140 lines
3.8 KiB
Go
140 lines
3.8 KiB
Go
// Copyright 2020 guylewin, guy@lewin.co.il
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/fatedier/frp/models/msg"
|
|
|
|
"github.com/coreos/go-oidc"
|
|
"golang.org/x/oauth2/clientcredentials"
|
|
)
|
|
|
|
type OidcAuthProvider struct {
|
|
baseAuth
|
|
|
|
tokenGenerator *clientcredentials.Config
|
|
}
|
|
|
|
func NewOidcAuthSetter(base baseAuth, clientId string, clientSecret string, audience string, tokenEndpointUrl string) *OidcAuthProvider {
|
|
tokenGenerator := &clientcredentials.Config{
|
|
ClientID: clientId,
|
|
ClientSecret: clientSecret,
|
|
Scopes: []string{audience},
|
|
TokenURL: tokenEndpointUrl,
|
|
}
|
|
|
|
return &OidcAuthProvider{
|
|
baseAuth: base,
|
|
tokenGenerator: tokenGenerator,
|
|
}
|
|
}
|
|
|
|
func (auth *OidcAuthProvider) generateAccessToken() (accessToken string, err error) {
|
|
tokenObj, err := auth.tokenGenerator.Token(context.Background())
|
|
if err != nil {
|
|
return "", fmt.Errorf("couldn't generate OIDC token for login: %v", err)
|
|
}
|
|
return tokenObj.AccessToken, nil
|
|
}
|
|
|
|
func (auth *OidcAuthProvider) SetLogin(loginMsg *msg.Login) (err error) {
|
|
loginMsg.PrivilegeKey, err = auth.generateAccessToken()
|
|
return err
|
|
}
|
|
|
|
func (auth *OidcAuthProvider) SetPing(pingMsg *msg.Ping) (err error) {
|
|
if !auth.authenticateHeartBeats {
|
|
return nil
|
|
}
|
|
|
|
pingMsg.PrivilegeKey, err = auth.generateAccessToken()
|
|
return err
|
|
}
|
|
|
|
func (auth *OidcAuthProvider) SetNewWorkConn(newWorkConnMsg *msg.NewWorkConn) (err error) {
|
|
if !auth.authenticateNewWorkConns {
|
|
return nil
|
|
}
|
|
|
|
newWorkConnMsg.PrivilegeKey, err = auth.generateAccessToken()
|
|
return err
|
|
}
|
|
|
|
type OidcAuthConsumer struct {
|
|
baseAuth
|
|
|
|
verifier *oidc.IDTokenVerifier
|
|
subjectFromLogin string
|
|
}
|
|
|
|
func NewOidcAuthVerifier(base baseAuth, issuer string, audience string, skipExpiryCheck bool, skipIssuerCheck bool) *OidcAuthConsumer {
|
|
provider, err := oidc.NewProvider(context.Background(), issuer)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
verifierConf := oidc.Config{
|
|
ClientID: audience,
|
|
SkipClientIDCheck: audience == "",
|
|
SkipExpiryCheck: skipExpiryCheck,
|
|
SkipIssuerCheck: skipIssuerCheck,
|
|
}
|
|
return &OidcAuthConsumer{
|
|
baseAuth: base,
|
|
verifier: provider.Verifier(&verifierConf),
|
|
}
|
|
}
|
|
|
|
func (auth *OidcAuthConsumer) VerifyLogin(loginMsg *msg.Login) (err error) {
|
|
token, err := auth.verifier.Verify(context.Background(), loginMsg.PrivilegeKey)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid OIDC token in login: %v", err)
|
|
}
|
|
auth.subjectFromLogin = token.Subject
|
|
return nil
|
|
}
|
|
|
|
func (auth *OidcAuthConsumer) verifyPostLoginToken(privilegeKey string) (err error) {
|
|
token, err := auth.verifier.Verify(context.Background(), privilegeKey)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid OIDC token in ping: %v", err)
|
|
}
|
|
if token.Subject != auth.subjectFromLogin {
|
|
return fmt.Errorf("received different OIDC subject in login and ping. "+
|
|
"original subject: %s, "+
|
|
"new subject: %s",
|
|
auth.subjectFromLogin, token.Subject)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (auth *OidcAuthConsumer) VerifyPing(pingMsg *msg.Ping) (err error) {
|
|
if !auth.authenticateHeartBeats {
|
|
return nil
|
|
}
|
|
|
|
return auth.verifyPostLoginToken(pingMsg.PrivilegeKey)
|
|
}
|
|
|
|
func (auth *OidcAuthConsumer) VerifyNewWorkConn(newWorkConnMsg *msg.NewWorkConn) (err error) {
|
|
if !auth.authenticateNewWorkConns {
|
|
return nil
|
|
}
|
|
|
|
return auth.verifyPostLoginToken(newWorkConnMsg.PrivilegeKey)
|
|
}
|