01b01d8 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #2376 from tuunit/feature/static-public-keys-support

01b01d8Joel Speed2 years ago

CHANGELOG.md+1

@@ -16,6 +16,7 @@

16- [#2620](https://github.com/oauth2-proxy/oauth2-proxy/pull/2620) fix: update code_verifier to use recommended method (@vishvananda)

17- [#2392](https://github.com/oauth2-proxy/oauth2-proxy/pull/2392) chore: extend test cases for oidc provider and documentation regarding implicit setting of the groups scope when no scope was specified in the config (@jjlakis / @tuunit)

18- [#2902](https://github.com/oauth2-proxy/oauth2-proxy/pull/2902) feat(entra): add Workload Identity support for Entra ID (@jjlakis)

19+- [#2376](https://github.com/oauth2-proxy/oauth2-proxy/pull/2376) feat: static public keys file support for oidc provider (@axel7083 / @jjlakis)

20# V7.7.1

21# V7.7.1

docs/docs/configuration/alpha_config.md+1

@@ -410,6 +410,7 @@ character.

410| `insecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked after the initial OAuth redeem & subsequent token refreshes. default set to 'true' Warning: In a future release, this will change to 'false' by default for enhanced security. |

411| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints default set to 'false' |

412| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL eg: https://www.googleapis.com/oauth2/v3/certs |

413+| `publicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use for verifying JWT tokens |

413| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email, default set to 'email' |

414| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email, default set to 'email' |

414| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups default set to 'groups' |

415| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups default set to 'groups' |

415| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID default set to 'email' |

416| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID default set to 'email' |

docs/docs/configuration/overview.md+2−1

@@ -96,7 +96,8 @@ Provider specific options can be found on their respective subpages.

99+| flag: `--oidc-jwks-url` toml: `oidc_jwks_url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled and public key files are not provided | |

100+| flag: `--oidc-public-key-file` toml: `oidc_public_key_files` | string | Path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times). Required if OIDC discovery is disabled na JWKS URL isn't provided | string \| list |

102| flag: `--provider-ca-file` toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |

103| flag: `--provider-ca-file` toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |

pkg/apis/options/legacy_options.go+3

@@ -522,6 +522,7 @@ type LegacyProvider struct {

522 OIDCGroupsClaim string `flag:"oidc-groups-claim" cfg:"oidc_groups_claim"`

523 OIDCAudienceClaims []string `flag:"oidc-audience-claim" cfg:"oidc_audience_claims"`

524 OIDCExtraAudiences []string `flag:"oidc-extra-audience" cfg:"oidc_extra_audiences"`

525+ OIDCPublicKeyFiles []string `flag:"oidc-public-key-file" cfg:"oidc_public_key_files"`

525 LoginURL string `flag:"login-url" cfg:"login_url"`

526 LoginURL string `flag:"login-url" cfg:"login_url"`

526 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`

527 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`

527 ProfileURL string `flag:"profile-url" cfg:"profile_url"`

528 ProfileURL string `flag:"profile-url" cfg:"profile_url"`

@@ -581,6 +582,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {

581 flagSet.String("oidc-email-claim", OIDCEmailClaim, "which OIDC claim contains the user's email")

582 flagSet.String("oidc-email-claim", OIDCEmailClaim, "which OIDC claim contains the user's email")

582 flagSet.StringSlice("oidc-audience-claim", OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id")

583 flagSet.StringSlice("oidc-audience-claim", OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id")

583 flagSet.StringSlice("oidc-extra-audience", []string{}, "additional audiences allowed to pass audience verification")

584 flagSet.StringSlice("oidc-extra-audience", []string{}, "additional audiences allowed to pass audience verification")

585+ flagSet.StringSlice("oidc-public-key-file", []string{}, "path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times)")

584 flagSet.String("login-url", "", "Authentication endpoint")

586 flagSet.String("login-url", "", "Authentication endpoint")

585 flagSet.String("redeem-url", "", "Token redemption endpoint")

587 flagSet.String("redeem-url", "", "Token redemption endpoint")

586 flagSet.String("profile-url", "", "Profile access endpoint")

588 flagSet.String("profile-url", "", "Profile access endpoint")

@@ -697,6 +699,7 @@ func (l *LegacyProvider) convert() (Providers, error) {

697 GroupsClaim: l.OIDCGroupsClaim,

699 GroupsClaim: l.OIDCGroupsClaim,

698 AudienceClaims: l.OIDCAudienceClaims,

700 AudienceClaims: l.OIDCAudienceClaims,

699 ExtraAudiences: l.OIDCExtraAudiences,

701 ExtraAudiences: l.OIDCExtraAudiences,

702+ PublicKeyFiles: l.OIDCPublicKeyFiles,

700 }

703 }

701

704

702 // Support for legacy configuration option

705 // Support for legacy configuration option

pkg/apis/options/providers.go+3

@@ -242,6 +242,9 @@ type OIDCOptions struct {

242 // JwksURL is the OpenID Connect JWKS URL

243 // eg: https://www.googleapis.com/oauth2/v3/certs

244 JwksURL string `json:"jwksURL,omitempty"`

245+ // PublicKeyFiles is a list of paths pointing to public key files in PEM format to use

246+ // for verifying JWT tokens

247+ PublicKeyFiles []string `json:"publicKeyFiles,omitempty"`

245 // EmailClaim indicates which claim contains the user email,

248 // EmailClaim indicates which claim contains the user email,

246 // default set to 'email'

249 // default set to 'email'

247 EmailClaim string `json:"emailClaim,omitempty"`

250 EmailClaim string `json:"emailClaim,omitempty"`

pkg/providers/oidc/provider_verifier.go+79−12

@@ -2,11 +2,14 @@ package oidc

3import (

4 "context"

5+ "crypto"

6+ "crypto/x509"

7+ "encoding/pem"

5 "errors"

8 "errors"

6 "fmt"

9 "fmt"

10+ "os"

8 "github.com/coreos/go-oidc/v3/oidc"

12 "github.com/coreos/go-oidc/v3/oidc"

9− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10 k8serrors "k8s.io/apimachinery/pkg/util/errors"

13 k8serrors "k8s.io/apimachinery/pkg/util/errors"

11)

14)

@@ -38,6 +41,10 @@ type ProviderVerifierOptions struct {

38 // eg: https://www.googleapis.com/oauth2/v3/certs

41 // eg: https://www.googleapis.com/oauth2/v3/certs

39 JWKsURL string

42 JWKsURL string

44+ // PublicKeyFiles is a list of paths pointing to public key files in PEM format to use

45+ // for verifying JWT tokens

46+ PublicKeyFiles []string

47+

41 // SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints

48 // SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints

42 SkipDiscovery bool

49 SkipDiscovery bool

@@ -59,8 +66,12 @@ func (p ProviderVerifierOptions) validate() error {

59 errs = append(errs, errors.New("missing required setting: issuer-url"))

66 errs = append(errs, errors.New("missing required setting: issuer-url"))

60 }

67 }

62− if p.SkipDiscovery && p.JWKsURL == "" {

69+ if p.SkipDiscovery && p.JWKsURL == "" && len(p.PublicKeyFiles) == 0 {

63− errs = append(errs, errors.New("missing required setting: jwks-url"))

70+ errs = append(errs, errors.New("missing required setting: jwks-url or public-key-files"))

71+ }

72+

73+ if p.JWKsURL != "" && len(p.PublicKeyFiles) > 0 {

74+ errs = append(errs, errors.New("mutually exclusive settings: jwks-url and public-key-files"))

64 }

75 }

66 if len(errs) > 0 {

77 if len(errs) > 0 {

@@ -91,12 +102,12 @@ func (p ProviderVerifierOptions) toOIDCConfig() *oidc.Config {

91// NewProviderVerifier constructs a ProviderVerifier from the options given.

102// NewProviderVerifier constructs a ProviderVerifier from the options given.

92func NewProviderVerifier(ctx context.Context, opts ProviderVerifierOptions) (ProviderVerifier, error) {

103func NewProviderVerifier(ctx context.Context, opts ProviderVerifierOptions) (ProviderVerifier, error) {

93 if err := opts.validate(); err != nil {

104 if err := opts.validate(); err != nil {

94− return nil, fmt.Errorf("invalid provider verifier options: %v", err)

105+ return nil, fmt.Errorf("invalid provider verifier options: %w", err)

95 }

106 }

107

97 verifierBuilder, provider, err := getVerifierBuilder(ctx, opts)

108 verifierBuilder, provider, err := getVerifierBuilder(ctx, opts)

98 if err != nil {

109 if err != nil {

99− return nil, fmt.Errorf("could not get verifier builder: %v", err)

110+ return nil, fmt.Errorf("could not get verifier builder: %w", err)

100 }

111 }

101 verifier := NewVerifier(verifierBuilder(opts.toOIDCConfig()), opts.toVerificationOptions())

112 verifier := NewVerifier(verifierBuilder(opts.toOIDCConfig()), opts.toVerificationOptions())

102

113

@@ -117,22 +128,78 @@ type verifierBuilder func(*oidc.Config) *oidc.IDTokenVerifier

117

128

118func getVerifierBuilder(ctx context.Context, opts ProviderVerifierOptions) (verifierBuilder, DiscoveryProvider, error) {

129func getVerifierBuilder(ctx context.Context, opts ProviderVerifierOptions) (verifierBuilder, DiscoveryProvider, error) {

119 if opts.SkipDiscovery {

130 if opts.SkipDiscovery {

131+ var keySet oidc.KeySet

132+ var err error

133+

134+ if opts.JWKsURL != "" {

135+ keySet = oidc.NewRemoteKeySet(ctx, opts.JWKsURL)

136+ } else {

137+ keySet, err = newKeySetFromStatic(opts.PublicKeyFiles)

138+ if err != nil {

139+ return nil, nil, fmt.Errorf("error while parsing public keys: %w", err)

140+ }

141+ }

120 // Instead of discovering the JWKs URL, it needs to be specified in the opts already

142 // Instead of discovering the JWKs URL, it needs to be specified in the opts already

121− return newVerifierBuilder(ctx, opts.IssuerURL, opts.JWKsURL, opts.SupportedSigningAlgs), nil, nil

143+ return newVerifierBuilder(

144+ opts.IssuerURL,

145+ keySet,

146+ opts.SupportedSigningAlgs,

147+ ), nil, nil

122 }

148 }

123

149

124 provider, err := NewProvider(ctx, opts.IssuerURL, opts.SkipIssuerVerification)

150 provider, err := NewProvider(ctx, opts.IssuerURL, opts.SkipIssuerVerification)

125 if err != nil {

151 if err != nil {

126− return nil, nil, fmt.Errorf("error while discovery OIDC configuration: %v", err)

152+ return nil, nil, fmt.Errorf("error while discovery OIDC configuration: %w", err)

153+ }

154+

155+ return newVerifierBuilder(

156+ opts.IssuerURL,

157+ oidc.NewRemoteKeySet(ctx, provider.Endpoints().JWKsURL),

158+ provider.SupportedSigningAlgs(),

159+ ), provider, nil

160+}

161+

162+// GetPublicKeyFromBytes parses a PEM-encoded public key from a byte array

163+// and returns a crypto.PublicKey object.

164+func getPublicKeyFromBytes(bytes []byte) (crypto.PublicKey, error) {

165+ block, _ := pem.Decode(bytes)

166+ if block == nil {

167+ return nil, errors.New("failed to parse PEM block containing the public key")

168+ }

169+ publicKey, err := x509.ParsePKIXPublicKey(block.Bytes)

170+ if err != nil {

171+ return nil, fmt.Errorf("failed to parse public key: %w", err)

127 }

172 }

128− verifierBuilder := newVerifierBuilder(ctx, opts.IssuerURL, provider.Endpoints().JWKsURL, provider.SupportedSigningAlgs())

173+

129− return verifierBuilder, provider, nil

174+ cryptoPublicKey, ok := publicKey.(crypto.PublicKey)

175+ if !ok {

176+ return nil, errors.New("failed to cast public key to crypto.PublicKey")

177+ }

178+

179+ return cryptoPublicKey, nil

180+}

181+

182+// newKeySetFromStatic create a StaticKeySet from a set of files

183+func newKeySetFromStatic(keys []string) (*oidc.StaticKeySet, error) {

184+ keySet := []crypto.PublicKey{}

185+ for _, keyFile := range keys {

186+ bytes, err := os.ReadFile(keyFile)

187+ if err != nil {

188+ return nil, fmt.Errorf("failed to read file: %w", err)

189+ }

190+

191+ publicKey, err := getPublicKeyFromBytes(bytes)

192+ if err != nil {

193+ return nil, fmt.Errorf("failed to create keys: %w", err)

194+ }

195+ keySet = append(keySet, publicKey)

196+ }

197+

198+ return &oidc.StaticKeySet{PublicKeys: keySet}, nil

130}

199}

131

200

132// newVerifierBuilder returns a function to create a IDToken verifier from an OIDC config.

201// newVerifierBuilder returns a function to create a IDToken verifier from an OIDC config.

133−func newVerifierBuilder(ctx context.Context, issuerURL, jwksURL string, supportedSigningAlgs []string) verifierBuilder {

202+func newVerifierBuilder(issuerURL string, keySet oidc.KeySet, supportedSigningAlgs []string) verifierBuilder {

134− ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

135− keySet := oidc.NewRemoteKeySet(ctx, jwksURL)

136 return func(oidcConfig *oidc.Config) *oidc.IDTokenVerifier {

203 return func(oidcConfig *oidc.Config) *oidc.IDTokenVerifier {

137 if len(supportedSigningAlgs) > 0 {

204 if len(supportedSigningAlgs) > 0 {

138 oidcConfig.SupportedSigningAlgs = supportedSigningAlgs

205 oidcConfig.SupportedSigningAlgs = supportedSigningAlgs

pkg/providers/oidc/provider_verifier_test.go+63−2

@@ -2,6 +2,8 @@ package oidc

3import (

4 "context"

5+ "os"

6+ "path/filepath"

5 "time"

7 "time"

7 "github.com/golang-jwt/jwt/v5"

9 "github.com/golang-jwt/jwt/v5"

@@ -10,6 +12,37 @@ import (

10 . "github.com/onsi/gomega"

12 . "github.com/onsi/gomega"

11)

13)

15+var tempDir string

16+var invalidPublicKeyFilePath string

17+var validPublicKeyFilePath string

18+

19+var _ = BeforeSuite(func() {

20+ var err error

21+

22+ // Create a temporary directory and public key file

23+ tempDir, err = os.MkdirTemp("/tmp", "provider-verifier-test")

24+ Expect(err).ToNot(HaveOccurred())

25+

26+ invalidPublicKeyFilePath = filepath.Join(tempDir, "invalid.key")

27+ validPublicKeyFilePath = filepath.Join(tempDir, "valid.key")

28+

29+ invalidKeyContents := []byte(`-----BEGIN INVALID KEY-----

30+ThisIsNotAValidKey

31+-----END INVALID KEY-----`)

32+ Expect(os.WriteFile(invalidPublicKeyFilePath, invalidKeyContents, 0644)).To(Succeed())

33+

34+ validKeyContents := []byte(`-----BEGIN PUBLIC KEY-----

35+MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALBJK+8qU+aQu2bHxJ8E95AIu2NINztM

36+NmX9R2zI9xlXN8wGQG8kWLYoRLbyiZwY9kdzOBGvYci64wHIjtFswHcCAwEAAQ==

37+-----END PUBLIC KEY-----`)

38+ Expect(os.WriteFile(validPublicKeyFilePath, validKeyContents, 0644)).To(Succeed())

39+})

40+

41+var _ = AfterSuite(func() {

42+ // Clean up temporary directory

43+ Expect(os.RemoveAll(tempDir)).To(Succeed())

44+})

45+

13var _ = Describe("ProviderVerifier", func() {

46var _ = Describe("ProviderVerifier", func() {

14 var m *mockoidc.MockOIDC

47 var m *mockoidc.MockOIDC

@@ -77,14 +110,42 @@ var _ = Describe("ProviderVerifier", func() {

77 p.SkipDiscovery = true

110 p.SkipDiscovery = true

78 p.JWKsURL = ""

111 p.JWKsURL = ""

79 },

112 },

80− expectedError: "invalid provider verifier options: missing required setting: jwks-url",

113+ expectedError: "invalid provider verifier options: missing required setting: jwks-url or public-key-files",

114+ }),

115+ Entry("with skip discovery, the JWKs URL not empty and len(PublicKeyFiles) is greater than 0", &newProviderVerifierTableInput{

116+ modifyOpts: func(p *ProviderVerifierOptions) {

117+ p.SkipDiscovery = true

118+ p.JWKsURL = "notEmpty"

119+ p.PublicKeyFiles = []string{"notEmpty"}

120+ },

121+ expectedError: "invalid provider verifier options: mutually exclusive settings: jwks-url and public-key-files",

81 }),

122 }),

82− Entry("should be succesfful when skipping discovery with the JWKs URL specified", &newProviderVerifierTableInput{

123+ Entry("should be successful when skipping discovery with the JWKs URL specified", &newProviderVerifierTableInput{

83 modifyOpts: func(p *ProviderVerifierOptions) {

124 modifyOpts: func(p *ProviderVerifierOptions) {

84 p.SkipDiscovery = true

125 p.SkipDiscovery = true

85 p.JWKsURL = m.JWKSEndpoint()

126 p.JWKsURL = m.JWKSEndpoint()

86 },

127 },

87 }),

128 }),

129+ Entry("should pass when the key is valid", &newProviderVerifierTableInput{

130+ modifyOpts: func(p *ProviderVerifierOptions) {

131+ p.SkipDiscovery = true

132+ p.PublicKeyFiles = []string{validPublicKeyFilePath}

133+ },

134+ }),

135+ Entry("should fail when the key is invalid", &newProviderVerifierTableInput{

136+ modifyOpts: func(p *ProviderVerifierOptions) {

137+ p.SkipDiscovery = true

138+ p.PublicKeyFiles = []string{invalidPublicKeyFilePath}

139+ },

140+ expectedError: "could not get verifier builder: error while parsing public keys",

141+ }),

142+ Entry("should fail when the key file is not found", &newProviderVerifierTableInput{

143+ modifyOpts: func(p *ProviderVerifierOptions) {

144+ p.SkipDiscovery = true

145+ p.PublicKeyFiles = []string{"non-existing"}

146+ },

147+ expectedError: "could not get verifier builder: error while parsing public keys: failed to read file",

148+ }),

88 )

149 )

150

90 type verifierTableInput struct {

151 type verifierTableInput struct {

providers/providers.go+1

@@ -92,6 +92,7 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

92 ExtraAudiences: providerConfig.OIDCConfig.ExtraAudiences,

93 IssuerURL: providerConfig.OIDCConfig.IssuerURL,

94 JWKsURL: providerConfig.OIDCConfig.JwksURL,

95+ PublicKeyFiles: providerConfig.OIDCConfig.PublicKeyFiles,

95 SkipDiscovery: providerConfig.OIDCConfig.SkipDiscovery,

96 SkipDiscovery: providerConfig.OIDCConfig.SkipDiscovery,

96 SkipIssuerVerification: providerConfig.OIDCConfig.InsecureSkipIssuerVerification,

97 SkipIssuerVerification: providerConfig.OIDCConfig.InsecureSkipIssuerVerification,

97 })

98 })

providers/providers_test.go+1−1

@@ -86,7 +86,7 @@ func TestSkipOIDCDiscovery(t *testing.T) {

86 }

88 _, err := newProviderDataFromConfig(providerConfig)

89− g.Expect(err).To(MatchError("error building OIDC ProviderVerifier: invalid provider verifier options: missing required setting: jwks-url"))

89+ g.Expect(err).To(MatchError("error building OIDC ProviderVerifier: invalid provider verifier options: missing required setting: jwks-url or public-key-files"))

91 providerConfig.LoginURL = msAuthURL

92 providerConfig.RedeemURL = msTokenURL