Merge remote-tracking branch 'origin/service-accounts' into service-accounts

pkg/oidc/authorization.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"golang.org/x/text/language"
+	"gopkg.in/square/go-jose.v2"
 )
 
 const (
@@ -152,7 +153,7 @@ type JWTTokenRequest struct {
 	Issuer    string   `json:"iss"`
 	Subject   string   `json:"sub"`
 	Scopes    Scopes   `json:"scope"`
-	Audience  string `json:"aud"`
+	Audience  []string `json:"aud"`
 	IssuedAt  Time     `json:"iat"`
 	ExpiresAt Time     `json:"exp"`
 }
@@ -185,7 +186,7 @@ func (j *JWTTokenRequest) GetIssuer() string {
 }
 
 func (j *JWTTokenRequest) GetAudience() []string {
-	return []string{j.Audience}
+	return j.Audience
 }
 
 func (j *JWTTokenRequest) GetExpiration() time.Time {
@@ -212,6 +213,8 @@ func (j *JWTTokenRequest) GetAuthorizedParty() string {
 	return ""
 }
 
+func (j *JWTTokenRequest) SetSignature(algorithm jose.SignatureAlgorithm) {}
+
 type TokenExchangeRequest struct {
 	subjectToken       string   `schema:"subject_token"`
 	subjectTokenType   string   `schema:"subject_token_type"`

pkg/op/default_op.go

@@ -238,6 +238,10 @@ func (p *DefaultOP) HandleDiscovery(w http.ResponseWriter, r *http.Request) {
 	Discover(w, CreateDiscoveryConfig(p, p.Signer()))
 }
 
+func (p *DefaultOP) Probes() []ProbesFn {
+	return nil
+}
+
 func (p *DefaultOP) VerifySignature(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) {
 	keyID := ""
 	for _, sig := range jws.Signatures {

pkg/op/storage.go

@@ -30,6 +30,7 @@ type OPStorage interface {
 	AuthorizeClientIDSecret(context.Context, string, string) error
 	GetUserinfoFromScopes(context.Context, string, []string) (*oidc.Userinfo, error)
 	GetUserinfoFromToken(context.Context, string, string) (*oidc.Userinfo, error)
+	GetKeysByServiceAccount(ctx context.Context, id string) (*jose.JSONWebKeySet, error)
 }
 
 type Storage interface {

pkg/op/tokenrequest.go

@@ -145,19 +145,19 @@ func AuthorizeCodeChallenge(ctx context.Context, tokenReq *oidc.AccessTokenReque
 
 type ClientJWTVerifier struct {
 	claims  *oidc.JWTTokenRequest
-	Storage
+	storage Storage
 }
 
 func (c ClientJWTVerifier) Storage() Storage {
-	panic("implement me")
+	return c.storage
 }
 
 func (c ClientJWTVerifier) Issuer() string {
-	panic("implement me")
+	return c.claims.Issuer
 }
 
 func (c ClientJWTVerifier) ClientID() string {
-	panic("implement me")
+	return c.claims.Issuer
 }
 
 func (c ClientJWTVerifier) SupportedSignAlgs() []string {
@@ -165,7 +165,8 @@ func (c ClientJWTVerifier) SupportedSignAlgs() []string {
 }
 
 func (c ClientJWTVerifier) KeySet() oidc.KeySet {
-	return c.claims
+	// return c.claims
+	return nil
 }
 
 func (c ClientJWTVerifier) ACR() oidc.ACRVerifier {
@@ -177,11 +178,13 @@ func (c ClientJWTVerifier) MaxAge() time.Duration {
 }
 
 func (c ClientJWTVerifier) MaxAgeIAT() time.Duration {
-	panic("implement me")
+	//TODO: define in conf/opts
+	return 1 * time.Hour
 }
 
 func (c ClientJWTVerifier) Offset() time.Duration {
-	panic("implement me")
+	//TODO: define in conf/opts
+	return time.Second
 }
 
 func JWTExchange(w http.ResponseWriter, r *http.Request, exchanger VerifyExchanger) {
@@ -189,12 +192,11 @@ func JWTExchange(w http.ResponseWriter, r *http.Request, exchanger VerifyExchang
 	if err != nil {
 		RequestError(w, r, err)
 	}
-	claims := new(oidc.JWTTokenRequest)
+
-	//var keyset oidc.KeySet
+	claims, err := VerifyJWTAssertion(r.Context(), assertion, exchanger.Storage())
-	verifier := new(ClientJWTVerifier)
-	req, err := VerifyJWTAssertion(r.Context(), assertion, verifier)
 	if err != nil {
 		RequestError(w, r, err)
+		return
 	}
 
 	resp, err := CreateJWTTokenResponse(r.Context(), claims, exchanger)
@@ -210,24 +212,39 @@ type JWTAssertionVerifier interface {
 	oidc.Verifier
 }
 
-func VerifyJWTAssertion(ctx context.Context, assertion string, v JWTAssertionVerifier) (*oidc.JWTTokenRequest, error) {
+func VerifyJWTAssertion(ctx context.Context, assertion string, storage Storage) (*oidc.JWTTokenRequest, error) {
-	claims := new(oidc.JWTTokenRequest)
+	verifier := &ClientJWTVerifier{
-	payload, err := oidc.ParseToken(assertion, claims)
+		storage: storage,
-
+		claims:  new(oidc.JWTTokenRequest),
-	oidc.CheckAudience(claims.Audience, v)
+	}
-
+	payload, err := oidc.ParseToken(assertion, verifier.claims)
-	oidc.CheckExpiration(claims.ExpiresAt, v)
+	if err != nil {
-
+		return nil, err
-	oidc.CheckIssuedAt(claims.IssuedAt, v)
-
-	if claims.Issuer != claims.Subject {
-
 	}
-	v.Storage().GetClientByClientID(ctx, claims.Issuer)
 
-	keySet := &ClientAssertionKeySet{v.Storage(), claims.Issuer}
+	if err = oidc.CheckAudience(verifier.claims.GetAudience(), verifier); err != nil {
+		return nil, err
+	}
 
-	oidc.CheckSignature(ctx, assertion, payload, claims, nil, keySet)
+	if err = oidc.CheckExpiration(verifier.claims.GetExpiration(), verifier); err != nil {
+		return nil, err
+	}
+
+	if err = oidc.CheckIssuedAt(verifier.claims.GetIssuedAt(), verifier); err != nil {
+		return nil, err
+	}
+
+	if verifier.claims.Issuer != verifier.claims.Subject {
+		//TODO: implement delegation (openid core / oauth rfc)
+	}
+	verifier.Storage().GetClientByClientID(ctx, verifier.claims.Subject)
+
+	keySet := &ClientAssertionKeySet{storage, verifier.claims.Subject}
+
+	if err = oidc.CheckSignature(ctx, assertion, payload, verifier.claims, nil, keySet); err != nil {
+		return nil, err
+	}
+	return verifier.claims, nil
 }
 
 type ClientAssertionKeySet struct {
@@ -241,7 +258,7 @@ func (c *ClientAssertionKeySet) VerifySignature(ctx context.Context, jws *jose.J
 		keyID = sig.Header.KeyID
 		break
 	}
-	keySet, err := c.Storage.GetKeysByServiceAccount(id)
+	keySet, err := c.Storage.GetKeysByServiceAccount(ctx, c.id)
 	if err != nil {
 		return nil, errors.New("error fetching keys")
 	}