Device grant flow (migrate to master)

authorize_request_handler_test.go

@@ -152,9 +152,9 @@ func TestNewAuthorizeRequest(t *testing.T) {
  },
  expectedError: ErrInvalidScope,
  },
- /* fails because scope not given */
+ /* fails because audience not given */
  {
- desc: "should fail because client does not have scope baz",
+ desc: "should fail because client does not have audience https://www.ory.sh/api",
  conf: &Fosite{Store: store, Config: &Config{ScopeStrategy: ExactScopeStrategy, AudienceMatchingStrategy: DefaultAudienceMatchingStrategy}},
  query: url.Values{
  "redirect_uri": {"https://foo.bar/cb"},

compose/compose.go

@@ -53,6 +53,12 @@ func Compose(config *fosite.Config, storage interface{}, strategy interface{}, f
  if ph, ok := res.(fosite.PushedAuthorizeEndpointHandler); ok {
  config.PushedAuthorizeEndpointHandlers.Append(ph)
  }
+ if dh, ok := res.(fosite.DeviceEndpointHandler); ok {
+ config.DeviceEndpointHandlers.Append(dh)
+ }
+ if dah, ok := res.(fosite.DeviceAuthorizeEndpointHandler); ok {
+ config.DeviceAuthorizeEndpointHandlers.Append(dah)
+ }
  }
 
  return f
@@ -68,6 +74,7 @@ func ComposeAllEnabled(config *fosite.Config, storage interface{}, key interface
  storage,
  &CommonStrategy{
  CoreStrategy: NewOAuth2HMACStrategy(config),
+ RFC8628CodeStrategy: NewDeviceStrategy(config),
  OpenIDConnectTokenStrategy: NewOpenIDConnectStrategy(keyGetter, config),
  Signer: &jwt.DefaultSigner{GetPrivateKey: keyGetter},
  },
@@ -77,11 +84,13 @@ func ComposeAllEnabled(config *fosite.Config, storage interface{}, key interface
  OAuth2RefreshTokenGrantFactory,
  OAuth2ResourceOwnerPasswordCredentialsFactory,
  RFC7523AssertionGrantFactory,
+ RFC8628DeviceFactory,
 
  OpenIDConnectExplicitFactory,
  OpenIDConnectImplicitFactory,
  OpenIDConnectHybridFactory,
  OpenIDConnectRefreshFactory,
+ OpenIDConnectDeviceFactory,
 
  OAuth2TokenIntrospectionFactory,
  OAuth2TokenRevocationFactory,

compose/compose_oauth2.go

@@ -6,6 +6,7 @@ package compose
 import (
  "github.com/ory/fosite"
  "github.com/ory/fosite/handler/oauth2"
+ "github.com/ory/fosite/handler/rfc8628"
  "github.com/ory/fosite/token/jwt"
 )
 
@@ -16,8 +17,10 @@ func OAuth2AuthorizeExplicitFactory(config fosite.Configurator, storage interfac
  AccessTokenStrategy: strategy.(oauth2.AccessTokenStrategy),
  RefreshTokenStrategy: strategy.(oauth2.RefreshTokenStrategy),
  AuthorizeCodeStrategy: strategy.(oauth2.AuthorizeCodeStrategy),
+ DeviceStrategy: strategy.(rfc8628.RFC8628CodeStrategy),
  CoreStorage: storage.(oauth2.CoreStorage),
  TokenRevocationStorage: storage.(oauth2.TokenRevocationStorage),
+ DeviceStorage: storage.(rfc8628.RFC8628CodeStorage),
  Config: config,
  }
 }

compose/compose_openid.go

@@ -79,3 +79,17 @@ func OpenIDConnectHybridFactory(config fosite.Configurator, storage interface{},
  OpenIDConnectRequestValidator: openid.NewOpenIDConnectRequestValidator(strategy.(jwt.Signer), config),
  }
 }
+
+// OpenIDConnectDeviceFactory creates an OpenID Connect device ("device code flow") grant handler.
+//
+// **Important note:** You must add this handler *after* you have added an OAuth2 authorize code handler!
+func OpenIDConnectDeviceFactory(config fosite.Configurator, storage interface{}, strategy interface{}) interface{} {
+ return &openid.OpenIDConnectDeviceHandler{
+ OpenIDConnectRequestStorage: storage.(openid.OpenIDConnectRequestStorage),
+ IDTokenHandleHelper: &openid.IDTokenHandleHelper{
+ IDTokenStrategy: strategy.(openid.OpenIDConnectTokenStrategy),
+ },
+ OpenIDConnectRequestValidator: openid.NewOpenIDConnectRequestValidator(strategy.(jwt.Signer), config),
+ Config: config,
+ }
+}

compose/compose_pkce.go

@@ -7,12 +7,14 @@ import (
  "github.com/ory/fosite"
  "github.com/ory/fosite/handler/oauth2"
  "github.com/ory/fosite/handler/pkce"
+ "github.com/ory/fosite/handler/rfc8628"
 )
 
 // OAuth2PKCEFactory creates a PKCE handler.
 func OAuth2PKCEFactory(config fosite.Configurator, storage interface{}, strategy interface{}) interface{} {
  return &pkce.Handler{
  AuthorizeCodeStrategy: strategy.(oauth2.AuthorizeCodeStrategy),
+ DeviceCodeStrategy: strategy.(rfc8628.DeviceCodeStrategy),
  Storage: storage.(pkce.PKCERequestStorage),
  Config: config,
  }

compose/compose_rfc8628.go

@@ -0,0 +1,19 @@
+// Copyright © 2022 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package compose
+
+import (
+ "github.com/ory/fosite"
+ "github.com/ory/fosite/handler/rfc8628"
+)
+
+// RFC8628DeviceFactory creates an OAuth2 device code grant ("Device Authorization Grant") handler and registers
+// an user code, device code, access token and a refresh token validator.
+func RFC8628DeviceFactory(config fosite.Configurator, storage interface{}, strategy interface{}) interface{} {
+ return &rfc8628.DeviceAuthHandler{
+ Strategy: strategy.(rfc8628.RFC8628CodeStrategy),
+ Storage: storage.(rfc8628.RFC8628CodeStorage),
+ Config: config,
+ }
+}

compose/compose_strategy.go

@@ -9,12 +9,14 @@ import (
  "github.com/ory/fosite"
  "github.com/ory/fosite/handler/oauth2"
  "github.com/ory/fosite/handler/openid"
+ "github.com/ory/fosite/handler/rfc8628"
  "github.com/ory/fosite/token/hmac"
  "github.com/ory/fosite/token/jwt"
 )
 
 type CommonStrategy struct {
  oauth2.CoreStrategy
+ rfc8628.RFC8628CodeStrategy
  openid.OpenIDConnectTokenStrategy
  jwt.Signer
 }
@@ -27,6 +29,7 @@ type HMACSHAStrategyConfigurator interface {
  fosite.GlobalSecretProvider
  fosite.RotatedGlobalSecretsProvider
  fosite.HMACHashingProvider
+ fosite.DeviceAndUserCodeLifespanProvider
 }
 
 func NewOAuth2HMACStrategy(config HMACSHAStrategyConfigurator) *oauth2.HMACSHAStrategy {
@@ -50,3 +53,10 @@ func NewOpenIDConnectStrategy(keyGetter func(context.Context) (interface{}, erro
  Config: config,
  }
 }
+
+func NewDeviceStrategy(config fosite.Configurator) *rfc8628.DefaultDeviceStrategy {
+ return &rfc8628.DefaultDeviceStrategy{
+ Enigma: &hmac.HMACStrategy{Config: config},
+ Config: config,
+ }
+}

config.go

@@ -22,6 +22,19 @@ type AuthorizeCodeLifespanProvider interface {
  GetAuthorizeCodeLifespan(ctx context.Context) time.Duration
 }
 
+type DeviceAndUserCodeLifespanProvider interface {
+ GetDeviceAndUserCodeLifespan(ctx context.Context) time.Duration
+}
+
+type DeviceAuthorizeProvider interface {
+ GetDeviceDone(ctx context.Context) string
+}
+
+type DeviceProvider interface {
+ GetDeviceVerificationURL(ctx context.Context) string
+ GetDeviceAuthTokenPollingInterval(ctx context.Context) time.Duration
+}
+
 // RefreshTokenLifespanProvider returns the provider for configuring the refresh token lifespan.
 type RefreshTokenLifespanProvider interface {
  // GetRefreshTokenLifespan returns the refresh token lifespan.
@@ -275,6 +288,18 @@ type PushedAuthorizeRequestHandlersProvider interface {
  GetPushedAuthorizeEndpointHandlers(ctx context.Context) PushedAuthorizeEndpointHandlers
 }
 
+// DeviceEndpointHandlersProvider returns the provider for setting up the Device handlers.
+type DeviceEndpointHandlersProvider interface {
+ // GetDeviceEndpointHandlers returns the handlers.
+ GetDeviceEndpointHandlers(ctx context.Context) DeviceEndpointHandlers
+}
+
+// DeviceAuthorizeEndpointHandlersProvider returns the provider for setting up the Device Authorize handlers.
+type DeviceAuthorizeEndpointHandlersProvider interface {
+ // GetDeviceAuthorizeEndpointHandlers returns the handlers.
+ GetDeviceAuthorizeEndpointHandlers(ctx context.Context) DeviceAuthorizeEndpointHandlers
+}
+
 // UseLegacyErrorFormatProvider returns the provider for configuring whether to use the legacy error format.
 //
 // DEPRECATED: Do not use this flag anymore.

config_default.go

@@ -62,6 +62,7 @@ var (
  _ RevocationHandlersProvider = (*Config)(nil)
  _ PushedAuthorizeRequestHandlersProvider = (*Config)(nil)
  _ PushedAuthorizeRequestConfigProvider = (*Config)(nil)
+ _ DeviceEndpointHandlersProvider = (*Config)(nil)
 )
 
 type Config struct {
@@ -75,6 +76,18 @@ type Config struct {
  // AuthorizeCodeLifespan sets how long an authorize code is going to be valid. Defaults to fifteen minutes.
  AuthorizeCodeLifespan time.Duration
 
+ // Sets how long a device user/device code pair is valid for
+ DeviceAndUserCodeLifespan time.Duration
+
+ // DeviceAuthTokenPollingInterval sets the interval that clients should check for device code grants
+ DeviceAuthTokenPollingInterval time.Duration
+
+ // DeviceVerificationURL is the URL of the device verification endpoint, this is is included with the device code request responses
+ DeviceVerificationURL string
+
+ // DeviceDoneURL is the URL of the user is redirected to once the verification is completed
+ DeviceDoneURL string
+
  // IDTokenLifespan sets the default id token lifetime. Defaults to one hour.
  IDTokenLifespan time.Duration
 
@@ -194,6 +207,12 @@ type Config struct {
  // PushedAuthorizeEndpointHandlers is a list of handlers that are called before the PAR endpoint is served.
  PushedAuthorizeEndpointHandlers PushedAuthorizeEndpointHandlers
 
+ // DeviceEndpointHandlers is a list of handlers that are called before the device endpoint is served.
+ DeviceEndpointHandlers DeviceEndpointHandlers
+
+ // DeviceAuthorizeEndpointHandlers is a list of handlers that are called before the device authorize endpoint is served.
+ DeviceAuthorizeEndpointHandlers DeviceAuthorizeEndpointHandlers
+
  // GlobalSecret is the global secret used to sign and verify signatures.
  GlobalSecret []byte
 
@@ -242,6 +261,14 @@ func (c *Config) GetTokenIntrospectionHandlers(ctx context.Context) TokenIntrosp
  return c.TokenIntrospectionHandlers
 }
 
+func (c *Config) GetDeviceEndpointHandlers(ctx context.Context) DeviceEndpointHandlers {
+ return c.DeviceEndpointHandlers
+}
+
+func (c *Config) GetDeviceAuthorizeEndpointHandlers(ctx context.Context) DeviceAuthorizeEndpointHandlers {
+ return c.DeviceAuthorizeEndpointHandlers
+}
+
 func (c *Config) GetRevocationHandlers(ctx context.Context) RevocationHandlers {
  return c.RevocationHandlers
 }
@@ -360,6 +387,13 @@ func (c *Config) GetAuthorizeCodeLifespan(_ context.Context) time.Duration {
  return c.AuthorizeCodeLifespan
 }
 
+func (c *Config) GetDeviceAndUserCodeLifespan(_ context.Context) time.Duration {
+ if c.AuthorizeCodeLifespan == 0 {
+ return time.Minute * 10
+ }
+ return c.DeviceAndUserCodeLifespan
+}
+
 // GeIDTokenLifespan returns how long an id token should be valid. Defaults to one hour.
 func (c *Config) GetIDTokenLifespan(_ context.Context) time.Duration {
  if c.IDTokenLifespan == 0 {
@@ -488,3 +522,18 @@ func (c *Config) GetPushedAuthorizeContextLifespan(ctx context.Context) time.Dur
 func (c *Config) EnforcePushedAuthorize(ctx context.Context) bool {
  return c.IsPushedAuthorizeEnforced
 }
+
+func (c *Config) GetDeviceDone(ctx context.Context) string {
+ return c.DeviceDoneURL
+}
+
+func (c *Config) GetDeviceVerificationURL(ctx context.Context) string {
+ return c.DeviceVerificationURL
+}
+
+func (c *Config) GetDeviceAuthTokenPollingInterval(ctx context.Context) time.Duration {
+ if c.DeviceAuthTokenPollingInterval == 0 {
+ return time.Second * 10
+ }
+ return c.DeviceAuthTokenPollingInterval
+}

device_authorize_request.go

@@ -0,0 +1,24 @@
+// Copyright © 2022 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package fosite
+
+// DeviceAuthorizeRequest is an implementation of DeviceAuthorizeRequester
+type DeviceAuthorizeRequest struct {
+ signature string
+ Request
+}
+
+func (d *DeviceAuthorizeRequest) GetDeviceCodeSignature() string {
+ return d.signature
+}
+
+func (d *DeviceAuthorizeRequest) SetDeviceCodeSignature(signature string) {
+ d.signature = signature
+}
+
+func NewDeviceAuthorizeRequest() *DeviceAuthorizeRequest {
+ return &DeviceAuthorizeRequest{
+ Request: *NewRequest(),
+ }
+}

device_authorize_request_handler.go

@@ -0,0 +1,37 @@
+// Copyright © 2022 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package fosite
+
+import (
+ "context"
+ "net/http"
+
+ "github.com/ory/fosite/i18n"
+ "github.com/ory/x/errorsx"
+)
+
+func (f *Fosite) NewDeviceAuthorizeRequest(ctx context.Context, r *http.Request) (DeviceAuthorizeRequester, error) {
+ request := NewDeviceAuthorizeRequest()
+ request.Lang = i18n.GetLangFromRequest(f.Config.GetMessageCatalog(ctx), r)
+
+ if err := r.ParseForm(); err != nil {
+ return nil, errorsx.WithStack(ErrInvalidRequest.WithHint("Unable to parse HTTP body, make sure to send a properly formatted form request body.").WithWrap(err).WithDebug(err.Error()))
+ }
+ request.Form = r.Form
+
+ verifier := request.GetRequestForm().Get("device_verifier")
+ if verifier != "" {
+ client, err := f.Store.GetClient(ctx, request.GetRequestForm().Get("client_id"))
+ if err != nil {
+ return nil, errorsx.WithStack(ErrInvalidClient.WithHint("The requested OAuth 2.0 Client does not exist.").WithWrap(err).WithDebug(err.Error()))
+ }
+ request.Client = client
+
+ if !client.GetGrantTypes().Has("urn:ietf:params:oauth:grant-type:device_code") {
+ return nil, errorsx.WithStack(ErrInvalidGrant.WithHint("The requested OAuth 2.0 Client does not have the 'urn:ietf:params:oauth:grant-type:device_code' grant."))
+ }
+ }
+
+ return request, nil
+}