Implement KeyCape service-token issuance

src/internal/config/config.go

@@ -16,26 +16,29 @@ import (
 
 // Config is the top-level server configuration.
 type Config struct {
-	Issuer        string            `yaml:"issuer"`
-	Port          int               `yaml:"port"`
-	TokenLifetime string            `yaml:"tokenLifetime"`
-	PrivateKeyPEM string            `yaml:"privateKeyPem"`
-	LLDAP         lldap.Config      `yaml:"lldap"`
-	Authelia      authelia.Config   `yaml:"authelia"`
+	Issuer        string             `yaml:"issuer"`
+	Port          int                `yaml:"port"`
+	TokenLifetime string             `yaml:"tokenLifetime"`
+	PrivateKeyPEM string             `yaml:"privateKeyPem"`
+	LLDAP         lldap.Config       `yaml:"lldap"`
+	Authelia      authelia.Config    `yaml:"authelia"`
 	PrivacyIDEA   privacyidea.Config `yaml:"privacyidea"`
-	Clients       []ClientConfig    `yaml:"clients"`
-	Environment   string            `yaml:"environment"`
+	Clients       []ClientConfig     `yaml:"clients"`
+	Environment   string             `yaml:"environment"`
 }
 
 // ClientConfig is a static OIDC client registration.
 type ClientConfig struct {
-	ClientID      string   `yaml:"clientId"`
-	DisplayName   string   `yaml:"displayName"`
-	RedirectURIs  []string `yaml:"redirectUris"`
-	AllowedScopes []string `yaml:"allowedScopes"`
-	GrantTypes    []string `yaml:"grantTypes"`
-	ClientType    string   `yaml:"clientType"` // "confidential" | "public"
-	SecretRef     string   `yaml:"secretRef,omitempty"`
+	ClientID       string   `yaml:"clientId"`
+	DisplayName    string   `yaml:"displayName"`
+	RedirectURIs   []string `yaml:"redirectUris"`
+	AllowedScopes  []string `yaml:"allowedScopes"`
+	GrantTypes     []string `yaml:"grantTypes"`
+	ClientType     string   `yaml:"clientType"` // "confidential" | "public"
+	SecretRef      string   `yaml:"secretRef,omitempty"`
+	ServiceSubject string   `yaml:"serviceSubject,omitempty"`
+	Tenant         string   `yaml:"tenant,omitempty"`
+	Roles          []string `yaml:"roles,omitempty"`
 }
 
 // Load reads and parses the YAML config file at path.

src/internal/config/validate.go

@@ -41,9 +41,22 @@ func ValidateConfig(cfg *Config) []string {
 			prefix = fmt.Sprintf("clients[%d]", i)
 			errs = append(errs, prefix+": clientId must not be empty")
 		}
-		if len(c.RedirectURIs) == 0 {
+		hasAuthorizationCode := contains(c.GrantTypes, "authorization_code")
+		hasClientCredentials := contains(c.GrantTypes, "client_credentials")
+		if (hasAuthorizationCode || !hasClientCredentials) && len(c.RedirectURIs) == 0 {
 			errs = append(errs, prefix+": redirect_uri: at least one redirectUri must be registered")
 		}
+		if hasClientCredentials {
+			if c.ClientType != "confidential" {
+				errs = append(errs, prefix+": client_credentials requires clientType confidential")
+			}
+			if !strings.HasPrefix(c.SecretRef, "env:") {
+				errs = append(errs, prefix+": client_credentials requires an env: secretRef")
+			}
+			if c.ServiceSubject == "" || c.Tenant == "" {
+				errs = append(errs, prefix+": client_credentials requires serviceSubject and tenant")
+			}
+		}
 		// Warn about wildcard redirect URIs (they are blocked at runtime anyway).
 		for _, uri := range c.RedirectURIs {
 			if strings.ContainsAny(uri, "*?") {
@@ -59,3 +72,12 @@ func ValidateConfig(cfg *Config) []string {
 
 	return errs
 }
+
+func contains(values []string, wanted string) bool {
+	for _, value := range values {
+		if value == wanted {
+			return true
+		}
+	}
+	return false
+}