mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-16 12:58:00 +00:00
041af26917
# Which Problems Are Solved Currently ZITADEL supports RP-initiated logout for clients. Back-channel logout ensures that user sessions are terminated across all connected applications, even if the user closes their browser or loses connectivity providing a more secure alternative for certain use cases. # How the Problems Are Solved If the feature is activated and the client used for the authentication has a back_channel_logout_uri configured, a `session_logout.back_channel` will be registered. Once a user terminates their session, a (notification) handler will send a SET (form POST) to the registered uri containing a logout_token (with the user's ID and session ID). - A new feature "back_channel_logout" is added on system and instance level - A `back_channel_logout_uri` can be managed on OIDC applications - Added a `session_logout` aggregate to register and inform about sent `back_channel` notifications - Added a `SecurityEventToken` channel and `Form`message type in the notification handlers - Added `TriggeredAtOrigin` fields to `HumanSignedOut` and `TerminateSession` events for notification handling - Exported various functions and types in the `oidc` package to be able to reuse for token signing in the back_channel notifier. - To prevent that current existing session termination events will be handled, a setup step is added to set the `current_states` for the `projections.notifications_back_channel_logout` to the current position - [x] requires https://github.com/zitadel/oidc/pull/671 # Additional Changes - Updated all OTEL dependencies to v1.29.0, since OIDC already updated some of them to that version. - Single Session Termination feature is correctly checked (fixed feature mapping) # Additional Context - closes https://github.com/zitadel/zitadel/issues/8467 - TODO: - Documentation - UI to be done: https://github.com/zitadel/zitadel/issues/8469 --------- Co-authored-by: Hidde Wieringa <hidde@hiddewieringa.nl>
103 lines
2.6 KiB
Go
103 lines
2.6 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/go-jose/go-jose/v4"
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"github.com/zitadel/oidc/v3/pkg/op"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/query"
|
|
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
|
)
|
|
|
|
func (s *Server) JWTProfile(ctx context.Context, r *op.Request[oidc.JWTProfileGrantRequest]) (_ *op.Response, err error) {
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
defer func() {
|
|
span.EndWithError(err)
|
|
err = oidcError(err)
|
|
}()
|
|
|
|
user, err := s.verifyJWTProfile(ctx, r.Data)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
client := &clientCredentialsClient{
|
|
clientID: user.Username,
|
|
userID: user.UserID,
|
|
resourceOwner: user.ResourceOwner,
|
|
tokenType: user.TokenType,
|
|
}
|
|
scope, err := op.ValidateAuthReqScopes(client, r.Data.Scope)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
scope, err = s.checkOrgScopes(ctx, client.resourceOwner, scope)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
session, err := s.command.CreateOIDCSession(ctx,
|
|
client.userID,
|
|
client.resourceOwner,
|
|
client.clientID,
|
|
"", // backChannelLogoutURI not needed for service user session
|
|
scope,
|
|
domain.AddAudScopeToAudience(ctx, nil, r.Data.Scope),
|
|
[]domain.UserAuthMethodType{domain.UserAuthMethodTypePrivateKey},
|
|
time.Now(),
|
|
"",
|
|
nil,
|
|
nil,
|
|
domain.TokenReasonJWTProfile,
|
|
nil,
|
|
false,
|
|
"",
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false, true, true, false))
|
|
}
|
|
|
|
func (s *Server) verifyJWTProfile(ctx context.Context, req *oidc.JWTProfileGrantRequest) (_ *query.AuthNKeyUser, err error) {
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
defer func() { span.EndWithError(err) }()
|
|
|
|
storage := &jwtProfileKeyStorage{query: s.query}
|
|
verifier := op.NewJWTProfileVerifier(
|
|
storage, op.IssuerFromContext(ctx),
|
|
time.Hour, time.Second,
|
|
)
|
|
_, err = op.VerifyJWTAssertion(ctx, req.Assertion, verifier)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return storage.user, nil
|
|
}
|
|
|
|
type jwtProfileKeyStorage struct {
|
|
query *query.Queries
|
|
user *query.AuthNKeyUser // only populated after GetKeyByIDAndClientID is called
|
|
}
|
|
|
|
func (s *jwtProfileKeyStorage) GetKeyByIDAndClientID(ctx context.Context, keyID, userID string) (_ *jose.JSONWebKey, err error) {
|
|
s.user, err = s.query.GetAuthNKeyUser(ctx, keyID, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
publicKey, err := crypto.BytesToPublicKey(s.user.PublicKey)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &jose.JSONWebKey{
|
|
KeyID: keyID,
|
|
Use: "sig",
|
|
Key: publicKey,
|
|
}, nil
|
|
}
|