towk/opaal
1
0
Fork 0
mirror of https://github.com/davidallendj/opaal.git synced 2025-12-20 03:27:02 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed issue with JWKS fetching

Browse source
This commit is contained in:
David Allen 2024-03-05 20:42:58 -07:00
parent 082c891ac4
commit 1e2242bad1
No known key found for this signature in database
GPG key ID: 1D2A29322FBB6FCB
2 changed files with 17 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

7
cmd/login.go
View file

@ -22,15 +22,22 @@ var loginCmd = &cobra.Command{
// try and find client with valid identity provider config // try and find client with valid identity provider config
var provider *oidc.IdentityProvider var provider *oidc.IdentityProvider
for _, c := range config.Authentication.Clients { for _, c := range config.Authentication.Clients {
// try to get identity provider info locally first
_, err := db.GetIdentityProvider(config.Options.CachePath, c.Issuer) _, err := db.GetIdentityProvider(config.Options.CachePath, c.Issuer)
if err != nil && !config.Options.LocalOnly { if err != nil && !config.Options.LocalOnly {
fmt.Printf("fetching config from issuer: %v\n", c.Issuer) fmt.Printf("fetching config from issuer: %v\n", c.Issuer)
// try to get info remotely by fetching // try to get info remotely by fetching
provider, err = oidc.FetchServerConfig(c.Issuer) provider, err = oidc.FetchServerConfig(c.Issuer)
if err != nil { if err != nil {
fmt.Printf("failed to fetch server config: %v\n", err)
continue continue
} }
client = c client = c
// fetch the provider's JWKS
err := provider.FetchJwks()
if err != nil {
fmt.Printf("failed to fetch JWKS: %v\n", err)
}
break break
} }
} }

33
internal/oidc/oidc.go
View file

@ -9,14 +9,14 @@ import (
"net/http" "net/http"
"os" "os"
"github.com/lestrrat-go/jwx/jwk" "github.com/lestrrat-go/jwx/v2/jwk"
) )
type IdentityProvider struct { type IdentityProvider struct {
Issuer string `db:"issuer" json:"issuer" yaml:"issuer"` Issuer string `db:"issuer" json:"issuer" yaml:"issuer"`
Endpoints Endpoints `db:"endpoints" json:"endpoints" yaml:"endpoints"` Endpoints Endpoints `db:"endpoints" json:"endpoints" yaml:"endpoints"`
Supported Supported `db:"supported" json:"supported" yaml:"supported"` Supported Supported `db:"supported" json:"supported" yaml:"supported"`
Key jwk.Key Jwks jwk.Set
} }
type Endpoints struct { type Endpoints struct {
@ -25,7 +25,7 @@ type Endpoints struct {
Revocation string `db:"revocation_endpoint" json:"revocation_endpoint" yaml:"revocation"` Revocation string `db:"revocation_endpoint" json:"revocation_endpoint" yaml:"revocation"`
Introspection string `db:"introspection_endpoint" json:"introspection_endpoint" yaml:"introspection"` Introspection string `db:"introspection_endpoint" json:"introspection_endpoint" yaml:"introspection"`
UserInfo string `db:"userinfo_endpoint" json:"userinfo_endpoint" yaml:"userinfo"` UserInfo string `db:"userinfo_endpoint" json:"userinfo_endpoint" yaml:"userinfo"`
Jwks string `db:"jwks_uri" json:"jwks_uri" yaml:"jwks_uri"` JwksUri string `db:"jwks_uri" json:"jwks_uri" yaml:"jwks_uri"`
} }
type Supported struct { type Supported struct {
ResponseTypes []string `db:"response_types_supported" json:"response_types_supported"` ResponseTypes []string `db:"response_types_supported" json:"response_types_supported"`
@ -46,7 +46,7 @@ func NewIdentityProvider() *IdentityProvider {
Revocation: p.Issuer + "/oauth/revocation", Revocation: p.Issuer + "/oauth/revocation",
Introspection: p.Issuer + "/oauth/introspect", Introspection: p.Issuer + "/oauth/introspect",
UserInfo: p.Issuer + "/oauth/userinfo", UserInfo: p.Issuer + "/oauth/userinfo",
Jwks: p.Issuer + "/oauth/discovery/keys", JwksUri: p.Issuer + "/oauth/discovery/keys",
} }
p.Supported = Supported{ p.Supported = Supported{
ResponseTypes: []string{"code"}, ResponseTypes: []string{"code"},
@ -134,31 +134,18 @@ func FetchServerConfig(issuer string) (*IdentityProvider, error) {
return &p, nil return &p, nil
} }
func (p *IdentityProvider) FetchJwk() error { func (p *IdentityProvider) FetchJwks() error {
if p.Endpoints.Jwks == "" { if p.Endpoints.JwksUri == "" {
return fmt.Errorf("JWKS endpoint not set") return fmt.Errorf("JWKS endpoint not set")
} }
// fetch JWKS from identity provider // fetch JWKS from identity provider
ctx, cancel := context.WithCancel(context.Background()) ctx, cancel := context.WithCancel(context.Background())
defer cancel() defer cancel()
set, err := jwk.Fetch(ctx, p.Endpoints.Jwks) var err error
p.Jwks, err = jwk.Fetch(ctx, p.Endpoints.JwksUri)
if err != nil { if err != nil {
return fmt.Errorf("%v", err) return fmt.Errorf("failed to fetch JWKS: %v", err)
}
// get the first JWK from set
for it := set.Iterate(context.Background()); it.Next(context.Background()); {
pair := it.Pair()
p.Key = pair.Value.(jwk.Key)
return nil
} }
return fmt.Errorf("failed to load public key: %v", err) return nil
}
func (p *IdentityProvider) GetRawJwk() (any, error) {
var rawkey any
if err := p.Key.Raw(&rawkey); err != nil {
return nil, fmt.Errorf("failed to get raw key: %v", err)
}
return rawkey, nil
} }