-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(openid): harden id_token validation
- Loading branch information
Showing
6 changed files
with
298 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,245 @@ | ||
| package openid_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/google/uuid" | ||
| "github.com/lestrrat-go/jwx/v2/jwa" | ||
| "github.com/lestrrat-go/jwx/v2/jwt" | ||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/nais/wonderwall/pkg/crypto" | ||
| "github.com/nais/wonderwall/pkg/mock" | ||
| "github.com/nais/wonderwall/pkg/openid" | ||
| ) | ||
|
|
||
| func TestParseIDToken(t *testing.T) { | ||
| iat := time.Now().Truncate(time.Second).UTC() | ||
| exp := iat.Add(5 * time.Second) | ||
| sub := uuid.New().String() | ||
|
|
||
| parsed, err := makeIDToken(claims{ | ||
| setClaims: map[string]any{ | ||
| "sub": sub, | ||
| "iat": iat.Unix(), | ||
| "exp": exp.Unix(), | ||
| }}) | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, sub, parsed.GetToken().Subject()) | ||
| assert.Equal(t, "some-issuer", parsed.GetToken().Issuer()) | ||
| assert.Equal(t, []string{"some-client-id"}, parsed.GetToken().Audience()) | ||
| assert.Equal(t, "some-nonce", parsed.GetStringClaimOrEmpty("nonce")) | ||
| assert.Equal(t, "some-acr", parsed.GetStringClaimOrEmpty("acr")) | ||
| assert.Equal(t, iat, parsed.GetToken().IssuedAt()) | ||
| assert.Equal(t, exp, parsed.GetToken().Expiration()) | ||
| assert.NotEmpty(t, parsed.GetToken().JwtID()) | ||
| } | ||
|
|
||
| func TestIDToken_GetAcrClaim(t *testing.T) { | ||
| idToken, err := makeIDToken() | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, "some-acr", idToken.GetAcrClaim()) | ||
| } | ||
|
|
||
| func TestIDToken_GetAmrClaim(t *testing.T) { | ||
| t.Run("amr is a string", func(t *testing.T) { | ||
| idToken, err := makeIDToken(claims{ | ||
| setClaims: map[string]any{ | ||
| "amr": "some-amr", | ||
| }}) | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, "some-amr", idToken.GetAmrClaim()) | ||
| }) | ||
|
|
||
| t.Run("amr is a string array", func(t *testing.T) { | ||
| idToken, err := makeIDToken(claims{ | ||
| setClaims: map[string]any{ | ||
| "amr": []string{"some-amr-array"}, | ||
| }, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, "some-amr-array", idToken.GetAmrClaim()) | ||
| }) | ||
|
|
||
| t.Run("amr is a string array with multiple values", func(t *testing.T) { | ||
| idToken, err := makeIDToken(claims{ | ||
| setClaims: map[string]any{ | ||
| "amr": []string{"some-amr-1", "some-amr-2"}, | ||
| }, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| assert.Equal(t, "some-amr-1,some-amr-2", idToken.GetAmrClaim()) | ||
| }) | ||
| } | ||
|
|
||
| func TestIDToken_GetSidClaim(t *testing.T) { | ||
| idToken, err := makeIDToken(claims{ | ||
| setClaims: map[string]any{ | ||
| "sid": "some-sid", | ||
| }, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| sid, err := idToken.GetSidClaim() | ||
| assert.NoError(t, err) | ||
| assert.Equal(t, "some-sid", sid) | ||
| } | ||
|
|
||
| func TestIDToken_Validate(t *testing.T) { | ||
| openidcfg := mock.NewTestConfiguration(mock.Config()) | ||
| openidcfg.TestProvider.WithFrontChannelLogoutSupport() | ||
| cookie := &openid.LoginCookie{ | ||
| Acr: "some-acr", | ||
| Nonce: "some-nonce", | ||
| } | ||
|
|
||
| for _, tt := range []struct { | ||
| name string | ||
| claims claims | ||
| assertion assert.ErrorAssertionFunc | ||
| }{ | ||
| { | ||
| name: "happy path", | ||
| claims: claims{ | ||
| setClaims: map[string]any{ | ||
| "sid": "some-sid", | ||
| "aud": openidcfg.Client().ClientID(), | ||
| "iss": openidcfg.Provider().Issuer(), | ||
| }, | ||
| }, | ||
| assertion: assert.NoError, | ||
| }, | ||
| } { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| idToken, err := makeIDToken(tt.claims) | ||
| require.NoError(t, err) | ||
|
|
||
| tt.assertion(t, idToken.Validate(openidcfg, cookie)) | ||
| }) | ||
| } | ||
|
|
||
| // TODO | ||
| t.Run("required claims", func(t *testing.T) { | ||
| t.Run("missing sub", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("missing exp", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("missing iat", func(t *testing.T) { | ||
|
|
||
| }) | ||
| }) | ||
|
|
||
| t.Run("nonce validation", func(t *testing.T) { | ||
| t.Run("missing nonce", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("nonce does not match nonce in authorization request", func(t *testing.T) { | ||
|
|
||
| }) | ||
| }) | ||
|
|
||
| t.Run("issuer validation", func(t *testing.T) { | ||
| t.Run("missing iss", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("issuer does not match provider issuer", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| }) | ||
|
|
||
| t.Run("sid claim is required", func(t *testing.T) { | ||
| // if provider has frontchannel_logout_supported and frontchannel_logout_session_supported | ||
|
|
||
| }) | ||
|
|
||
| t.Run("acr value was requested", func(t *testing.T) { | ||
| t.Run("acr value matches", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("acr value does not match", func(t *testing.T) { | ||
|
|
||
| }) | ||
| }) | ||
|
|
||
| t.Run("audience validation", func(t *testing.T) { | ||
| t.Run("missing aud", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("audience does not include client_id", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("multiple trusted audiences", func(t *testing.T) { | ||
|
|
||
| }) | ||
|
|
||
| t.Run("untrusted audiences", func(t *testing.T) { | ||
|
|
||
| }) | ||
| }) | ||
| } | ||
|
|
||
| type claims struct { | ||
| setClaims map[string]any | ||
| removeClaims []string | ||
| } | ||
|
|
||
| func makeIDToken(claims ...claims) (*openid.IDToken, error) { | ||
| jwks, err := crypto.NewJwkSet() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("creating jwk set") | ||
| } | ||
|
|
||
| iat := time.Now().Truncate(time.Second).UTC() | ||
| exp := iat.Add(5 * time.Second) | ||
| sub := uuid.New().String() | ||
|
|
||
| idToken := jwt.New() | ||
| idToken.Set("sub", sub) | ||
| idToken.Set("iss", "some-issuer") | ||
| idToken.Set("aud", "some-client-id") | ||
| idToken.Set("nonce", "some-nonce") | ||
| idToken.Set("acr", "some-acr") | ||
| idToken.Set("iat", iat.Unix()) | ||
| idToken.Set("exp", exp.Unix()) | ||
| idToken.Set("jti", uuid.NewString()) | ||
|
|
||
| if len(claims) > 0 { | ||
| for claim, claimValue := range claims[0].setClaims { | ||
| idToken.Set(claim, claimValue) | ||
| } | ||
|
|
||
| for _, claim := range claims[0].removeClaims { | ||
| idToken.Remove(claim) | ||
| } | ||
| } | ||
|
|
||
| key, ok := jwks.Private.Key(0) | ||
| if !ok { | ||
| return nil, fmt.Errorf("no private key found at index 0") | ||
| } | ||
|
|
||
| jws, err := jwt.Sign(idToken, jwt.WithKey(jwa.RS256, key)) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("signing token: %w", err) | ||
| } | ||
|
|
||
| return openid.ParseIDToken(string(jws), jwks.Public) | ||
| } |