mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-29 18:19:07 +02:00
Bethuel Mmbaga
30dd076b36
* Generalize PKCE verifier store into SingleUseStore * Generalize PKCE verifier store into SingleUseStore * Extend single-use store to generate one-time retrieval codes * Hand off proxy OIDC session via one-time code instead of URL token * Use the single-use store in integration tests * Read active proxy versions by cluster * Detect proxy clusters that support session codes * Bind OIDC session handoff mode to signed state * Deprecate legacy OIDC session token handoff * Remove unrelated session code test stub * fix tests * fix merge * Fix session code compatibility detection * Isolate proxy session codes in shared cache * bump min session version
72 lines
1.9 KiB
Go
72 lines
1.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"google.golang.org/grpc"
|
|
|
|
"github.com/netbirdio/netbird/proxy/auth"
|
|
"github.com/netbirdio/netbird/proxy/internal/types"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
type urlGenerator interface {
|
|
GetOIDCURL(context.Context, *proto.GetOIDCURLRequest, ...grpc.CallOption) (*proto.GetOIDCURLResponse, error)
|
|
}
|
|
|
|
type OIDC struct {
|
|
id types.ServiceID
|
|
accountId types.AccountID
|
|
forwardedProto string
|
|
client urlGenerator
|
|
}
|
|
|
|
// NewOIDC creates a new OIDC authentication scheme
|
|
func NewOIDC(client urlGenerator, id types.ServiceID, accountId types.AccountID, forwardedProto string) OIDC {
|
|
return OIDC{
|
|
id: id,
|
|
accountId: accountId,
|
|
forwardedProto: forwardedProto,
|
|
client: client,
|
|
}
|
|
}
|
|
|
|
func (OIDC) Type() auth.Method {
|
|
return auth.MethodOIDC
|
|
}
|
|
|
|
// Authenticate checks for an OIDC session token or obtains the OIDC redirect URL.
|
|
func (o OIDC) Authenticate(r *http.Request) (string, string, error) {
|
|
// Check for the session credential returned by the OIDC callback. The management
|
|
// server passes it in the URL because it cannot set a cookie for the proxy's
|
|
// domain (cookies are domain-scoped per RFC 6265). The current flow uses a
|
|
// single-use session_code to keep the durable token out of the URL.
|
|
// session_token remains supported for backward compatibility.
|
|
if code := r.URL.Query().Get("session_code"); code != "" {
|
|
return code, "", nil
|
|
}
|
|
if token := r.URL.Query().Get("session_token"); token != "" {
|
|
return token, "", nil
|
|
}
|
|
|
|
redirectURL := &url.URL{
|
|
Scheme: auth.ResolveProto(o.forwardedProto, r.TLS),
|
|
Host: r.Host,
|
|
Path: r.URL.Path,
|
|
}
|
|
|
|
res, err := o.client.GetOIDCURL(r.Context(), &proto.GetOIDCURLRequest{
|
|
Id: string(o.id),
|
|
AccountId: string(o.accountId),
|
|
RedirectUrl: redirectURL.String(),
|
|
})
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("get OIDC URL: %w", err)
|
|
}
|
|
|
|
return "", res.GetUrl(), nil
|
|
}
|