@@ -5,6 +5,10 @@ import (
55 "fmt"
66 "net/http"
77 "net/url"
8+ "encoding/json"
9+ "io/ioutil"
10+ "bytes"
11+ "time"
812
913 "github.com/bitly/go-simplejson"
1014 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
@@ -65,6 +69,67 @@ func (p *AzureProvider) Configure(tenant string) {
6569 }
6670}
6771
72+func (p *AzureProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {
73+ if code == "" {
74+ err = errors.New("missing code")
75+ return
76+ }
77+
78+ params := url.Values{}
79+ params.Add("redirect_uri", redirectURL)
80+ params.Add("client_id", p.ClientID)
81+ params.Add("client_secret", p.ClientSecret)
82+ params.Add("code", code)
83+ params.Add("grant_type", "authorization_code")
84+ if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
85+ params.Add("resource", p.ProtectedResource.String())
86+ }
87+
88+ var req *http.Request
89+ req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
90+ if err != nil {
91+ return
92+ }
93+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
94+
95+ var resp *http.Response
96+ resp, err = http.DefaultClient.Do(req)
97+ if err != nil {
98+ return nil, err
99+ }
100+ var body []byte
101+ body, err = ioutil.ReadAll(resp.Body)
102+ resp.Body.Close()
103+ if err != nil {
104+ return
105+ }
106+
107+ if resp.StatusCode != 200 {
108+ err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
109+ return
110+ }
111+
112+ var jsonResponse struct {
113+ AccessToken string `json:"access_token"`
114+ RefreshToken string `json:"refresh_token"`
115+ ExpiresOn int64 `json:"expires_on,string"`
116+ IDToken string `json:"id_token"`
117+ }
118+ err = json.Unmarshal(body, &jsonResponse)
119+ if err != nil {
120+ return
121+ }
122+
123+ s = &sessions.SessionState{
124+ AccessToken: jsonResponse.AccessToken,
125+ IDToken: jsonResponse.IDToken,
126+ CreatedAt: time.Now(),
127+ ExpiresOn: time.Unix(jsonResponse.ExpiresOn, 0),
128+ RefreshToken: jsonResponse.RefreshToken,
129+ }
130+ return
131+}
132+
68133func getAzureHeader(accessToken string) http.Header {
69134 header := make(http.Header)
70135 header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))