mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-14 20:08:02 +00:00
fd0c15dd4f
# Which Problems Are Solved Use web keys, managed by the `resources/v3alpha/web_keys` API, for OIDC token signing and verification, as well as serving the public web keys on the jwks / keys endpoint. Response header on the keys endpoint now allows caching of the response. This is now "safe" to do since keys can be created ahead of time and caches have sufficient time to pickup the change before keys get enabled. # How the Problems Are Solved - The web key format is used in the `getSignerOnce` function in the `api/oidc` package. - The public key cache is changed to get and store web keys. - The jwks / keys endpoint returns the combined set of valid "legacy" public keys and all available web keys. - Cache-Control max-age default to 5 minutes and is configured in `defaults.yaml`. When the web keys feature is enabled, fallback mechanisms are in place to obtain and convert "legacy" `query.PublicKey` as web keys when needed. This allows transitioning to the feature without invalidating existing tokens. A small performance overhead may be noticed on the keys endpoint, because 2 queries need to be run sequentially. This will disappear once the feature is stable and the legacy code gets cleaned up. # Additional Changes - Extend legacy key lifetimes so that tests can be run on an existing database with more than 6 hours apart. - Discovery endpoint returns all supported algorithms when the Web Key feature is enabled. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/8031 - Part of https://github.com/zitadel/zitadel/issues/7809 - After https://github.com/zitadel/oidc/pull/637 - After https://github.com/zitadel/oidc/pull/638
210 lines
11 KiB
Go
210 lines
11 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"github.com/zitadel/oidc/v3/pkg/op"
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
"github.com/zitadel/zitadel/internal/feature"
|
|
"golang.org/x/text/language"
|
|
)
|
|
|
|
func TestServer_createDiscoveryConfig(t *testing.T) {
|
|
type fields struct {
|
|
LegacyServer *op.LegacyServer
|
|
signingKeyAlgorithm string
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
supportedUILocales []language.Tag
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
want *oidc.DiscoveryConfiguration
|
|
}{
|
|
{
|
|
"config",
|
|
fields{
|
|
LegacyServer: op.NewLegacyServer(
|
|
func() *op.Provider {
|
|
//nolint:staticcheck
|
|
provider, _ := op.NewForwardedOpenIDProvider("path",
|
|
&op.Config{
|
|
CodeMethodS256: true,
|
|
AuthMethodPost: true,
|
|
AuthMethodPrivateKeyJWT: true,
|
|
GrantTypeRefreshToken: true,
|
|
RequestObjectSupported: true,
|
|
},
|
|
nil,
|
|
)
|
|
return provider
|
|
}(),
|
|
op.Endpoints{
|
|
Authorization: op.NewEndpoint("auth"),
|
|
Token: op.NewEndpoint("token"),
|
|
Introspection: op.NewEndpoint("introspect"),
|
|
Userinfo: op.NewEndpoint("userinfo"),
|
|
Revocation: op.NewEndpoint("revoke"),
|
|
EndSession: op.NewEndpoint("logout"),
|
|
JwksURI: op.NewEndpoint("keys"),
|
|
DeviceAuthorization: op.NewEndpoint("device"),
|
|
},
|
|
),
|
|
signingKeyAlgorithm: "RS256",
|
|
},
|
|
args{
|
|
ctx: op.ContextWithIssuer(context.Background(), "https://issuer.com"),
|
|
supportedUILocales: []language.Tag{language.English, language.German},
|
|
},
|
|
&oidc.DiscoveryConfiguration{
|
|
Issuer: "https://issuer.com",
|
|
AuthorizationEndpoint: "https://issuer.com/auth",
|
|
TokenEndpoint: "https://issuer.com/token",
|
|
IntrospectionEndpoint: "https://issuer.com/introspect",
|
|
UserinfoEndpoint: "https://issuer.com/userinfo",
|
|
RevocationEndpoint: "https://issuer.com/revoke",
|
|
EndSessionEndpoint: "https://issuer.com/logout",
|
|
DeviceAuthorizationEndpoint: "https://issuer.com/device",
|
|
CheckSessionIframe: "",
|
|
JwksURI: "https://issuer.com/keys",
|
|
RegistrationEndpoint: "",
|
|
ScopesSupported: []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopePhone, oidc.ScopeAddress, oidc.ScopeOfflineAccess},
|
|
ResponseTypesSupported: []string{string(oidc.ResponseTypeCode), string(oidc.ResponseTypeIDTokenOnly), string(oidc.ResponseTypeIDToken)},
|
|
ResponseModesSupported: []string{string(oidc.ResponseModeQuery), string(oidc.ResponseModeFragment), string(oidc.ResponseModeFormPost)},
|
|
GrantTypesSupported: []oidc.GrantType{oidc.GrantTypeCode, oidc.GrantTypeImplicit, oidc.GrantTypeRefreshToken, oidc.GrantTypeBearer},
|
|
ACRValuesSupported: nil,
|
|
SubjectTypesSupported: []string{"public"},
|
|
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
|
IDTokenEncryptionAlgValuesSupported: nil,
|
|
IDTokenEncryptionEncValuesSupported: nil,
|
|
UserinfoSigningAlgValuesSupported: nil,
|
|
UserinfoEncryptionAlgValuesSupported: nil,
|
|
UserinfoEncryptionEncValuesSupported: nil,
|
|
RequestObjectSigningAlgValuesSupported: []string{"RS256"},
|
|
RequestObjectEncryptionAlgValuesSupported: nil,
|
|
RequestObjectEncryptionEncValuesSupported: nil,
|
|
TokenEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodNone, oidc.AuthMethodBasic, oidc.AuthMethodPost, oidc.AuthMethodPrivateKeyJWT},
|
|
TokenEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
RevocationEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodNone, oidc.AuthMethodBasic, oidc.AuthMethodPost, oidc.AuthMethodPrivateKeyJWT},
|
|
RevocationEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
IntrospectionEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodBasic, oidc.AuthMethodPrivateKeyJWT},
|
|
IntrospectionEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
DisplayValuesSupported: nil,
|
|
ClaimTypesSupported: nil,
|
|
ClaimsSupported: []string{"sub", "aud", "exp", "iat", "iss", "auth_time", "nonce", "acr", "amr", "c_hash", "at_hash", "act", "scopes", "client_id", "azp", "preferred_username", "name", "family_name", "given_name", "locale", "email", "email_verified", "phone_number", "phone_number_verified"},
|
|
ClaimsParameterSupported: false,
|
|
CodeChallengeMethodsSupported: []oidc.CodeChallengeMethod{"S256"},
|
|
ServiceDocumentation: "",
|
|
ClaimsLocalesSupported: nil,
|
|
UILocalesSupported: []language.Tag{language.English, language.German},
|
|
RequestParameterSupported: true,
|
|
RequestURIParameterSupported: false,
|
|
RequireRequestURIRegistration: false,
|
|
OPPolicyURI: "",
|
|
OPTermsOfServiceURI: "",
|
|
},
|
|
},
|
|
{
|
|
"web keys feature enabled",
|
|
fields{
|
|
LegacyServer: op.NewLegacyServer(
|
|
func() *op.Provider {
|
|
//nolint:staticcheck
|
|
provider, _ := op.NewForwardedOpenIDProvider("path",
|
|
&op.Config{
|
|
CodeMethodS256: true,
|
|
AuthMethodPost: true,
|
|
AuthMethodPrivateKeyJWT: true,
|
|
GrantTypeRefreshToken: true,
|
|
RequestObjectSupported: true,
|
|
},
|
|
nil,
|
|
)
|
|
return provider
|
|
}(),
|
|
op.Endpoints{
|
|
Authorization: op.NewEndpoint("auth"),
|
|
Token: op.NewEndpoint("token"),
|
|
Introspection: op.NewEndpoint("introspect"),
|
|
Userinfo: op.NewEndpoint("userinfo"),
|
|
Revocation: op.NewEndpoint("revoke"),
|
|
EndSession: op.NewEndpoint("logout"),
|
|
JwksURI: op.NewEndpoint("keys"),
|
|
DeviceAuthorization: op.NewEndpoint("device"),
|
|
},
|
|
),
|
|
signingKeyAlgorithm: "RS256",
|
|
},
|
|
args{
|
|
ctx: authz.WithFeatures(
|
|
op.ContextWithIssuer(context.Background(), "https://issuer.com"),
|
|
feature.Features{WebKey: true},
|
|
),
|
|
supportedUILocales: []language.Tag{language.English, language.German},
|
|
},
|
|
&oidc.DiscoveryConfiguration{
|
|
Issuer: "https://issuer.com",
|
|
AuthorizationEndpoint: "https://issuer.com/auth",
|
|
TokenEndpoint: "https://issuer.com/token",
|
|
IntrospectionEndpoint: "https://issuer.com/introspect",
|
|
UserinfoEndpoint: "https://issuer.com/userinfo",
|
|
RevocationEndpoint: "https://issuer.com/revoke",
|
|
EndSessionEndpoint: "https://issuer.com/logout",
|
|
DeviceAuthorizationEndpoint: "https://issuer.com/device",
|
|
CheckSessionIframe: "",
|
|
JwksURI: "https://issuer.com/keys",
|
|
RegistrationEndpoint: "",
|
|
ScopesSupported: []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopePhone, oidc.ScopeAddress, oidc.ScopeOfflineAccess},
|
|
ResponseTypesSupported: []string{string(oidc.ResponseTypeCode), string(oidc.ResponseTypeIDTokenOnly), string(oidc.ResponseTypeIDToken)},
|
|
ResponseModesSupported: []string{string(oidc.ResponseModeQuery), string(oidc.ResponseModeFragment), string(oidc.ResponseModeFormPost)},
|
|
GrantTypesSupported: []oidc.GrantType{oidc.GrantTypeCode, oidc.GrantTypeImplicit, oidc.GrantTypeRefreshToken, oidc.GrantTypeBearer},
|
|
ACRValuesSupported: nil,
|
|
SubjectTypesSupported: []string{"public"},
|
|
IDTokenSigningAlgValuesSupported: supportedWebKeyAlgs,
|
|
IDTokenEncryptionAlgValuesSupported: nil,
|
|
IDTokenEncryptionEncValuesSupported: nil,
|
|
UserinfoSigningAlgValuesSupported: nil,
|
|
UserinfoEncryptionAlgValuesSupported: nil,
|
|
UserinfoEncryptionEncValuesSupported: nil,
|
|
RequestObjectSigningAlgValuesSupported: []string{"RS256"},
|
|
RequestObjectEncryptionAlgValuesSupported: nil,
|
|
RequestObjectEncryptionEncValuesSupported: nil,
|
|
TokenEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodNone, oidc.AuthMethodBasic, oidc.AuthMethodPost, oidc.AuthMethodPrivateKeyJWT},
|
|
TokenEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
RevocationEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodNone, oidc.AuthMethodBasic, oidc.AuthMethodPost, oidc.AuthMethodPrivateKeyJWT},
|
|
RevocationEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
IntrospectionEndpointAuthMethodsSupported: []oidc.AuthMethod{oidc.AuthMethodBasic, oidc.AuthMethodPrivateKeyJWT},
|
|
IntrospectionEndpointAuthSigningAlgValuesSupported: []string{"RS256"},
|
|
DisplayValuesSupported: nil,
|
|
ClaimTypesSupported: nil,
|
|
ClaimsSupported: []string{"sub", "aud", "exp", "iat", "iss", "auth_time", "nonce", "acr", "amr", "c_hash", "at_hash", "act", "scopes", "client_id", "azp", "preferred_username", "name", "family_name", "given_name", "locale", "email", "email_verified", "phone_number", "phone_number_verified"},
|
|
ClaimsParameterSupported: false,
|
|
CodeChallengeMethodsSupported: []oidc.CodeChallengeMethod{"S256"},
|
|
ServiceDocumentation: "",
|
|
ClaimsLocalesSupported: nil,
|
|
UILocalesSupported: []language.Tag{language.English, language.German},
|
|
RequestParameterSupported: true,
|
|
RequestURIParameterSupported: false,
|
|
RequireRequestURIRegistration: false,
|
|
OPPolicyURI: "",
|
|
OPTermsOfServiceURI: "",
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := &Server{
|
|
LegacyServer: tt.fields.LegacyServer,
|
|
signingKeyAlgorithm: tt.fields.signingKeyAlgorithm,
|
|
}
|
|
assert.Equalf(t, tt.want, s.createDiscoveryConfig(tt.args.ctx, tt.args.supportedUILocales), "createDiscoveryConfig(%v)", tt.args.ctx)
|
|
})
|
|
}
|
|
}
|