RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(oidc): client_secret_jwt authentication 

This adds the authentication machinery for the client_secret_jwt Default Client Authentication Strategy.

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
fix-pkce-flow
James Elliott 2023-04-15 20:55:38 +10:00
parent a34b1412ed
commit 435d8e35fd
No known key found for this signature in database
GPG Key ID: 0F1C4A096E857E49
4 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config.template.yml
View File

@ -1521,6 +1521,10 @@ notifier:
## the 'client_secret_jwt' token_endpoint_auth_method. ## the 'client_secret_jwt' token_endpoint_auth_method.
# token_endpoint_auth_signing_alg: HS256 # token_endpoint_auth_signing_alg: HS256
## The permitted client authentication signing algorithm for the Token Endpoint for this client when using
## the 'client_secret_jwt' token_endpoint_auth_method.
# token_endpoint_auth_signing_alg: HS256
## The policy to require for this client; one_factor or two_factor. ## The policy to require for this client; one_factor or two_factor.
# authorization_policy: 'two_factor' # authorization_policy: 'two_factor'

4
internal/configuration/config.template.yml
View File

@ -1521,6 +1521,10 @@ notifier:
## the 'client_secret_jwt' token_endpoint_auth_method. ## the 'client_secret_jwt' token_endpoint_auth_method.
# token_endpoint_auth_signing_alg: HS256 # token_endpoint_auth_signing_alg: HS256
## The permitted client authentication signing algorithm for the Token Endpoint for this client when using
## the 'client_secret_jwt' token_endpoint_auth_method.
# token_endpoint_auth_signing_alg: HS256
## The policy to require for this client; one_factor or two_factor. ## The policy to require for this client; one_factor or two_factor.
# authorization_policy: 'two_factor' # authorization_policy: 'two_factor'

6
internal/oidc/client_auth.go
View File

@ -74,8 +74,8 @@ func (p *OpenIDConnectProvider) DefaultClientAuthenticationStrategy(ctx context.
return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("This requested OAuth 2.0 client only supports client authentication method '%s', however that method is not supported by this server.", oidcClient.GetTokenEndpointAuthMethod())) return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("This requested OAuth 2.0 client only supports client authentication method '%s', however that method is not supported by this server.", oidcClient.GetTokenEndpointAuthMethod()))
} }
if oidcClient.GetTokenEndpointAuthSigningAlgorithm() != fmt.Sprintf("%s", t.Header[JWTHeaderKeyAlgorithm]) { if oidcClient.GetTokenEndpointAuthSigningAlgorithm() != fmt.Sprintf("%s", t.Header[HeaderParameterAlgorithm]) {
return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' uses signing algorithm '%s' but the requested OAuth 2.0 Client enforces signing algorithm '%s'.", t.Header[JWTHeaderKeyAlgorithm], oidcClient.GetTokenEndpointAuthSigningAlgorithm())) return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' uses signing algorithm '%s' but the requested OAuth 2.0 Client enforces signing algorithm '%s'.", t.Header[HeaderParameterAlgorithm], oidcClient.GetTokenEndpointAuthSigningAlgorithm()))
} }
switch t.Method { switch t.Method {
@ -94,7 +94,7 @@ func (p *OpenIDConnectProvider) DefaultClientAuthenticationStrategy(ctx context.
return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("This client does not support authentication method 'client_secret_jwt' as the client secret is not in plaintext.")) return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHint("This client does not support authentication method 'client_secret_jwt' as the client secret is not in plaintext."))
default: default:
return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' request parameter uses unsupported signing algorithm '%s'.", t.Header[JWTHeaderKeyAlgorithm])) return nil, errorsx.WithStack(fosite.ErrInvalidClient.WithHintf("The 'client_assertion' request parameter uses unsupported signing algorithm '%s'.", t.Header[HeaderParameterAlgorithm]))
} }
}) })

7
internal/oidc/const.go
View File

@ -134,6 +134,10 @@ const (
PKCEChallengeMethodSHA256 = "S256" PKCEChallengeMethodSHA256 = "S256"
) )
const (
HeaderParameterAlgorithm = "alg"
)
const ( const (
FormParameterClientID = "client_id" FormParameterClientID = "client_id"
FormParameterClientSecret = "client_secret" FormParameterClientSecret = "client_secret"
@ -166,9 +170,6 @@ const (
const ( const (
// JWTHeaderKeyIdentifier is the JWT Header referencing the JWS Key Identifier used to sign a token. // JWTHeaderKeyIdentifier is the JWT Header referencing the JWS Key Identifier used to sign a token.
JWTHeaderKeyIdentifier = "kid" JWTHeaderKeyIdentifier = "kid"
// JWTHeaderKeyAlgorithm is the JWT Header referencing the JWS Key algorithm used to sign a token.
JWTHeaderKeyAlgorithm = "alg"
) )
const ( const (