diff --git a/cmd/serve.go b/cmd/serve.go
index b68b814..67cec1a 100644
--- a/cmd/serve.go
+++ b/cmd/serve.go
@@ -2,7 +2,6 @@ package cmd
import (
opaal "davidallendj/opaal/internal"
- "davidallendj/opaal/internal/oidc"
"errors"
"fmt"
"net/http"
@@ -10,13 +9,9 @@ import (
"github.com/spf13/cobra"
)
-var (
- endpoints oidc.Endpoints
-)
-
-var serveCmd = &cobra.Command{
+var exampleCmd = &cobra.Command{
Use: "serve",
- Short: "Start an simple, bare minimal identity provider server",
+ Short: "Start an simple identity provider server",
Long: "The built-in identity provider is not (nor meant to be) a complete OIDC implementation and behaves like an external IdP",
Run: func(cmd *cobra.Command, args []string) {
s := opaal.NewServerWithConfig(&config)
@@ -26,15 +21,11 @@ var serveCmd = &cobra.Command{
if errors.Is(err, http.ErrServerClosed) {
fmt.Printf("Identity provider server closed.\n")
} else if err != nil {
- fmt.Printf("failed to start server: %v", err)
+ fmt.Errorf("failed to start server: %v", err)
}
},
}
func init() {
- serveCmd.Flags().StringVar(&endpoints.Authorization, "endpoints.authorization", "", "set the authorization endpoint for the identity provider")
- serveCmd.Flags().StringVar(&endpoints.Token, "endpoints.token", "", "set the token endpoint for the identity provider")
- serveCmd.Flags().StringVar(&endpoints.JwksUri, "endpoints.jwks_uri", "", "set the JWKS endpoints for the identity provider")
-
- rootCmd.AddCommand(serveCmd)
+ rootCmd.AddCommand(exampleCmd)
}
diff --git a/internal/config.go b/internal/config.go
index 9108ac1..8e2139f 100644
--- a/internal/config.go
+++ b/internal/config.go
@@ -2,7 +2,6 @@ package opaal
import (
"davidallendj/opaal/internal/oauth"
- "davidallendj/opaal/internal/oidc"
"log"
"os"
"path/filepath"
@@ -73,18 +72,11 @@ type Config struct {
}
func NewConfig() Config {
- config := Config{
+ return Config{
Version: goutil.GetCommit(),
Server: server.Server{
Host: "127.0.0.1",
Port: 3333,
- Issuer: server.IdentityProviderServer{
- Endpoints: oidc.Endpoints{
- Authorization: "",
- Token: "",
- JwksUri: "",
- },
- },
},
Options: Options{
RunOnce: true,
@@ -107,7 +99,6 @@ func NewConfig() Config {
},
},
}
- return config
}
func LoadConfig(path string) Config {
diff --git a/internal/flows/jwt_bearer.go b/internal/flows/jwt_bearer.go
index a0287d9..2e93265 100644
--- a/internal/flows/jwt_bearer.go
+++ b/internal/flows/jwt_bearer.go
@@ -51,9 +51,6 @@ func NewJwtBearerFlow(eps JwtBearerFlowEndpoints, params JwtBearerFlowParams) (s
if client == nil {
return "", fmt.Errorf("invalid client (client is nil)")
}
- if verbose {
- fmt.Printf("ID token (IDP): %s\n access token (IDP): %s", accessToken, idToken)
- }
if accessToken != "" {
_, err := jws.Verify([]byte(accessToken), jws.WithKeySet(client.Provider.KeySet), jws.WithValidateKey(true))
if err != nil {
diff --git a/internal/login.go b/internal/login.go
index b6aaf84..ab51747 100644
--- a/internal/login.go
+++ b/internal/login.go
@@ -42,9 +42,8 @@ func Login(config *Config) error {
AuthProvider: &oidc.IdentityProvider{
Issuer: config.Authorization.Endpoints.Issuer,
Endpoints: oidc.Endpoints{
- Config: config.Authorization.Endpoints.Config,
- Authorization: config.Authorization.Endpoints.Authorize,
- JwksUri: config.Authorization.Endpoints.JwksUri,
+ Config: config.Authorization.Endpoints.Config,
+ JwksUri: config.Authorization.Endpoints.JwksUri,
},
},
JwtBearerEndpoints: flows.JwtBearerFlowEndpoints{
diff --git a/internal/new.go b/internal/new.go
index 2799d88..55d9cda 100644
--- a/internal/new.go
+++ b/internal/new.go
@@ -90,11 +90,9 @@ func NewServerWithConfig(conf *Config) *server.Server {
},
Host: host,
Port: port,
- Issuer: server.IdentityProviderServer{
- Host: conf.Server.Issuer.Host,
- Port: conf.Server.Issuer.Port,
- Endpoints: conf.Server.Issuer.Endpoints,
- Clients: conf.Server.Issuer.Clients,
+ Issuer: server.Issuer{
+ Host: conf.Server.Issuer.Host,
+ Port: conf.Server.Issuer.Port,
},
}
return server
diff --git a/internal/oauth/authenticate.go b/internal/oauth/authenticate.go
index 4af65cb..b579e8e 100644
--- a/internal/oauth/authenticate.go
+++ b/internal/oauth/authenticate.go
@@ -109,14 +109,12 @@ func (client *Client) FetchTokenFromAuthenticationServer(code string, state stri
}
res, err := http.PostForm(client.Provider.Endpoints.Token, body)
if err != nil {
- return nil, fmt.Errorf("failed to get ID token: %v", err)
+ return nil, fmt.Errorf("failed to get ID token: %s", err)
}
- b, err := io.ReadAll(res.Body)
- if err != nil {
- return nil, fmt.Errorf("failed to read response body: %v", err)
- }
- fmt.Printf("%s\n", string(b))
defer res.Body.Close()
- return b, nil
+ // domain, _ := url.Parse("http://127.0.0.1")
+ // client.Jar.SetCookies(domain, res.Cookies())
+
+ return io.ReadAll(res.Body)
}
diff --git a/internal/oidc/oidc.go b/internal/oidc/oidc.go
index f52e0c4..2ec1f9c 100644
--- a/internal/oidc/oidc.go
+++ b/internal/oidc/oidc.go
@@ -164,25 +164,3 @@ func (p *IdentityProvider) FetchJwks() error {
return nil
}
-
-func (p *IdentityProvider) UpdateEndpoints(other *IdentityProvider) {
- UpdateEndpoints(&p.Endpoints, &other.Endpoints)
-}
-
-func UpdateEndpoints(eps *Endpoints, other *Endpoints) {
- // only update endpoints that are not empty
- var UpdateIfEmpty = func(ep *string, s string) {
- if ep != nil {
- if *ep == "" {
- *ep = s
- }
- }
- }
- UpdateIfEmpty(&eps.Config, other.Config)
- UpdateIfEmpty(&eps.Authorization, other.Authorization)
- UpdateIfEmpty(&eps.Token, other.Token)
- UpdateIfEmpty(&eps.Revocation, other.Revocation)
- UpdateIfEmpty(&eps.Introspection, other.Introspection)
- UpdateIfEmpty(&eps.UserInfo, other.UserInfo)
- UpdateIfEmpty(&eps.JwksUri, other.JwksUri)
-}
diff --git a/internal/server/idp.go b/internal/server/idp.go
index bb82a28..67c70b1 100644
--- a/internal/server/idp.go
+++ b/internal/server/idp.go
@@ -3,6 +3,7 @@ package server
import (
"crypto/rand"
"crypto/rsa"
+ "davidallendj/opaal/internal/oauth"
"davidallendj/opaal/internal/oidc"
"encoding/json"
"fmt"
@@ -21,22 +22,6 @@ import (
"github.com/lestrrat-go/jwx/v2/jwt"
)
-// TODO: make this a completely separate server
-type IdentityProviderServer struct {
- Host string `yaml:"host"`
- Port int `yaml:"port"`
- Endpoints oidc.Endpoints `yaml:"endpoints"`
- Clients []RegisteredClient `yaml:"clients"`
-}
-
-// NOTE: could we use a oauth.Client here instead??
-type RegisteredClient struct {
- Id string `yaml:"id"`
- Secret string `yaml:"secret"`
- Name string `yaml:"name"`
- RedirectUris []string `yaml:"redirect-uris"`
-}
-
func (s *Server) StartIdentityProvider() error {
// NOTE: this example does NOT implement CSRF tokens nor use them
@@ -44,16 +29,14 @@ func (s *Server) StartIdentityProvider() error {
var (
r = chi.NewRouter()
// clients = []oauth.Client{}
+ callback = ""
activeCodes = []string{}
)
- // update endpoints that have values set
- defaultEps := oidc.Endpoints{
- Authorization: "http://" + s.Addr + "/oauth2/authorize",
- Token: "http://" + s.Addr + "/oauth2/token",
- JwksUri: "http://" + s.Addr + "/.well-known/jwks.json",
+ // check if callback is set
+ if s.Callback == "" {
+ callback = "/oidc/callback"
}
- oidc.UpdateEndpoints(&s.Issuer.Endpoints, &defaultEps)
// generate key pair used to sign JWKS and create JWTs
privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
@@ -89,13 +72,14 @@ func (s *Server) StartIdentityProvider() error {
w.Write(b)
})
+ // TODO: create .well-known openid configuration
r.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
// create config JSON to serve with GET request
config := map[string]any{
"issuer": "http://" + s.Addr,
- "authorization_endpoint": s.Issuer.Endpoints.Authorization,
- "token_endpoint": s.Issuer.Endpoints.Token,
- "jwks_uri": s.Issuer.Endpoints.JwksUri,
+ "authorization_endpoint": "http://" + s.Addr + "/oauth/authorize",
+ "token_endpoint": "http://" + s.Addr + "/oauth/token",
+ "jwks_uri": "http://" + s.Addr + "/.well-known/jwks.json",
"scopes_supported": []string{
"openid",
"profile",
@@ -147,18 +131,21 @@ func (s *Server) StartIdentityProvider() error {
username := r.Form.Get("username")
password := r.Form.Get("password")
- if len(s.Issuer.Clients) <= 0 {
- fmt.Printf("no registered clients found with identity provider (add them in config)\n")
- return
- }
-
// example username and password so do simplified authorization code flow
- if username == "openchami" && password == "openchami" {
- client := s.Issuer.Clients[0]
+ if username == "ochami" && password == "ochami" {
+ client := oauth.Client{
+ Id: "ochami",
+ Secret: "ochami",
+ Name: "ochami",
+ Provider: oidc.IdentityProvider{
+ Issuer: "http://127.0.0.1:3333",
+ },
+ RedirectUris: []string{fmt.Sprintf("http://%s:%d%s", s.Host, s.Port, callback)},
+ }
// check if there are any redirect URIs supplied
if len(client.RedirectUris) <= 0 {
- fmt.Printf("no redirect URIs found for client %s (ID: %s)\n", client.Name, client.Id)
+ fmt.Printf("no redirect URIs found")
return
}
for _, url := range client.RedirectUris {
@@ -179,7 +166,7 @@ func (s *Server) StartIdentityProvider() error {
http.Redirect(w, r, "/browser/login", http.StatusUnauthorized)
}
})
- r.HandleFunc("/oauth2/token", func(w http.ResponseWriter, r *http.Request) {
+ r.HandleFunc("/oauth/token", func(w http.ResponseWriter, r *http.Request) {
r.ParseForm()
// check for authorization code and make sure it's valid
@@ -253,7 +240,7 @@ func (s *Server) StartIdentityProvider() error {
fmt.Printf("bearer: %s\n", string(b))
w.Write(b)
})
- r.HandleFunc("/oauth2/authorize", func(w http.ResponseWriter, r *http.Request) {
+ r.HandleFunc("/oauth/authorize", func(w http.ResponseWriter, r *http.Request) {
var (
responseType = r.URL.Query().Get("response_type")
clientId = r.URL.Query().Get("client_id")
@@ -266,13 +253,9 @@ func (s *Server) StartIdentityProvider() error {
return
}
- // find a valid client
- index := slices.IndexFunc(s.Issuer.Clients, func(c RegisteredClient) bool {
- fmt.Printf("%s ? %s\n", c.Id, clientId)
- return c.Id == clientId
- })
- if index < 0 {
- fmt.Printf("no valid client found")
+ // check that we're using the default registered client
+ if clientId != "ochami" {
+ fmt.Printf("invalid client\n")
return
}
diff --git a/internal/server/server.go b/internal/server/server.go
index 3fdae97..3c7507b 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -18,11 +18,16 @@ import (
type Server struct {
*http.Server
- Host string `yaml:"host"`
- Port int `yaml:"port"`
- Callback string `yaml:"callback"`
- State string `yaml:"state"`
- Issuer IdentityProviderServer `yaml:"issuer"`
+ Host string `yaml:"host"`
+ Port int `yaml:"port"`
+ Callback string `yaml:"callback"`
+ State string `yaml:"state"`
+ Issuer Issuer `yaml:"issuer"`
+}
+
+type Issuer struct {
+ Host string `yaml:"host"`
+ Port int `yaml:"port"`
}
type ServerParams struct {
@@ -57,7 +62,7 @@ func (s *Server) StartLogin(clients []oauth.Client, params ServerParams) error {
// make the login page SSO buttons and authorization URLs to write to stdout
buttons := ""
- fmt.Printf("Login with an identity provider: \n")
+ fmt.Printf("Login with external identity providers: \n")
for i, client := range clients {
// fetch provider configuration before adding button
p, err := oidc.FetchServerConfig(client.Provider.Issuer)
@@ -74,7 +79,8 @@ func (s *Server) StartLogin(clients []oauth.Client, params ServerParams) error {
clients[i].Provider = *p
buttons += makeButton(fmt.Sprintf("/login?sso=%s", client.Id), client.Name)
- fmt.Printf("\t%s: /login?sso=%s\n", client.Name, client.Id)
+ url := client.BuildAuthorizationUrl(s.State)
+ fmt.Printf("\t%s\n", url)
}
var code string
@@ -114,9 +120,7 @@ func (s *Server) StartLogin(clients []oauth.Client, params ServerParams) error {
client = &clients[index]
url := client.BuildAuthorizationUrl(s.State)
- if params.Verbose {
- fmt.Printf("Redirect URL: %s\n", url)
- }
+ fmt.Printf("Redirect URL: %s\n", url)
http.Redirect(w, r, url, http.StatusFound)
return
}
@@ -141,47 +145,38 @@ func (s *Server) StartLogin(clients []oauth.Client, params ServerParams) error {
p = params.AuthProvider
jwks []byte
)
-
- fetchAndMarshal := func() (err error) {
- err = p.FetchJwks()
+ // try and get the JWKS from param first
+ if p.Endpoints.JwksUri != "" {
+ err := p.FetchJwks()
if err != nil {
- fmt.Printf("failed to fetch keys: %v\n", err)
- return
+ fmt.Printf("failed to fetch keys using JWKS url...trying to fetch config and try again...\n")
}
jwks, err = json.Marshal(p.KeySet)
if err != nil {
fmt.Printf("failed to marshal JWKS: %v\n", err)
}
- return
- }
-
- // try and get the JWKS from param first
- if p.Endpoints.JwksUri != "" {
- if err := fetchAndMarshal(); err != nil {
- w.Write(jwks)
- return
- }
- }
-
- // otherwise or if fetching the JWKS failed, try and fetch the whole config first and try again
- if p.Endpoints.Config != "" {
- if err := p.FetchServerConfig(); err != nil {
+ } else if p.Endpoints.Config != "" && jwks == nil {
+ // otherwise, try and fetch the whole config and try again
+ err := p.FetchServerConfig()
+ if err != nil {
fmt.Printf("failed to fetch server config: %v\n", err)
- http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+ http.Redirect(w, r, "/error", http.StatusInternalServerError)
+ return
+ }
+ err = p.FetchJwks()
+ if err != nil {
+ fmt.Printf("failed to fetch JWKS after fetching server config: %v\n", err)
+ http.Redirect(w, r, "/error", http.StatusInternalServerError)
return
}
- } else {
- fmt.Printf("getting JWKS from param failed and endpoints config unavailable\n")
- http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
- return
}
- if err := fetchAndMarshal(); err != nil {
- fmt.Printf("failed to fetch and marshal JWKS after config update: %v\n", err)
- http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+ // forward the JWKS from the authorization server
+ if jwks == nil {
+ fmt.Printf("no JWKS was fetched from authorization server\n")
+ http.Redirect(w, r, "/error", http.StatusInternalServerError)
return
}
-
w.Write(jwks)
})
r.HandleFunc("/token", func(w http.ResponseWriter, r *http.Request) {
diff --git a/pages/login.html b/pages/login.html
index c25f8c3..e55f5cf 100644
--- a/pages/login.html
+++ b/pages/login.html
@@ -7,7 +7,7 @@
Forgot Username?
-
+