devstack/authorizer
4
0
Fork 0
Code Pull Requests Actions Activity

fix: open id config

Browse Source
This commit is contained in:
Lakhan Samani 2022-10-16 21:03:37 +05:30
parent 2bd92d6028
commit 3cd99fe5f6
3 changed files with 28 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server/constants/oauth2.go
View File

@ -14,4 +14,6 @@ const (
ResponseTypeCode = "code" ResponseTypeCode = "code"
// For the Implicit grant, use response_type=token to include an access token. // For the Implicit grant, use response_type=token to include an access token.
ResponseTypeToken = "token" ResponseTypeToken = "token"
// For the Implicit grant of id_token, use response_type=id_token to include an identifier token.
ResponseTypeIDToken = "id_token"
) )

18
server/handlers/authorize.go
View File

@ -137,6 +137,18 @@ func AuthorizeHandler() gin.HandlerFunc {
// in case, response type is code and user is already logged in send the code and state // in case, response type is code and user is already logged in send the code and state
// and cookie session will already be rolled over and set // and cookie session will already be rolled over and set
if responseMode == constants.ResponseModeFormPost {
gc.HTML(http.StatusOK, authorizeFormPostTemplate, gin.H{
"target_origin": redirectURI,
"authorization_response": map[string]interface{}{
"type": "authorization_response",
"response": map[string]string{
"code": code,
"state": state,
},
},
})
} else {
gc.HTML(http.StatusOK, authorizeWebMessageTemplate, gin.H{ gc.HTML(http.StatusOK, authorizeWebMessageTemplate, gin.H{
"target_origin": redirectURI, "target_origin": redirectURI,
"authorization_response": map[string]interface{}{ "authorization_response": map[string]interface{}{
@ -147,10 +159,12 @@ func AuthorizeHandler() gin.HandlerFunc {
}, },
}, },
}) })
}
return return
} }
if responseType == constants.ResponseTypeToken { if responseType == constants.ResponseTypeToken || responseType == constants.ResponseTypeIDToken {
// rollover the session for security // rollover the session for security
authToken, err := token.CreateAuthToken(gc, user, claims.Roles, scope, claims.LoginMethod) authToken, err := token.CreateAuthToken(gc, user, claims.Roles, scope, claims.LoginMethod)
if err != nil { if err != nil {
@ -222,7 +236,7 @@ func AuthorizeHandler() gin.HandlerFunc {
} }
func validateAuthorizeRequest(responseType, responseMode, clientID, state, codeChallenge string) error { func validateAuthorizeRequest(responseType, responseMode, clientID, state, codeChallenge string) error {
if responseType != constants.ResponseTypeCode && responseType != constants.ResponseTypeToken { if responseType != constants.ResponseTypeCode && responseType != constants.ResponseTypeToken && responseType != constants.ResponseTypeIDToken {
return fmt.Errorf("invalid response type %s. 'code' & 'token' are valid response_type", responseMode) return fmt.Errorf("invalid response type %s. 'code' & 'token' are valid response_type", responseMode)
} }

2
server/handlers/openid_config.go
View File

@ -22,7 +22,7 @@ func OpenIDConfigurationHandler() gin.HandlerFunc {
"jwks_uri": issuer + "/.well-known/jwks.json", "jwks_uri": issuer + "/.well-known/jwks.json",
"response_types_supported": []string{"code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token"}, "response_types_supported": []string{"code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token"},
"scopes_supported": []string{"openid", "email", "profile", "email_verified", "given_name", "family_name", "nick_name", "picture"}, "scopes_supported": []string{"openid", "email", "profile", "email_verified", "given_name", "family_name", "nick_name", "picture"},
"response_modes_supported": []string{"query", "fragment", "form_post"}, "response_modes_supported": []string{"query", "fragment", "form_post", "web_message"},
"id_token_signing_alg_values_supported": []string{jwtType}, "id_token_signing_alg_values_supported": []string{jwtType},
"claims_supported": []string{"aud", "exp", "iss", "iat", "sub", "given_name", "family_name", "middle_name", "nickname", "preferred_username", "picture", "email", "email_verified", "roles", "gender", "birthdate", "phone_number", "phone_number_verified"}, "claims_supported": []string{"aud", "exp", "iss", "iat", "sub", "given_name", "family_name", "middle_name", "nickname", "preferred_username", "picture", "email", "email_verified", "roles", "gender", "birthdate", "phone_number", "phone_number_verified"},
}) })