devstack/authorizer
4
0
Fork 0
Code Pull Requests Actions Activity

fix: other auth recipes for oidc idp + remove logs

Browse Source
This commit is contained in:
Lakhan Samani
2022-11-15 21:45:08 +05:30
parent 579899c397
commit 75a547cfe2
12 changed files with 248 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
server/handlers/oauth_callback.go
View File

@@ -56,20 +56,20 @@ func OAuthCallbackHandler() gin.HandlerFunc {
scopes := strings.Split(sessionSplit[3], ",")
user := models.User{}
code := ctx.Request.FormValue("code")
oauthCode := ctx.Request.FormValue("code")
switch provider {
case constants.AuthRecipeMethodGoogle:
user, err = processGoogleUserInfo(code)
user, err = processGoogleUserInfo(oauthCode)
case constants.AuthRecipeMethodGithub:
user, err = processGithubUserInfo(code)
user, err = processGithubUserInfo(oauthCode)
case constants.AuthRecipeMethodFacebook:
user, err = processFacebookUserInfo(code)
user, err = processFacebookUserInfo(oauthCode)
case constants.AuthRecipeMethodLinkedIn:
user, err = processLinkedInUserInfo(code)
user, err = processLinkedInUserInfo(oauthCode)
case constants.AuthRecipeMethodApple:
user, err = processAppleUserInfo(code)
user, err = processAppleUserInfo(oauthCode)
case constants.AuthRecipeMethodTwitter:
user, err = processTwitterUserInfo(code, sessionState)
user, err = processTwitterUserInfo(oauthCode, sessionState)
default:
log.Info("Invalid oauth provider")
err = fmt.Errorf(`invalid oauth provider`)
@@ -200,19 +200,50 @@ func OAuthCallbackHandler() gin.HandlerFunc {
// TODO
// use stateValue to get code / nonce
// add code / nonce to id_token
nonce := uuid.New().String()
authToken, err := token.CreateAuthToken(ctx, user, inputRoles, scopes, provider, nonce, "")
code := ""
codeChallenge := ""
nonce := ""
if stateValue != "" {
// Get state from store
authorizeState, _ := memorystore.Provider.GetState(stateValue)
if authorizeState != "" {
authorizeStateSplit := strings.Split(authorizeState, "@@")
if len(authorizeStateSplit) > 1 {
code = authorizeStateSplit[0]
codeChallenge = authorizeStateSplit[1]
} else {
nonce = authorizeState
}
go memorystore.Provider.RemoveState(stateValue)
}
}
if nonce == "" {
nonce = uuid.New().String()
}
authToken, err := token.CreateAuthToken(ctx, user, inputRoles, scopes, provider, nonce, code)
if err != nil {
log.Debug("Failed to create auth token: ", err)
ctx.JSON(500, gin.H{"error": err.Error()})
}
// Code challenge could be optional if PKCE flow is not used
if code != "" {
if err := memorystore.Provider.SetState(code, codeChallenge+"@@"+authToken.FingerPrintHash); err != nil {
log.Debug("SetState failed: ", err)
ctx.JSON(500, gin.H{"error": err.Error()})
}
}
expiresIn := authToken.AccessToken.ExpiresAt - time.Now().Unix()
if expiresIn <= 0 {
expiresIn = 1
}
params := "access_token=" + authToken.AccessToken.Token + "&token_type=bearer&expires_in=" + strconv.FormatInt(expiresIn, 10) + "&state=" + stateValue + "&id_token=" + authToken.IDToken.Token
params := "access_token=" + authToken.AccessToken.Token + "&token_type=bearer&expires_in=" + strconv.FormatInt(expiresIn, 10) + "&state=" + stateValue + "&id_token=" + authToken.IDToken.Token + "&nonce=" + nonce
if code != "" {
params += "&code=" + code
}
sessionKey := provider + ":" + user.ID
cookie.SetSession(ctx, authToken.FingerPrintHash)
@@ -220,7 +251,7 @@ func OAuthCallbackHandler() gin.HandlerFunc {
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token)
if authToken.RefreshToken != nil {
params = params + `&refresh_token=` + authToken.RefreshToken.Token
params += `&refresh_token=` + authToken.RefreshToken.Token
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
}