cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: aud

Browse source
This commit is contained in:
adlerhurst 2020-09-10 16:24:48 +02:00
parent 9d8fc4fe8a
commit a731a46ccf
4 changed files with 17 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

1
pkg/op/storage.go
View file

@ -31,6 +31,7 @@ type OPStorage interface {
GetUserinfoFromScopes(context.Context, string, []string) (*oidc.Userinfo, error)
GetUserinfoFromToken(context.Context, string, string) (*oidc.Userinfo, error)
GetKeysByServiceAccount(ctx context.Context, id string) (*jose.JSONWebKeySet, error)
GetKeyByID(ctx context.Context, keyID string) (*jose.JSONWebKeySet, error)
}
type Storage interface {

14
pkg/op/tokenrequest.go
View file

@ -126,6 +126,7 @@ func AuthorizeCodeChallenge(ctx context.Context, tokenReq *oidc.AccessTokenReque
type ClientJWTVerifier struct {
claims *oidc.JWTTokenRequest
storage Storage
issuer string
}
func (c ClientJWTVerifier) Storage() Storage {
@ -137,7 +138,7 @@ func (c ClientJWTVerifier) Issuer() string {
}
func (c ClientJWTVerifier) ClientID() string {
return c.claims.Issuer
return c.issuer
}
func (c ClientJWTVerifier) SupportedSignAlgs() []string {
@ -173,7 +174,7 @@ func JWTExchange(w http.ResponseWriter, r *http.Request, exchanger VerifyExchang
RequestError(w, r, err)
}
claims, err := VerifyJWTAssertion(r.Context(), assertion, exchanger.Storage())
claims, err := VerifyJWTAssertion(r.Context(), assertion, exchanger)
if err != nil {
RequestError(w, r, err)
return
@ -192,9 +193,10 @@ type JWTAssertionVerifier interface {
oidc.Verifier
}
func VerifyJWTAssertion(ctx context.Context, assertion string, storage Storage) (*oidc.JWTTokenRequest, error) {
func VerifyJWTAssertion(ctx context.Context, assertion string, exchanger Exchanger) (*oidc.JWTTokenRequest, error) {
verifier := &ClientJWTVerifier{
storage: storage,
storage: exchanger.Storage(),
issuer: exchanger.Issuer(),
claims: new(oidc.JWTTokenRequest),
}
payload, err := oidc.ParseToken(assertion, verifier.claims)
@ -219,7 +221,7 @@ func VerifyJWTAssertion(ctx context.Context, assertion string, storage Storage)
}
verifier.Storage().GetClientByClientID(ctx, verifier.claims.Subject)
keySet := &ClientAssertionKeySet{storage, verifier.claims.Subject}
keySet := &ClientAssertionKeySet{exchanger.Storage(), verifier.claims.Subject}
if err = oidc.CheckSignature(ctx, assertion, payload, verifier.claims, nil, keySet); err != nil {
return nil, err
@ -238,7 +240,7 @@ func (c *ClientAssertionKeySet) VerifySignature(ctx context.Context, jws *jose.J
keyID = sig.Header.KeyID
break
}
keySet, err := c.Storage.GetKeysByServiceAccount(ctx, c.id)
keySet, err := c.Storage.GetKeyByID(ctx, keyID)
if err != nil {
return nil, errors.New("error fetching keys")
}