Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| package oidcclient | ||
|
|
||
| import ( | ||
| "errors" | ||
|
|
||
| "github.com/vdbulcke/oauthx" | ||
| ) | ||
|
|
||
| func (c *OIDCClient) ClientCredentialsFlow() error { | ||
| scopes := c.config.Scopes | ||
| req := oauthx.NewClientCredentialsGrantTokenRequest(scopes...) | ||
|
|
||
| tokenResp, err := c.client.DoTokenRequest(c.ctx, req) | ||
| if err != nil { | ||
| c.logger.Error("Failed to get Access Token", "err", err) | ||
|
|
||
| var httpErr *oauthx.HttpErr | ||
| if errors.As(err, &httpErr) { | ||
| c.logger.Error("http error", "response_headers", httpErr.ResponseHeader, "response_body", string(httpErr.RespBody)) | ||
| } | ||
|
|
||
| return err | ||
| } | ||
|
|
||
| // Print Access Token | ||
| c.processAccessTokenResponse(tokenResp) | ||
|
|
||
| if tokenResp.IDToken != "" { | ||
|
|
||
| // use default options | ||
| idToken, err := c.client.ParseIDToken(c.ctx, tokenResp.IDToken) | ||
| if err != nil { | ||
| c.logger.Error("ID Token validation failed", "err", err) | ||
| return err | ||
| } | ||
|
|
||
| // print idToken | ||
| c.processIdToken(idToken) | ||
| } | ||
|
|
||
| // Validate Access Token if JWT | ||
| // and print claims | ||
| if c.config.AccessTokenJwt { | ||
| // try to parse access token as JWT | ||
| accessTokenRaw := tokenResp.AccessToken | ||
| if accessTokenRaw == "" { | ||
| c.logger.Error("no Access Token Found") | ||
| } else { | ||
| // validate signature against the JWK | ||
| err := c.processAccessToken(c.ctx, accessTokenRaw) | ||
| if err != nil { | ||
| c.logger.Error("Access Token validation failed", "err", err) | ||
| return err | ||
| } | ||
|
|
||
| } | ||
| } | ||
|
|
||
| // Validate refresh Token if JWT | ||
| // and print claims | ||
| if c.config.RefreshTokenJwt { | ||
| // try to parse refresh token as JWT | ||
| refreshTokenRaw := tokenResp.RefreshToken | ||
| if refreshTokenRaw == "" { | ||
| c.logger.Error("no Refresh Token Found") | ||
| } else { | ||
| // validate signature against the JWK | ||
| err := c.processRefreshToken(c.ctx, refreshTokenRaw) | ||
| if err != nil { | ||
| c.logger.Error("Refresh Token validation failed", "err", err) | ||
| return err | ||
| } | ||
|
|
||
| } | ||
| } | ||
|
|
||
| // Fetch Userinfo | ||
| if !c.config.SkipUserinfo { | ||
| userinfo, err := c.client.DoUserinfoRequest(c.ctx, tokenResp.AccessToken) | ||
| if err != nil { | ||
|
|
||
| var httpErr *oauthx.HttpErr | ||
| if errors.As(err, &httpErr) { | ||
| c.logger.Error("http error", "response_headers", httpErr.ResponseHeader, "response_body", string(httpErr.RespBody)) | ||
| } | ||
| return err | ||
| } | ||
|
|
||
| _ = c.userinfo(userinfo) | ||
| } | ||
|
|
||
| return nil | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "os" | ||
|
|
||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func init() { | ||
| // bind to root command | ||
| rootCmd.AddCommand(clientCredentialsCmd) | ||
| // add flags to sub command | ||
| clientCredentialsCmd.Flags().StringVarP(&configFilename, "config", "c", "", "oidc client config file") | ||
| clientCredentialsCmd.Flags().BoolVarP(&skipIdTokenVerification, "skip-id-token-verification", "", false, "Skip validation of id_token after renewing tokens") | ||
| clientCredentialsCmd.Flags().StringVarP(&privateKey, "pem-key", "", "", "private key (pem format) for jwt signature or mTLS") | ||
| clientCredentialsCmd.Flags().StringVarP(&clientCertificate, "pem-cert", "", "", "client certificate (pem format) mTLS") | ||
| clientCredentialsCmd.Flags().StringVarP(&mockKid, "mock-jwt-kid", "", "", "Use static jwt 'kid' value") | ||
|
|
||
| // required flags | ||
| //nolint | ||
| clientCredentialsCmd.MarkFlagRequired("config") | ||
|
|
||
| } | ||
|
|
||
| var clientCredentialsCmd = &cobra.Command{ | ||
| Use: "client-credentials", | ||
| Short: "Client Credentials Grant Flow", | ||
| // Long: "", | ||
| Run: func(cmd *cobra.Command, args []string) { | ||
| client := initClient() | ||
| // set default output | ||
| client.SetDefaultOutput() | ||
|
|
||
| // display info about the current client | ||
| client.Info() | ||
|
|
||
| err := client.ClientCredentialsFlow() | ||
| if err != nil { | ||
| client.GetLogger().Error("Error during Client Credentials grant", "error", err) | ||
| os.Exit(1) | ||
| } | ||
| }, | ||
| } |