git.iko.soy/typeable/oauth2-proxy
on master help sign in
Handle claim finding differently in bearer vs standard IDTokens
dcc7541Nick Meves
providers/oidc.go+10−7
compare with master
unifiedsplit
@@ -157,7 +157,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
157 newSession = &sessions.SessionState{}
157 newSession = &sessions.SessionState{}
158 } else {
158 } else {
159 var err error
159 var err error
160− newSession, err = p.createSessionStateInternal(ctx, token.Extra("id_token").(string), idToken, token)
160+ newSession, err = p.createSessionStateInternal(ctx, token.Extra("id_token").(string), idToken, token, false)
161 if err != nil {
161 if err != nil {
162 return nil, err
162 return nil, err
163 }
163 }
@@ -172,7 +172,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
172}
172}
173
173
174func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
174func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
175− newSession, err := p.createSessionStateInternal(ctx, rawIDToken, idToken, nil)
175+ newSession, err := p.createSessionStateInternal(ctx, rawIDToken, idToken, nil, true)
176 if err != nil {
176 if err != nil {
177 return nil, err
177 return nil, err
178 }
178 }
@@ -185,7 +185,7 @@ func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, ra
185 return newSession, nil
185 return newSession, nil
186}
186}
187
187
188−func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToken string, idToken *oidc.IDToken, token *oauth2.Token) (*sessions.SessionState, error) {
188+func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToken string, idToken *oidc.IDToken, token *oauth2.Token, bearer bool) (*sessions.SessionState, error) {
189
189
190 newSession := &sessions.SessionState{}
190 newSession := &sessions.SessionState{}
191
191
@@ -197,7 +197,7 @@ func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToke
197 accessToken = token.AccessToken
197 accessToken = token.AccessToken
198 }
198 }
199
199
200− claims, err := p.findClaimsFromIDToken(ctx, idToken, accessToken, p.ProfileURL.String())
200+ claims, err := p.findClaimsFromIDToken(ctx, idToken, accessToken, p.ProfileURL.String(), bearer)
201 if err != nil {
201 if err != nil {
202 return nil, fmt.Errorf("couldn't extract claims from id_token (%v)", err)
202 return nil, fmt.Errorf("couldn't extract claims from id_token (%v)", err)
203 }
203 }
@@ -230,7 +230,7 @@ func getOIDCHeader(accessToken string) http.Header {
230 return header
230 return header
231}
231}
232
232
233−func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.IDToken, accessToken string, profileURL string) (*OIDCClaims, error) {
233+func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.IDToken, accessToken string, profileURL string, bearer bool) (*OIDCClaims, error) {
234 claims := &OIDCClaims{}
234 claims := &OIDCClaims{}
235 // Extract default claims.
235 // Extract default claims.
236 if err := idToken.Claims(&claims); err != nil {
236 if err := idToken.Claims(&claims); err != nil {
@@ -249,8 +249,11 @@ func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.
249 // userID claim was not present or was empty in the ID Token
249 // userID claim was not present or was empty in the ID Token
250 if claims.UserID == "" {
250 if claims.UserID == "" {
251 if profileURL == "" {
251 if profileURL == "" {
252+ if bearer {
252− claims.UserID = claims.Subject
253+ claims.UserID = claims.Subject
253− return claims, nil
254+ return claims, nil
255+ }
256+ return nil, fmt.Errorf("id_token did not contain user ID claim (%q)", p.UserIDClaim)
254 }
257 }
255
258
256 // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo
259 // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo