@@ -1,62 +1,258 @@
11package providers
22
33import (
4+ "context"
5+ "encoding/json"
6+ "fmt"
7+ "io/ioutil"
48 "net/http"
5− "net/url"
9+ "strings"
10+ "time"
611
12+ oidc "github.com/coreos/go-oidc"
713 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
8− "github.com/pusher/oauth2_proxy/pkg/logger"
9− "github.com/pusher/oauth2_proxy/pkg/requests"
14+ "golang.org/x/oauth2"
1015)
1116
12−// GitLabProvider represents an GitLab based Identity Provider
17+// GitLabProvider represents a GitLab based Identity Provider
1318type GitLabProvider struct {
1419 *ProviderData
20+
21+ Group string
22+ EmailDomains []string
23+
24+ Verifier *oidc.IDTokenVerifier
25+ AllowUnverifiedEmail bool
1526}
1627
1728// NewGitLabProvider initiates a new GitLabProvider
1829func NewGitLabProvider(p *ProviderData) *GitLabProvider {
1930 p.ProviderName = "GitLab"
20− if p.LoginURL == nil || p.LoginURL.String() == "" {
21− p.LoginURL = &url.URL{
22− Scheme: "https",
23− Host: "gitlab.com",
24− Path: "/oauth/authorize",
25− }
31+
32+ if p.Scope == "" {
33+ p.Scope = "openid email"
34+ }
35+
36+ return &GitLabProvider{ProviderData: p}
37+}
38+
39+// Redeem exchanges the OAuth2 authentication token for an ID token
40+func (p *GitLabProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {
41+ ctx := context.Background()
42+ c := oauth2.Config{
43+ ClientID: p.ClientID,
44+ ClientSecret: p.ClientSecret,
45+ Endpoint: oauth2.Endpoint{
46+ TokenURL: p.RedeemURL.String(),
47+ },
48+ RedirectURL: redirectURL,
49+ }
50+ token, err := c.Exchange(ctx, code)
51+ if err != nil {
52+ return nil, fmt.Errorf("token exchange: %v", err)
53+ }
54+ s, err = p.createSessionState(ctx, token)
55+ if err != nil {
56+ return nil, fmt.Errorf("unable to update session: %v", err)
57+ }
58+ return
59+}
60+
61+// RefreshSessionIfNeeded checks if the session has expired and uses the
62+// RefreshToken to fetch a new ID token if required
63+func (p *GitLabProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error) {
64+ if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {
65+ return false, nil
66+ }
67+
68+ origExpiration := s.ExpiresOn
69+
70+ err := p.redeemRefreshToken(s)
71+ if err != nil {
72+ return false, fmt.Errorf("unable to redeem refresh token: %v", err)
73+ }
74+
75+ fmt.Printf("refreshed id token %s (expired on %s)\n", s, origExpiration)
76+ return true, nil
77+}
78+
79+func (p *GitLabProvider) redeemRefreshToken(s *sessions.SessionState) (err error) {
80+ c := oauth2.Config{
81+ ClientID: p.ClientID,
82+ ClientSecret: p.ClientSecret,
83+ Endpoint: oauth2.Endpoint{
84+ TokenURL: p.RedeemURL.String(),
85+ },
86+ }
87+ ctx := context.Background()
88+ t := &oauth2.Token{
89+ RefreshToken: s.RefreshToken,
90+ Expiry: time.Now().Add(-time.Hour),
91+ }
92+ token, err := c.TokenSource(ctx, t).Token()
93+ if err != nil {
94+ return fmt.Errorf("failed to get token: %v", err)
95+ }
96+ newSession, err := p.createSessionState(ctx, token)
97+ if err != nil {
98+ return fmt.Errorf("unable to update session: %v", err)
99+ }
100+ s.AccessToken = newSession.AccessToken
101+ s.IDToken = newSession.IDToken
102+ s.RefreshToken = newSession.RefreshToken
103+ s.CreatedAt = newSession.CreatedAt
104+ s.ExpiresOn = newSession.ExpiresOn
105+ s.Email = newSession.Email
106+ return
107+}
108+
109+type gitlabUserInfo struct {
110+ Username string `json:"nickname"`
111+ Email string `json:"email"`
112+ EmailVerified bool `json:"email_verified"`
113+ Groups []string `json:"groups"`
114+}
115+
116+func (p *GitLabProvider) getUserInfo(s *sessions.SessionState) (*gitlabUserInfo, error) {
117+ // Retrieve user info JSON
118+ // https://docs.gitlab.com/ee/integration/openid_connect_provider.html#shared-information
119+
120+ // Build user info url from login url of GitLab instance
121+ userInfoURL := *p.LoginURL
122+ userInfoURL.Path = "/oauth/userinfo"
123+
124+ req, err := http.NewRequest("GET", userInfoURL.String(), nil)
125+ if err != nil {
126+ return nil, fmt.Errorf("failed to create user info request: %v", err)
127+ }
128+ req.Header.Set("Authorization", "Bearer "+s.AccessToken)
129+
130+ resp, err := http.DefaultClient.Do(req)
131+ if err != nil {
132+ return nil, fmt.Errorf("failed to perform user info request: %v", err)
133+ }
134+ var body []byte
135+ body, err = ioutil.ReadAll(resp.Body)
136+ resp.Body.Close()
137+ if err != nil {
138+ return nil, fmt.Errorf("failed to read user info response: %v", err)
26139 }
27− if p.RedeemURL == nil || p.RedeemURL.String() == "" {
28− p.RedeemURL = &url.URL{
29− Scheme: "https",
30− Host: "gitlab.com",
31− Path: "/oauth/token",
140+
141+ if resp.StatusCode != 200 {
142+ return nil, fmt.Errorf("got %d during user info request: %s", resp.StatusCode, body)
143+ }
144+
145+ var userInfo gitlabUserInfo
146+ err = json.Unmarshal(body, &userInfo)
147+ if err != nil {
148+ return nil, fmt.Errorf("failed to parse user info: %v", err)
149+ }
150+
151+ return &userInfo, nil
152+}
153+
154+func (p *GitLabProvider) verifyGroupMembership(userInfo *gitlabUserInfo) error {
155+ if p.Group == "" {
156+ return nil
157+ }
158+
159+ // Collect user group memberships
160+ membershipSet := make(map[string]bool)
161+ for _, group := range userInfo.Groups {
162+ membershipSet[group] = true
163+ }
164+
165+ // Find a valid group that they are a member of
166+ validGroups := strings.Split(p.Group, " ")
167+ for _, validGroup := range validGroups {
168+ if _, ok := membershipSet[validGroup]; ok {
169+ return nil
32170 }
33171 }
34− if p.ValidateURL == nil || p.ValidateURL.String() == "" {
35− p.ValidateURL = &url.URL{
36− Scheme: "https",
37− Host: "gitlab.com",
38− Path: "/api/v4/user",
172+
173+ return fmt.Errorf("user is not a member of '%s'", p.Group)
174+}
175+
176+func (p *GitLabProvider) verifyEmailDomain(userInfo *gitlabUserInfo) error {
177+ if len(p.EmailDomains) == 0 || p.EmailDomains[0] == "*" {
178+ return nil
179+ }
180+
181+ for _, domain := range p.EmailDomains {
182+ if strings.HasSuffix(userInfo.Email, domain) {
183+ return nil
39184 }
40185 }
41− if p.Scope == "" {
42− p.Scope = "read_user"
186+
187+ return fmt.Errorf("user email is not one of the valid domains '%v'", p.EmailDomains)
188+}
189+
190+func (p *GitLabProvider) createSessionState(ctx context.Context, token *oauth2.Token) (*sessions.SessionState, error) {
191+ rawIDToken, ok := token.Extra("id_token").(string)
192+ if !ok {
193+ return nil, fmt.Errorf("token response did not contain an id_token")
43194 }
44− return &GitLabProvider{ProviderData: p}
195+
196+ // Parse and verify ID Token payload.
197+ idToken, err := p.Verifier.Verify(ctx, rawIDToken)
198+ if err != nil {
199+ return nil, fmt.Errorf("could not verify id_token: %v", err)
200+ }
201+
202+ return &sessions.SessionState{
203+ AccessToken: token.AccessToken,
204+ IDToken: rawIDToken,
205+ RefreshToken: token.RefreshToken,
206+ CreatedAt: time.Now(),
207+ ExpiresOn: idToken.Expiry,
208+ }, nil
209+}
210+
211+// ValidateSessionState checks that the session's IDToken is still valid
212+func (p *GitLabProvider) ValidateSessionState(s *sessions.SessionState) bool {
213+ ctx := context.Background()
214+ _, err := p.Verifier.Verify(ctx, s.IDToken)
215+ if err != nil {
216+ return false
217+ }
218+
219+ return true
45220}
46221
47222// GetEmailAddress returns the Account email address
48223func (p *GitLabProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {
224+ // Retrieve user info
225+ userInfo, err := p.getUserInfo(s)
226+ if err != nil {
227+ return "", fmt.Errorf("failed to retrieve user info: %v", err)
228+ }
229+
230+ // Check if email is verified
231+ if !p.AllowUnverifiedEmail && !userInfo.EmailVerified {
232+ return "", fmt.Errorf("user email is not verified")
233+ }
234+
235+ // Check if email has valid domain
236+ err = p.verifyEmailDomain(userInfo)
237+ if err != nil {
238+ return "", fmt.Errorf("email domain check failed: %v", err)
239+ }
49240
50− req, err := http.NewRequest("GET",
51− p.ValidateURL.String()+"?access_token="+s.AccessToken, nil)
241+ // Check group membership
242+ err = p.verifyGroupMembership(userInfo)
52243 if err != nil {
53− logger.Printf("failed building request %s", err)
54− return "", err
244+ return "", fmt.Errorf("group membership check failed: %v", err)
55245 }
56− json, err := requests.Request(req)
246+
247+ return userInfo.Email, nil
248+}
249+
250+// GetUserName returns the Account user name
251+func (p *GitLabProvider) GetUserName(s *sessions.SessionState) (string, error) {
252+ userInfo, err := p.getUserInfo(s)
57253 if err != nil {
58− logger.Printf("failed making request %s", err)
59− return "", err
254+ return "", fmt.Errorf("failed to retrieve user info: %v", err)
60255 }
61− return json.Get("email").String()
256+
257+ return userInfo.Username, nil
62258}