big juicy update
This commit is contained in:
parent
8fa8d04427
commit
b58086263b
10 changed files with 106 additions and 427 deletions
397
auth.go
397
auth.go
|
|
@ -2,33 +2,15 @@ package main
|
|||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
type contextKey string
|
||||
|
||||
const userContextKey contextKey = "auth_user"
|
||||
|
||||
const (
|
||||
sessionCookieName = "session_token"
|
||||
stateCookieName = "oidc_state"
|
||||
)
|
||||
|
||||
type User struct {
|
||||
Sub string
|
||||
Email string
|
||||
|
|
@ -36,176 +18,24 @@ type User struct {
|
|||
}
|
||||
|
||||
type Auth struct {
|
||||
issuer string
|
||||
audience string
|
||||
jwksURL string
|
||||
authURL string
|
||||
tokenURL string
|
||||
clientID string
|
||||
clientSecret string
|
||||
redirectURL string
|
||||
logoutURL string
|
||||
devMode bool
|
||||
db *sql.DB
|
||||
|
||||
mu sync.RWMutex
|
||||
keyByKid map[string]*rsa.PublicKey
|
||||
lastSyncAt time.Time
|
||||
devMode bool
|
||||
db *sql.DB
|
||||
}
|
||||
|
||||
func NewAuth(cfg Config) (*Auth, error) {
|
||||
a := &Auth{
|
||||
issuer: cfg.OIDCIssuer,
|
||||
audience: cfg.OIDCAudience,
|
||||
jwksURL: cfg.OIDCJWKSURL,
|
||||
authURL: cfg.OIDCAuthURL,
|
||||
tokenURL: cfg.OIDCTokenURL,
|
||||
clientID: cfg.OIDCClientID,
|
||||
clientSecret: cfg.OIDCClientSecret,
|
||||
redirectURL: cfg.OIDCRedirect,
|
||||
logoutURL: cfg.OIDCLogoutURL,
|
||||
devMode: cfg.DevMode,
|
||||
keyByKid: map[string]*rsa.PublicKey{},
|
||||
lastSyncAt: time.Time{},
|
||||
}
|
||||
if a.devMode {
|
||||
return a, nil
|
||||
}
|
||||
if err := a.refreshKeys(context.Background()); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return a, nil
|
||||
return &Auth{devMode: cfg.DevMode}, nil
|
||||
}
|
||||
|
||||
func (a *Auth) WithDB(db *sql.DB) {
|
||||
a.db = db
|
||||
}
|
||||
|
||||
func (a *Auth) HandleLogin(w http.ResponseWriter, r *http.Request) {
|
||||
if a.devMode {
|
||||
http.Redirect(w, r, "/dashboard", http.StatusFound)
|
||||
return
|
||||
}
|
||||
state, err := randomToken(24)
|
||||
if err != nil {
|
||||
http.Error(w, "failed to initialize login", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: stateCookieName,
|
||||
Value: state,
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: false,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: 600,
|
||||
})
|
||||
|
||||
q := url.Values{}
|
||||
q.Set("client_id", a.clientID)
|
||||
q.Set("response_type", "code")
|
||||
q.Set("scope", "openid profile email")
|
||||
q.Set("redirect_uri", a.redirectURL)
|
||||
q.Set("state", state)
|
||||
http.Redirect(w, r, a.authURL+"?"+q.Encode(), http.StatusFound)
|
||||
}
|
||||
|
||||
func (a *Auth) HandleCallback(w http.ResponseWriter, r *http.Request) {
|
||||
if a.devMode {
|
||||
http.Redirect(w, r, "/dashboard", http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
stateCookie, err := r.Cookie(stateCookieName)
|
||||
if err != nil {
|
||||
http.Error(w, "missing state cookie", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
stateParam := r.URL.Query().Get("state")
|
||||
if stateParam == "" || stateParam != stateCookie.Value {
|
||||
http.Error(w, "invalid state", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
code := r.URL.Query().Get("code")
|
||||
if code == "" {
|
||||
http.Error(w, "missing authorization code", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
token, err := a.exchangeCode(r.Context(), code)
|
||||
if err != nil {
|
||||
http.Error(w, "token exchange failed", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
if _, err := a.userFromToken(token); err != nil {
|
||||
http.Error(w, "invalid access token", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: sessionCookieName,
|
||||
Value: token,
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: false,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: 3600,
|
||||
})
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: stateCookieName,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: false,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: -1,
|
||||
})
|
||||
http.Redirect(w, r, "/dashboard", http.StatusFound)
|
||||
}
|
||||
|
||||
func (a *Auth) HandleLogout(w http.ResponseWriter, r *http.Request) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: sessionCookieName,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: false,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: -1,
|
||||
})
|
||||
if !a.devMode && a.logoutURL != "" {
|
||||
http.Redirect(w, r, a.logoutURL, http.StatusFound)
|
||||
return
|
||||
}
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
}
|
||||
|
||||
func (a *Auth) RequireAuth(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
var (
|
||||
user User
|
||||
err error
|
||||
)
|
||||
|
||||
if a.devMode {
|
||||
user = User{
|
||||
Sub: "demo-user-001",
|
||||
Email: "demo@example.com",
|
||||
Name: "Demo User",
|
||||
}
|
||||
} else {
|
||||
cookie, cErr := r.Cookie(sessionCookieName)
|
||||
if cErr != nil || strings.TrimSpace(cookie.Value) == "" {
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
return
|
||||
}
|
||||
user, err = a.userFromToken(cookie.Value)
|
||||
if err != nil {
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
return
|
||||
}
|
||||
user, ok := a.userFromRequest(r)
|
||||
if !ok {
|
||||
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
if a.db != nil {
|
||||
|
|
@ -222,6 +52,33 @@ func (a *Auth) RequireAuth(next http.Handler) http.Handler {
|
|||
})
|
||||
}
|
||||
|
||||
func (a *Auth) userFromRequest(r *http.Request) (User, bool) {
|
||||
if a.devMode {
|
||||
return User{Sub: "demo-user-001", Email: "demo@example.com", Name: "Demo User"}, true
|
||||
}
|
||||
|
||||
sub := strings.TrimSpace(r.Header.Get("X-Authentik-Uid"))
|
||||
if sub == "" {
|
||||
sub = strings.TrimSpace(r.Header.Get("X-Forwarded-User"))
|
||||
}
|
||||
email := strings.TrimSpace(r.Header.Get("X-Authentik-Email"))
|
||||
name := strings.TrimSpace(r.Header.Get("X-Authentik-Name"))
|
||||
if name == "" {
|
||||
name = strings.TrimSpace(r.Header.Get("X-Forwarded-Preferred-Username"))
|
||||
}
|
||||
|
||||
if sub == "" {
|
||||
return User{}, false
|
||||
}
|
||||
if email == "" {
|
||||
email = sub
|
||||
}
|
||||
if name == "" {
|
||||
name = email
|
||||
}
|
||||
return User{Sub: sub, Email: email, Name: name}, true
|
||||
}
|
||||
|
||||
func MustUserFromContext(ctx context.Context) User {
|
||||
v := ctx.Value(userContextKey)
|
||||
if v == nil {
|
||||
|
|
@ -232,189 +89,3 @@ func MustUserFromContext(ctx context.Context) User {
|
|||
}
|
||||
return User{}
|
||||
}
|
||||
|
||||
func (a *Auth) exchangeCode(ctx context.Context, code string) (string, error) {
|
||||
form := url.Values{}
|
||||
form.Set("grant_type", "authorization_code")
|
||||
form.Set("code", code)
|
||||
form.Set("client_id", a.clientID)
|
||||
form.Set("client_secret", a.clientSecret)
|
||||
form.Set("redirect_uri", a.redirectURL)
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, a.tokenURL, strings.NewReader(form.Encode()))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
|
||||
return "", fmt.Errorf("token endpoint failed: %s %s", resp.Status, string(body))
|
||||
}
|
||||
|
||||
var tr struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&tr); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if tr.AccessToken == "" {
|
||||
return "", errors.New("missing access_token")
|
||||
}
|
||||
return tr.AccessToken, nil
|
||||
}
|
||||
|
||||
func (a *Auth) userFromToken(token string) (User, error) {
|
||||
parser := jwt.NewParser(jwt.WithValidMethods([]string{"RS256"}))
|
||||
parsed, err := parser.Parse(token, func(t *jwt.Token) (any, error) {
|
||||
kid, _ := t.Header["kid"].(string)
|
||||
if kid == "" {
|
||||
return nil, errors.New("missing kid")
|
||||
}
|
||||
key, err := a.lookupKey(context.Background(), kid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return key, nil
|
||||
})
|
||||
if err != nil || !parsed.Valid {
|
||||
return User{}, errors.New("invalid token")
|
||||
}
|
||||
|
||||
claims, ok := parsed.Claims.(jwt.MapClaims)
|
||||
if !ok {
|
||||
return User{}, errors.New("invalid claims")
|
||||
}
|
||||
if iss, _ := claims["iss"].(string); iss != a.issuer {
|
||||
return User{}, errors.New("invalid issuer")
|
||||
}
|
||||
if !audienceMatches(claims["aud"], a.audience) {
|
||||
return User{}, errors.New("invalid audience")
|
||||
}
|
||||
|
||||
sub, _ := claims["sub"].(string)
|
||||
email, _ := claims["email"].(string)
|
||||
name, _ := claims["name"].(string)
|
||||
if sub == "" {
|
||||
return User{}, errors.New("missing sub")
|
||||
}
|
||||
return User{Sub: sub, Email: email, Name: name}, nil
|
||||
}
|
||||
|
||||
func (a *Auth) lookupKey(ctx context.Context, kid string) (*rsa.PublicKey, error) {
|
||||
a.mu.RLock()
|
||||
key := a.keyByKid[kid]
|
||||
last := a.lastSyncAt
|
||||
a.mu.RUnlock()
|
||||
if key != nil {
|
||||
return key, nil
|
||||
}
|
||||
if time.Since(last) > time.Minute {
|
||||
if err := a.refreshKeys(ctx); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
a.mu.RLock()
|
||||
defer a.mu.RUnlock()
|
||||
if refreshed := a.keyByKid[kid]; refreshed != nil {
|
||||
return refreshed, nil
|
||||
}
|
||||
}
|
||||
return nil, fmt.Errorf("no key for kid %s", kid)
|
||||
}
|
||||
|
||||
type jwksDoc struct {
|
||||
Keys []struct {
|
||||
Kid string `json:"kid"`
|
||||
Kty string `json:"kty"`
|
||||
N string `json:"n"`
|
||||
E string `json:"e"`
|
||||
} `json:"keys"`
|
||||
}
|
||||
|
||||
func (a *Auth) refreshKeys(ctx context.Context) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, a.jwksURL, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("jwks request failed: %s", resp.Status)
|
||||
}
|
||||
|
||||
var doc jwksDoc
|
||||
if err := json.NewDecoder(resp.Body).Decode(&doc); err != nil {
|
||||
return err
|
||||
}
|
||||
newKeys := map[string]*rsa.PublicKey{}
|
||||
for _, k := range doc.Keys {
|
||||
if k.Kty != "RSA" || k.Kid == "" || k.N == "" || k.E == "" {
|
||||
continue
|
||||
}
|
||||
pub, err := rsaKeyFromJWK(k.N, k.E)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
newKeys[k.Kid] = pub
|
||||
}
|
||||
if len(newKeys) == 0 {
|
||||
return errors.New("no usable jwks keys")
|
||||
}
|
||||
a.mu.Lock()
|
||||
a.keyByKid = newKeys
|
||||
a.lastSyncAt = time.Now()
|
||||
a.mu.Unlock()
|
||||
return nil
|
||||
}
|
||||
|
||||
func rsaKeyFromJWK(nB64, eB64 string) (*rsa.PublicKey, error) {
|
||||
nBytes, err := base64.RawURLEncoding.DecodeString(nB64)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
eBytes, err := base64.RawURLEncoding.DecodeString(eB64)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
n := new(big.Int).SetBytes(nBytes)
|
||||
e := 0
|
||||
for _, b := range eBytes {
|
||||
e = e<<8 + int(b)
|
||||
}
|
||||
if e == 0 {
|
||||
return nil, errors.New("invalid exponent")
|
||||
}
|
||||
return &rsa.PublicKey{N: n, E: e}, nil
|
||||
}
|
||||
|
||||
func audienceMatches(audValue any, expected string) bool {
|
||||
switch v := audValue.(type) {
|
||||
case string:
|
||||
return v == expected
|
||||
case []any:
|
||||
for _, item := range v {
|
||||
s, ok := item.(string)
|
||||
if ok && s == expected {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func randomToken(n int) (string, error) {
|
||||
b := make([]byte, n)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue