git.iko.soy/typeable/oauth2-proxy
on master help sign in
Fix other packages that rely on verifiers
commit82710a7ac167b745fa56667ca6848832c00ff4a1 authorJoel Speed <joel.speed@hotmail.co.uk> dateWed 16 Feb 2022, 15:55 (5 years ago) parent1f992b3
3 files changed+29−36
compare with master
unifiedsplit
oauthproxy_test.go+1−1 pkg/apis/options/options.go+11−11 pkg/validation/options.go+17−24
oauthproxy_test.go+1−1
@@ -1747,7 +1747,7 @@ func TestGetJwtSession(t *testing.T) {
17471747 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
17481748 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true,
17491749 SkipClientIDCheck: true})
1750− verificationOptions := &internaloidc.IDTokenVerificationOptions{
1750+ verificationOptions := internaloidc.IDTokenVerificationOptions{
17511751 AudienceClaims: []string{"aud"},
17521752 ClientID: "https://test.myapp.com",
17531753 ExtraAudiences: []string{},
pkg/apis/options/options.go+11−11
@@ -68,26 +68,26 @@ type Options struct {
6868 // internal values that are set after config validation
6969 redirectURL *url.URL
7070 signatureData *SignatureData
71− oidcVerifier *internaloidc.IDTokenVerifier
72− jwtBearerVerifiers []*internaloidc.IDTokenVerifier
71+ oidcVerifier internaloidc.IDTokenVerifier
72+ jwtBearerVerifiers []internaloidc.IDTokenVerifier
7373 realClientIPParser ipapi.RealClientIPParser
7474}
7575
7676// Options for Getting internal values
77−func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }
78−func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }
79−func (o *Options) GetOIDCVerifier() *internaloidc.IDTokenVerifier { return o.oidcVerifier }
80−func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier {
77+func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }
78+func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }
79+func (o *Options) GetOIDCVerifier() internaloidc.IDTokenVerifier { return o.oidcVerifier }
80+func (o *Options) GetJWTBearerVerifiers() []internaloidc.IDTokenVerifier {
8181 return o.jwtBearerVerifiers
8282}
8383func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser }
8484
8585// Options for Setting internal values
86−func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }
87−func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
88−func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s }
89−func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }
90−func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }
86+func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }
87+func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
88+func (o *Options) SetOIDCVerifier(s internaloidc.IDTokenVerifier) { o.oidcVerifier = s }
89+func (o *Options) SetJWTBearerVerifiers(s []internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }
90+func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }
9191
9292// NewOptions constructs a new Options with defaulted values
9393func NewOptions() *Options {
pkg/validation/options.go+17−24
@@ -8,13 +8,11 @@ import (
88 "net/url"
99 "strings"
1010
11− "github.com/coreos/go-oidc/v3/oidc"
1211 "github.com/mbland/hmacauth"
1312 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1413 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
1514 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1615 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
17− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1816 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
1917)
2018
@@ -148,32 +146,27 @@ func parseJwtIssuers(issuers []string, msgs []string) ([]jwtIssuer, []string) {
148146
149147// newVerifierFromJwtIssuer takes in issuer information in jwtIssuer info and returns
150148// a verifier for that issuer.
151−func newVerifierFromJwtIssuer(audienceClaims []string, extraAudiences []string, jwtIssuer jwtIssuer) (*internaloidc.IDTokenVerifier, error) {
152− config := &oidc.Config{
153− ClientID: jwtIssuer.audience,
154− SkipClientIDCheck: true, // client id check is done within oauth2-proxy: IDTokenVerifier.Verify
155− }
156− // Try as an OpenID Connect Provider first
157− var verifier *oidc.IDTokenVerifier
158− provider, err := oidc.NewProvider(context.Background(), jwtIssuer.issuerURI)
159− if err != nil {
160− // Try as JWKS URI
161− jwksURI := strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
162− if err := requests.New(jwksURI).Do().Error(); err != nil {
163− return nil, err
164− }
165−
166− verifier = oidc.NewVerifier(jwtIssuer.issuerURI, oidc.NewRemoteKeySet(context.Background(), jwksURI), config)
167− } else {
168− verifier = provider.Verifier(config)
169− }
170− verificationOptions := &internaloidc.IDTokenVerificationOptions{
149+func newVerifierFromJwtIssuer(audienceClaims []string, extraAudiences []string, jwtIssuer jwtIssuer) (internaloidc.IDTokenVerifier, error) {
150+ pvOpts := internaloidc.ProviderVerifierOptions{
171151 AudienceClaims: audienceClaims,
172152 ClientID: jwtIssuer.audience,
173153 ExtraAudiences: extraAudiences,
174− // ExtraAudiences: o.Providers[0].OIDCConfig.ExtraAudiences,
154+ IssuerURL: jwtIssuer.issuerURI,
155+ }
156+
157+ pv, err := internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
158+ if err != nil {
159+ // If the discovery didn't work, try again without discovery
160+ pvOpts.JWKsURL = strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
161+ pvOpts.SkipDiscovery = true
162+
163+ pv, err = internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
164+ if err != nil {
165+ return nil, fmt.Errorf("could not construct provider verifier for JWT Issuer: %v", err)
166+ }
175167 }
176− return internaloidc.NewVerifier(verifier, verificationOptions), nil
168+
169+ return pv.Verifier(), nil
177170}
178171
179172// jwtIssuer hold parsed JWT issuer info that's used to construct a verifier.