From c15577c1f925103fefc2aa3c5924227d8c2757bc Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Wed, 27 Jul 2022 09:49:16 +0200 Subject: [PATCH] fix: use default redirect uri when not passed on end_session endpoint (#4054) * fix: use default redirect uri when not passed on end_session endpoint * instance state --- docs/docs/apis/openidoauth/endpoints.md | 18 +++++++++++++++--- go.mod | 2 +- go.sum | 4 ++-- internal/api/grpc/instance/converter.go | 2 ++ internal/api/oidc/auth_request.go | 6 +++--- .../ui/login/static/templates/logout_done.html | 4 ++-- 6 files changed, 25 insertions(+), 11 deletions(-) diff --git a/docs/docs/apis/openidoauth/endpoints.md b/docs/docs/apis/openidoauth/endpoints.md index 4723b8416e..d5bd12dd29 100644 --- a/docs/docs/apis/openidoauth/endpoints.md +++ b/docs/docs/apis/openidoauth/endpoints.md @@ -323,7 +323,7 @@ Send a `client_assertion` as JWT for us to validate the signature against the re {your_domain}/oauth/v2/introspect -This endpoint enables client to validate an `acccess_token`, either opaque or JWT. Unlike client side JWT validation, +This endpoint enables clients to validate an `acccess_token`, either opaque or JWT. Unlike client side JWT validation, this endpoint will check if the token is not revoked (by client or logout). | Parameter | Description | @@ -499,9 +499,21 @@ curl --request POST \ ## end_session_endpoint -{your_domain}/oidc/v1/endsession +{your_domain}/oidc/v1/end_session -> The end_session_endpoint is located with the login page, due to the need of accessing the same cookie domain +The endpoint has to be opened in the user agent (browser) to terminate the user sessions. + +No parameters are needed apart from the user agent cookie, but you can provide the following to customize the behaviour: + +| Parameter | Description | +|--------------------------|----------------------------------------------------------------------------------------------------------------------------------| +| id_token_hint | the id_token that was previously issued to the client | +| client_id | client_id of the application | +| post_logout_redirect_uri | Callback uri of the logout where the user (agent) will be redirected to. Must match exactly one of the preregistered in Console. | +| state | Opaque value used to maintain state between the request and the callback | + +The `post_logout_redirect_uri` will be checked against the previously registered uris of the client provided by the `azp` claim of the `id_token_hint` or the `client_id` parameter. +If both parameters are provided, they must be equal. ## jwks_uri diff --git a/go.mod b/go.mod index 80c9649b6f..679d91caea 100644 --- a/go.mod +++ b/go.mod @@ -48,7 +48,7 @@ require ( github.com/superseriousbusiness/exifremove v0.0.0-20210330092427-6acd27eac203 github.com/ttacon/libphonenumber v1.2.1 github.com/zitadel/logging v0.3.4 - github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.4 + github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.27.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.27.0 go.opentelemetry.io/otel v1.2.0 diff --git a/go.sum b/go.sum index 1c77d75086..7f10eaf680 100644 --- a/go.sum +++ b/go.sum @@ -865,8 +865,8 @@ github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q= github.com/zitadel/logging v0.3.4 h1:9hZsTjMMTE3X2LUi0xcF9Q9EdLo+FAezeu52ireBbHM= github.com/zitadel/logging v0.3.4/go.mod h1:aPpLQhE+v6ocNK0TWrBrd363hZ95KcI17Q1ixAQwZF0= -github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.4 h1:llGVhiHOuI2SXF6yR9s5podxe8n7Md0lpo/9cr37AkU= -github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.4/go.mod h1:uoJw5Xc6HXfnQbNZiLbld9dED0/8UMu0M4gOipTRZBA= +github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5 h1:dP+6SheVtpF4T/oql6mJoqou8jlW3J/9NCTYnEpKgpM= +github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5/go.mod h1:uoJw5Xc6HXfnQbNZiLbld9dED0/8UMu0M4gOipTRZBA= go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg= go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs= diff --git a/internal/api/grpc/instance/converter.go b/internal/api/grpc/instance/converter.go index 8cbbed0902..a59b674b78 100644 --- a/internal/api/grpc/instance/converter.go +++ b/internal/api/grpc/instance/converter.go @@ -28,6 +28,7 @@ func InstanceToPb(instance *query.Instance) *instance_pb.Instance { Name: instance.Name, Domains: DomainsToPb(instance.Domains), Version: build.Version(), + State: instance_pb.State_STATE_RUNNING, //TODO: change when delete is implemented } } @@ -43,6 +44,7 @@ func InstanceDetailToPb(instance *query.Instance) *instance_pb.InstanceDetail { Name: instance.Name, Domains: DomainsToPb(instance.Domains), Version: build.Version(), + State: instance_pb.State_STATE_RUNNING, //TODO: change when delete is implemented } } diff --git a/internal/api/oidc/auth_request.go b/internal/api/oidc/auth_request.go index 649ae4b6bd..d32d2e49c2 100644 --- a/internal/api/oidc/auth_request.go +++ b/internal/api/oidc/auth_request.go @@ -143,12 +143,12 @@ func (o *OPStorage) TerminateSession(ctx context.Context, userID, clientID strin defer func() { span.EndWithError(err) }() userAgentID, ok := middleware.UserAgentIDFromCtx(ctx) if !ok { - logging.Log("OIDC-aGh4q").Error("no user agent id") + logging.Error("no user agent id") return errors.ThrowPreconditionFailed(nil, "OIDC-fso7F", "no user agent id") } userIDs, err := o.repo.UserSessionUserIDsByAgentID(ctx, userAgentID) if err != nil { - logging.Log("OIDC-Ghgr3").WithError(err).Error("error retrieving user sessions") + logging.WithError(err).Error("error retrieving user sessions") return err } if len(userIDs) == 0 { @@ -158,7 +158,7 @@ func (o *OPStorage) TerminateSession(ctx context.Context, userID, clientID strin UserID: userID, } err = o.command.HumansSignOut(authz.SetCtxData(ctx, data), userAgentID, userIDs) - logging.Log("OIDC-Dggt2").OnError(err).Error("error signing out") + logging.OnError(err).Error("error signing out") return err } diff --git a/internal/api/ui/login/static/templates/logout_done.html b/internal/api/ui/login/static/templates/logout_done.html index de359c4c84..36d001c76b 100644 --- a/internal/api/ui/login/static/templates/logout_done.html +++ b/internal/api/ui/login/static/templates/logout_done.html @@ -10,9 +10,9 @@
- +
-{{template "main-bottom" .}} \ No newline at end of file +{{template "main-bottom" .}}