git.iko.soy/typeable/oauth2-proxy
on v2.2 help sign in
typeable/oauth2-proxy/providers/google.go
322 lines 8.4 kB history raw
1package providers
3import (
4 "bytes"
5 "encoding/base64"
6 "encoding/json"
7 "errors"
8 "fmt"
9 "io"
10 "io/ioutil"
11 "log"
12 "net/http"
13 "net/url"
14 "strings"
15 "time"
17 "golang.org/x/oauth2"
18 "golang.org/x/oauth2/google"
19 "google.golang.org/api/admin/directory/v1"
20 "google.golang.org/api/googleapi"
23type GoogleProvider struct {
24 *ProviderData
25 RedeemRefreshURL *url.URL
26 // GroupValidator is a function that determines if the passed email is in
27 // the configured Google group.
28 GroupValidator func(string) bool
31func NewGoogleProvider(p *ProviderData) *GoogleProvider {
32 p.ProviderName = "Google"
33 if p.LoginURL.String() == "" {
34 p.LoginURL = &url.URL{Scheme: "https",
35 Host: "accounts.google.com",
36 Path: "/o/oauth2/auth",
37 // to get a refresh token. see https://developers.google.com/identity/protocols/OAuth2WebServer#offline
38 RawQuery: "access_type=offline",
39 }
40 }
41 if p.RedeemURL.String() == "" {
42 p.RedeemURL = &url.URL{Scheme: "https",
43 Host: "www.googleapis.com",
44 Path: "/oauth2/v3/token"}
45 }
46 if p.ValidateURL.String() == "" {
47 p.ValidateURL = &url.URL{Scheme: "https",
48 Host: "www.googleapis.com",
49 Path: "/oauth2/v1/tokeninfo"}
50 }
51 if p.Scope == "" {
52 p.Scope = "profile email"
53 }
55 return &GoogleProvider{
56 ProviderData: p,
57 // Set a default GroupValidator to just always return valid (true), it will
58 // be overwritten if we configured a Google group restriction.
59 GroupValidator: func(email string) bool {
60 return true
61 },
62 }
65func emailFromIdToken(idToken string) (string, error) {
67 // id_token is a base64 encode ID token payload
68 // https://developers.google.com/accounts/docs/OAuth2Login#obtainuserinfo
69 jwt := strings.Split(idToken, ".")
70 b, err := jwtDecodeSegment(jwt[1])
71 if err != nil {
72 return "", err
73 }
75 var email struct {
76 Email string `json:"email"`
77 EmailVerified bool `json:"email_verified"`
78 }
79 err = json.Unmarshal(b, &email)
80 if err != nil {
81 return "", err
82 }
83 if email.Email == "" {
84 return "", errors.New("missing email")
85 }
86 if !email.EmailVerified {
87 return "", fmt.Errorf("email %s not listed as verified", email.Email)
88 }
89 return email.Email, nil
92func jwtDecodeSegment(seg string) ([]byte, error) {
93 if l := len(seg) % 4; l > 0 {
94 seg += strings.Repeat("=", 4-l)
95 }
97 return base64.URLEncoding.DecodeString(seg)
100func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {
101 if code == "" {
102 err = errors.New("missing code")
103 return
104 }
106 params := url.Values{}
107 params.Add("redirect_uri", redirectURL)
108 params.Add("client_id", p.ClientID)
109 params.Add("client_secret", p.ClientSecret)
110 params.Add("code", code)
111 params.Add("grant_type", "authorization_code")
112 var req *http.Request
113 req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
114 if err != nil {
115 return
116 }
117 req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
119 resp, err := http.DefaultClient.Do(req)
120 if err != nil {
121 return
122 }
123 var body []byte
124 body, err = ioutil.ReadAll(resp.Body)
125 resp.Body.Close()
126 if err != nil {
127 return
128 }
130 if resp.StatusCode != 200 {
131 err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
132 return
133 }
135 var jsonResponse struct {
136 AccessToken string `json:"access_token"`
137 RefreshToken string `json:"refresh_token"`
138 ExpiresIn int64 `json:"expires_in"`
139 IdToken string `json:"id_token"`
140 }
141 err = json.Unmarshal(body, &jsonResponse)
142 if err != nil {
143 return
144 }
145 var email string
146 email, err = emailFromIdToken(jsonResponse.IdToken)
147 if err != nil {
148 return
149 }
150 s = &SessionState{
151 AccessToken: jsonResponse.AccessToken,
152 ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),
153 RefreshToken: jsonResponse.RefreshToken,
154 Email: email,
155 }
156 return
159// SetGroupRestriction configures the GoogleProvider to restrict access to the
160// specified group(s). AdminEmail has to be an administrative email on the domain that is
161// checked. CredentialsFile is the path to a json file containing a Google service
162// account credentials.
163func (p *GoogleProvider) SetGroupRestriction(groups []string, adminEmail string, credentialsReader io.Reader) {
164 adminService := getAdminService(adminEmail, credentialsReader)
165 p.GroupValidator = func(email string) bool {
166 return userInGroup(adminService, groups, email)
167 }
170func getAdminService(adminEmail string, credentialsReader io.Reader) *admin.Service {
171 data, err := ioutil.ReadAll(credentialsReader)
172 if err != nil {
173 log.Fatal("can't read Google credentials file:", err)
174 }
175 conf, err := google.JWTConfigFromJSON(data, admin.AdminDirectoryUserReadonlyScope, admin.AdminDirectoryGroupReadonlyScope)
176 if err != nil {
177 log.Fatal("can't load Google credentials file:", err)
178 }
179 conf.Subject = adminEmail
181 client := conf.Client(oauth2.NoContext)
182 adminService, err := admin.New(client)
183 if err != nil {
184 log.Fatal(err)
185 }
186 return adminService
189func userInGroup(service *admin.Service, groups []string, email string) bool {
190 user, err := fetchUser(service, email)
191 if err != nil {
192 log.Printf("error fetching user: %v", err)
193 return false
194 }
195 id := user.Id
196 custID := user.CustomerId
198 for _, group := range groups {
199 members, err := fetchGroupMembers(service, group)
200 if err != nil {
201 if err, ok := err.(*googleapi.Error); ok && err.Code == 404 {
202 log.Printf("error fetching members for group %s: group does not exist", group)
203 } else {
204 log.Printf("error fetching group members: %v", err)
205 return false
206 }
207 }
209 for _, member := range members {
210 switch member.Type {
211 case "CUSTOMER":
212 if member.Id == custID {
213 return true
214 }
215 case "USER":
216 if member.Id == id {
217 return true
218 }
219 }
220 }
221 }
222 return false
225func fetchUser(service *admin.Service, email string) (*admin.User, error) {
226 user, err := service.Users.Get(email).Do()
227 return user, err
230func fetchGroupMembers(service *admin.Service, group string) ([]*admin.Member, error) {
231 members := []*admin.Member{}
232 pageToken := ""
233 for {
234 req := service.Members.List(group)
235 if pageToken != "" {
236 req.PageToken(pageToken)
237 }
238 r, err := req.Do()
239 if err != nil {
240 return nil, err
241 }
242 for _, member := range r.Members {
243 members = append(members, member)
244 }
245 if r.NextPageToken == "" {
246 break
247 }
248 pageToken = r.NextPageToken
249 }
250 return members, nil
253// ValidateGroup validates that the provided email exists in the configured Google
254// group(s).
255func (p *GoogleProvider) ValidateGroup(email string) bool {
256 return p.GroupValidator(email)
259func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {
260 if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {
261 return false, nil
262 }
264 newToken, duration, err := p.redeemRefreshToken(s.RefreshToken)
265 if err != nil {
266 return false, err
267 }
269 // re-check that the user is in the proper google group(s)
270 if !p.ValidateGroup(s.Email) {
271 return false, fmt.Errorf("%s is no longer in the group(s)", s.Email)
272 }
274 origExpiration := s.ExpiresOn
275 s.AccessToken = newToken
276 s.ExpiresOn = time.Now().Add(duration).Truncate(time.Second)
277 log.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
278 return true, nil
281func (p *GoogleProvider) redeemRefreshToken(refreshToken string) (token string, expires time.Duration, err error) {
282 // https://developers.google.com/identity/protocols/OAuth2WebServer#refresh
283 params := url.Values{}
284 params.Add("client_id", p.ClientID)
285 params.Add("client_secret", p.ClientSecret)
286 params.Add("refresh_token", refreshToken)
287 params.Add("grant_type", "refresh_token")
288 var req *http.Request
289 req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
290 if err != nil {
291 return
292 }
293 req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
295 resp, err := http.DefaultClient.Do(req)
296 if err != nil {
297 return
298 }
299 var body []byte
300 body, err = ioutil.ReadAll(resp.Body)
301 resp.Body.Close()
302 if err != nil {
303 return
304 }
306 if resp.StatusCode != 200 {
307 err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
308 return
309 }
311 var data struct {
312 AccessToken string `json:"access_token"`
313 ExpiresIn int64 `json:"expires_in"`
314 }
315 err = json.Unmarshal(body, &data)
316 if err != nil {
317 return
318 }
319 token = data.AccessToken
320 expires = time.Duration(data.ExpiresIn) * time.Second
321 return