git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/providers/ms_entra_id.go
326 lines 11 kB history raw
1package providers
3import (
4 "bytes"
5 "context"
6 "encoding/json"
7 "fmt"
8 "net/http"
9 "net/url"
10 "os"
11 "regexp"
12 "time"
14 "github.com/coreos/go-oidc/v3/oidc"
15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
18 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
19 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
20 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
21 "github.com/spf13/cast"
22 "golang.org/x/oauth2"
25// MicrosoftEntraIDProvider represents provider for Azure Entra Authentication V2 endpoint
26type MicrosoftEntraIDProvider struct {
27 *OIDCProvider
28 multiTenantAllowedTenants []string
29 federatedTokenAuth bool
31 microsoftGraphURL *url.URL
34const (
35 microsoftEntraIDProviderName = "Microsoft Entra ID"
38var (
39 microsoftGraphURL = &url.URL{
40 Scheme: "https",
41 Host: "graph.microsoft.com",
42 Path: "/v1.0/me",
43 }
46// NewMicrosoftEntraIDProvider initiates a new MicrosoftEntraIDProvider
47func NewMicrosoftEntraIDProvider(p *ProviderData, opts options.Provider) *MicrosoftEntraIDProvider {
48 p.setProviderDefaults(providerDefaults{
49 name: microsoftEntraIDProviderName,
50 })
52 return &MicrosoftEntraIDProvider{
53 OIDCProvider: NewOIDCProvider(p, opts.OIDCConfig),
55 multiTenantAllowedTenants: opts.MicrosoftEntraIDConfig.AllowedTenants,
56 federatedTokenAuth: ptr.Deref(opts.MicrosoftEntraIDConfig.FederatedTokenAuth, options.DefaultMicrosoftEntraIDUseFederatedToken),
57 microsoftGraphURL: microsoftGraphURL,
58 }
61// EnrichSession checks for group overage after calling generic EnrichSession
62func (p *MicrosoftEntraIDProvider) EnrichSession(ctx context.Context, session *sessions.SessionState) error {
63 if err := p.OIDCProvider.EnrichSession(ctx, session); err != nil {
64 return fmt.Errorf("unable to enrich session: %v", err)
65 }
67 hasGroupOverage, err := p.checkGroupOverage(session)
68 if err != nil {
69 return fmt.Errorf("unable to check token: %v", err)
70 }
72 if hasGroupOverage {
73 logger.Printf("entra overage found, reading groups from Graph API")
74 if err = p.addGraphGroupsToSession(ctx, session); err != nil {
75 return fmt.Errorf("unable to enrich session: %v", err)
76 }
77 }
79 return nil
82// ValidateSession checks for allowed tenants (e.g. for multi-tenant apps) and passes through to generic ValidateSession
83func (p *MicrosoftEntraIDProvider) ValidateSession(ctx context.Context, session *sessions.SessionState) bool {
84 tenant, err := p.getTenantFromToken(session)
85 if err != nil {
86 logger.Errorf("unable to retrieve entra tenant from token: %v", err)
87 return false
88 }
90 if len(p.multiTenantAllowedTenants) > 0 {
91 tenantAllowed := p.checkTenantMatchesTenantList(tenant, p.multiTenantAllowedTenants)
92 if !tenantAllowed {
93 logger.Printf("entra: tenant %s is not specified in the list of allowed tenants", tenant)
94 return false
95 }
96 logger.Printf("entra: tenant %s is allowed", tenant)
97 }
99 return p.OIDCProvider.ValidateSession(ctx, session)
102// Redeem exchanges the OAuth2 authentication token for an ID token, considering federated token authentication
103func (p *MicrosoftEntraIDProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {
104 if p.federatedTokenAuth {
105 return p.redeemWithFederatedToken(ctx, redirectURL, code, codeVerifier)
106 }
108 return p.OIDCProvider.Redeem(ctx, redirectURL, code, codeVerifier)
111// redeemWithFederatedToken performs custom token exchange with federated token instead of client secret
112func (p *MicrosoftEntraIDProvider) redeemWithFederatedToken(ctx context.Context, redirectURL, code, codeVerifier string) (*sessions.SessionState, error) {
113 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
114 // #nosec G703 -- AZURE_FEDERATED_TOKEN_FILE is set by the operator, not user input
115 federatedToken, err := os.ReadFile(federatedTokenPath)
116 if err != nil {
117 return nil, fmt.Errorf("error reading federated token file %s: %s", federatedTokenPath, err)
118 }
120 params := url.Values{}
122 // Exchange parameters for token federation
123 // https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-access-token-with-a-certificate-credential
124 if codeVerifier != "" {
125 params.Add("code_verifier", codeVerifier)
126 }
127 params.Add("redirect_uri", redirectURL)
128 params.Add("client_id", p.ClientID)
129 params.Add("client_assertion", string(federatedToken))
130 params.Add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
131 params.Add("code", code)
132 params.Add("grant_type", "authorization_code")
134 token, err := p.fetchToken(ctx, params)
135 if err != nil {
136 return nil, fmt.Errorf("error fetching token: %w", err)
137 }
139 return p.OIDCProvider.createSession(ctx, token, false)
142// RefreshSession uses the RefreshToken to fetch new Access and ID Tokens
143func (p *MicrosoftEntraIDProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {
144 if s == nil || s.RefreshToken == "" {
145 return false, nil
146 }
148 var err error
149 ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)
150 if p.federatedTokenAuth {
151 err = p.redeemRefreshTokenWithFederatedToken(ctx, s)
152 } else {
153 err = p.redeemRefreshToken(ctx, s)
154 }
156 if err != nil {
157 return false, fmt.Errorf("unable to redeem refresh token: %v", err)
158 }
160 return true, nil
163// redeemRefreshTokenWithFederatedToken uses a RefreshToken and federated credentials with the RedeemURL to refresh the
164// Refresh Token, Access Token and ID Token
165func (p *MicrosoftEntraIDProvider) redeemRefreshTokenWithFederatedToken(ctx context.Context, s *sessions.SessionState) error {
166 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
167 // #nosec G703 -- AZURE_FEDERATED_TOKEN_FILE is set by the operator, not user input
168 federatedToken, err := os.ReadFile(federatedTokenPath)
169 if err != nil {
170 return fmt.Errorf("error reading federated token file %s: %s", federatedTokenPath, err)
171 }
173 params := url.Values{}
174 params.Add("client_id", p.ClientID)
175 params.Add("client_assertion", string(federatedToken))
176 params.Add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
177 params.Add("refresh_token", s.RefreshToken)
178 params.Add("grant_type", "refresh_token")
179 params.Add("expiry", time.Now().Add(-time.Hour).Format(time.RFC3339))
181 token, err := p.fetchToken(ctx, params)
182 if err != nil {
183 return fmt.Errorf("error fetching token: %w", err)
184 }
186 newSession, err := p.OIDCProvider.createSession(ctx, token, true)
187 if err != nil {
188 return fmt.Errorf("unable create new session state from response: %v", err)
189 }
191 // Update the ID Token and user details if returned as part of the refresh response
192 // ref. https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse
193 if newSession.IDToken != "" {
194 s.IDToken = newSession.IDToken
195 s.Email = newSession.Email
196 s.User = newSession.User
197 s.Groups = newSession.Groups
198 s.PreferredUsername = newSession.PreferredUsername
199 }
201 s.AccessToken = newSession.AccessToken
202 s.RefreshToken = newSession.RefreshToken
203 s.CreatedAt = newSession.CreatedAt
204 s.ExpiresOn = newSession.ExpiresOn
206 return nil
209// checkGroupOverage checks ID token's group membership claims for the group overage
210func (p *MicrosoftEntraIDProvider) checkGroupOverage(session *sessions.SessionState) (bool, error) {
211 extractor, err := p.getClaimExtractor(session.IDToken, session.AccessToken)
212 if err != nil {
213 return false, fmt.Errorf("unable to get claim extractor: %v", err)
214 }
216 claimNames, _, _ := extractor.GetClaim("_claim_names")
218 var claimNamesMap map[string]string
220 if claimNames != nil {
221 claimNamesMap = cast.ToStringMapString(claimNames)
222 }
224 if _, groupsKeyPresent := claimNamesMap["groups"]; groupsKeyPresent {
225 return true, nil
226 }
228 return false, nil
231func (p *MicrosoftEntraIDProvider) addGraphGroupsToSession(ctx context.Context, s *sessions.SessionState) error {
232 groupsHeaders := makeAuthorizationHeader(tokenTypeBearer, s.AccessToken, nil)
233 groupsHeaders.Add("ConsistencyLevel", "eventual")
235 var allGroups []string
236 var nextLink string
238 for {
239 if nextLink == "" {
240 nextLink = fmt.Sprintf("%s/transitiveMemberOf?$select=id&$top=100", p.microsoftGraphURL)
241 }
243 response, err := requests.New(nextLink).
244 WithContext(ctx).
245 WithHeaders(groupsHeaders).
246 Do().
247 UnmarshalSimpleJSON()
249 if err != nil {
250 logger.Errorf("invalid response from microsoft graph, no groups added to session: %v", err)
251 return nil
252 }
253 reqGroups := response.Get("value").MustArray()
255 for i := range reqGroups {
256 value := response.Get("value").GetIndex(i).Get("id").MustString()
257 allGroups = append(allGroups, value)
258 }
260 // https://learn.microsoft.com/en-us/graph/paging?view=graph-rest-1.0&tabs=http#how-paging-works
261 nextLink = response.Get("@odata.nextLink").MustString()
263 if nextLink == "" {
264 break
265 }
266 }
268 s.Groups = util.RemoveDuplicateStr(append(s.Groups, allGroups...))
269 return nil
272func (p *MicrosoftEntraIDProvider) getTenantFromToken(session *sessions.SessionState) (string, error) {
273 extractor, err := p.getClaimExtractor(session.IDToken, session.AccessToken)
274 if err != nil {
275 return "", fmt.Errorf("unable to get claim extractor: %v", err)
276 }
278 value, exists, err := extractor.GetClaim("iss")
280 if !exists || err != nil {
281 return "", fmt.Errorf("iss claim does not exist in the token")
282 }
284 pattern := `^https://login\.microsoftonline\.com/([a-zA-Z0-9-]+)/v2\.0$`
285 re := regexp.MustCompile(pattern)
287 matches := re.FindStringSubmatch(value.(string))
289 if len(matches) > 1 {
290 return matches[1], nil
291 }
293 return "", fmt.Errorf("invalid issuer in the ID token")
296func (p *MicrosoftEntraIDProvider) checkTenantMatchesTenantList(tenant string, allowedTenantList []string) bool {
297 for _, allowedTenant := range allowedTenantList {
298 if tenant == allowedTenant {
299 return true
300 }
301 }
302 return false
305func (p *MicrosoftEntraIDProvider) fetchToken(ctx context.Context, params url.Values) (*oauth2.Token, error) {
306 resp := requests.New(p.RedeemURL.String()).
307 WithContext(ctx).
308 WithMethod(http.MethodPost).
309 WithBody(bytes.NewBufferString(params.Encode())).
310 SetHeader("Content-Type", "application/x-www-form-urlencoded").
311 Do()
313 var token *oauth2.Token
314 var rawResponse interface{}
316 body := resp.Body()
317 if err := json.Unmarshal(body, &rawResponse); err != nil {
318 return nil, fmt.Errorf("unable to unmarshal raw response body: %w", err)
319 }
321 if err := json.Unmarshal(body, &token); err != nil {
322 return nil, fmt.Errorf("unable to unmarshal token response body: %w", err)
323 }
325 return token.WithExtra(rawResponse), nil