mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-14 11:58:02 +00:00
8a5badddf6
* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix test * fix ports and enable console Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
255 lines
6.1 KiB
Go
255 lines
6.1 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"time"
|
|
|
|
"github.com/caos/oidc/pkg/oidc"
|
|
"github.com/caos/oidc/pkg/op"
|
|
"golang.org/x/text/language"
|
|
|
|
api_utils "github.com/caos/zitadel/internal/api"
|
|
http_utils "github.com/caos/zitadel/internal/api/http"
|
|
"github.com/caos/zitadel/internal/auth_request/model"
|
|
"github.com/caos/zitadel/internal/errors"
|
|
)
|
|
|
|
const (
|
|
amrPassword = "password"
|
|
amrMFA = "mfa"
|
|
amrOTP = "otp"
|
|
)
|
|
|
|
type AuthRequest struct {
|
|
*model.AuthRequest
|
|
}
|
|
|
|
func (a *AuthRequest) GetID() string {
|
|
return a.ID
|
|
}
|
|
|
|
func (a *AuthRequest) GetACR() string {
|
|
// return a.
|
|
return "" //PLANNED: impl
|
|
}
|
|
|
|
func (a *AuthRequest) GetAMR() []string {
|
|
amr := make([]string, 0)
|
|
if a.PasswordVerified {
|
|
amr = append(amr, amrPassword)
|
|
}
|
|
if len(a.MfasVerified) > 0 {
|
|
amr = append(amr, amrMFA)
|
|
for _, mfa := range a.MfasVerified {
|
|
if amrMfa := AMRFromMFAType(mfa); amrMfa != "" {
|
|
amr = append(amr, amrMfa)
|
|
}
|
|
}
|
|
}
|
|
return amr
|
|
}
|
|
|
|
func (a *AuthRequest) GetAudience() []string {
|
|
return a.Audience
|
|
}
|
|
|
|
func (a *AuthRequest) GetAuthTime() time.Time {
|
|
return a.AuthTime
|
|
}
|
|
|
|
func (a *AuthRequest) GetClientID() string {
|
|
return a.ApplicationID
|
|
}
|
|
|
|
func (a *AuthRequest) GetCodeChallenge() *oidc.CodeChallenge {
|
|
return CodeChallengeToOIDC(a.oidc().CodeChallenge)
|
|
}
|
|
|
|
func (a *AuthRequest) GetNonce() string {
|
|
return a.oidc().Nonce
|
|
}
|
|
|
|
func (a *AuthRequest) GetRedirectURI() string {
|
|
return a.CallbackURI
|
|
}
|
|
|
|
func (a *AuthRequest) GetResponseType() oidc.ResponseType {
|
|
return ResponseTypeToOIDC(a.oidc().ResponseType)
|
|
}
|
|
|
|
func (a *AuthRequest) GetScopes() []string {
|
|
return a.oidc().Scopes
|
|
}
|
|
|
|
func (a *AuthRequest) GetState() string {
|
|
return a.TransferState
|
|
}
|
|
|
|
func (a *AuthRequest) GetSubject() string {
|
|
return a.UserID
|
|
}
|
|
|
|
func (a *AuthRequest) Done() bool {
|
|
for _, step := range a.PossibleSteps {
|
|
if step.Type() == model.NextStepRedirectToCallback {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (a *AuthRequest) oidc() *model.AuthRequestOIDC {
|
|
return a.Request.(*model.AuthRequestOIDC)
|
|
}
|
|
|
|
func AuthRequestFromBusiness(authReq *model.AuthRequest) (_ op.AuthRequest, err error) {
|
|
if _, ok := authReq.Request.(*model.AuthRequestOIDC); !ok {
|
|
return nil, errors.ThrowInvalidArgument(nil, "OIDC-Haz7A", "auth request is not of type oidc")
|
|
}
|
|
return &AuthRequest{authReq}, nil
|
|
}
|
|
|
|
func CreateAuthRequestToBusiness(ctx context.Context, authReq *oidc.AuthRequest, userAgentID, userID string) *model.AuthRequest {
|
|
return &model.AuthRequest{
|
|
AgentID: userAgentID,
|
|
BrowserInfo: ParseBrowserInfoFromContext(ctx),
|
|
ApplicationID: authReq.ClientID,
|
|
CallbackURI: authReq.RedirectURI,
|
|
TransferState: authReq.State,
|
|
Prompt: PromptToBusiness(authReq.Prompt),
|
|
PossibleLOAs: ACRValuesToBusiness(authReq.ACRValues),
|
|
UiLocales: UILocalesToBusiness(authReq.UILocales),
|
|
LoginHint: authReq.LoginHint,
|
|
MaxAuthAge: authReq.MaxAge,
|
|
UserID: userID,
|
|
Request: &model.AuthRequestOIDC{
|
|
Scopes: authReq.Scopes,
|
|
ResponseType: ResponseTypeToBusiness(authReq.ResponseType),
|
|
Nonce: authReq.Nonce,
|
|
CodeChallenge: CodeChallengeToBusiness(authReq.CodeChallenge, authReq.CodeChallengeMethod),
|
|
},
|
|
}
|
|
}
|
|
|
|
func ParseBrowserInfoFromContext(ctx context.Context) *model.BrowserInfo {
|
|
userAgent, acceptLang := HttpHeadersFromContext(ctx)
|
|
ip := IpFromContext(ctx)
|
|
return &model.BrowserInfo{RemoteIP: ip, UserAgent: userAgent, AcceptLanguage: acceptLang}
|
|
}
|
|
|
|
func HttpHeadersFromContext(ctx context.Context) (userAgent, acceptLang string) {
|
|
ctxHeaders, ok := http_utils.HeadersFromCtx(ctx)
|
|
if !ok {
|
|
return
|
|
}
|
|
if agents, ok := ctxHeaders[api_utils.UserAgent]; ok {
|
|
userAgent = agents[0]
|
|
}
|
|
if langs, ok := ctxHeaders[api_utils.AcceptLanguage]; ok {
|
|
acceptLang = langs[0]
|
|
}
|
|
return userAgent, acceptLang
|
|
}
|
|
|
|
func IpFromContext(ctx context.Context) net.IP {
|
|
ipString := http_utils.RemoteIPFromCtx(ctx)
|
|
if ipString == "" {
|
|
return nil
|
|
}
|
|
return net.ParseIP(ipString)
|
|
}
|
|
|
|
func PromptToBusiness(prompt oidc.Prompt) model.Prompt {
|
|
switch prompt {
|
|
case oidc.PromptNone:
|
|
return model.PromptNone
|
|
case oidc.PromptLogin:
|
|
return model.PromptLogin
|
|
case oidc.PromptConsent:
|
|
return model.PromptConsent
|
|
case oidc.PromptSelectAccount:
|
|
return model.PromptSelectAccount
|
|
default:
|
|
return model.PromptUnspecified
|
|
}
|
|
}
|
|
|
|
func ACRValuesToBusiness(values []string) []model.LevelOfAssurance {
|
|
return nil
|
|
}
|
|
|
|
func UILocalesToBusiness(tags []language.Tag) []string {
|
|
if tags == nil {
|
|
return nil
|
|
}
|
|
locales := make([]string, len(tags))
|
|
for i, tag := range tags {
|
|
locales[i] = tag.String()
|
|
}
|
|
return locales
|
|
}
|
|
|
|
func ResponseTypeToBusiness(responseType oidc.ResponseType) model.OIDCResponseType {
|
|
switch responseType {
|
|
case oidc.ResponseTypeCode:
|
|
return model.OIDCResponseTypeCode
|
|
case oidc.ResponseTypeIDToken:
|
|
return model.OIDCResponseTypeIdToken
|
|
case oidc.ResponseTypeIDTokenOnly:
|
|
return model.OIDCResponseTypeToken
|
|
default:
|
|
return model.OIDCResponseTypeCode
|
|
}
|
|
}
|
|
|
|
func ResponseTypeToOIDC(responseType model.OIDCResponseType) oidc.ResponseType {
|
|
switch responseType {
|
|
case model.OIDCResponseTypeCode:
|
|
return oidc.ResponseTypeCode
|
|
case model.OIDCResponseTypeToken:
|
|
return oidc.ResponseTypeIDToken
|
|
case model.OIDCResponseTypeIdToken:
|
|
return oidc.ResponseTypeIDTokenOnly
|
|
default:
|
|
return oidc.ResponseTypeCode
|
|
}
|
|
}
|
|
|
|
func CodeChallengeToBusiness(challenge string, method oidc.CodeChallengeMethod) *model.OIDCCodeChallenge {
|
|
if challenge == "" {
|
|
return nil
|
|
}
|
|
challengeMethod := model.CodeChallengeMethodPlain
|
|
if method == oidc.CodeChallengeMethodS256 {
|
|
challengeMethod = model.CodeChallengeMethodS256
|
|
}
|
|
return &model.OIDCCodeChallenge{
|
|
Challenge: challenge,
|
|
Method: challengeMethod,
|
|
}
|
|
}
|
|
|
|
func CodeChallengeToOIDC(challenge *model.OIDCCodeChallenge) *oidc.CodeChallenge {
|
|
if challenge == nil {
|
|
return nil
|
|
}
|
|
challengeMethod := oidc.CodeChallengeMethodPlain
|
|
if challenge.Method == model.CodeChallengeMethodS256 {
|
|
challengeMethod = oidc.CodeChallengeMethodS256
|
|
}
|
|
return &oidc.CodeChallenge{
|
|
Challenge: challenge.Challenge,
|
|
Method: challengeMethod,
|
|
}
|
|
}
|
|
|
|
func AMRFromMFAType(mfaType model.MfaType) string {
|
|
switch mfaType {
|
|
case model.MfaTypeOTP:
|
|
return amrOTP
|
|
default:
|
|
return ""
|
|
}
|
|
}
|