cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
343 commits 8 branches 227 tags 3.4 MiB
Commit graph

40 commits

Author SHA1 Message Date
David Sharnoff
34fee029d9 Add an additional, optional, op.Storage interface so that refresh tokens 
that are not JWTs do not cause failures when they randomly, sometimes, decrypt
without error

```go
// CanRefreshTokenInfo is an optional additional interface that Storage can support.
// Supporting CanRefreshTokenInfo is required to be able to revoke a refresh token that
// does not happen to also be a JWTs work properly.
type CanRefreshTokenInfo interface {
        // GetRefreshTokenInfo must return oidc.ErrInvalidRefreshToken when presented
	// with a token that is not a refresh token.
	GetRefreshTokenInfo(ctx context.Context, clientID string, token string) (userID string, tokenID string, err error)
}
```
 2022-11-14 14:09:00 -08:00
David Sharnoff
763d69b4ca feat: add rp.RevokeToken 2022-10-24 12:50:39 -07:00
David Sharnoff
0d721d937e
chore: adjustments to comments for things found while implementing Storage 2022-09-30 07:18:08 +02:00
David Sharnoff
0b4d62c745
chore: add comments documenting Storage and AuthStorage (#193) 
* add comments documenting Storage and AuthStorage

* JWTTokenRequest is a pointer

* note that token strings are actually tokenIDs

* review feedback

* remove suggestion that CreateAccessToken could be called with retrun from AuthStorage.TokenRequestByRefreshToken
 2022-08-05 10:54:40 +02:00
Livio Spring
53ede2ee8c
fix: use default redirect uri when not passed on end_session endpoint (#201) 2022-07-27 08:36:43 +02:00
James Batt
86fd502434
feat(op): implemented support for client_credentials grant (#172) 
* implemented support for client_credentials grant

* first draft

* Update pkg/op/token_client_credentials.go

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* updated placeholder interface name

* updated import paths

* ran mockgen

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
 2022-05-09 15:06:54 +02:00
Florian Forster
550f7877f2
fix: move to new org (#177) 
* chore: move to new org

* chore: change import

* fix: update logging lib

Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
 2022-04-26 23:48:29 +02:00
Livio Amstutz
eb10752e48
feat: Token Revocation, Request Object and OP Certification (#130) 
FEATURES (and FIXES):
- support OAuth 2.0 Token Revocation [RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009)
- handle request object using `request` parameter [OIDC Core 1.0 Request Object](https://openid.net/specs/openid-connect-core-1_0.html#RequestObject)
- handle response mode
- added some information to the discovery endpoint:
  - revocation_endpoint (added with token revocation) 
  - revocation_endpoint_auth_methods_supported (added with token revocation)
  - revocation_endpoint_auth_signing_alg_values_supported (added with token revocation)
  - token_endpoint_auth_signing_alg_values_supported (was missing)
  - introspection_endpoint_auth_signing_alg_values_supported (was missing)
  - request_object_signing_alg_values_supported (added with request object)
  - request_parameter_supported (added with request object)
 - fixed `removeUserinfoScopes ` now returns the scopes without "userinfo" scopes (profile, email, phone, addedd) [source diff](https://github.com/caos/oidc/pull/130/files#diff-fad50c8c0f065d4dbc49d6c6a38f09c992c8f5d651a479ba00e31b500543559eL170-R171)
- improved error handling (pkg/oidc/error.go) and fixed some wrong OAuth errors (e.g. `invalid_grant` instead of `invalid_request`)
- improved MarshalJSON and added MarshalJSONWithStatus
- removed deprecated PEM decryption from `BytesToPrivateKey`  [source diff](https://github.com/caos/oidc/pull/130/files#diff-fe246e428e399ccff599627c71764de51387b60b4df84c67de3febd0954e859bL11-L19)
- NewAccessTokenVerifier now uses correct (internal) `accessTokenVerifier` [source diff](https://github.com/caos/oidc/pull/130/files#diff-3a01c7500ead8f35448456ef231c7c22f8d291710936cac91de5edeef52ffc72L52-R52)

BREAKING CHANGE:
- move functions from `utils` package into separate packages
- added various methods to the (OP) `Configuration` interface [source diff](https://github.com/caos/oidc/pull/130/files#diff-2538e0dfc772fdc37f057aecd6fcc2943f516c24e8be794cce0e368a26d20a82R19-R32)
- added revocationEndpoint to `WithCustomEndpoints ` [source diff](https://github.com/caos/oidc/pull/130/files#diff-19ae13a743eb7cebbb96492798b1bec556673eb6236b1387e38d722900bae1c3L355-R391)
- remove unnecessary context parameter from JWTProfileExchange [source diff](https://github.com/caos/oidc/pull/130/files#diff-4ed8f6affa4a9631fa8a034b3d5752fbb6a819107141aae00029014e950f7b4cL14)
 2021-11-02 13:21:35 +01:00
Livio Amstutz
400f5c4de4
fix: parse max_age and prompt correctly (and change scope type) (#105) 
* fix: parse max_age and prompt correctly (and change scope type)

* remove unnecessary omitempty
 2021-06-16 08:34:01 +02:00
Livio Amstutz
2a11a1979e rename storage methods and fix mocks 2021-05-11 10:48:11 +02:00
Livio Amstutz
5119d7aea3 begin refresh token 2021-04-29 09:20:01 +02:00
Livio Amstutz
1049c44c3e Merge remote-tracking branch 'origin/token-introspection' into signingkey 
# Conflicts:
#	pkg/op/mock/storage.mock.go
#	pkg/op/storage.go
 2021-02-12 13:02:04 +01:00
Livio Amstutz
0ca2370d48 refactoring 2021-02-11 17:38:58 +01:00
Livio Amstutz
138da8a208 introspect 2021-02-10 16:42:01 +01:00
Livio Amstutz
345fc7e837 token introspection 2021-02-03 10:42:01 +01:00
Livio Amstutz
960be5af1f introspect and client assertion 2021-02-01 17:17:40 +01:00
Livio Amstutz
50ab51bb46 introspect and client assertion 2021-01-28 08:41:36 +01:00
Livio Amstutz
a1a21f0d59 introspect 2021-01-08 15:01:23 +01:00
Livio Amstutz
3acc62e79e cleanup 2020-10-20 07:39:36 +02:00
Livio Amstutz
06dcac4c2f fix: remove signing key creation (when not found) 2020-10-19 15:26:34 +02:00
Livio Amstutz
736d6902d9 solve PR issues 2020-10-15 15:23:33 +02:00
Livio Amstutz
8be8306511 Merge branch 'master' into serializing 
# Conflicts:
#	example/internal/mock/storage.go
#	pkg/op/mock/storage.mock.go
#	pkg/op/storage.go
 2020-10-15 11:19:20 +02:00
Fabi
9943f20215
feat: bearer access token includes tokenid and subject (#62) 2020-10-15 09:38:06 +02:00
Livio Amstutz
b8d892443c claims assertion 2020-10-14 16:41:04 +02:00
Livio Amstutz
b311610d06 feat: check allowed scopes (and pass clientID to GetUserinfoFromScopes) 2020-10-07 08:44:26 +02:00
Livio Amstutz
542ec6ed7b refactoring 2020-09-25 16:41:25 +02:00
Livio Amstutz
a56a4a018a harmonize jwtProfile and existing interfaces / functions 2020-09-15 16:59:27 +02:00
adlerhurst
17a72ccc97 fix: storage interface 2020-09-10 18:31:53 +02:00
adlerhurst
a731a46ccf fix: aud 2020-09-10 16:24:48 +02:00
adlerhurst
7700cb3539 fix: implement storage 2020-09-10 15:43:21 +02:00
Livio Amstutz
a37a8461a5 lot of unfinished changes 2020-09-08 16:07:49 +02:00
Livio Amstutz
6e71c17f1d pass origin into GetUserinfoFromToken 2020-08-24 07:52:22 +02:00
Livio Amstutz
58545a1710
fix: handle code separately (#30) 2020-05-29 09:40:34 +02:00
livio-a
a8d10945d8
feat: preselect user with id_token_hint (#16) 
* feat: preselect user with id_token_hint

* fix tests
 2020-03-11 09:41:54 +01:00
livio-a
2b9f7dfd18
Fix: userinfo (#15) 
* add idea to gitignore

* working userinfo

* cleanup

* tests
 2020-03-06 17:14:30 +01:00
Livio Amstutz
e8f3010910 feat: terminate session (front channel logout) 2020-03-03 11:31:23 +01:00
Livio Amstutz
5e7e5ebe3a fix: create access token from storage 2020-02-27 17:06:32 +01:00
Livio Amstutz
a2e2f064a2 fix: change channel for GetSigningKey to time 2020-02-14 12:54:26 +01:00
Livio Amstutz
93709a18b6 add readiness and partial key rotation 2020-02-11 17:17:09 +01:00
Livio Amstutz
6d0890e280 initial commit 2020-01-31 15:22:16 +01:00