for issuer"))
|
|
}
|
|
key, ok := activeJwk.Key.(*ecdsa.PrivateKey)
|
|
if !ok {
|
|
actualType := "nil"
|
|
if t := reflect.TypeOf(activeJwk.Key); t != nil {
|
|
actualType = t.String()
|
|
}
|
|
plog.Debug(
|
|
"JWK must be of type ecdsa",
|
|
"issuer",
|
|
s.fositeConfig.IDTokenIssuer,
|
|
"actualType",
|
|
actualType,
|
|
)
|
|
return "", fosite.ErrServerError.WithWrap(constable.Error("JWK must be of type ecdsa"))
|
|
}
|
|
|
|
return compose.NewOpenIDConnectECDSAStrategy(s.fositeConfig, key).GenerateIDToken(ctx, requester)
|
|
}
|