git.iko.soy/typeable/oauth2-proxy
on master help sign in
Improve OIDC error handling
commit42f6cef7d6571aa0ea5fea109a77177a069a950e authorNick Meves <nick.meves@greenhouse.io> dateTue 1 Dec 2020, 12:01 (6 years ago) parentea5b8cc
4 files changed+36−11
compare with master
unifiedsplit
providers/oidc.go+9−6 providers/provider_data.go+4−1 providers/provider_data_test.go+15−4 providers/provider_default.go+8
providers/oidc.go+9−6
@@ -206,12 +206,15 @@ func (p *OIDCProvider) CreateSessionFromToken(ctx context.Context, token string)
206206func (p *OIDCProvider) createSession(ctx context.Context, token *oauth2.Token, refresh bool) (*sessions.SessionState, error) {
207207 idToken, err := p.verifyIDToken(ctx, token)
208208 if err != nil {
209− return nil, fmt.Errorf("could not verify id_token: %v", err)
210− }
211−
212− // IDToken is mandatory in Redeem but optional in Refresh
213− if idToken == nil && !refresh {
214− return nil, errors.New("token response did not contain an id_token")
209+ switch err {
210+ case ErrMissingIDToken:
211+ // IDToken is mandatory in Redeem but optional in Refresh
212+ if !refresh {
213+ return nil, errors.New("token response did not contain an id_token")
214+ }
215+ default:
216+ return nil, fmt.Errorf("could not verify id_token: %v", err)
217+ }
215218 }
216219
217220 ss, err := p.buildSessionFromClaims(idToken)
providers/provider_data.go+4−1
@@ -129,9 +129,12 @@ type OIDCClaims struct {
129129func (p *ProviderData) verifyIDToken(ctx context.Context, token *oauth2.Token) (*oidc.IDToken, error) {
130130 rawIDToken := getIDToken(token)
131131 if strings.TrimSpace(rawIDToken) != "" {
132+ if p.Verifier == nil {
133+ return nil, ErrMissingOIDCVerifier
134+ }
132135 return p.Verifier.Verify(ctx, rawIDToken)
133136 }
134− return nil, nil
137+ return nil, ErrMissingIDToken
135138}
136139
137140// buildSessionFromClaims uses IDToken claims to populate a fresh SessionState
providers/provider_data_test.go+15−4
@@ -137,23 +137,33 @@ func TestProviderData_verifyIDToken(t *testing.T) {
137137
138138 testCases := map[string]struct {
139139 IDToken *idTokenClaims
140+ Verifier bool
140141 ExpectIDToken bool
141142 ExpectedError error
142143 }{
143144 "Valid ID Token": {
144145 IDToken: &defaultIDToken,
146+ Verifier: true,
145147 ExpectIDToken: true,
146148 ExpectedError: nil,
147149 },
148150 "Invalid ID Token": {
149151 IDToken: &failureIDToken,
152+ Verifier: true,
150153 ExpectIDToken: false,
151154 ExpectedError: errors.New("failed to verify signature: the validation failed for subject [123456789]"),
152155 },
153156 "Missing ID Token": {
154157 IDToken: nil,
158+ Verifier: true,
155159 ExpectIDToken: false,
156− ExpectedError: nil,
160+ ExpectedError: ErrMissingIDToken,
161+ },
162+ "OIDC Verifier not Configured": {
163+ IDToken: &defaultIDToken,
164+ Verifier: false,
165+ ExpectIDToken: false,
166+ ExpectedError: ErrMissingOIDCVerifier,
157167 },
158168 }
159169
@@ -170,12 +180,13 @@ func TestProviderData_verifyIDToken(t *testing.T) {
170180 })
171181 }
172182
173− provider := &ProviderData{
174− Verifier: oidc.NewVerifier(
183+ provider := &ProviderData{}
184+ if tc.Verifier {
185+ provider.Verifier = oidc.NewVerifier(
175186 oidcIssuer,
176187 mockJWKS{},
177188 &oidc.Config{ClientID: oidcClientID},
178− ),
189+ )
179190 }
180191 verified, err := provider.verifyIDToken(context.Background(), token)
181192 if err != nil {
providers/provider_default.go+8
@@ -22,6 +22,14 @@ var (
2222 // code
2323 ErrMissingCode = errors.New("missing code")
2424
25+ // ErrMissingIDToken is returned when an oidc.Token does not contain the
26+ // extra `id_token` field for an IDToken.
27+ ErrMissingIDToken = errors.New("missing id_token")
28+
29+ // ErrMissingOIDCVerifier is returned when a provider didn't set `Verifier`
30+ // but an attempt to call `Verifier.Verify` was about to be made.
31+ ErrMissingOIDCVerifier = errors.New("oidc verifier is not configured")
32+
2533 _ Provider = (*ProviderData)(nil)
2634)
2735