|
| 1 | +package oauthpki |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "crypto/rsa" |
| 6 | + "crypto/sha1" |
| 7 | + "crypto/x509" |
| 8 | + "encoding/base64" |
| 9 | + "encoding/pem" |
| 10 | + "strings" |
| 11 | + "time" |
| 12 | + |
| 13 | + "github.com/golang-jwt/jwt/v4" |
| 14 | + "github.com/google/uuid" |
| 15 | + "golang.org/x/oauth2" |
| 16 | + "golang.org/x/xerrors" |
| 17 | +) |
| 18 | + |
| 19 | +// Config uses jwt assertions over client_secret for oauth2 authentication of |
| 20 | +// the application. This implementation was made specifically for Azure AD. |
| 21 | +// |
| 22 | +// https://learn.microsoft.com/en-us/azure/active-directory/develop/certificate-credentials |
| 23 | +// |
| 24 | +// However this does mostly follow the standard. We can generalize this as we |
| 25 | +// include support for more IDPs. |
| 26 | +// |
| 27 | +// https://datatracker.ietf.org/doc/html/rfc7523 |
| 28 | +type Config struct { |
| 29 | + *oauth2.Config |
| 30 | + |
| 31 | + // ClientSecret is the private key of the PKI cert. |
| 32 | + // Azure AD only supports RS256 signing algorithm. |
| 33 | + clientKey *rsa.PrivateKey |
| 34 | + // Base64url-encoded SHA-1 thumbprint of the X.509 certificate's DER encoding. |
| 35 | + // This is specific to Azure AD |
| 36 | + x5t string |
| 37 | +} |
| 38 | + |
| 39 | +// NewOauth2PKIConfig creates the oauth2 config for PKI based auth. It requires the certificate and it's private key. |
| 40 | +// The values should be passed in as PEM encoded values, which is the standard encoding for x509 certs saved to disk. |
| 41 | +// It should look like: |
| 42 | +// |
| 43 | +// -----BEGIN RSA PRIVATE KEY---- |
| 44 | +// ... |
| 45 | +// -----END RSA PRIVATE KEY----- |
| 46 | +// |
| 47 | +// -----BEGIN CERTIFICATE----- |
| 48 | +// ... |
| 49 | +// -----END CERTIFICATE----- |
| 50 | +func NewOauth2PKIConfig(config *oauth2.Config, pemEncodedKey []byte, pemEncodedCert []byte) (*Config, error) { |
| 51 | + rsaKey, err := decodeKeyCertificate(pemEncodedKey) |
| 52 | + if err != nil { |
| 53 | + return nil, err |
| 54 | + } |
| 55 | + |
| 56 | + // Azure AD requires a certificate. The sha1 of the cert is used to identify the signer. |
| 57 | + // This is not required in the general specification. |
| 58 | + if strings.Contains(strings.ToLower(config.Endpoint.TokenURL), "microsoftonline") && len(pemEncodedCert) == 0 { |
| 59 | + return nil, xerrors.Errorf("oidc client certificate is required and missing") |
| 60 | + } |
| 61 | + |
| 62 | + block, _ := pem.Decode(pemEncodedCert) |
| 63 | + hashed := sha1.Sum(block.Bytes) |
| 64 | + |
| 65 | + return &Config{ |
| 66 | + Config: config, |
| 67 | + clientKey: rsaKey, |
| 68 | + x5t: base64.StdEncoding.EncodeToString(hashed[:]), |
| 69 | + }, nil |
| 70 | +} |
| 71 | + |
| 72 | +// decodeKeyCertificate decodes a PEM encoded PKI cert. |
| 73 | +func decodeKeyCertificate(pemEncoded []byte) (*rsa.PrivateKey, error) { |
| 74 | + block, _ := pem.Decode(pemEncoded) |
| 75 | + key, err := x509.ParsePKCS1PrivateKey(block.Bytes) |
| 76 | + if err != nil { |
| 77 | + return nil, xerrors.Errorf("failed to parse private key: %w", err) |
| 78 | + } |
| 79 | + |
| 80 | + return key, nil |
| 81 | +} |
| 82 | + |
| 83 | +func (ja *Config) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string { |
| 84 | + return ja.Config.AuthCodeURL(state, opts...) |
| 85 | +} |
| 86 | + |
| 87 | +// Exchange includes the client_assertion signed JWT. |
| 88 | +func (ja *Config) Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) { |
| 89 | + now := time.Now() |
| 90 | + token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{ |
| 91 | + "iss": ja.Config.ClientID, |
| 92 | + "sub": ja.Config.ClientID, |
| 93 | + "aud": ja.Config.Endpoint.TokenURL, |
| 94 | + "exp": now.Add(time.Minute * 5).Unix(), |
| 95 | + "jti": uuid.New().String(), |
| 96 | + "nbf": now.Unix(), |
| 97 | + "iat": now.Unix(), |
| 98 | + }) |
| 99 | + token.Header["x5t"] = ja.x5t |
| 100 | + |
| 101 | + signed, err := token.SignedString(ja.clientKey) |
| 102 | + if err != nil { |
| 103 | + return nil, xerrors.Errorf("failed to sign jwt assertion: %w", err) |
| 104 | + } |
| 105 | + |
| 106 | + opts = append(opts, |
| 107 | + oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"), |
| 108 | + oauth2.SetAuthURLParam("client_assertion", signed), |
| 109 | + ) |
| 110 | + return ja.Config.Exchange(ctx, code, opts...) |
| 111 | +} |
| 112 | + |
| 113 | +func (ja *Config) TokenSource(ctx context.Context, token *oauth2.Token) oauth2.TokenSource { |
| 114 | + return ja.Config.TokenSource(ctx, token) |
| 115 | +} |
0 commit comments