Timshel
4 weeks ago
3 changed files with 320 additions and 242 deletions
@ -0,0 +1,264 @@ |
|||||
|
use regex::Regex; |
||||
|
use std::borrow::Cow; |
||||
|
use std::time::Duration; |
||||
|
use url::Url; |
||||
|
|
||||
|
use mini_moka::sync::Cache; |
||||
|
use once_cell::sync::Lazy; |
||||
|
use openidconnect::core::*; |
||||
|
use openidconnect::reqwest; |
||||
|
use openidconnect::*; |
||||
|
|
||||
|
use crate::{ |
||||
|
api::{ApiResult, EmptyResult}, |
||||
|
db::models::SsoNonce, |
||||
|
sso::{OIDCCode, OIDCState}, |
||||
|
CONFIG, |
||||
|
}; |
||||
|
|
||||
|
static CLIENT_CACHE_KEY: Lazy<String> = Lazy::new(|| "sso-client".to_string()); |
||||
|
static CLIENT_CACHE: Lazy<Cache<String, Client>> = Lazy::new(|| { |
||||
|
Cache::builder().max_capacity(1).time_to_live(Duration::from_secs(CONFIG.sso_client_cache_expiration())).build() |
||||
|
}); |
||||
|
|
||||
|
/// OpenID Connect Core client.
|
||||
|
pub type CustomClient = openidconnect::Client< |
||||
|
EmptyAdditionalClaims, |
||||
|
CoreAuthDisplay, |
||||
|
CoreGenderClaim, |
||||
|
CoreJweContentEncryptionAlgorithm, |
||||
|
CoreJsonWebKey, |
||||
|
CoreAuthPrompt, |
||||
|
StandardErrorResponse<CoreErrorResponseType>, |
||||
|
CoreTokenResponse, |
||||
|
CoreTokenIntrospectionResponse, |
||||
|
CoreRevocableToken, |
||||
|
CoreRevocationErrorResponse, |
||||
|
EndpointSet, |
||||
|
EndpointNotSet, |
||||
|
EndpointNotSet, |
||||
|
EndpointNotSet, |
||||
|
EndpointSet, |
||||
|
EndpointSet, |
||||
|
>; |
||||
|
|
||||
|
#[derive(Clone)] |
||||
|
pub struct Client { |
||||
|
pub http_client: reqwest::Client, |
||||
|
pub core_client: CustomClient, |
||||
|
} |
||||
|
|
||||
|
impl Client { |
||||
|
// Call the OpenId discovery endpoint to retrieve configuration
|
||||
|
async fn _get_client() -> ApiResult<Self> { |
||||
|
let client_id = ClientId::new(CONFIG.sso_client_id()); |
||||
|
let client_secret = ClientSecret::new(CONFIG.sso_client_secret()); |
||||
|
|
||||
|
let issuer_url = CONFIG.sso_issuer_url()?; |
||||
|
|
||||
|
let http_client = match reqwest::ClientBuilder::new().redirect(reqwest::redirect::Policy::none()).build() { |
||||
|
Err(err) => err!(format!("Failed to build http client: {err}")), |
||||
|
Ok(client) => client, |
||||
|
}; |
||||
|
|
||||
|
let provider_metadata = match CoreProviderMetadata::discover_async(issuer_url, &http_client).await { |
||||
|
Err(err) => err!(format!("Failed to discover OpenID provider: {err}")), |
||||
|
Ok(metadata) => metadata, |
||||
|
}; |
||||
|
|
||||
|
let base_client = CoreClient::from_provider_metadata(provider_metadata, client_id, Some(client_secret)); |
||||
|
|
||||
|
let token_uri = match base_client.token_uri() { |
||||
|
Some(uri) => uri.clone(), |
||||
|
None => err!("Failed to discover token_url, cannot proceed"), |
||||
|
}; |
||||
|
|
||||
|
let user_info_url = match base_client.user_info_url() { |
||||
|
Some(url) => url.clone(), |
||||
|
None => err!("Failed to discover user_info url, cannot proceed"), |
||||
|
}; |
||||
|
|
||||
|
let core_client = base_client |
||||
|
.set_redirect_uri(CONFIG.sso_redirect_url()?) |
||||
|
.set_token_uri(token_uri) |
||||
|
.set_user_info_url(user_info_url); |
||||
|
|
||||
|
Ok(Client { |
||||
|
http_client, |
||||
|
core_client, |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// Simple cache to prevent recalling the discovery endpoint each time
|
||||
|
pub async fn cached() -> ApiResult<Self> { |
||||
|
if CONFIG.sso_client_cache_expiration() > 0 { |
||||
|
match CLIENT_CACHE.get(&*CLIENT_CACHE_KEY) { |
||||
|
Some(client) => Ok(client), |
||||
|
None => Self::_get_client().await.inspect(|client| { |
||||
|
debug!("Inserting new client in cache"); |
||||
|
CLIENT_CACHE.insert(CLIENT_CACHE_KEY.clone(), client.clone()); |
||||
|
}), |
||||
|
} |
||||
|
} else { |
||||
|
Self::_get_client().await |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn invalidate() { |
||||
|
if CONFIG.sso_client_cache_expiration() > 0 { |
||||
|
CLIENT_CACHE.invalidate(&*CLIENT_CACHE_KEY); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// The `state` is encoded using base64 to ensure no issue with providers (It contains the Organization identifier).
|
||||
|
pub async fn authorize_url(state: OIDCState, redirect_uri: String) -> ApiResult<(Url, SsoNonce)> { |
||||
|
let scopes = CONFIG.sso_scopes_vec().into_iter().map(Scope::new); |
||||
|
let base64_state = data_encoding::BASE64.encode(state.to_string().as_bytes()); |
||||
|
|
||||
|
let client = Self::cached().await?; |
||||
|
let mut auth_req = client |
||||
|
.core_client |
||||
|
.authorize_url( |
||||
|
AuthenticationFlow::<CoreResponseType>::AuthorizationCode, |
||||
|
|| CsrfToken::new(base64_state), |
||||
|
Nonce::new_random, |
||||
|
) |
||||
|
.add_scopes(scopes) |
||||
|
.add_extra_params(CONFIG.sso_authorize_extra_params_vec()?); |
||||
|
|
||||
|
let verifier = if CONFIG.sso_pkce() { |
||||
|
let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256(); |
||||
|
auth_req = auth_req.set_pkce_challenge(pkce_challenge); |
||||
|
Some(pkce_verifier.into_secret()) |
||||
|
} else { |
||||
|
None |
||||
|
}; |
||||
|
|
||||
|
let (auth_url, _, nonce) = auth_req.url(); |
||||
|
Ok((auth_url, SsoNonce::new(state, nonce.secret().clone(), verifier, redirect_uri))) |
||||
|
} |
||||
|
|
||||
|
pub async fn exchange_code( |
||||
|
&self, |
||||
|
code: OIDCCode, |
||||
|
nonce: SsoNonce, |
||||
|
) -> ApiResult<( |
||||
|
StandardTokenResponse< |
||||
|
IdTokenFields< |
||||
|
EmptyAdditionalClaims, |
||||
|
EmptyExtraTokenFields, |
||||
|
CoreGenderClaim, |
||||
|
CoreJweContentEncryptionAlgorithm, |
||||
|
CoreJwsSigningAlgorithm, |
||||
|
>, |
||||
|
CoreTokenType, |
||||
|
>, |
||||
|
IdTokenClaims<EmptyAdditionalClaims, CoreGenderClaim>, |
||||
|
)> { |
||||
|
let oidc_code = AuthorizationCode::new(code.to_string()); |
||||
|
|
||||
|
let mut exchange = self.core_client.exchange_code(oidc_code); |
||||
|
|
||||
|
if CONFIG.sso_pkce() { |
||||
|
match nonce.verifier { |
||||
|
None => err!(format!("Missing verifier in the DB nonce table")), |
||||
|
Some(secret) => exchange = exchange.set_pkce_verifier(PkceCodeVerifier::new(secret.clone())), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
match exchange.request_async(&self.http_client).await { |
||||
|
Err(err) => err!(format!("Failed to contact token endpoint: {:?}", err)), |
||||
|
Ok(token_response) => { |
||||
|
let oidc_nonce = Nonce::new(nonce.nonce); |
||||
|
|
||||
|
let id_token = match token_response.extra_fields().id_token() { |
||||
|
None => err!("Token response did not contain an id_token"), |
||||
|
Some(token) => token, |
||||
|
}; |
||||
|
|
||||
|
if CONFIG.sso_debug_tokens() { |
||||
|
debug!("Id token: {}", id_token.to_string()); |
||||
|
debug!("Access token: {}", token_response.access_token().secret()); |
||||
|
debug!("Refresh token: {:?}", token_response.refresh_token().map(|t| t.secret())); |
||||
|
debug!("Expiration time: {:?}", token_response.expires_in()); |
||||
|
} |
||||
|
|
||||
|
let id_claims = match id_token.claims(&self.vw_id_token_verifier(), &oidc_nonce) { |
||||
|
Ok(claims) => claims.clone(), |
||||
|
Err(err) => { |
||||
|
Self::invalidate(); |
||||
|
err!(format!("Could not read id_token claims, {err}")); |
||||
|
} |
||||
|
}; |
||||
|
|
||||
|
Ok((token_response, id_claims)) |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub async fn user_info(&self, access_token: AccessToken) -> ApiResult<CoreUserInfoClaims> { |
||||
|
match self.core_client.user_info(access_token, None).request_async(&self.http_client).await { |
||||
|
Err(err) => err!(format!("Request to user_info endpoint failed: {err}")), |
||||
|
Ok(user_info) => Ok(user_info), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub async fn check_validaty(access_token: String) -> EmptyResult { |
||||
|
let client = Client::cached().await?; |
||||
|
match client.user_info(AccessToken::new(access_token)).await { |
||||
|
Err(err) => { |
||||
|
err_silent!(format!("Failed to retrieve user info, token has probably been invalidated: {err}")) |
||||
|
} |
||||
|
Ok(_) => Ok(()), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn vw_id_token_verifier(&self) -> CoreIdTokenVerifier<'_> { |
||||
|
let mut verifier = self.core_client.id_token_verifier(); |
||||
|
if let Some(regex_str) = CONFIG.sso_audience_trusted() { |
||||
|
match Regex::new(®ex_str) { |
||||
|
Ok(regex) => { |
||||
|
verifier = verifier.set_other_audience_verifier_fn(move |aud| regex.is_match(aud)); |
||||
|
} |
||||
|
Err(err) => { |
||||
|
error!("Failed to parse SSO_AUDIENCE_TRUSTED={regex_str} regex: {err}"); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
verifier |
||||
|
} |
||||
|
|
||||
|
pub async fn exchange_refresh_token( |
||||
|
refresh_token: String, |
||||
|
) -> ApiResult<(Option<String>, String, Option<Duration>)> { |
||||
|
let rt = RefreshToken::new(refresh_token); |
||||
|
|
||||
|
let client = Client::cached().await?; |
||||
|
let token_response = |
||||
|
match client.core_client.exchange_refresh_token(&rt).request_async(&client.http_client).await { |
||||
|
Err(err) => err!(format!("Request to exchange_refresh_token endpoint failed: {:?}", err)), |
||||
|
Ok(token_response) => token_response, |
||||
|
}; |
||||
|
|
||||
|
Ok(( |
||||
|
token_response.refresh_token().map(|token| token.secret().clone()), |
||||
|
token_response.access_token().secret().clone(), |
||||
|
token_response.expires_in(), |
||||
|
)) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
trait AuthorizationRequestExt<'a> { |
||||
|
fn add_extra_params<N: Into<Cow<'a, str>>, V: Into<Cow<'a, str>>>(self, params: Vec<(N, V)>) -> Self; |
||||
|
} |
||||
|
|
||||
|
impl<'a, AD: AuthDisplay, P: AuthPrompt, RT: ResponseType> AuthorizationRequestExt<'a> |
||||
|
for AuthorizationRequest<'a, AD, P, RT> |
||||
|
{ |
||||
|
fn add_extra_params<N: Into<Cow<'a, str>>, V: Into<Cow<'a, str>>>(mut self, params: Vec<(N, V)>) -> Self { |
||||
|
for (key, value) in params { |
||||
|
self = self.add_extra_param(key, value); |
||||
|
} |
||||
|
self |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue