514db45 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Allow OIDC Bearer Tokens without emails

514db45Nick Meves6 years ago

CHANGELOG.md+1

@@ -16,6 +16,7 @@

16- [#718](https://github.com/oauth2-proxy/oauth2-proxy/pull/718) Allow Logging to stdout with separate Error Log Channel

17- [#690](https://github.com/oauth2-proxy/oauth2-proxy/pull/690) Address GoSec security findings & remediate (@NickMeves)

18- [#689](https://github.com/oauth2-proxy/oauth2-proxy/pull/689) Fix finicky logging_handler_test from time drift (@NickMeves)

19+- [#700](https://github.com/oauth2-proxy/oauth2-proxy/pull/700) Allow OIDC Bearer auth IDTokens to have empty email claim & profile URL (@NickMeves)

19- [#699](https://github.com/oauth2-proxy/oauth2-proxy/pull/699) Align persistence ginkgo tests with conventions (@NickMeves)

20- [#699](https://github.com/oauth2-proxy/oauth2-proxy/pull/699) Align persistence ginkgo tests with conventions (@NickMeves)

20- [#696](https://github.com/oauth2-proxy/oauth2-proxy/pull/696) Preserve query when building redirect

21- [#696](https://github.com/oauth2-proxy/oauth2-proxy/pull/696) Preserve query when building redirect

21- [#561](https://github.com/oauth2-proxy/oauth2-proxy/pull/561) Refactor provider URLs to package level vars (@JoelSpeed)

22- [#561](https://github.com/oauth2-proxy/oauth2-proxy/pull/561) Refactor provider URLs to package level vars (@JoelSpeed)

providers/oidc.go+2−2

@@ -231,7 +231,6 @@ func getOIDCHeader(accessToken string) http.Header {

231}

232

233func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.IDToken, accessToken string, profileURL string) (*OIDCClaims, error) {

234−

235 claims := &OIDCClaims{}

234 claims := &OIDCClaims{}

236 // Extract default claims.

235 // Extract default claims.

237 if err := idToken.Claims(&claims); err != nil {

236 if err := idToken.Claims(&claims); err != nil {

@@ -250,7 +249,8 @@ func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.

250 // userID claim was not present or was empty in the ID Token

249 // userID claim was not present or was empty in the ID Token

251 if claims.UserID == "" {

250 if claims.UserID == "" {

252 if profileURL == "" {

251 if profileURL == "" {

253− return nil, fmt.Errorf("id_token did not contain user ID claim (%q)", p.UserIDClaim)

252+ claims.UserID = claims.Subject

253+ return claims, nil

254 }

255

256 // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo

providers/oidc_test.go+76

@@ -60,6 +60,22 @@ var defaultIDToken idTokenClaims = idTokenClaims{

60 },

61}

63+var minimalIDToken idTokenClaims = idTokenClaims{

64+ "",

65+ "",

66+ "",

67+ "",

68+ jwt.StandardClaims{

69+ Audience: "https://test.myapp.com",

70+ ExpiresAt: time.Now().Add(time.Duration(5) * time.Minute).Unix(),

71+ Id: "id-some-id",

72+ IssuedAt: time.Now().Unix(),

73+ Issuer: "https://issuer.example.com",

74+ NotBefore: 0,

75+ Subject: "minimal",

76+ },

77+}

78+

63type fakeKeySetStub struct{}

79type fakeKeySetStub struct{}

65func (fakeKeySetStub) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {

81func (fakeKeySetStub) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {

@@ -253,6 +269,66 @@ func TestOIDCProviderRefreshSessionIfNeededWithIdToken(t *testing.T) {

253 assert.Equal(t, refreshToken, existingSession.RefreshToken)

269 assert.Equal(t, refreshToken, existingSession.RefreshToken)

254}

270}

255

271

272+func TestCreateSessionStateFromBearerToken(t *testing.T) {

273+ const profileURLEmail = "janed@me.com"

274+

275+ testCases := map[string]struct {

276+ IDToken idTokenClaims

277+ ProfileURL bool

278+ ExpectedEmail string

279+ }{

280+ "Default IDToken": {

281+ IDToken: defaultIDToken,

282+ ProfileURL: true,

283+ ExpectedEmail: profileURLEmail,

284+ },

285+ "Minimal IDToken with no OIDC Profile URL": {

286+ IDToken: minimalIDToken,

287+ ProfileURL: false,

288+ ExpectedEmail: "",

289+ },

290+ "Minimal IDToken with OIDC Profile URL": {

291+ IDToken: minimalIDToken,

292+ ProfileURL: true,

293+ ExpectedEmail: profileURLEmail,

294+ },

295+ }

296+ for testName, tc := range testCases {

297+ t.Run(testName, func(t *testing.T) {

298+ jsonResp := []byte(fmt.Sprintf(`{"email":"%s"}`, profileURLEmail))

299+ server, provider := newTestSetup(jsonResp)

300+ defer server.Close()

301+ if !tc.ProfileURL {

302+ provider.ProfileURL = &url.URL{}

303+ }

304+

305+ rawIDToken, err := newSignedTestIDToken(tc.IDToken)

306+ assert.NoError(t, err)

307+

308+ keyset := fakeKeySetStub{}

309+ verifier := oidc.NewVerifier("https://issuer.example.com", keyset,

310+ &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})

311+

312+ idToken, err := verifier.Verify(context.Background(), rawIDToken)

313+ assert.NoError(t, err)

314+

315+ ss, err := provider.CreateSessionStateFromBearerToken(context.Background(), rawIDToken, idToken)

316+ assert.NoError(t, err)

317+

318+ if tc.ExpectedEmail != "" {

319+ assert.Equal(t, tc.ExpectedEmail, ss.Email)

320+ assert.NotEqual(t, ss.Email, ss.User)

321+ } else {

322+ assert.Equal(t, tc.IDToken.Subject, ss.Email)

323+ assert.Equal(t, ss.Email, ss.User)

324+ }

325+ assert.Equal(t, rawIDToken, ss.IDToken)

326+ assert.Equal(t, rawIDToken, ss.AccessToken)

327+ assert.Equal(t, "", ss.RefreshToken)

328+ })

329+ }

330+}

331+

256func TestOIDCProvider_findVerifiedIdToken(t *testing.T) {

332func TestOIDCProvider_findVerifiedIdToken(t *testing.T) {

257

333

258 server, provider := newTestSetup([]byte(""))

334 server, provider := newTestSetup([]byte(""))