forked from dexidp/dex
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Alex Palesandro
committed
Nov 9, 2023
1 parent
a333e96
commit 91cdf9e
Showing
11 changed files
with
369 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,69 @@ | ||
package claims | ||
|
||
import ( | ||
"encoding/json" | ||
"fmt" | ||
|
||
"github.com/dexidp/dex/pkg/webhook/config" | ||
"github.com/dexidp/dex/pkg/webhook/helpers" | ||
) | ||
|
||
func NewClaimMutatingHook(hook *config.ClaimsMutatingHook) (*ClaimsMutatingHook, error) { | ||
var hookInvoker ClaimsHookCaller | ||
switch hook.Type { | ||
case config.External: | ||
h, err := helpers.NewWebhookHTTPHelpers(hook.Config) | ||
if err != nil { | ||
return nil, fmt.Errorf("could not create webhook http helpers: %v", err) | ||
} | ||
hookInvoker = NewWebhookCaller(h, hook.AcceptedClaims) | ||
default: | ||
return nil, fmt.Errorf("unknown type: %s", hook.Type) | ||
} | ||
return &ClaimsMutatingHook{ | ||
Name: hook.Name, | ||
Type: hook.Type, | ||
HookInvoker: hookInvoker, | ||
}, nil | ||
} | ||
|
||
func NewWebhookCaller(h helpers.WebhookHTTPHelpers, acceptedClaims []string) *WebhookCallerImpl { | ||
return &WebhookCallerImpl{ | ||
AcceptedClaims: acceptedClaims, | ||
transportHelper: h, | ||
} | ||
} | ||
|
||
type ClaimsWebhookPayload struct { | ||
ConnID string `json:"connID"` | ||
Claims map[string]interface{} `json:"claims"` | ||
} | ||
|
||
func (w WebhookCallerImpl) callHook(claims map[string]interface{}, connID string) (map[string]interface{}, error) { | ||
toMarshal := ClaimsWebhookPayload{ | ||
ConnID: connID, | ||
Claims: claims, | ||
} | ||
|
||
payload, err := json.Marshal(toMarshal) | ||
if err != nil { | ||
return nil, fmt.Errorf("could not serialize claims: %v", err) | ||
} | ||
|
||
body, err := w.transportHelper.CallWebhook(payload) | ||
if err != nil { | ||
return nil, fmt.Errorf("could not call webhook: %v", err) | ||
} | ||
var res map[string]interface{} | ||
|
||
if err := json.Unmarshal(body, &res); err != nil { | ||
return nil, fmt.Errorf("could not unmarshal response: %v", err) | ||
} | ||
|
||
return res, nil | ||
} | ||
|
||
func (w WebhookCallerImpl) CallHook(claims map[string]interface{}, connID string) (map[string]interface{}, error) { | ||
filteredClaims := constrainScope(claims, w.AcceptedClaims) | ||
return w.callHook(filteredClaims, connID) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,77 @@ | ||
package claims | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/stretchr/testify/assert" | ||
"go.uber.org/mock/gomock" | ||
|
||
"github.com/dexidp/dex/pkg/webhook/config" | ||
"github.com/dexidp/dex/pkg/webhook/helpers" | ||
) | ||
|
||
func TestNewClaimsMutating(t *testing.T) { | ||
hook, err := NewClaimMutatingHook(&config.ClaimsMutatingHook{ | ||
Name: "test", | ||
Type: config.External, | ||
AcceptedClaims: []string{"claim1", "claim2"}, | ||
Config: &config.WebhookConfig{ | ||
URL: "https://test.com", | ||
InsecureSkipVerify: true, | ||
}, | ||
}) | ||
assert.NoError(t, err) | ||
assert.NotNil(t, hook) | ||
assert.Equal(t, hook.Name, "test") | ||
assert.Equal(t, hook.Type, config.External) | ||
assert.IsType(t, hook.HookInvoker, &WebhookCallerImpl{}) | ||
} | ||
|
||
func TestNewClaimsMutating_UnknownType(t *testing.T) { | ||
hook, err := NewClaimMutatingHook(&config.ClaimsMutatingHook{ | ||
Name: "test", | ||
Type: "Unknown", | ||
AcceptedClaims: []string{"claim1", "claim2"}, | ||
Config: &config.WebhookConfig{ | ||
URL: "https://test.com", | ||
InsecureSkipVerify: true, | ||
}, | ||
}) | ||
assert.Error(t, err) | ||
assert.Nil(t, hook) | ||
} | ||
|
||
func TestNewWebhookCaller(t *testing.T) { | ||
h, err := helpers.NewWebhookHTTPHelpers(&config.WebhookConfig{ | ||
URL: "https://test.com", | ||
InsecureSkipVerify: true, | ||
}) | ||
assert.NoError(t, err) | ||
d := NewWebhookCaller(h, []string{"claim1", "claim2"}) | ||
assert.NotNil(t, d) | ||
assert.Equal(t, d.AcceptedClaims, []string{"claim1", "claim2"}) | ||
assert.IsType(t, d.transportHelper, h) | ||
} | ||
|
||
func TestCallHook_Logic_Error(t *testing.T) { | ||
ctrl := gomock.NewController(t) | ||
defer ctrl.Finish() | ||
h := helpers.NewMockWebhookHTTPHelpers(ctrl) | ||
h.EXPECT().CallWebhook(gomock.Any()).Return(nil, assert.AnError) | ||
d := NewWebhookCaller(h, []string{"claim1", "claim2"}) | ||
hook, err := d.CallHook(map[string]interface{}{"claim1": "value1", "claim2": "value2"}, "test") | ||
assert.Error(t, err) | ||
assert.Nil(t, hook) | ||
} | ||
|
||
func TestCallHook_Logic(t *testing.T) { | ||
ctrl := gomock.NewController(t) | ||
defer ctrl.Finish() | ||
h := helpers.NewMockWebhookHTTPHelpers(ctrl) | ||
h.EXPECT().CallWebhook([]byte(`{"connID":"test","claims":{"claim1":"value1"}}`)).Return([]byte( | ||
`{"connID": "test", "claims": { "claim1" : "value1" } }`), nil) | ||
d := NewWebhookCaller(h, []string{"claim1", "claim3"}) | ||
hook, err := d.CallHook(map[string]interface{}{"claim1": "value1", "claim2": "value2"}, "test") | ||
assert.NoError(t, err) | ||
assert.NotNil(t, hook) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
package claims | ||
|
||
import "golang.org/x/exp/slices" | ||
|
||
func constrainScope(claims map[string]interface{}, acceptedClaims []string) map[string]interface{} { | ||
scopedClaims := make(map[string]interface{}) | ||
for k, v := range claims { | ||
if slices.Contains(acceptedClaims, k) { | ||
scopedClaims[k] = v | ||
} | ||
} | ||
return scopedClaims | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
package claims | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/stretchr/testify/assert" | ||
) | ||
|
||
func TestConstrainScope(t *testing.T) { | ||
res := constrainScope(map[string]interface{}{ | ||
"claim1": "value1", | ||
"claim2": "value2", | ||
}, []string{"claim1", "claim3"}) | ||
assert.Equal(t, res, map[string]interface{}{ | ||
"claim1": "value1", | ||
}) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
package claims | ||
|
||
import ( | ||
"encoding/json" | ||
"fmt" | ||
|
||
"golang.org/x/exp/maps" | ||
"golang.org/x/exp/slices" | ||
) | ||
|
||
func getProtectedClaims() []string { | ||
return []string{"iss", "sub", "aud", "exp", "iat", "azp", "nonce", "at_hash", "c_hash"} | ||
} | ||
|
||
func generateIDClaims(baseIDClaims map[string]interface{}, customClaims map[string]interface{}) map[string]interface{} { | ||
finalClaims := map[string]interface{}{} | ||
maps.Copy(finalClaims, baseIDClaims) | ||
// Adding the immutable claims to the token | ||
protectedClaims := getProtectedClaims() | ||
for claim := range customClaims { | ||
if !slices.Contains(protectedClaims, claim) { | ||
finalClaims[claim] = customClaims[claim] | ||
} | ||
} | ||
return finalClaims | ||
} | ||
|
||
func GenerateTokenFromTemplate(baseIDClaims map[string]interface{}, customClaims map[string]interface{}) ([]byte, | ||
error, | ||
) { | ||
payload, err := json.Marshal(generateIDClaims(baseIDClaims, customClaims)) | ||
if err != nil { | ||
return []byte{}, fmt.Errorf("could not serialize claims: %v", err) | ||
} | ||
return payload, nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,54 @@ | ||
package claims | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/stretchr/testify/assert" | ||
) | ||
|
||
func Test_GroupTranslation(t *testing.T) { | ||
baseIDToken := map[string]interface{}{ | ||
"groups": []string{"group1", "group2"}, | ||
} | ||
receivedIDToken := map[string]interface{}{ | ||
"groups": []string{"test2:group1", "test2:group2"}, | ||
} | ||
res, err := GenerateTokenFromTemplate(baseIDToken, receivedIDToken) | ||
assert.NoError(t, err) | ||
assert.Equal(t, res, []byte(`{"groups":["test2:group1","test2:group2"]}`)) | ||
} | ||
|
||
func Test_EmptyInput(t *testing.T) { | ||
res, err := GenerateTokenFromTemplate(map[string]interface{}{}, map[string]interface{}{}) | ||
assert.NoError(t, err) | ||
assert.Equal(t, res, []byte(`{}`)) | ||
} | ||
|
||
func Test_ProtectedClaims(t *testing.T) { | ||
baseIDToken := map[string]interface{}{ | ||
"iss": "iss", | ||
"sub": "sub", | ||
"aud": "aud", | ||
"groups": []string{"group1", "group2"}, | ||
} | ||
receivedIDToken := map[string]interface{}{ | ||
"iss": "iss2", | ||
"groups": []string{"test2:group1", "test2:group2"}, | ||
} | ||
res, err := GenerateTokenFromTemplate(baseIDToken, receivedIDToken) | ||
assert.NoError(t, err) | ||
assert.Equal(t, res, []byte(`{"aud":"aud","groups":["test2:group1","test2:group2"],"iss":"iss","sub":"sub"}`)) | ||
} | ||
|
||
func Test_NotStandardClaims(t *testing.T) { | ||
baseIDToken := map[string]interface{}{ | ||
"groups": []string{"group1", "group2"}, | ||
} | ||
receivedIDToken := map[string]interface{}{ | ||
"groups": []string{"test2:group1", "test2:group2"}, | ||
"custom": "custom", | ||
} | ||
res, err := GenerateTokenFromTemplate(baseIDToken, receivedIDToken) | ||
assert.NoError(t, err) | ||
assert.Equal(t, res, []byte(`{"custom":"custom","groups":["test2:group1","test2:group2"]}`)) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
package claims | ||
|
||
import ( | ||
"github.com/dexidp/dex/pkg/webhook/config" | ||
"github.com/dexidp/dex/pkg/webhook/helpers" | ||
) | ||
|
||
type MutateClaimsRequest interface { | ||
MutateClaims(claims map[string]interface{}, connID string) (map[string]interface{}, error) | ||
} | ||
|
||
type ClaimsHookCaller interface { | ||
CallHook(claims map[string]interface{}, connID string) (map[string]interface{}, error) | ||
} | ||
|
||
type ClaimsMutatingHook struct { | ||
// Name is the name of the webhook | ||
Name string `json:"name"` | ||
// To be modified to enum? | ||
Type config.HookType `json:"type"` | ||
HookInvoker ClaimsHookCaller | ||
} | ||
|
||
var _ ClaimsHookCaller = &WebhookCallerImpl{} | ||
|
||
type WebhookCallerImpl struct { | ||
AcceptedClaims []string | ||
transportHelper helpers.WebhookHTTPHelpers | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
package config | ||
|
||
type ClaimsMutatingHook struct { | ||
// Name is the name of the webhook | ||
Name string `json:"name"` | ||
Type HookType `json:"type"` | ||
AcceptedClaims []string `json:"claims"` | ||
Config *WebhookConfig | ||
} | ||
|
||
type ClaimsValidatingHook struct { | ||
// Name is the name of the webhook | ||
Name string `json:"name"` | ||
// To be modified to enum? | ||
Type HookType `json:"type"` | ||
AcceptedClaims []string `json:"claims"` | ||
Config *WebhookConfig `json:"config"` | ||
} | ||
|
||
type TokenClaimsHooks struct { | ||
MutatingHooks []ClaimsMutatingHook `json:"mutatingHooks"` | ||
ValidatingHooks []ClaimsValidatingHook `json:"validatingHooks"` | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
package config | ||
|
||
type HookType string | ||
|
||
const ( | ||
External HookType = "external" | ||
) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.