package oidcauth import ( "context" "encoding/json" "errors" "fmt" "strings" "time" "github.com/coreos/go-oidc" "github.com/hashicorp/go-uuid" "golang.org/x/oauth2" ) var ( oidcStateTimeout = 10 * time.Minute oidcStateCleanupInterval = 1 * time.Minute ) // GetAuthCodeURL is the first part of the OIDC authorization code workflow. // The statePayload field is stored in the Authenticator instance keyed by the // "state" key so it can be returned during a future call to // ClaimsFromAuthCode. // // Requires the authenticator's config type be set to 'oidc'. func (a *Authenticator) GetAuthCodeURL(ctx context.Context, redirectURI string, statePayload interface{}) (string, error) { if a.config.authType() != authOIDCFlow { return "", fmt.Errorf("GetAuthCodeURL is incompatible with type %q", TypeJWT) } if redirectURI == "" { return "", errors.New("missing redirect_uri") } if !validRedirect(redirectURI, a.config.AllowedRedirectURIs) { return "", fmt.Errorf("unauthorized redirect_uri: %s", redirectURI) } // "openid" is a required scope for OpenID Connect flows scopes := append([]string{oidc.ScopeOpenID}, a.config.OIDCScopes...) // Configure an OpenID Connect aware OAuth2 client oauth2Config := oauth2.Config{ ClientID: a.config.OIDCClientID, ClientSecret: a.config.OIDCClientSecret, RedirectURL: redirectURI, Endpoint: a.provider.Endpoint(), Scopes: scopes, } stateID, nonce, err := a.createOIDCState(redirectURI, statePayload) if err != nil { return "", fmt.Errorf("error generating OAuth state: %v", err) } authCodeOpts := []oauth2.AuthCodeOption{ oidc.Nonce(nonce), } if len(a.config.OIDCACRValues) > 0 { authCodeOpts = append(authCodeOpts, oauth2.SetAuthURLParam("acr_values", strings.Join(a.config.OIDCACRValues, " "))) } return oauth2Config.AuthCodeURL(stateID, authCodeOpts...), nil } // ClaimsFromAuthCode is the second part of the OIDC authorization code // workflow. The interface{} return value is the statePayload previously passed // via GetAuthCodeURL. // // The error may be of type *ProviderLoginFailedError or // *TokenVerificationFailedError which can be detected via errors.As(). // // Requires the authenticator's config type be set to 'oidc'. func (a *Authenticator) ClaimsFromAuthCode(ctx context.Context, stateParam, code string) (*Claims, interface{}, error) { if a.config.authType() != authOIDCFlow { return nil, nil, fmt.Errorf("ClaimsFromAuthCode is incompatible with type %q", TypeJWT) } // TODO(sso): this could be because we ACTUALLY are getting OIDC error responses and // should handle them elsewhere! if code == "" { return nil, nil, &ProviderLoginFailedError{ Err: fmt.Errorf("OAuth code parameter not provided"), } } state := a.verifyOIDCState(stateParam) if state == nil { return nil, nil, &ProviderLoginFailedError{ Err: fmt.Errorf("Expired or missing OAuth state."), } } oidcCtx := contextWithHttpClient(ctx, a.httpClient) var oauth2Config = oauth2.Config{ ClientID: a.config.OIDCClientID, ClientSecret: a.config.OIDCClientSecret, RedirectURL: state.redirectURI, Endpoint: a.provider.Endpoint(), Scopes: []string{oidc.ScopeOpenID}, } oauth2Token, err := oauth2Config.Exchange(oidcCtx, code) if err != nil { return nil, nil, &ProviderLoginFailedError{ Err: fmt.Errorf("Error exchanging oidc code: %w", err), } } // Extract the ID Token from OAuth2 token. rawToken, ok := oauth2Token.Extra("id_token").(string) if !ok { return nil, nil, &TokenVerificationFailedError{ Err: errors.New("No id_token found in response."), } } if a.config.VerboseOIDCLogging && a.logger != nil { a.logger.Debug("OIDC provider response", "ID token", rawToken) } // Parse and verify ID Token payload. allClaims, err := a.verifyOIDCToken(ctx, rawToken) // TODO(sso): should this use oidcCtx? if err != nil { return nil, nil, &TokenVerificationFailedError{ Err: err, } } if allClaims["nonce"] != state.nonce { // TODO(sso): does this need a cast? return nil, nil, &TokenVerificationFailedError{ Err: errors.New("Invalid ID token nonce."), } } delete(allClaims, "nonce") // Attempt to fetch information from the /userinfo endpoint and merge it with // the existing claims data. A failure to fetch additional information from this // endpoint will not invalidate the authorization flow. if userinfo, err := a.provider.UserInfo(oidcCtx, oauth2.StaticTokenSource(oauth2Token)); err == nil { _ = userinfo.Claims(&allClaims) } else { if a.logger != nil { logFunc := a.logger.Warn if strings.Contains(err.Error(), "user info endpoint is not supported") { logFunc = a.logger.Info } logFunc("error reading /userinfo endpoint", "error", err) } } if a.config.VerboseOIDCLogging && a.logger != nil { if c, err := json.Marshal(allClaims); err == nil { a.logger.Debug("OIDC provider response", "claims", string(c)) } else { a.logger.Debug("OIDC provider response", "marshalling error", err.Error()) } } c, err := a.extractClaims(allClaims) if err != nil { return nil, nil, &TokenVerificationFailedError{ Err: err, } } if a.config.VerboseOIDCLogging && a.logger != nil { a.logger.Debug("OIDC provider response", "extracted_claims", c) } return c, state.payload, nil } // ProviderLoginFailedError is an error type sometimes returned from // ClaimsFromAuthCode(). // // It represents a failure to complete the authorization code workflow with the // provider such as losing important OIDC parameters or a failure to fetch an // id_token. // // You can check for it with errors.As(). type ProviderLoginFailedError struct { Err error } func (e *ProviderLoginFailedError) Error() string { return fmt.Sprintf("Provider login failed: %v", e.Err) } func (e *ProviderLoginFailedError) Unwrap() error { return e.Err } // TokenVerificationFailedError is an error type sometimes returned from // ClaimsFromAuthCode(). // // It represents a failure to vet the returned OIDC credentials for validity // such as the id_token not passing verification or using an mismatched nonce. // // You can check for it with errors.As(). type TokenVerificationFailedError struct { Err error } func (e *TokenVerificationFailedError) Error() string { return fmt.Sprintf("Token verification failed: %v", e.Err) } func (e *TokenVerificationFailedError) Unwrap() error { return e.Err } func (a *Authenticator) verifyOIDCToken(ctx context.Context, rawToken string) (map[string]interface{}, error) { allClaims := make(map[string]interface{}) oidcConfig := &oidc.Config{ SupportedSigningAlgs: a.config.JWTSupportedAlgs, } switch a.config.authType() { case authOIDCFlow: oidcConfig.ClientID = a.config.OIDCClientID case authOIDCDiscovery: oidcConfig.SkipClientIDCheck = true default: return nil, fmt.Errorf("unsupported auth type for this verifyOIDCToken: %d", a.config.authType()) } verifier := a.provider.Verifier(oidcConfig) idToken, err := verifier.Verify(ctx, rawToken) if err != nil { return nil, fmt.Errorf("error validating signature: %v", err) } if err := idToken.Claims(&allClaims); err != nil { return nil, fmt.Errorf("unable to successfully parse all claims from token: %v", err) } // TODO(sso): why isn't this strict for OIDC? if err := validateAudience(a.config.BoundAudiences, idToken.Audience, false); err != nil { return nil, fmt.Errorf("error validating claims: %v", err) } return allClaims, nil } // verifyOIDCState tests whether the provided state ID is valid and returns the // associated state object if so. A nil state is returned if the ID is not found // or expired. The state should only ever be retrieved once and is deleted as // part of this request. func (a *Authenticator) verifyOIDCState(stateID string) *oidcState { defer a.oidcStates.Delete(stateID) if stateRaw, ok := a.oidcStates.Get(stateID); ok { return stateRaw.(*oidcState) } return nil } // createOIDCState make an expiring state object, associated with a random state ID // that is passed throughout the OAuth process. A nonce is also included in the // auth process, and for simplicity will be identical in length/format as the state ID. func (a *Authenticator) createOIDCState(redirectURI string, payload interface{}) (string, string, error) { // Get enough bytes for 2 160-bit IDs (per rfc6749#section-10.10) bytes, err := uuid.GenerateRandomBytes(2 * 20) if err != nil { return "", "", err } stateID := fmt.Sprintf("%x", bytes[:20]) nonce := fmt.Sprintf("%x", bytes[20:]) a.oidcStates.SetDefault(stateID, &oidcState{ nonce: nonce, redirectURI: redirectURI, payload: payload, }) return stateID, nonce, nil } // oidcState is created when an authURL is requested. The state // identifier is passed throughout the OAuth process. type oidcState struct { nonce string redirectURI string payload interface{} }