mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2024-11-24 08:52:25 +02:00
330 lines
8.8 KiB
Go
330 lines
8.8 KiB
Go
package providers
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"io/ioutil"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/pusher/oauth2_proxy/logger"
|
|
"github.com/pusher/oauth2_proxy/pkg/apis/sessions"
|
|
"golang.org/x/oauth2"
|
|
"golang.org/x/oauth2/google"
|
|
admin "google.golang.org/api/admin/directory/v1"
|
|
"google.golang.org/api/googleapi"
|
|
)
|
|
|
|
// GoogleProvider represents an Google based Identity Provider
|
|
type GoogleProvider struct {
|
|
*ProviderData
|
|
RedeemRefreshURL *url.URL
|
|
// GroupValidator is a function that determines if the passed email is in
|
|
// the configured Google group.
|
|
GroupValidator func(string) bool
|
|
}
|
|
|
|
type claims struct {
|
|
Subject string `json:"sub"`
|
|
Email string `json:"email"`
|
|
EmailVerified bool `json:"email_verified"`
|
|
}
|
|
|
|
// NewGoogleProvider initiates a new GoogleProvider
|
|
func NewGoogleProvider(p *ProviderData) *GoogleProvider {
|
|
p.ProviderName = "Google"
|
|
if p.LoginURL.String() == "" {
|
|
p.LoginURL = &url.URL{Scheme: "https",
|
|
Host: "accounts.google.com",
|
|
Path: "/o/oauth2/auth",
|
|
// to get a refresh token. see https://developers.google.com/identity/protocols/OAuth2WebServer#offline
|
|
RawQuery: "access_type=offline",
|
|
}
|
|
}
|
|
if p.RedeemURL.String() == "" {
|
|
p.RedeemURL = &url.URL{Scheme: "https",
|
|
Host: "www.googleapis.com",
|
|
Path: "/oauth2/v3/token"}
|
|
}
|
|
if p.ValidateURL.String() == "" {
|
|
p.ValidateURL = &url.URL{Scheme: "https",
|
|
Host: "www.googleapis.com",
|
|
Path: "/oauth2/v1/tokeninfo"}
|
|
}
|
|
if p.Scope == "" {
|
|
p.Scope = "profile email"
|
|
}
|
|
|
|
return &GoogleProvider{
|
|
ProviderData: p,
|
|
// Set a default GroupValidator to just always return valid (true), it will
|
|
// be overwritten if we configured a Google group restriction.
|
|
GroupValidator: func(email string) bool {
|
|
return true
|
|
},
|
|
}
|
|
}
|
|
|
|
func claimsFromIDToken(idToken string) (*claims, error) {
|
|
|
|
// id_token is a base64 encode ID token payload
|
|
// https://developers.google.com/accounts/docs/OAuth2Login#obtainuserinfo
|
|
jwt := strings.Split(idToken, ".")
|
|
jwtData := strings.TrimSuffix(jwt[1], "=")
|
|
b, err := base64.RawURLEncoding.DecodeString(jwtData)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
c := &claims{}
|
|
err = json.Unmarshal(b, c)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if c.Email == "" {
|
|
return nil, errors.New("missing email")
|
|
}
|
|
if !c.EmailVerified {
|
|
return nil, fmt.Errorf("email %s not listed as verified", c.Email)
|
|
}
|
|
return c, nil
|
|
}
|
|
|
|
// Redeem exchanges the OAuth2 authentication token for an ID token
|
|
func (p *GoogleProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {
|
|
if code == "" {
|
|
err = errors.New("missing code")
|
|
return
|
|
}
|
|
|
|
params := url.Values{}
|
|
params.Add("redirect_uri", redirectURL)
|
|
params.Add("client_id", p.ClientID)
|
|
params.Add("client_secret", p.ClientSecret)
|
|
params.Add("code", code)
|
|
params.Add("grant_type", "authorization_code")
|
|
var req *http.Request
|
|
req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
|
|
if err != nil {
|
|
return
|
|
}
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return
|
|
}
|
|
var body []byte
|
|
body, err = ioutil.ReadAll(resp.Body)
|
|
resp.Body.Close()
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
if resp.StatusCode != 200 {
|
|
err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
|
|
return
|
|
}
|
|
|
|
var jsonResponse struct {
|
|
AccessToken string `json:"access_token"`
|
|
RefreshToken string `json:"refresh_token"`
|
|
ExpiresIn int64 `json:"expires_in"`
|
|
IDToken string `json:"id_token"`
|
|
}
|
|
err = json.Unmarshal(body, &jsonResponse)
|
|
if err != nil {
|
|
return
|
|
}
|
|
c, err := claimsFromIDToken(jsonResponse.IDToken)
|
|
if err != nil {
|
|
return
|
|
}
|
|
s = &sessions.SessionState{
|
|
AccessToken: jsonResponse.AccessToken,
|
|
IDToken: jsonResponse.IDToken,
|
|
CreatedAt: time.Now(),
|
|
ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),
|
|
RefreshToken: jsonResponse.RefreshToken,
|
|
Email: c.Email,
|
|
User: c.Subject,
|
|
}
|
|
return
|
|
}
|
|
|
|
// SetGroupRestriction configures the GoogleProvider to restrict access to the
|
|
// specified group(s). AdminEmail has to be an administrative email on the domain that is
|
|
// checked. CredentialsFile is the path to a json file containing a Google service
|
|
// account credentials.
|
|
func (p *GoogleProvider) SetGroupRestriction(groups []string, adminEmail string, credentialsReader io.Reader) {
|
|
adminService := getAdminService(adminEmail, credentialsReader)
|
|
p.GroupValidator = func(email string) bool {
|
|
return userInGroup(adminService, groups, email)
|
|
}
|
|
}
|
|
|
|
func getAdminService(adminEmail string, credentialsReader io.Reader) *admin.Service {
|
|
data, err := ioutil.ReadAll(credentialsReader)
|
|
if err != nil {
|
|
logger.Fatal("can't read Google credentials file:", err)
|
|
}
|
|
conf, err := google.JWTConfigFromJSON(data, admin.AdminDirectoryUserReadonlyScope, admin.AdminDirectoryGroupReadonlyScope)
|
|
if err != nil {
|
|
logger.Fatal("can't load Google credentials file:", err)
|
|
}
|
|
conf.Subject = adminEmail
|
|
|
|
client := conf.Client(oauth2.NoContext)
|
|
adminService, err := admin.New(client)
|
|
if err != nil {
|
|
logger.Fatal(err)
|
|
}
|
|
return adminService
|
|
}
|
|
|
|
func userInGroup(service *admin.Service, groups []string, email string) bool {
|
|
user, err := fetchUser(service, email)
|
|
if err != nil {
|
|
logger.Printf("error fetching user: %v", err)
|
|
return false
|
|
}
|
|
id := user.Id
|
|
custID := user.CustomerId
|
|
|
|
for _, group := range groups {
|
|
members, err := fetchGroupMembers(service, group)
|
|
if err != nil {
|
|
if err, ok := err.(*googleapi.Error); ok && err.Code == 404 {
|
|
logger.Printf("error fetching members for group %s: group does not exist", group)
|
|
} else {
|
|
logger.Printf("error fetching group members: %v", err)
|
|
return false
|
|
}
|
|
}
|
|
|
|
for _, member := range members {
|
|
switch member.Type {
|
|
case "CUSTOMER":
|
|
if member.Id == custID {
|
|
return true
|
|
}
|
|
case "USER":
|
|
if member.Id == id {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func fetchUser(service *admin.Service, email string) (*admin.User, error) {
|
|
user, err := service.Users.Get(email).Do()
|
|
return user, err
|
|
}
|
|
|
|
func fetchGroupMembers(service *admin.Service, group string) ([]*admin.Member, error) {
|
|
members := []*admin.Member{}
|
|
pageToken := ""
|
|
for {
|
|
req := service.Members.List(group)
|
|
if pageToken != "" {
|
|
req.PageToken(pageToken)
|
|
}
|
|
r, err := req.Do()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
for _, member := range r.Members {
|
|
members = append(members, member)
|
|
}
|
|
if r.NextPageToken == "" {
|
|
break
|
|
}
|
|
pageToken = r.NextPageToken
|
|
}
|
|
return members, nil
|
|
}
|
|
|
|
// ValidateGroup validates that the provided email exists in the configured Google
|
|
// group(s).
|
|
func (p *GoogleProvider) ValidateGroup(email string) bool {
|
|
return p.GroupValidator(email)
|
|
}
|
|
|
|
// RefreshSessionIfNeeded checks if the session has expired and uses the
|
|
// RefreshToken to fetch a new ID token if required
|
|
func (p *GoogleProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error) {
|
|
if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {
|
|
return false, nil
|
|
}
|
|
|
|
newToken, newIDToken, duration, err := p.redeemRefreshToken(s.RefreshToken)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
// re-check that the user is in the proper google group(s)
|
|
if !p.ValidateGroup(s.Email) {
|
|
return false, fmt.Errorf("%s is no longer in the group(s)", s.Email)
|
|
}
|
|
|
|
origExpiration := s.ExpiresOn
|
|
s.AccessToken = newToken
|
|
s.IDToken = newIDToken
|
|
s.ExpiresOn = time.Now().Add(duration).Truncate(time.Second)
|
|
logger.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
|
|
return true, nil
|
|
}
|
|
|
|
func (p *GoogleProvider) redeemRefreshToken(refreshToken string) (token string, idToken string, expires time.Duration, err error) {
|
|
// https://developers.google.com/identity/protocols/OAuth2WebServer#refresh
|
|
params := url.Values{}
|
|
params.Add("client_id", p.ClientID)
|
|
params.Add("client_secret", p.ClientSecret)
|
|
params.Add("refresh_token", refreshToken)
|
|
params.Add("grant_type", "refresh_token")
|
|
var req *http.Request
|
|
req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
|
|
if err != nil {
|
|
return
|
|
}
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return
|
|
}
|
|
var body []byte
|
|
body, err = ioutil.ReadAll(resp.Body)
|
|
resp.Body.Close()
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
if resp.StatusCode != 200 {
|
|
err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
|
|
return
|
|
}
|
|
|
|
var data struct {
|
|
AccessToken string `json:"access_token"`
|
|
ExpiresIn int64 `json:"expires_in"`
|
|
IDToken string `json:"id_token"`
|
|
}
|
|
err = json.Unmarshal(body, &data)
|
|
if err != nil {
|
|
return
|
|
}
|
|
token = data.AccessToken
|
|
idToken = data.IDToken
|
|
expires = time.Duration(data.ExpiresIn) * time.Second
|
|
return
|
|
}
|