Add OIDC discovery and empty user info

webishdev · Aug 27, 2024 · ef81a3e · ef81a3e
1 parent b2c5954
commit ef81a3e
Show file tree

Hide file tree

Showing 17 changed files with 289 additions and 85 deletions.
diff --git a/cmd/stopnik/commands.go b/cmd/stopnik/commands.go
@@ -69,7 +69,7 @@ func readConfiguration(configurationFile *string, configLoader *config.Loader) (
 	}
 	logger.SetLogLevel(currentConfig.Server.LogLevel)
 	logger.Info("Config loaded from %s", *configurationFile)
-	if currentConfig.GetOIDC() {
+	if currentConfig.GetOidc() {
 		logger.Info("OpenId Connect is enabled")
 	}
 

diff --git a/internal/config/config.go b/internal/config/config.go
@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	internalHttp "github.com/webishdev/stopnik/internal/http"
 	"github.com/webishdev/stopnik/log"
 	"math/big"
 )
@@ -80,7 +81,7 @@ type Client struct {
 	Id                      string   `yaml:"id"`
 	ClientSecret            string   `yaml:"clientSecret"`
 	Salt                    string   `yaml:"salt"`
-	OIDC                    bool     `yaml:"oidc"`
+	Oidc                    bool     `yaml:"oidc"`
 	ClientType              string   `yaml:"type"`
 	AccessTTL               int      `yaml:"accessTTL"`
 	RefreshTTL              int      `yaml:"refreshTTL"`
@@ -220,7 +221,7 @@ func (config *Config) Setup() error {
 			return errors.New(invalidClient)
 		}
 
-		config.oidc = config.oidc || client.OIDC
+		config.oidc = config.oidc || client.Oidc
 	}
 
 	config.userMap = setup[User](&config.Users, func(user User) string {
@@ -292,7 +293,7 @@ func (config *Config) GetFooterText() string {
 	return GetOrDefaultString(config.UI.FooterText, "STOPnik")
 }
 
-func (config *Config) GetOIDC() bool {
+func (config *Config) GetOidc() bool {
 	return config.oidc
 }
 
@@ -304,8 +305,11 @@ func (client *Client) GetRefreshTTL() int {
 	return GetOrDefaultInt(client.RefreshTTL, 0)
 }
 
-func (client *Client) GetIssuer() string {
-	return GetOrDefaultString(client.Issuer, "STOPnik")
+func (client *Client) GetIssuer(requestData *internalHttp.RequestData) string {
+	if requestData == nil || requestData.Host == "" || requestData.Scheme == "" {
+		return GetOrDefaultString(client.Issuer, "STOPnik")
+	}
+	return GetOrDefaultString(client.Issuer, requestData.IssuerString())
 }
 
 func (client *Client) GetAudience() []string {

diff --git a/internal/config/config_test.go b/internal/config/config_test.go
@@ -2,6 +2,7 @@ package config
 
 import (
 	"errors"
+	internalHttp "github.com/webishdev/stopnik/internal/http"
 	"reflect"
 	"testing"
 )
@@ -452,7 +453,7 @@ func assertClientValues(t *testing.T, config *Config, id string, expectedAccessT
 		t.Errorf("expected refresh TTL to be %d, got %d", expectedRefreshTTL, refreshTTL)
 	}
 
-	issuer := client.GetIssuer()
+	issuer := client.GetIssuer(&internalHttp.RequestData{})
 	if issuer != expectedIssuer {
 		t.Errorf("expected issuer to be '%s', got '%s'", expectedIssuer, issuer)
 	}

diff --git a/internal/endpoint/endpoint.go b/internal/endpoint/endpoint.go
@@ -10,4 +10,6 @@ const (
 	Revoke        string = "/revoke"
 	Metadata      string = "/.well-known/oauth-authorization-server"
 	Keys          string = "/keys"
+	OidcDiscovery string = "/.well-known/openid-configuration"
+	OidcUserInfo  string = "/userinfo"
 )
diff --git a/internal/http/request.go b/internal/http/request.go
@@ -0,0 +1,48 @@
+package http
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+)
+
+type RequestData struct {
+	Scheme   string
+	Host     string
+	Path     string
+	Query    string
+	Fragment string
+}
+
+func NewRequestData(r *http.Request) *RequestData {
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+
+	query := ""
+	if r.URL.RawQuery != "" {
+		query = "?" + r.URL.RawQuery
+	}
+	fragment := ""
+	if r.URL.RawFragment != "" {
+		fragment = "#" + r.URL.RawFragment
+	}
+	return &RequestData{
+		Scheme:   scheme,
+		Host:     r.Host,
+		Path:     r.URL.RawPath,
+		Query:    query,
+		Fragment: fragment,
+	}
+}
+
+func (r *RequestData) IssuerString() string {
+	return fmt.Sprintf("%s://%s", r.Scheme, r.Host)
+}
+
+func (r *RequestData) URL() (*url.URL, error) {
+	uri := fmt.Sprintf("%s://%s%s%s%s", r.Scheme, r.Host, r.Path, r.Query, r.Fragment)
+
+	return url.Parse(uri)
+}
diff --git a/internal/manager/token.go b/internal/manager/token.go
@@ -11,6 +11,7 @@ import (
 	"github.com/webishdev/stopnik/internal/oauth2"
 	"github.com/webishdev/stopnik/internal/store"
 	"github.com/webishdev/stopnik/log"
+	"net/http"
 	"strings"
 	"time"
 )
@@ -53,14 +54,15 @@ func (tokenManager *TokenManager) RevokeRefreshToken(refreshToken *oauth2.Refres
 	refreshTokenStore.Delete(refreshToken.Key)
 }
 
-func (tokenManager *TokenManager) CreateAccessTokenResponse(username string, client *config.Client, scopes []string, nonce string) oauth2.AccessTokenResponse {
+func (tokenManager *TokenManager) CreateAccessTokenResponse(r *http.Request, username string, client *config.Client, scopes []string, nonce string) oauth2.AccessTokenResponse {
 	log.Debug("Creating new access token for %s, access TTL %d, refresh TTL %d", client.Id, client.GetAccessTTL(), client.GetRefreshTTL())
 
+	requestData := internalHttp.NewRequestData(r)
 	accessTokenStore := *tokenManager.accessTokenStore
 	refreshTokenStore := *tokenManager.refreshTokenStore
 
 	accessTokenDuration := time.Minute * time.Duration(client.GetAccessTTL())
-	accessTokenKey := tokenManager.generateAccessToken(username, client, accessTokenDuration)
+	accessTokenKey := tokenManager.generateAccessToken(requestData, username, client, accessTokenDuration)
 	accessToken := &oauth2.AccessToken{
 		Key:       accessTokenKey,
 		TokenType: oauth2.TtBearer,
@@ -79,7 +81,7 @@ func (tokenManager *TokenManager) CreateAccessTokenResponse(username string, cli
 
 	if client.GetRefreshTTL() > 0 {
 		refreshTokenDuration := time.Minute * time.Duration(client.GetRefreshTTL())
-		refreshTokenKey := tokenManager.generateAccessToken(username, client, refreshTokenDuration)
+		refreshTokenKey := tokenManager.generateAccessToken(requestData, username, client, refreshTokenDuration)
 		refreshToken := &oauth2.RefreshToken{
 			Key:      refreshTokenKey,
 			Username: username,
@@ -92,11 +94,11 @@ func (tokenManager *TokenManager) CreateAccessTokenResponse(username string, cli
 		accessTokenResponse.RefreshTokenKey = refreshTokenKey
 	}
 
-	if client.OIDC {
+	if client.Oidc {
 		user, userExists := tokenManager.config.GetUser(username)
 		if userExists {
 			idTokenDuration := time.Minute * time.Duration(client.GetAccessTTL())
-			idTokenKey := tokenManager.generateIdToken(user, client, nonce, idTokenDuration)
+			idTokenKey := tokenManager.generateIdToken(requestData, user, client, nonce, idTokenDuration)
 			accessTokenResponse.IdToken = idTokenKey
 		}
 	}
@@ -126,17 +128,17 @@ func (tokenManager *TokenManager) ValidateAccessToken(authorizationHeader string
 	return user, accessToken.Scopes, true
 }
 
-func (tokenManager *TokenManager) generateIdToken(user *config.User, client *config.Client, nonce string, duration time.Duration) string {
-	idToken := generateIdToken(user, client, nonce, duration)
+func (tokenManager *TokenManager) generateIdToken(requestData *internalHttp.RequestData, user *config.User, client *config.Client, nonce string, duration time.Duration) string {
+	idToken := generateIdToken(requestData, user, client, nonce, duration)
 	return tokenManager.generateJWTToken(client, idToken)
 }
 
-func (tokenManager *TokenManager) generateAccessToken(username string, client *config.Client, duration time.Duration) string {
+func (tokenManager *TokenManager) generateAccessToken(requestData *internalHttp.RequestData, username string, client *config.Client, duration time.Duration) string {
 	tokenId := uuid.New()
 	if client.OpaqueToken {
 		return tokenManager.generateOpaqueAccessToken(tokenId.String())
 	}
-	accessToken := generateAccessToken(tokenId.String(), duration, username, client)
+	accessToken := generateAccessToken(requestData, tokenId.String(), duration, username, client)
 	return tokenManager.generateJWTToken(client, accessToken)
 }
 
@@ -187,7 +189,7 @@ func (tokenManager *TokenManager) generateJWTToken(client *config.Client, token
 
 }
 
-func generateIdToken(user *config.User, client *config.Client, nonce string, duration time.Duration) jwt.Token {
+func generateIdToken(requestData *internalHttp.RequestData, user *config.User, client *config.Client, nonce string, duration time.Duration) jwt.Token {
 	tokenId := uuid.New().String()
 	builder := jwt.NewBuilder().
 		Expiration(time.Now().Add(duration)). // https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.4
@@ -197,7 +199,7 @@ func generateIdToken(user *config.User, client *config.Client, nonce string, dur
 	builder.JwtID(tokenId)
 
 	// https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.1
-	builder.Issuer(client.GetIssuer())
+	builder.Issuer(client.GetIssuer(requestData))
 
 	// https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.2
 	builder.Subject(user.Username)
@@ -218,7 +220,7 @@ func generateIdToken(user *config.User, client *config.Client, nonce string, dur
 	return token
 }
 
-func generateAccessToken(tokenId string, duration time.Duration, username string, client *config.Client) jwt.Token {
+func generateAccessToken(requestData *internalHttp.RequestData, tokenId string, duration time.Duration, username string, client *config.Client) jwt.Token {
 	builder := jwt.NewBuilder().
 		Expiration(time.Now().Add(duration)). // https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.4
 		IssuedAt(time.Now())                  // https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.6
@@ -232,7 +234,7 @@ func generateAccessToken(tokenId string, duration time.Duration, username string
 	builder.JwtID(tokenId)
 
 	// https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.1
-	builder.Issuer(client.GetIssuer())
+	builder.Issuer(client.GetIssuer(requestData))
 
 	// https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.2
 	builder.Subject(username)

diff --git a/internal/manager/token_test.go b/internal/manager/token_test.go
@@ -3,8 +3,11 @@ package manager
 import (
 	"fmt"
 	"github.com/webishdev/stopnik/internal/config"
+	"github.com/webishdev/stopnik/internal/endpoint"
 	internalHttp "github.com/webishdev/stopnik/internal/http"
 	"github.com/webishdev/stopnik/internal/oauth2"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"testing"
 )
@@ -33,7 +36,8 @@ func Test_Token(t *testing.T) {
 				t.Fatal("client does not exist")
 			}
 
-			accessTokenResponse := tokenManager.CreateAccessTokenResponse("foo", client, []string{"abc", "def"}, "")
+			request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+			accessTokenResponse := tokenManager.CreateAccessTokenResponse(request, "foo", client, []string{"abc", "def"}, "")
 
 			if accessTokenResponse.AccessTokenKey == "" {
 				t.Error("empty access token")
@@ -137,7 +141,8 @@ func Test_Token(t *testing.T) {
 			t.Fatal("client does not exist")
 		}
 
-		accessTokenResponse := tokenManager.CreateAccessTokenResponse("bar", client, []string{"abc", "def"}, "")
+		request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+		accessTokenResponse := tokenManager.CreateAccessTokenResponse(request, "bar", client, []string{"abc", "def"}, "")
 
 		_, _, valid := tokenManager.ValidateAccessToken(fmt.Sprintf("%s %s", internalHttp.AuthBearer, accessTokenResponse.AccessTokenKey))
 

diff --git a/internal/server/handler/authorize/authorize.go b/internal/server/handler/authorize/authorize.go
@@ -135,7 +135,7 @@ func (h *Handler) handleGetRequest(w http.ResponseWriter, r *http.Request) {
 		State:               state,
 	}
 
-	if client.OIDC {
+	if client.Oidc {
 		nonceQueryParameter := r.URL.Query().Get(oidc.ParameterNonce)
 		authSession.Nonce = nonceQueryParameter
 	} else {
@@ -157,7 +157,7 @@ func (h *Handler) handleGetRequest(w http.ResponseWriter, r *http.Request) {
 		query := redirectURL.Query()
 
 		if slices.Contains(responseTypes, oauth2.RtToken) {
-			accessTokenResponse := h.tokenManager.CreateAccessTokenResponse(user.Username, client, scopes, authSession.Nonce)
+			accessTokenResponse := h.tokenManager.CreateAccessTokenResponse(r, user.Username, client, scopes, authSession.Nonce)
 			setImplicitGrantParameter(query, accessTokenResponse)
 		} else if slices.Contains(responseTypes, oauth2.RtCode) {
 			setAuthorizationGrantParameter(query, id.String())
@@ -225,7 +225,7 @@ func (h *Handler) handlePostRequest(w http.ResponseWriter, r *http.Request, user
 			h.errorHandler.InternalServerErrorHandler(w, r)
 			return
 		}
-		accessTokenResponse := h.tokenManager.CreateAccessTokenResponse(user.Username, client, authSession.Scopes, authSession.Nonce)
+		accessTokenResponse := h.tokenManager.CreateAccessTokenResponse(r, user.Username, client, authSession.Scopes, authSession.Nonce)
 		setImplicitGrantParameter(query, accessTokenResponse)
 	} else if slices.Contains(responseTypes, oauth2.RtCode) {
 		setAuthorizationGrantParameter(query, authSession.Id)

diff --git a/internal/server/handler/health/health_test.go b/internal/server/handler/health/health_test.go
@@ -72,7 +72,8 @@ func Test_Health(t *testing.T) {
 			t.Error("client should exist")
 		}
 
-		tokenResponse := tokenManager.CreateAccessTokenResponse("foo", client, []string{"a:foo", "b:bar"}, "")
+		request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+		tokenResponse := tokenManager.CreateAccessTokenResponse(request, "foo", client, []string{"a:foo", "b:bar"}, "")
 
 		healthHandler := NewHealthHandler(tokenManager)
 

diff --git a/internal/server/handler/introspect/introspect_test.go b/internal/server/handler/introspect/introspect_test.go
@@ -236,7 +236,8 @@ func testIntrospect(t *testing.T, testConfig *config.Config, keyManger *manager.
 			sessionManager := manager.NewSessionManager(testConfig)
 			tokenManager := manager.NewTokenManager(testConfig, manager.NewDefaultKeyLoader(testConfig, keyManger))
 			sessionManager.StartSession(authSession)
-			accessTokenResponse := tokenManager.CreateAccessTokenResponse(user.Username, client, scopes, "")
+			request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+			accessTokenResponse := tokenManager.CreateAccessTokenResponse(request, user.Username, client, scopes, "")
 
 			introspectHandler := NewIntrospectHandler(testConfig, requestValidator, tokenManager)
 
@@ -253,7 +254,7 @@ func testIntrospect(t *testing.T, testConfig *config.Config, keyManger *manager.
 			)
 			body := strings.NewReader(bodyString)
 
-			request := httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
+			request = httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
 			request.Header.Add(internalHttp.Authorization, fmt.Sprintf("Basic %s", testTokenCreateBasicAuth("foo", "bar")))
 			request.Header.Add(internalHttp.ContentType, "application/x-www-form-urlencoded")
 
@@ -308,7 +309,8 @@ func testIntrospectWithoutHint(t *testing.T, testConfig *config.Config, keyMange
 			sessionManager := manager.NewSessionManager(testConfig)
 			tokenManager := manager.NewTokenManager(testConfig, manager.NewDefaultKeyLoader(testConfig, keyManger))
 			sessionManager.StartSession(authSession)
-			accessTokenResponse := tokenManager.CreateAccessTokenResponse(user.Username, client, scopes, "")
+			request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+			accessTokenResponse := tokenManager.CreateAccessTokenResponse(request, user.Username, client, scopes, "")
 
 			introspectHandler := NewIntrospectHandler(testConfig, requestValidator, tokenManager)
 
@@ -324,7 +326,7 @@ func testIntrospectWithoutHint(t *testing.T, testConfig *config.Config, keyMange
 			)
 			body := strings.NewReader(bodyString)
 
-			request := httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
+			request = httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
 			request.Header.Add(internalHttp.Authorization, fmt.Sprintf("Basic %s", testTokenCreateBasicAuth("foo", "bar")))
 			request.Header.Add(internalHttp.ContentType, "application/x-www-form-urlencoded")
 
@@ -379,7 +381,8 @@ func testIntrospectDisabled(t *testing.T, testConfig *config.Config, keyManger *
 			sessionManager := manager.NewSessionManager(testConfig)
 			tokenManager := manager.NewTokenManager(testConfig, manager.NewDefaultKeyLoader(testConfig, keyManger))
 			sessionManager.StartSession(authSession)
-			accessTokenResponse := tokenManager.CreateAccessTokenResponse(user.Username, client, scopes, "")
+			request := httptest.NewRequest(http.MethodPost, endpoint.Token, nil)
+			accessTokenResponse := tokenManager.CreateAccessTokenResponse(request, user.Username, client, scopes, "")
 
 			introspectHandler := NewIntrospectHandler(testConfig, requestValidator, tokenManager)
 
@@ -396,7 +399,7 @@ func testIntrospectDisabled(t *testing.T, testConfig *config.Config, keyManger *
 			)
 			body := strings.NewReader(bodyString)
 
-			request := httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
+			request = httptest.NewRequest(http.MethodPost, endpoint.Introspect, body)
 			request.Header.Add(internalHttp.Authorization, fmt.Sprintf("Basic %s", testTokenCreateBasicAuth("bar", "bar")))
 			request.Header.Add(internalHttp.ContentType, "application/x-www-form-urlencoded")