public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix other packages that rely on verifiers

This commit is contained in:
Joel Speed 2022-02-16 15:55:44 +00:00 committed by Joel Speed
parent 1f992b3f87
commit 82710a7ac1
No known key found for this signature in database
GPG Key ID: 6E80578D6751DEFB
3 changed files with 29 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
oauthproxy_test.go
View File

@ -1747,7 +1747,7 @@ func TestGetJwtSession(t *testing.T) {
verifier := oidc.NewVerifier("https://issuer.example.com", keyset, verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
&oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true, &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true,
SkipClientIDCheck: true}) SkipClientIDCheck: true})
verificationOptions := &internaloidc.IDTokenVerificationOptions{ verificationOptions := internaloidc.IDTokenVerificationOptions{
AudienceClaims: []string{"aud"}, AudienceClaims: []string{"aud"},
ClientID: "https://test.myapp.com", ClientID: "https://test.myapp.com",
ExtraAudiences: []string{}, ExtraAudiences: []string{},

22
pkg/apis/options/options.go
View File

@ -68,26 +68,26 @@ type Options struct {
// internal values that are set after config validation // internal values that are set after config validation
redirectURL *url.URL redirectURL *url.URL
signatureData *SignatureData signatureData *SignatureData
oidcVerifier *internaloidc.IDTokenVerifier oidcVerifier internaloidc.IDTokenVerifier
jwtBearerVerifiers []*internaloidc.IDTokenVerifier jwtBearerVerifiers []internaloidc.IDTokenVerifier
realClientIPParser ipapi.RealClientIPParser realClientIPParser ipapi.RealClientIPParser
} }
// Options for Getting internal values // Options for Getting internal values
func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL } func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }
func (o *Options) GetSignatureData() *SignatureData { return o.signatureData } func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }
func (o *Options) GetOIDCVerifier() *internaloidc.IDTokenVerifier { return o.oidcVerifier } func (o *Options) GetOIDCVerifier() internaloidc.IDTokenVerifier { return o.oidcVerifier }
func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier { func (o *Options) GetJWTBearerVerifiers() []internaloidc.IDTokenVerifier {
return o.jwtBearerVerifiers return o.jwtBearerVerifiers
} }
func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser } func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser }
// Options for Setting internal values // Options for Setting internal values
func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s } func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }
func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s } func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s } func (o *Options) SetOIDCVerifier(s internaloidc.IDTokenVerifier) { o.oidcVerifier = s }
func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s } func (o *Options) SetJWTBearerVerifiers(s []internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }
func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s } func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }
// NewOptions constructs a new Options with defaulted values // NewOptions constructs a new Options with defaulted values
func NewOptions() *Options { func NewOptions() *Options {

41
pkg/validation/options.go
View File

@ -8,13 +8,11 @@ import (
"net/url" "net/url"
"strings" "strings"
"github.com/coreos/go-oidc/v3/oidc"
"github.com/mbland/hmacauth" "github.com/mbland/hmacauth"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options" "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip" "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger" "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc" internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util" "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
) )
@ -148,32 +146,27 @@ func parseJwtIssuers(issuers []string, msgs []string) ([]jwtIssuer, []string) {
// newVerifierFromJwtIssuer takes in issuer information in jwtIssuer info and returns // newVerifierFromJwtIssuer takes in issuer information in jwtIssuer info and returns
// a verifier for that issuer. // a verifier for that issuer.
func newVerifierFromJwtIssuer(audienceClaims []string, extraAudiences []string, jwtIssuer jwtIssuer) (*internaloidc.IDTokenVerifier, error) { func newVerifierFromJwtIssuer(audienceClaims []string, extraAudiences []string, jwtIssuer jwtIssuer) (internaloidc.IDTokenVerifier, error) {
config := &oidc.Config{ pvOpts := internaloidc.ProviderVerifierOptions{
ClientID: jwtIssuer.audience,
SkipClientIDCheck: true, // client id check is done within oauth2-proxy: IDTokenVerifier.Verify
}
// Try as an OpenID Connect Provider first
var verifier *oidc.IDTokenVerifier
provider, err := oidc.NewProvider(context.Background(), jwtIssuer.issuerURI)
if err != nil {
// Try as JWKS URI
jwksURI := strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
if err := requests.New(jwksURI).Do().Error(); err != nil {
return nil, err
}
verifier = oidc.NewVerifier(jwtIssuer.issuerURI, oidc.NewRemoteKeySet(context.Background(), jwksURI), config)
} else {
verifier = provider.Verifier(config)
}
verificationOptions := &internaloidc.IDTokenVerificationOptions{
AudienceClaims: audienceClaims, AudienceClaims: audienceClaims,
ClientID: jwtIssuer.audience, ClientID: jwtIssuer.audience,
ExtraAudiences: extraAudiences, ExtraAudiences: extraAudiences,
// ExtraAudiences: o.Providers[0].OIDCConfig.ExtraAudiences, IssuerURL: jwtIssuer.issuerURI,
} }
return internaloidc.NewVerifier(verifier, verificationOptions), nil
pv, err := internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
if err != nil {
// If the discovery didn't work, try again without discovery
pvOpts.JWKsURL = strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
pvOpts.SkipDiscovery = true
pv, err = internaloidc.NewProviderVerifier(context.TODO(), pvOpts)
if err != nil {
return nil, fmt.Errorf("could not construct provider verifier for JWT Issuer: %v", err)
}
}
return pv.Verifier(), nil
} }
// jwtIssuer hold parsed JWT issuer info that's used to construct a verifier. // jwtIssuer hold parsed JWT issuer info that's used to construct a verifier.