cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

clenaup

Browse source
This commit is contained in:
Livio Amstutz 2021-02-12 07:02:10 +01:00
parent 01ff740f4e
commit 0c7b2605bd
8 changed files with 51 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

34
example/client/service/service.go
View file

@ -21,24 +21,18 @@ var (
) )
func main() { func main() {
//keyPath := os.Getenv("KEY_PATH") keyPath := os.Getenv("KEY_PATH")
issuer := os.Getenv("ISSUER") issuer := os.Getenv("ISSUER")
port := os.Getenv("PORT") port := os.Getenv("PORT")
scopes := strings.Split(os.Getenv("SCOPES"), " ") scopes := strings.Split(os.Getenv("SCOPES"), " ")
//testURL := os.Getenv("TEST_URL")
//if keyPath != "" { if keyPath != "" {
// ts, err := rp.NewJWTProfileTokenSourceFromFile(issuer, keyPath, scopes) ts, err := profile.NewJWTProfileTokenSourceFromKeyFile(issuer, keyPath, scopes)
// if err != nil { if err != nil {
// logrus.Fatalf("error creating token source %s", err.Error()) logrus.Fatalf("error creating token source %s", err.Error())
// } }
// //client = oauth2.NewClient(context.Background(), ts) client = oauth2.NewClient(context.Background(), ts)
// resp, err := callExampleEndpoint(client, testURL) }
// if err != nil {
// logrus.Fatalf("error response from test url: %s", err.Error())
// }
// fmt.Println(resp)
//}
http.HandleFunc("/jwt-profile", func(w http.ResponseWriter, r *http.Request) { http.HandleFunc("/jwt-profile", func(w http.ResponseWriter, r *http.Request) {
if r.Method == "GET" { if r.Method == "GET" {
@ -84,7 +78,7 @@ func main() {
http.Error(w, err.Error(), http.StatusInternalServerError) http.Error(w, err.Error(), http.StatusInternalServerError)
return return
} }
ts, err := profile.NewJWTProfileTokenSourceFromKeyFile(issuer, key, scopes) ts, err := profile.NewJWTProfileTokenSourceFromKeyFileData(issuer, key, scopes)
if err != nil { if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError) http.Error(w, err.Error(), http.StatusInternalServerError)
return return
@ -95,16 +89,6 @@ func main() {
http.Error(w, err.Error(), http.StatusInternalServerError) http.Error(w, err.Error(), http.StatusInternalServerError)
return return
} }
//assertion, err := oidc.NewJWTProfileAssertionFromFileData(key, []string{issuer})
//if err != nil {
// http.Error(w, err.Error(), http.StatusInternalServerError)
// return
//}
//token, err := rp.JWTProfileAssertionExchange(ctx, assertion, scopes, provider)
//if err != nil {
// http.Error(w, err.Error(), http.StatusInternalServerError)
// return
//}
data, err := json.Marshal(token) data, err := json.Marshal(token)
if err != nil { if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError) http.Error(w, err.Error(), http.StatusInternalServerError)

21
example/internal/mock/storage.go
View file

@ -210,23 +210,34 @@ func (s *AuthStorage) AuthorizeClientIDSecret(_ context.Context, id string, _ st
return nil return nil
} }
func (s *AuthStorage) GetUserinfoFromToken(ctx context.Context, _, _, _ string) (oidc.UserInfo, error) { func (s *AuthStorage) SetUserinfoFromToken(ctx context.Context, userinfo oidc.UserInfoSetter, _, _, _ string) error {
return s.GetUserinfoFromScopes(ctx, "", "", []string{}) return s.SetUserinfoFromScopes(ctx, userinfo, "", "", []string{})
} }
func (s *AuthStorage) GetUserinfoFromScopes(_ context.Context, _, _ string, _ []string) (oidc.UserInfo, error) { func (s *AuthStorage) SetUserinfoFromScopes(ctx context.Context, userinfo oidc.UserInfoSetter, _, _ string, _ []string) error {
userinfo := oidc.NewUserInfo()
userinfo.SetSubject(a.GetSubject()) userinfo.SetSubject(a.GetSubject())
userinfo.SetAddress(oidc.NewUserInfoAddress("Test 789\nPostfach 2", "", "", "", "", "")) userinfo.SetAddress(oidc.NewUserInfoAddress("Test 789\nPostfach 2", "", "", "", "", ""))
userinfo.SetEmail("test", true) userinfo.SetEmail("test", true)
userinfo.SetPhone("0791234567", true) userinfo.SetPhone("0791234567", true)
userinfo.SetName("Test") userinfo.SetName("Test")
userinfo.AppendClaims("private_claim", "test") userinfo.AppendClaims("private_claim", "test")
return userinfo, nil return nil
} }
func (s *AuthStorage) GetPrivateClaimsFromScopes(_ context.Context, _, _ string, _ []string) (map[string]interface{}, error) { func (s *AuthStorage) GetPrivateClaimsFromScopes(_ context.Context, _, _ string, _ []string) (map[string]interface{}, error) {
return map[string]interface{}{"private_claim": "test"}, nil return map[string]interface{}{"private_claim": "test"}, nil
} }
func (s *AuthStorage) SetIntrospectionFromToken(ctx context.Context, userinfo oidc.IntrospectionResponse, tokenID, subject, clientID string) error {
if err := s.SetUserinfoFromScopes(ctx, userinfo, "", "", []string{}); err != nil {
return err
}
userinfo.SetClientID(a.ClientID)
return nil
}
func (s *AuthStorage) ValidateJWTProfileScopes(ctx context.Context, userID string, scope oidc.Scopes) (oidc.Scopes, error) {
return scope, nil
}
type ConfClient struct { type ConfClient struct {
applicationType op.ApplicationType applicationType op.ApplicationType
authMethod oidc.AuthMethod authMethod oidc.AuthMethod

10
pkg/client/profile/jwt_profile.go
View file

@ -23,7 +23,15 @@ type jwtProfileTokenSource struct {
tokenEndpoint string tokenEndpoint string
} }
func NewJWTProfileTokenSourceFromKeyFile(issuer string, data []byte, scopes []string, options ...func(source *jwtProfileTokenSource)) (oauth2.TokenSource, error) { func NewJWTProfileTokenSourceFromKeyFile(issuer, keyPath string, scopes []string, options ...func(source *jwtProfileTokenSource)) (oauth2.TokenSource, error) {
keyData, err := client.ConfigFromKeyFile(keyPath)
if err != nil {
return nil, err
}
return NewJWTProfileTokenSource(issuer, keyData.UserID, keyData.KeyID, []byte(keyData.Key), scopes, options...)
}
func NewJWTProfileTokenSourceFromKeyFileData(issuer string, data []byte, scopes []string, options ...func(source *jwtProfileTokenSource)) (oauth2.TokenSource, error) {
keyData, err := client.ConfigFromKeyFileData(data) keyData, err := client.ConfigFromKeyFileData(data)
if err != nil { if err != nil {
return nil, err return nil, err

10
pkg/oidc/introspection.go
View file

@ -21,7 +21,7 @@ type IntrospectionResponse interface {
UserInfoSetter UserInfoSetter
SetActive(bool) SetActive(bool)
IsActive() bool IsActive() bool
SetScopes(scopes Scope) SetScopes(scopes Scopes)
SetClientID(id string) SetClientID(id string)
} }
@ -31,7 +31,7 @@ func NewIntrospectionResponse() IntrospectionResponse {
type introspectionResponse struct { type introspectionResponse struct {
Active bool `json:"active"` Active bool `json:"active"`
Scope Scope `json:"scope,omitempty"` Scope Scopes `json:"scope,omitempty"`
ClientID string `json:"client_id,omitempty"` ClientID string `json:"client_id,omitempty"`
Subject string `json:"sub,omitempty"` Subject string `json:"sub,omitempty"`
userInfoProfile userInfoProfile
@ -46,7 +46,7 @@ func (u *introspectionResponse) IsActive() bool {
return u.Active return u.Active
} }
func (u *introspectionResponse) SetScopes(scope Scope) { func (u *introspectionResponse) SetScopes(scope Scopes) {
u.Scope = scope u.Scope = scope
} }
@ -252,10 +252,6 @@ func (i *introspectionResponse) MarshalJSON() ([]byte, error) {
} }
return json.Marshal(i.claims) return json.Marshal(i.claims)
//if err != nil {
// return nil, fmt.Errorf("jws: invalid map of custom claims %v", i.claims)
//}
//return utils.ConcatenateJSON(b, claims)
} }
func (i *introspectionResponse) UnmarshalJSON(data []byte) error { func (i *introspectionResponse) UnmarshalJSON(data []byte) error {

9
pkg/oidc/types.go
View file

@ -59,7 +59,6 @@ type Prompt string
type ResponseType string type ResponseType string
type Scopes []string type Scopes []string
type Scope []string //TODO: hurst?
func (s Scopes) Encode() string { func (s Scopes) Encode() string {
return strings.Join(s, " ") return strings.Join(s, " ")
@ -74,16 +73,16 @@ func (s *Scopes) MarshalText() ([]byte, error) {
return []byte(s.Encode()), nil return []byte(s.Encode()), nil
} }
func (s *Scope) MarshalJSON() ([]byte, error) { func (s *Scopes) MarshalJSON() ([]byte, error) {
return json.Marshal(Scopes(*s).Encode()) return json.Marshal((*s).Encode())
} }
func (s *Scope) UnmarshalJSON(data []byte) error { func (s *Scopes) UnmarshalJSON(data []byte) error {
var str string var str string
if err := json.Unmarshal(data, &str); err != nil { if err := json.Unmarshal(data, &str); err != nil {
return err return err
} }
*s = Scope(strings.Split(str, " ")) *s = strings.Split(str, " ")
return nil return nil
} }

5
pkg/oidc/userinfo.go
View file

@ -355,11 +355,6 @@ func (i *userinfo) MarshalJSON() ([]byte, error) {
} }
return json.Marshal(i.claims) return json.Marshal(i.claims)
//claims, err := json.Marshal(i.claims)
//if err != nil {
// return nil, fmt.Errorf("jws: invalid map of custom claims %v", i.claims)
//}
//return utils.ConcatenateJSON(b, claims)
} }
func (i *userinfo) UnmarshalJSON(data []byte) error { func (i *userinfo) UnmarshalJSON(data []byte) error {

4
pkg/op/discovery.go
View file

@ -26,15 +26,11 @@ func CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfigurati
TokenEndpoint: c.TokenEndpoint().Absolute(c.Issuer()), TokenEndpoint: c.TokenEndpoint().Absolute(c.Issuer()),
IntrospectionEndpoint: c.IntrospectionEndpoint().Absolute(c.Issuer()), IntrospectionEndpoint: c.IntrospectionEndpoint().Absolute(c.Issuer()),
UserinfoEndpoint: c.UserinfoEndpoint().Absolute(c.Issuer()), UserinfoEndpoint: c.UserinfoEndpoint().Absolute(c.Issuer()),
//RevocationEndpoint: c.RevocationEndpoint().Absolute(c.Issuer()),
EndSessionEndpoint: c.EndSessionEndpoint().Absolute(c.Issuer()), EndSessionEndpoint: c.EndSessionEndpoint().Absolute(c.Issuer()),
// CheckSessionIframe: c.TokenEndpoint().Absolute(c.Issuer())(c.CheckSessionIframe),
JwksURI: c.KeysEndpoint().Absolute(c.Issuer()), JwksURI: c.KeysEndpoint().Absolute(c.Issuer()),
ScopesSupported: Scopes(c), ScopesSupported: Scopes(c),
ResponseTypesSupported: ResponseTypes(c), ResponseTypesSupported: ResponseTypes(c),
//ResponseModesSupported:
GrantTypesSupported: GrantTypes(c), GrantTypesSupported: GrantTypes(c),
//ACRValuesSupported: ACRValues(c),
SubjectTypesSupported: SubjectTypes(c), SubjectTypesSupported: SubjectTypes(c),
IDTokenSigningAlgValuesSupported: SigAlgorithms(s), IDTokenSigningAlgValuesSupported: SigAlgorithms(s),
TokenEndpointAuthMethodsSupported: AuthMethodsTokenEndpoint(c), TokenEndpointAuthMethodsSupported: AuthMethodsTokenEndpoint(c),

3
pkg/utils/http.go
View file

@ -42,9 +42,6 @@ func FormRequest(endpoint string, request interface{}, encoder Encoder, authFn i
if fn, ok := authFn.(FormAuthorization); ok { if fn, ok := authFn.(FormAuthorization); ok {
fn(form) fn(form)
} }
if fn, ok := authFn.(func(url.Values)); ok {
fn(form)
}
body := strings.NewReader(form.Encode()) body := strings.NewReader(form.Encode())
req, err := http.NewRequest("POST", endpoint, body) req, err := http.NewRequest("POST", endpoint, body)
if err != nil { if err != nil {