git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/providers/dtt_sso.go
202 lines 5.9 kB history raw
1package providers
3import (
4 "bytes"
5 "context"
6 "encoding/base64"
7 "errors"
8 "fmt"
9 "net/http"
10 "net/url"
11 "time"
13 "github.com/golang-jwt/jwt/v5"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
18// DTTSSOProvider signs users in with the DTT SSO (auth-server).
19type DTTSSOProvider struct {
20 *ProviderData
23var _ Provider = (*DTTSSOProvider)(nil)
25const (
26 dttSSOProviderName = "DTT SSO"
27 dttSSODefaultScope = "openid"
30var (
31 dttSSODefaultLoginURL = &url.URL{
32 Scheme: "https",
33 Host: "auth.thebestagent.pro",
34 Path: "/oauth/authorize",
35 }
37 dttSSODefaultRedeemURL = &url.URL{
38 Scheme: "https",
39 Host: "auth.thebestagent.pro",
40 Path: "/oauth/token",
41 }
43 dttSSODefaultValidateURL = &url.URL{
44 Scheme: "https",
45 Host: "auth.thebestagent.pro",
46 Path: "/oauth/check_token",
47 }
50// NewDTTSSOProvider initiates a new DTTSSOProvider
51func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {
52 p.setProviderDefaults(providerDefaults{
53 name: dttSSOProviderName,
54 loginURL: dttSSODefaultLoginURL,
55 redeemURL: dttSSODefaultRedeemURL,
56 profileURL: nil,
57 validateURL: dttSSODefaultValidateURL,
58 scope: dttSSODefaultScope,
59 })
60 return &DTTSSOProvider{ProviderData: p}
63// dttSSOTokenResponse is the SSO's /oauth/token response.
64type dttSSOTokenResponse struct {
65 AccessToken string `json:"access_token"`
66 RefreshToken string `json:"refresh_token"`
67 ExpiresIn int64 `json:"expires_in"`
68 IDToken string `json:"id_token"`
71// dttSSOClaims holds the id_token claims the provider uses.
72type dttSSOClaims struct {
73 jwt.RegisteredClaims
74 Email string `json:"email"`
75 Role string `json:"role"`
76 UserID string `json:"user_id"`
79// Redeem exchanges the authorization code for a session.
80func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {
81 if code == "" {
82 return nil, ErrMissingCode
83 }
84 return p.requestTokens(ctx, url.Values{
85 "grant_type": {"authorization_code"},
86 "code": {code},
87 "redirect_uri": {redirectURL},
88 })
91// RefreshSession renews the tokens and re-reads the email and role.
92func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {
93 if s == nil || s.RefreshToken == "" {
94 return false, nil
95 }
96 refreshed, err := p.requestTokens(ctx, url.Values{
97 "grant_type": {"refresh_token"},
98 "refresh_token": {s.RefreshToken},
99 })
100 if err != nil {
101 return false, fmt.Errorf("unable to redeem refresh token: %v", err)
102 }
103 s.AccessToken = refreshed.AccessToken
104 s.RefreshToken = refreshed.RefreshToken
105 s.IDToken = refreshed.IDToken
106 s.Email = refreshed.Email
107 s.User = refreshed.User
108 s.Groups = refreshed.Groups
109 s.CreatedAt = refreshed.CreatedAt
110 s.ExpiresOn = refreshed.ExpiresOn
111 return true, nil
114// ValidateSession checks the access token with the SSO's check_token endpoint.
115func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
116 return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
119// requestTokens calls the token endpoint and builds a session from the verified id_token.
120//
121// The SSO compares the Basic credentials byte for byte, so they are sent unescaped
122// rather than through golang.org/x/oauth2, which URL-escapes them.
123func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {
124 clientSecret, err := p.GetClientSecret()
125 if err != nil {
126 return nil, err
127 }
128 credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))
130 result := requests.New(p.RedeemURL.String()).
131 WithContext(ctx).
132 WithMethod(http.MethodPost).
133 WithBody(bytes.NewBufferString(params.Encode())).
134 SetHeader("Content-Type", "application/x-www-form-urlencoded").
135 SetHeader("Authorization", "Basic "+credentials).
136 Do()
137 if result.Error() != nil {
138 return nil, result.Error()
139 }
140 if result.StatusCode() != http.StatusOK {
141 return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())
142 }
144 var token dttSSOTokenResponse
145 if err := result.UnmarshalInto(&token); err != nil {
146 return nil, err
147 }
148 if token.AccessToken == "" {
149 return nil, errors.New("token response carried no access_token")
150 }
151 claims, err := p.verifyIDToken(token.IDToken, clientSecret)
152 if err != nil {
153 return nil, err
154 }
156 s := &sessions.SessionState{
157 AccessToken: token.AccessToken,
158 RefreshToken: token.RefreshToken,
159 IDToken: token.IDToken,
160 Email: claims.Email,
161 User: claims.UserID,
162 }
163 if claims.Role != "" {
164 s.Groups = []string{claims.Role}
165 }
166 s.CreatedAtNow()
167 if token.ExpiresIn > 0 {
168 s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)
169 }
170 return s, nil
173// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),
174// issuer, audience and expiry.
175//
176// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets
177// can be shorter.
178func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {
179 if raw == "" {
180 return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")
181 }
182 var claims dttSSOClaims
183 _, err := jwt.ParseWithClaims(raw, &claims,
184 func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },
185 jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
186 jwt.WithIssuer(p.issuer()),
187 jwt.WithAudience(p.ClientID),
188 jwt.WithExpirationRequired(),
189 )
190 if err != nil {
191 return nil, fmt.Errorf("verifying id_token: %v", err)
192 }
193 if claims.Email == "" {
194 return nil, errors.New("id_token carries no email")
195 }
196 return &claims, nil
199// issuer is the SSO's site host, the origin of the login URL.
200func (p *DTTSSOProvider) issuer() string {
201 return p.LoginURL.Scheme + "://" + p.LoginURL.Host