@@ -1,6 +1,7 @@
11package main
22
33import (
4+ "context"
45 b64 "encoding/base64"
56 "errors"
67 "fmt"
@@ -13,6 +14,7 @@ import (
1314 "strings"
1415 "time"
1516
17+ "github.com/coreos/go-oidc"
1618 "github.com/mbland/hmacauth"
1719 "github.com/pusher/oauth2_proxy/cookie"
1820 "github.com/pusher/oauth2_proxy/logger"
@@ -92,6 +94,8 @@ type OAuthProxy struct {
9294 PassAuthorization bool
9395 skipAuthRegex []string
9496 skipAuthPreflight bool
97+ skipJwtBearerTokens bool
98+ jwtBearerVerifiers []*oidc.IDTokenVerifier
9599 compiledRegex []*regexp.Regexp
96100 templates *template.Template
97101 Footer string
@@ -206,6 +210,12 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
206210 logger.Printf("compiled skip-auth-regex => %q", u)
207211 }
208212
213+ if opts.SkipJwtBearerTokens {
214+ logger.Printf("Skipping JWT tokens from configured OIDC issuer: %q", opts.OIDCIssuerURL)
215+ for _, issuer := range opts.ExtraJwtIssuers {
216+ logger.Printf("Skipping JWT tokens from extra JWT issuer: %q", issuer)
217+ }
218+ }
209219 redirectURL := opts.redirectURL
210220 if redirectURL.Path == "" {
211221 redirectURL.Path = fmt.Sprintf("%s/callback", opts.ProxyPrefix)
@@ -239,25 +249,27 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
239249 OAuthCallbackPath: fmt.Sprintf("%s/callback", opts.ProxyPrefix),
240250 AuthOnlyPath: fmt.Sprintf("%s/auth", opts.ProxyPrefix),
241251
242− ProxyPrefix: opts.ProxyPrefix,
243− provider: opts.provider,
244− sessionStore: opts.sessionStore,
245− serveMux: serveMux,
246− redirectURL: redirectURL,
247− whitelistDomains: opts.WhitelistDomains,
248− skipAuthRegex: opts.SkipAuthRegex,
249− skipAuthPreflight: opts.SkipAuthPreflight,
250− compiledRegex: opts.CompiledRegex,
251− SetXAuthRequest: opts.SetXAuthRequest,
252− PassBasicAuth: opts.PassBasicAuth,
253− PassUserHeaders: opts.PassUserHeaders,
254− BasicAuthPassword: opts.BasicAuthPassword,
255− PassAccessToken: opts.PassAccessToken,
256− SetAuthorization: opts.SetAuthorization,
257− PassAuthorization: opts.PassAuthorization,
258− SkipProviderButton: opts.SkipProviderButton,
259− templates: loadTemplates(opts.CustomTemplatesDir),
260− Footer: opts.Footer,
252+ ProxyPrefix: opts.ProxyPrefix,
253+ provider: opts.provider,
254+ sessionStore: opts.sessionStore,
255+ serveMux: serveMux,
256+ redirectURL: redirectURL,
257+ whitelistDomains: opts.WhitelistDomains,
258+ skipAuthRegex: opts.SkipAuthRegex,
259+ skipAuthPreflight: opts.SkipAuthPreflight,
260+ skipJwtBearerTokens: opts.SkipJwtBearerTokens,
261+ jwtBearerVerifiers: opts.jwtBearerVerifiers,
262+ compiledRegex: opts.CompiledRegex,
263+ SetXAuthRequest: opts.SetXAuthRequest,
264+ PassBasicAuth: opts.PassBasicAuth,
265+ PassUserHeaders: opts.PassUserHeaders,
266+ BasicAuthPassword: opts.BasicAuthPassword,
267+ PassAccessToken: opts.PassAccessToken,
268+ SetAuthorization: opts.SetAuthorization,
269+ PassAuthorization: opts.PassAuthorization,
270+ SkipProviderButton: opts.SkipProviderButton,
271+ templates: loadTemplates(opts.CustomTemplatesDir),
272+ Footer: opts.Footer,
261273 }
262274}
263275
@@ -693,26 +705,42 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
693705// Returns nil, ErrNeedsLogin if user needs to login.
694706// Set-Cookie headers may be set on the response as a side-effect of calling this method.
695707func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.Request) (*sessionsapi.SessionState, error) {
708+ var session *sessionsapi.SessionState
709+ var err error
696710 var saveSession, clearSession, revalidated bool
697− remoteAddr := getRemoteAddr(req)
698711
699− session, err := p.LoadCookiedSession(req)
700− if err != nil {
701− logger.Printf("Error loading cookied session: %s", err)
712+ if p.skipJwtBearerTokens && req.Header.Get("Authorization") != "" {
713+ session, err = p.GetJwtSession(req)
714+ if err != nil {
715+ logger.Printf("Error validating JWT token from Authorization header: %s", err)
716+ }
717+ if session != nil {
718+ saveSession = false
719+ }
702720 }
703− if session != nil && session.Age() > p.CookieRefresh && p.CookieRefresh != time.Duration(0) {
704− logger.Printf("Refreshing %s old session cookie for %s (refresh after %s)", session.Age(), session, p.CookieRefresh)
705− saveSession = true
721+
722+ remoteAddr := getRemoteAddr(req)
723+ if session == nil {
724+ session, err = p.LoadCookiedSession(req)
725+ if err != nil {
726+ logger.Printf("Error loading cookied session: %s", err)
727+ }
728+ if session != nil && session.Age() > p.CookieRefresh && p.CookieRefresh != time.Duration(0) {
729+ logger.Printf("Refreshing %s old session cookie for %s (refresh after %s)", session.Age(), session, p.CookieRefresh)
730+ saveSession = true
731+ }
706732 }
707733
708− var ok bool
709− if ok, err = p.provider.RefreshSessionIfNeeded(session); err != nil {
710− logger.Printf("%s removing session. error refreshing access token %s %s", remoteAddr, err, session)
711− clearSession = true
712− session = nil
713− } else if ok {
714− saveSession = true
715− revalidated = true
734+ if session != nil {
735+ var ok bool
736+ if ok, err = p.provider.RefreshSessionIfNeeded(session); err != nil {
737+ logger.Printf("%s removing session. error refreshing access token %s %s", remoteAddr, err, session)
738+ clearSession = true
739+ session = nil
740+ } else if ok {
741+ saveSession = true
742+ revalidated = true
743+ }
716744 }
717745
718746 if session != nil && session.IsExpired() {
@@ -854,3 +882,92 @@ func (p *OAuthProxy) ErrorJSON(rw http.ResponseWriter, code int) {
854882 rw.Header().Set("Content-Type", applicationJSON)
855883 rw.WriteHeader(code)
856884}
885+
886+// GetJwtSession loads a session based on a JWT token in the authorization header.
887+func (p *OAuthProxy) GetJwtSession(req *http.Request) (*sessionsapi.SessionState, error) {
888+ rawBearerToken, err := p.findBearerToken(req)
889+ if err != nil {
890+ return nil, err
891+ }
892+
893+ ctx := context.Background()
894+ var session *sessionsapi.SessionState
895+ for _, verifier := range p.jwtBearerVerifiers {
896+ bearerToken, err := verifier.Verify(ctx, rawBearerToken)
897+
898+ if err != nil {
899+ logger.Printf("failed to verify bearer token: %v", err)
900+ continue
901+ }
902+
903+ var claims struct {
904+ Email string `json:"email"`
905+ Verified *bool `json:"email_verified"`
906+ }
907+
908+ if err := bearerToken.Claims(&claims); err != nil {
909+ return nil, fmt.Errorf("failed to parse bearer token claims: %v", err)
910+ }
911+
912+ if claims.Email == "" {
913+ return nil, fmt.Errorf("id_token did not contain an email")
914+ }
915+
916+ if claims.Verified != nil && !*claims.Verified {
917+ return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
918+ }
919+ user := strings.Split(claims.Email, "@")[0]
920+
921+ session = &sessionsapi.SessionState{
922+ AccessToken: rawBearerToken,
923+ IDToken: rawBearerToken,
924+ RefreshToken: "",
925+ ExpiresOn: bearerToken.Expiry,
926+ Email: claims.Email,
927+ User: user,
928+ }
929+ return session, nil
930+ }
931+ return nil, fmt.Errorf("unable to verify jwt token %s", req.Header.Get("Authorization"))
932+}
933+
934+// findBearerToken finds a valid JWT token from the Authorization header of a given request.
935+func (p *OAuthProxy) findBearerToken(req *http.Request) (string, error) {
936+ auth := req.Header.Get("Authorization")
937+ s := strings.SplitN(auth, " ", 2)
938+ if len(s) != 2 {
939+ return "", fmt.Errorf("invalid authorization header %s", auth)
940+ }
941+
942+ var rawBearerToken string
943+ if s[0] == "Bearer" {
944+ rawBearerToken = s[1]
945+ } else if s[0] == "Basic" {
946+ // Check if we have a Bearer token masquerading in Basic
947+ b, err := b64.StdEncoding.DecodeString(s[1])
948+ if err != nil {
949+ return "", err
950+ }
951+ pair := strings.SplitN(string(b), ":", 2)
952+ if len(pair) != 2 {
953+ return "", fmt.Errorf("invalid format %s", b)
954+ }
955+ user, password := pair[0], pair[1]
956+
957+ // check user, user+password, or just password for a token
958+ jwtRegex := regexp.MustCompile(`^eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`)
959+ if jwtRegex.MatchString(user) {
960+ // Support blank passwords or magic `x-oauth-basic` passwords - nothing else
961+ if password == "" || password == "x-oauth-basic" {
962+ rawBearerToken = user
963+ }
964+ } else if jwtRegex.MatchString(password) {
965+ // support passwords and ignore user
966+ rawBearerToken = password
967+ }
968+ } else {
969+ return "", fmt.Errorf("invalid authorization header %s", auth)
970+ }
971+
972+ return rawBearerToken, nil
973+}