118 lines
3.2 KiB
Go
118 lines
3.2 KiB
Go
package app
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
type oidcDiscovery struct {
|
|
Issuer string `json:"issuer"`
|
|
UserInfo string `json:"userinfo_endpoint"`
|
|
TokenURL string `json:"token_endpoint"`
|
|
AuthURL string `json:"authorization_endpoint"`
|
|
}
|
|
|
|
func (a *App) fetchOIDCDiscovery() (oidcDiscovery, error) {
|
|
if strings.TrimSpace(a.cfg.OIDCIssuerURL) == "" {
|
|
return oidcDiscovery{}, errors.New("OIDC_ISSUER_URL is required")
|
|
}
|
|
u := a.cfg.OIDCIssuerURL + "/.well-known/openid-configuration"
|
|
resp, err := http.Get(u)
|
|
if err != nil {
|
|
return oidcDiscovery{}, err
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(resp.Body)
|
|
if resp.StatusCode >= 300 {
|
|
return oidcDiscovery{}, fmt.Errorf("oidc discovery failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
|
|
}
|
|
var d oidcDiscovery
|
|
if err := json.Unmarshal(body, &d); err != nil {
|
|
return oidcDiscovery{}, err
|
|
}
|
|
if strings.TrimSpace(d.UserInfo) == "" {
|
|
return oidcDiscovery{}, errors.New("oidc discovery missing userinfo_endpoint")
|
|
}
|
|
return d, nil
|
|
}
|
|
|
|
func (a *App) validateBearerToken(token string) (User, error) {
|
|
d, err := a.fetchOIDCDiscovery()
|
|
if err != nil {
|
|
return User{}, err
|
|
}
|
|
req, err := http.NewRequest(http.MethodGet, d.UserInfo, nil)
|
|
if err != nil {
|
|
return User{}, err
|
|
}
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return User{}, err
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(resp.Body)
|
|
if resp.StatusCode >= 300 {
|
|
return User{}, fmt.Errorf("oidc userinfo failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
|
|
}
|
|
var claims map[string]any
|
|
if err := json.Unmarshal(body, &claims); err != nil {
|
|
return User{}, err
|
|
}
|
|
if aud := strings.TrimSpace(a.cfg.OIDCAudience); aud != "" {
|
|
if !claimContainsAudience(claims["aud"], aud) {
|
|
return User{}, errors.New("token audience does not match configured OIDC_AUDIENCE")
|
|
}
|
|
}
|
|
username := firstStringClaim(claims, "preferred_username", "username", "sub")
|
|
if strings.TrimSpace(username) == "" {
|
|
return User{}, errors.New("oidc token missing preferred_username/username/sub")
|
|
}
|
|
email := firstStringClaim(claims, "email")
|
|
return User{Username: username, Email: email}, nil
|
|
}
|
|
|
|
func claimContainsAudience(v any, expected string) bool {
|
|
switch t := v.(type) {
|
|
case string:
|
|
return strings.EqualFold(strings.TrimSpace(t), expected)
|
|
case []any:
|
|
for _, item := range t {
|
|
if s, ok := item.(string); ok && strings.EqualFold(strings.TrimSpace(s), expected) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func firstStringClaim(claims map[string]any, keys ...string) string {
|
|
for _, k := range keys {
|
|
if v, ok := claims[k]; ok {
|
|
if s, ok := v.(string); ok && strings.TrimSpace(s) != "" {
|
|
return strings.TrimSpace(s)
|
|
}
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func postForm(urlStr string, values url.Values) ([]byte, int, error) {
|
|
req, err := http.NewRequest(http.MethodPost, urlStr, strings.NewReader(values.Encode()))
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(resp.Body)
|
|
return body, resp.StatusCode, nil
|
|
}
|