Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add PKCE support to the openid-connect plugin #7370

Merged
merged 8 commits into from
Jul 6, 2022
Merged

feat: add PKCE support to the openid-connect plugin #7370

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
67c26d0
add PKCE support to openid plugin
Jul 2, 2022
007e6e9
doc
Jul 2, 2022
f8243c4
fix lint warn
Jul 2, 2022
74900ea
fix ut error
qihaiyan Jul 3, 2022
7900f5a
fix doc
qihaiyan Jul 4, 2022
d5fd80a
Merge branch 'master' into fix-7052
qihaiyan Jul 5, 2022
78c9ee2
add ut
qihaiyan Jul 5, 2022
4bab3b6
add new line
qihaiyan Jul 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions apisix/plugins/openid-connect.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,11 @@ local schema = {
},
public_key = {type = "string"},
token_signing_alg_values_expected = {type = "string"},
use_pkce = {
description = "when set to true the PKEC(Proof Key for Code Exchange) will be used.",
type = "boolean",
default = false
},
set_access_token_header = {
description = "Whether the access token should be added as a header to the request " ..
"for downstream",
Expand Down
1 change: 1 addition & 0 deletions docs/en/latest/plugins/openid-connect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ The `openid-connect` Plugin provides authentication and introspection capability
| public_key | string | False | | | Public key to verify the token. |
| use_jwks | boolean | False | | | When set to true, uses the JWKS endpoint of the identity server to verify the token. |
| token_signing_alg_values_expected | string | False | | | Algorithm used for signing the authentication token. |
| use_pkce | boolean | False | | | when set to true the "Proof Key for Code Exchange" as defined in RFC 7636 will be used. |
qihaiyan marked this conversation as resolved.
Show resolved Hide resolved
| set_access_token_header | boolean | False | true | | When set to true, sets the access token in a request header. |
| access_token_in_authorization_header | boolean | False | false | | When set to true, sets the access token in the `Authorization` header. Otherwise, set the `X-Access-Token` header. |
| set_id_token_header | boolean | False | true | | When set to true and the ID token is available, sets the ID token in the `X-ID-Token` request header. |
Expand Down
1 change: 1 addition & 0 deletions docs/zh/latest/plugins/openid-connect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ description: 本文介绍了关于 Apache APISIX `openid-connect` 插件的基
| introspection_endpoint_auth_method | string | 否 | "client_secret_basic" | | 令牌自省的认证方法名称。 |
| public_key | string | 否 | | | 验证令牌的公钥。 |
| token_signing_alg_values_expected | string | 否 | | | 用于对令牌进行签名的算法。 |
| use_pkce | boolean | 否 | | | 是否使用 PKEC（Proof Key for Code Exchange）。 |
| set_access_token_header | boolean | 否 | true | [true, false] | 在请求头设置访问令牌。 |
| access_token_in_authorization_header | boolean | 否 | false | [true, false] | 当值为 `true` 时，将访问令牌设置在请求头参数 `Authorization`，否则将使用请求头参数 `X-Access-Token`。|
| set_id_token_header | boolean | 否 | true | [true, false] | 是否将 ID 令牌设置到请求头参数 `X-ID-Token`。 |
Expand Down
2 changes: 1 addition & 1 deletion rockspec/apisix-master-0.rockspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ dependencies = {
"opentracing-openresty = 0.1",
"lua-resty-radixtree = 2.8.2",
"lua-protobuf = 0.3.4",
"lua-resty-openidc = 1.7.2-1",
"lua-resty-openidc = 1.7.5",
"luafilesystem = 1.7.0-2",
"api7-lua-tinyyaml = 0.4.2",
"nginx-lua-prometheus = 0.20220527",
Expand Down
5 changes: 3 additions & 2 deletions t/plugin/openid-connect.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,8 @@ done
"redirect_uri": "https://iresty.com",
"ssl_verify": false,
"timeout": 10,
"scope": "apisix"
"scope": "apisix",
"use_pkce": false
}
},
"upstream": {
Expand Down Expand Up @@ -918,7 +919,7 @@ OIDC introspection failed: invalid token
--- request
GET /t
--- response_body
{"access_token_in_authorization_header":false,"bearer_only":false,"client_id":"kbyuFDidLLm280LIwVFiazOqjO3ty8KH","client_secret":"60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa","discovery":"http://127.0.0.1:1980/.well-known/openid-configuration","introspection_endpoint_auth_method":"client_secret_basic","logout_path":"/logout","realm":"apisix","scope":"openid","set_access_token_header":true,"set_id_token_header":true,"set_refresh_token_header":false,"set_userinfo_header":true,"ssl_verify":false,"timeout":3}
{"access_token_in_authorization_header":false,"bearer_only":false,"client_id":"kbyuFDidLLm280LIwVFiazOqjO3ty8KH","client_secret":"60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa","discovery":"http://127.0.0.1:1980/.well-known/openid-configuration","introspection_endpoint_auth_method":"client_secret_basic","logout_path":"/logout","realm":"apisix","scope":"openid","set_access_token_header":true,"set_id_token_header":true,"set_refresh_token_header":false,"set_userinfo_header":true,"ssl_verify":false,"timeout":3,"use_pkce":false}
--- no_error_log
[error]

Expand Down