2023-01-23 07:11:40 +00:00
|
|
|
package oidc
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
|
|
|
|
"github.com/zitadel/oidc/v2/pkg/client/rp"
|
|
|
|
"github.com/zitadel/oidc/v2/pkg/oidc"
|
|
|
|
|
|
|
|
"github.com/zitadel/zitadel/internal/idp"
|
|
|
|
)
|
|
|
|
|
|
|
|
var _ idp.Provider = (*Provider)(nil)
|
|
|
|
|
|
|
|
// Provider is the [idp.Provider] implementation for a generic OIDC provider
|
|
|
|
type Provider struct {
|
|
|
|
rp.RelyingParty
|
|
|
|
options []rp.Option
|
|
|
|
name string
|
|
|
|
isLinkingAllowed bool
|
|
|
|
isCreationAllowed bool
|
|
|
|
isAutoCreation bool
|
|
|
|
isAutoUpdate bool
|
2023-03-16 15:47:22 +00:00
|
|
|
useIDToken bool
|
2023-03-28 11:28:56 +00:00
|
|
|
userInfoMapper func(info *oidc.UserInfo) idp.User
|
2023-03-13 16:34:29 +00:00
|
|
|
authOptions []rp.AuthURLOpt
|
2023-01-23 07:11:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ProviderOpts func(provider *Provider)
|
|
|
|
|
|
|
|
// WithLinkingAllowed allows end users to link the federated user to an existing one.
|
|
|
|
func WithLinkingAllowed() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.isLinkingAllowed = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithCreationAllowed allows end users to create a new user using the federated information.
|
|
|
|
func WithCreationAllowed() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.isCreationAllowed = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithAutoCreation enables that federated users are automatically created if not already existing.
|
|
|
|
func WithAutoCreation() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.isAutoCreation = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithAutoUpdate enables that information retrieved from the provider is automatically used to update
|
|
|
|
// the existing user on each authentication.
|
|
|
|
func WithAutoUpdate() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.isAutoUpdate = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-16 15:47:22 +00:00
|
|
|
// WithIDTokenMapping enables that information to map the user is retrieved from the id_token and not the userinfo endpoint.
|
|
|
|
func WithIDTokenMapping() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.useIDToken = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-01-23 07:11:40 +00:00
|
|
|
// WithRelyingPartyOption allows to set an additional [rp.Option] like [rp.WithPKCE].
|
|
|
|
func WithRelyingPartyOption(option rp.Option) ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.options = append(p.options, option)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-13 16:34:29 +00:00
|
|
|
// WithSelectAccount adds the select_account prompt to the auth request
|
|
|
|
func WithSelectAccount() ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
p.authOptions = append(p.authOptions, rp.WithPrompt(oidc.PromptSelectAccount))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-31 06:39:16 +00:00
|
|
|
// WithResponseMode sets the `response_mode` params in the auth request
|
|
|
|
func WithResponseMode(mode oidc.ResponseMode) ProviderOpts {
|
|
|
|
return func(p *Provider) {
|
|
|
|
paramOpt := rp.WithResponseModeURLParam(mode)
|
|
|
|
p.authOptions = append(p.authOptions, rp.AuthURLOpt(paramOpt))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-28 11:28:56 +00:00
|
|
|
type UserInfoMapper func(info *oidc.UserInfo) idp.User
|
2023-01-23 07:11:40 +00:00
|
|
|
|
2023-03-28 11:28:56 +00:00
|
|
|
var DefaultMapper UserInfoMapper = func(info *oidc.UserInfo) idp.User {
|
2023-01-23 07:11:40 +00:00
|
|
|
return NewUser(info)
|
|
|
|
}
|
|
|
|
|
|
|
|
// New creates a generic OIDC provider
|
2023-02-28 20:20:58 +00:00
|
|
|
func New(name, issuer, clientID, clientSecret, redirectURI string, scopes []string, userInfoMapper UserInfoMapper, options ...ProviderOpts) (provider *Provider, err error) {
|
2023-01-23 07:11:40 +00:00
|
|
|
provider = &Provider{
|
|
|
|
name: name,
|
|
|
|
userInfoMapper: userInfoMapper,
|
|
|
|
}
|
|
|
|
for _, option := range options {
|
|
|
|
option(provider)
|
|
|
|
}
|
2023-02-28 20:20:58 +00:00
|
|
|
provider.RelyingParty, err = rp.NewRelyingPartyOIDC(issuer, clientID, clientSecret, redirectURI, setDefaultScope(scopes), provider.options...)
|
2023-01-23 07:11:40 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return provider, nil
|
|
|
|
}
|
|
|
|
|
2023-02-28 20:20:58 +00:00
|
|
|
// setDefaultScope ensures that at least openid ist set
|
|
|
|
// if none is provided it will request `openid profile email phone`
|
|
|
|
func setDefaultScope(scopes []string) []string {
|
|
|
|
if len(scopes) == 0 {
|
|
|
|
return []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopePhone}
|
|
|
|
}
|
|
|
|
for _, scope := range scopes {
|
|
|
|
if scope == oidc.ScopeOpenID {
|
|
|
|
return scopes
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return append(scopes, oidc.ScopeOpenID)
|
|
|
|
}
|
|
|
|
|
2023-01-23 07:11:40 +00:00
|
|
|
// Name implements the [idp.Provider] interface
|
|
|
|
func (p *Provider) Name() string {
|
|
|
|
return p.name
|
|
|
|
}
|
|
|
|
|
|
|
|
// BeginAuth implements the [idp.Provider] interface.
|
|
|
|
// It will create a [Session] with an OIDC authorization request as AuthURL.
|
2023-03-14 15:42:29 +00:00
|
|
|
func (p *Provider) BeginAuth(ctx context.Context, state string, params ...any) (idp.Session, error) {
|
|
|
|
opts := p.authOptions
|
|
|
|
for _, param := range params {
|
|
|
|
if option, ok := param.(rp.AuthURLOpt); ok {
|
|
|
|
opts = append(opts, option)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
url := rp.AuthURL(state, p.RelyingParty, opts...)
|
2023-01-23 07:11:40 +00:00
|
|
|
return &Session{AuthURL: url, Provider: p}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsLinkingAllowed implements the [idp.Provider] interface.
|
|
|
|
func (p *Provider) IsLinkingAllowed() bool {
|
|
|
|
return p.isLinkingAllowed
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsCreationAllowed implements the [idp.Provider] interface.
|
|
|
|
func (p *Provider) IsCreationAllowed() bool {
|
|
|
|
return p.isCreationAllowed
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsAutoCreation implements the [idp.Provider] interface.
|
|
|
|
func (p *Provider) IsAutoCreation() bool {
|
|
|
|
return p.isAutoCreation
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsAutoUpdate implements the [idp.Provider] interface.
|
|
|
|
func (p *Provider) IsAutoUpdate() bool {
|
|
|
|
return p.isAutoUpdate
|
|
|
|
}
|