2021-05-04 22:06:05 +00:00
|
|
|
package oidc
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
2022-04-07 05:33:53 +00:00
|
|
|
"crypto/sha256"
|
|
|
|
"database/sql"
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
2021-05-04 22:06:05 +00:00
|
|
|
"time"
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
"github.com/google/uuid"
|
2021-05-04 22:06:05 +00:00
|
|
|
"github.com/ory/fosite"
|
|
|
|
|
2021-08-11 01:04:35 +00:00
|
|
|
"github.com/authelia/authelia/v4/internal/authorization"
|
|
|
|
"github.com/authelia/authelia/v4/internal/configuration/schema"
|
|
|
|
"github.com/authelia/authelia/v4/internal/logging"
|
2022-04-07 05:33:53 +00:00
|
|
|
"github.com/authelia/authelia/v4/internal/model"
|
|
|
|
"github.com/authelia/authelia/v4/internal/storage"
|
2021-05-04 22:06:05 +00:00
|
|
|
)
|
|
|
|
|
2022-11-13 03:26:10 +00:00
|
|
|
// NewStore returns a Store when provided with a schema.OpenIDConnectConfiguration and storage.Provider.
|
|
|
|
func NewStore(config *schema.OpenIDConnectConfiguration, provider storage.Provider) (store *Store) {
|
2021-08-03 22:54:45 +00:00
|
|
|
logger := logging.Logger()
|
|
|
|
|
2022-10-20 02:16:36 +00:00
|
|
|
store = &Store{
|
2022-04-07 05:33:53 +00:00
|
|
|
provider: provider,
|
2023-04-13 10:58:18 +00:00
|
|
|
clients: map[string]Client{},
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
}
|
2021-05-04 22:06:05 +00:00
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
for _, client := range config.Clients {
|
2022-12-17 12:39:24 +00:00
|
|
|
policy := authorization.NewLevel(client.Policy)
|
2021-08-03 22:54:45 +00:00
|
|
|
logger.Debugf("Registering client %s with policy %s (%v)", client.ID, client.Policy, policy)
|
2021-05-04 22:06:05 +00:00
|
|
|
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
store.clients[client.ID] = NewClient(client)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2021-11-23 09:45:38 +00:00
|
|
|
return store
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GenerateOpaqueUserID either retrieves or creates an opaque user id from a sectorID and username.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GenerateOpaqueUserID(ctx context.Context, sectorID, username string) (opaqueID *model.UserOpaqueIdentifier, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
if opaqueID, err = s.provider.LoadUserOpaqueIdentifierBySignature(ctx, "openid", sectorID, username); err != nil {
|
|
|
|
return nil, err
|
|
|
|
} else if opaqueID == nil {
|
|
|
|
if opaqueID, err = model.NewUserOpaqueIdentifier("openid", sectorID, username); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if err = s.provider.SaveUserOpaqueIdentifier(ctx, *opaqueID); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return opaqueID, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetSubject returns a subject UUID for a username. If it exists, it returns the existing one, otherwise it creates and saves it.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetSubject(ctx context.Context, sectorID, username string) (subject uuid.UUID, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
var opaqueID *model.UserOpaqueIdentifier
|
|
|
|
|
|
|
|
if opaqueID, err = s.GenerateOpaqueUserID(ctx, sectorID, username); err != nil {
|
|
|
|
return uuid.UUID{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return opaqueID.Identifier, nil
|
|
|
|
}
|
|
|
|
|
2021-05-04 22:06:05 +00:00
|
|
|
// GetClientPolicy retrieves the policy from the client with the matching provided id.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetClientPolicy(id string) (level authorization.Level) {
|
2022-04-07 05:33:53 +00:00
|
|
|
client, err := s.GetFullClient(id)
|
2021-05-04 22:06:05 +00:00
|
|
|
if err != nil {
|
|
|
|
return authorization.TwoFactor
|
|
|
|
}
|
|
|
|
|
2023-04-13 10:58:18 +00:00
|
|
|
return client.GetAuthorizationPolicy()
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetFullClient returns a fosite.Client asserted as an Client matching the provided id.
|
2023-04-13 10:58:18 +00:00
|
|
|
func (s *Store) GetFullClient(id string) (client Client, err error) {
|
2021-05-04 22:06:05 +00:00
|
|
|
client, ok := s.clients[id]
|
|
|
|
if !ok {
|
2023-04-08 04:48:55 +00:00
|
|
|
return nil, fosite.ErrInvalidClient
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return client, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsValidClientID returns true if the provided id exists in the OpenIDConnectProvider.Clients map.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) IsValidClientID(id string) (valid bool) {
|
2022-04-07 05:33:53 +00:00
|
|
|
_, err := s.GetFullClient(id)
|
2021-05-04 22:06:05 +00:00
|
|
|
|
|
|
|
return err == nil
|
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// BeginTX starts a transaction.
|
|
|
|
// This implements a portion of fosite storage.Transactional interface.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) BeginTX(ctx context.Context) (c context.Context, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.BeginTX(ctx)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// Commit completes a transaction.
|
|
|
|
// This implements a portion of fosite storage.Transactional interface.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) Commit(ctx context.Context) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.Commit(ctx)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// Rollback rolls a transaction back.
|
|
|
|
// This implements a portion of fosite storage.Transactional interface.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) Rollback(ctx context.Context) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.Rollback(ctx)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetClient loads the client by its ID or returns an error if the client does not exist or another error occurred.
|
|
|
|
// This implements a portion of fosite.ClientManager.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetClient(_ context.Context, id string) (client fosite.Client, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.GetFullClient(id)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// ClientAssertionJWTValid returns an error if the JTI is known or the DB check failed and nil if the JTI is not known.
|
|
|
|
// This implements a portion of fosite.ClientManager.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) ClientAssertionJWTValid(ctx context.Context, jti string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
signature := fmt.Sprintf("%x", sha256.Sum256([]byte(jti)))
|
|
|
|
|
|
|
|
blacklistedJTI, err := s.provider.LoadOAuth2BlacklistedJTI(ctx, signature)
|
|
|
|
|
|
|
|
switch {
|
|
|
|
case errors.Is(sql.ErrNoRows, err):
|
|
|
|
return nil
|
|
|
|
case err != nil:
|
|
|
|
return err
|
|
|
|
case blacklistedJTI.ExpiresAt.After(time.Now()):
|
|
|
|
return fosite.ErrJTIKnown
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// SetClientAssertionJWT marks a JTI as known for the given expiry time. Before inserting the new JTI, it will clean
|
|
|
|
// up any existing JTIs that have expired as those tokens can not be replayed due to the expiry.
|
|
|
|
// This implements a portion of fosite.ClientManager.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) SetClientAssertionJWT(ctx context.Context, jti string, exp time.Time) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
blacklistedJTI := model.NewOAuth2BlacklistedJTI(jti, exp)
|
|
|
|
|
|
|
|
return s.provider.SaveOAuth2BlacklistedJTI(ctx, blacklistedJTI)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// CreateAuthorizeCodeSession stores the authorization request for a given authorization code.
|
|
|
|
// This implements a portion of oauth2.AuthorizeCodeStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) CreateAuthorizeCodeSession(ctx context.Context, code string, request fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.saveSession(ctx, storage.OAuth2SessionTypeAuthorizeCode, code, request)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// InvalidateAuthorizeCodeSession is called when an authorize code is being used. The state of the authorization
|
|
|
|
// code should be set to invalid and consecutive requests to GetAuthorizeCodeSession should return the
|
|
|
|
// ErrInvalidatedAuthorizeCode error.
|
|
|
|
// This implements a portion of oauth2.AuthorizeCodeStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) InvalidateAuthorizeCodeSession(ctx context.Context, code string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.DeactivateOAuth2Session(ctx, storage.OAuth2SessionTypeAuthorizeCode, code)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetAuthorizeCodeSession hydrates the session based on the given code and returns the authorization request.
|
|
|
|
// If the authorization code has been invalidated with `InvalidateAuthorizeCodeSession`, this
|
|
|
|
// method should return the ErrInvalidatedAuthorizeCode error.
|
|
|
|
// Make sure to also return the fosite.Requester value when returning the fosite.ErrInvalidatedAuthorizeCode error!
|
|
|
|
// This implements a portion of oauth2.AuthorizeCodeStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetAuthorizeCodeSession(ctx context.Context, code string, session fosite.Session) (request fosite.Requester, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
// TODO: Implement the fosite.ErrInvalidatedAuthorizeCode error above. This requires splitting the invalidated sessions and deleted sessions.
|
2023-03-06 03:58:50 +00:00
|
|
|
return s.loadRequesterBySignature(ctx, storage.OAuth2SessionTypeAuthorizeCode, code, session)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// CreateAccessTokenSession stores the authorization request for a given access token.
|
|
|
|
// This implements a portion of oauth2.AccessTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) CreateAccessTokenSession(ctx context.Context, signature string, request fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.saveSession(ctx, storage.OAuth2SessionTypeAccessToken, signature, request)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// DeleteAccessTokenSession marks an access token session as deleted.
|
|
|
|
// This implements a portion of oauth2.AccessTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) DeleteAccessTokenSession(ctx context.Context, signature string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeAccessToken, signature)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2023-02-05 07:11:30 +00:00
|
|
|
// RevokeAccessToken revokes an access token as specified in: https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
|
2022-04-07 05:33:53 +00:00
|
|
|
// If the token passed to the request is an access token, the server MAY revoke the respective refresh token as well.
|
|
|
|
// This implements a portion of oauth2.TokenRevocationStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) RevokeAccessToken(ctx context.Context, requestID string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.revokeSessionByRequestID(ctx, storage.OAuth2SessionTypeAccessToken, requestID)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetAccessTokenSession gets the authorization request for a given access token.
|
|
|
|
// This implements a portion of oauth2.AccessTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
|
2023-03-06 03:58:50 +00:00
|
|
|
return s.loadRequesterBySignature(ctx, storage.OAuth2SessionTypeAccessToken, signature, session)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// CreateRefreshTokenSession stores the authorization request for a given refresh token.
|
|
|
|
// This implements a portion of oauth2.RefreshTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) CreateRefreshTokenSession(ctx context.Context, signature string, request fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.saveSession(ctx, storage.OAuth2SessionTypeRefreshToken, signature, request)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// DeleteRefreshTokenSession marks the authorization request for a given refresh token as deleted.
|
|
|
|
// This implements a portion of oauth2.RefreshTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) DeleteRefreshTokenSession(ctx context.Context, signature string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeRefreshToken, signature)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2023-02-05 07:11:30 +00:00
|
|
|
// RevokeRefreshToken revokes a refresh token as specified in: https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
|
2022-04-07 05:33:53 +00:00
|
|
|
// If the particular token is a refresh token and the authorization server supports the revocation of access tokens,
|
|
|
|
// then the authorization server SHOULD also invalidate all access tokens based on the same authorization grant (see Implementation Note).
|
|
|
|
// This implements a portion of oauth2.TokenRevocationStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) RevokeRefreshToken(ctx context.Context, requestID string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.DeactivateOAuth2SessionByRequestID(ctx, storage.OAuth2SessionTypeRefreshToken, requestID)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2023-02-05 07:11:30 +00:00
|
|
|
// RevokeRefreshTokenMaybeGracePeriod revokes an access token as specified in: https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
|
2022-04-07 05:33:53 +00:00
|
|
|
// If the token passed to the request is an access token, the server MAY revoke the respective refresh token as well.
|
|
|
|
// This implements a portion of oauth2.TokenRevocationStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) RevokeRefreshTokenMaybeGracePeriod(ctx context.Context, requestID string, signature string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.RevokeRefreshToken(ctx, requestID)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetRefreshTokenSession gets the authorization request for a given refresh token.
|
|
|
|
// This implements a portion of oauth2.RefreshTokenStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
|
2023-03-06 03:58:50 +00:00
|
|
|
return s.loadRequesterBySignature(ctx, storage.OAuth2SessionTypeRefreshToken, signature, session)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// CreatePKCERequestSession stores the authorization request for a given PKCE request.
|
|
|
|
// This implements a portion of pkce.PKCERequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) CreatePKCERequestSession(ctx context.Context, signature string, request fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.saveSession(ctx, storage.OAuth2SessionTypePKCEChallenge, signature, request)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// DeletePKCERequestSession marks the authorization request for a given PKCE request as deleted.
|
|
|
|
// This implements a portion of pkce.PKCERequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) DeletePKCERequestSession(ctx context.Context, signature string) (err error) {
|
2023-04-19 04:27:10 +00:00
|
|
|
return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypePKCEChallenge, signature)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetPKCERequestSession gets the authorization request for a given PKCE request.
|
|
|
|
// This implements a portion of pkce.PKCERequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (requester fosite.Requester, err error) {
|
2023-03-06 03:58:50 +00:00
|
|
|
return s.loadRequesterBySignature(ctx, storage.OAuth2SessionTypePKCEChallenge, signature, session)
|
2022-01-12 15:52:15 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// CreateOpenIDConnectSession creates an open id connect session for a given authorize code.
|
|
|
|
// This is relevant for explicit open id connect flow.
|
|
|
|
// This implements a portion of openid.OpenIDConnectRequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) CreateOpenIDConnectSession(ctx context.Context, authorizeCode string, request fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.saveSession(ctx, storage.OAuth2SessionTypeOpenIDConnect, authorizeCode, request)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// DeleteOpenIDConnectSession just implements the method required by fosite even though it's unused.
|
|
|
|
// This implements a portion of openid.OpenIDConnectRequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) DeleteOpenIDConnectSession(ctx context.Context, authorizeCode string) (err error) {
|
2023-04-19 04:27:10 +00:00
|
|
|
return s.revokeSessionBySignature(ctx, storage.OAuth2SessionTypeOpenIDConnect, authorizeCode)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// GetOpenIDConnectSession returns error:
|
|
|
|
// - nil if a session was found,
|
|
|
|
// - ErrNoSessionFound if no session was found
|
|
|
|
// - or an arbitrary error if an error occurred.
|
|
|
|
// This implements a portion of openid.OpenIDConnectRequestStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) GetOpenIDConnectSession(ctx context.Context, authorizeCode string, request fosite.Requester) (r fosite.Requester, err error) {
|
2023-03-06 03:58:50 +00:00
|
|
|
return s.loadRequesterBySignature(ctx, storage.OAuth2SessionTypeOpenIDConnect, authorizeCode, request.GetSession())
|
|
|
|
}
|
|
|
|
|
|
|
|
// CreatePARSession stores the pushed authorization request context. The requestURI is used to derive the key.
|
|
|
|
// This implements a portion of fosite.PARStorage.
|
|
|
|
func (s *Store) CreatePARSession(ctx context.Context, requestURI string, request fosite.AuthorizeRequester) (err error) {
|
|
|
|
var par *model.OAuth2PARContext
|
|
|
|
|
|
|
|
if par, err = model.NewOAuth2PARContext(requestURI, request); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return s.provider.SaveOAuth2PARContext(ctx, *par)
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetPARSession gets the push authorization request context. The caller is expected to merge the AuthorizeRequest.
|
|
|
|
// This implements a portion of fosite.PARStorage.
|
|
|
|
func (s *Store) GetPARSession(ctx context.Context, requestURI string) (request fosite.AuthorizeRequester, err error) {
|
|
|
|
var par *model.OAuth2PARContext
|
|
|
|
|
|
|
|
if par, err = s.provider.LoadOAuth2PARContext(ctx, requestURI); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return par.ToAuthorizeRequest(ctx, NewSession(), s)
|
|
|
|
}
|
|
|
|
|
|
|
|
// DeletePARSession deletes the context.
|
|
|
|
// This implements a portion of fosite.PARStorage.
|
|
|
|
func (s *Store) DeletePARSession(ctx context.Context, requestURI string) (err error) {
|
|
|
|
return s.provider.RevokeOAuth2PARContext(ctx, requestURI)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// IsJWTUsed implements an interface required for RFC7523.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) IsJWTUsed(ctx context.Context, jti string) (used bool, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
if err = s.ClientAssertionJWTValid(ctx, jti); err != nil {
|
|
|
|
return true, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return false, nil
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2022-04-07 05:33:53 +00:00
|
|
|
// MarkJWTUsedForTime implements an interface required for rfc7523.RFC7523KeyStorage.
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) MarkJWTUsedForTime(ctx context.Context, jti string, exp time.Time) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.SetClientAssertionJWT(ctx, jti, exp)
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|
|
|
|
|
2023-03-06 03:58:50 +00:00
|
|
|
func (s *Store) loadRequesterBySignature(ctx context.Context, sessionType storage.OAuth2SessionType, signature string, session fosite.Session) (r fosite.Requester, err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
var (
|
|
|
|
sessionModel *model.OAuth2Session
|
|
|
|
)
|
|
|
|
|
|
|
|
sessionModel, err = s.provider.LoadOAuth2Session(ctx, sessionType, signature)
|
|
|
|
if err != nil {
|
|
|
|
switch {
|
|
|
|
case errors.Is(err, sql.ErrNoRows):
|
|
|
|
return nil, fosite.ErrNotFound
|
|
|
|
default:
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if r, err = sessionModel.ToRequest(ctx, session, s); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if !sessionModel.Active && sessionType == storage.OAuth2SessionTypeAuthorizeCode {
|
|
|
|
return r, fosite.ErrInvalidatedAuthorizeCode
|
|
|
|
}
|
|
|
|
|
|
|
|
return r, nil
|
|
|
|
}
|
|
|
|
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) saveSession(ctx context.Context, sessionType storage.OAuth2SessionType, signature string, r fosite.Requester) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
var session *model.OAuth2Session
|
|
|
|
|
|
|
|
if session, err = model.NewOAuth2SessionFromRequest(signature, r); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return s.provider.SaveOAuth2Session(ctx, sessionType, *session)
|
|
|
|
}
|
|
|
|
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) revokeSessionBySignature(ctx context.Context, sessionType storage.OAuth2SessionType, signature string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
return s.provider.RevokeOAuth2Session(ctx, sessionType, signature)
|
|
|
|
}
|
|
|
|
|
2022-10-20 02:16:36 +00:00
|
|
|
func (s *Store) revokeSessionByRequestID(ctx context.Context, sessionType storage.OAuth2SessionType, requestID string) (err error) {
|
2022-04-07 05:33:53 +00:00
|
|
|
if err = s.provider.RevokeOAuth2SessionByRequestID(ctx, sessionType, requestID); err != nil {
|
|
|
|
switch {
|
|
|
|
case errors.Is(err, sql.ErrNoRows):
|
|
|
|
return fosite.ErrNotFound
|
|
|
|
default:
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
2021-05-04 22:06:05 +00:00
|
|
|
}
|