tegwick
139b6ff351
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Closes the local protocol surface of gap G01 from the scope assessment (KEY-WP-0016). The browser grant validated PKCE, client id and scopes but left four bindings unenforced, and UserInfo verified less than the caller CLI does. Authorization-code path: bind the exchange to the redirect URI the code was issued for, refuse clients whose registration does not permit the grant, and authenticate confidential clients with a digest-based constant-time comparison over the same credential sources as the service grant. An empty grantTypes stays an implicit authorization-code client, matching config validation. Code consumption: SessionStore.Consume reads and deletes under one lock. The previous Get/Delete pair spanned JWT signing, and the added test reproduces the race against that version -- 9 of 16 concurrent exchanges succeeded, and a failed exchange left the code replayable. UserInfo: check the JOSE header algorithm before trusting the signature, require the configured issuer, and require an access token rather than accepting an ID token of the right shape. Purpose is decided on the scope claim so the issued token contract, which consumers pin exactly, does not change. SCOPE.md and the assessment record which bindings are now enforced and that the Authelia upstream-trust assumption remains open, so G01 is not fully closed and no profile-conformance claim is made. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
109 lines
3.1 KiB
Go
109 lines
3.1 KiB
Go
package oidc
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"sync"
|
|
"time"
|
|
)
|
|
|
|
// PKCESession stores the in-flight authorization state server-side.
|
|
type PKCESession struct {
|
|
Code string
|
|
ClientID string
|
|
RedirectURI string
|
|
PKCEChallenge string // S256 challenge
|
|
PKCEChallengeMethod string // always "S256"
|
|
State string
|
|
Nonce string
|
|
Username string // set after auth
|
|
Scopes []string
|
|
ExpiresAt time.Time
|
|
// MFAVerified records whether this authorization actually required and
|
|
// passed MFA validation (vs. MFA not being required for this user at
|
|
// all). Feeds the assurance claim's level in token.go
|
|
// (KEY-WP-0005-T01): aal2 when true, aal1 when false. Set once, at
|
|
// completeAuthorization -- never re-derived from stale enrollment state
|
|
// at token-exchange time.
|
|
MFAVerified bool
|
|
}
|
|
|
|
// SessionStore is an in-memory PKCE session store.
|
|
type SessionStore struct {
|
|
mu sync.Mutex
|
|
sessions map[string]*PKCESession // keyed by code
|
|
}
|
|
|
|
// NewSessionStore returns an initialised, empty SessionStore.
|
|
func NewSessionStore() *SessionStore {
|
|
return &SessionStore{
|
|
sessions: make(map[string]*PKCESession),
|
|
}
|
|
}
|
|
|
|
// Create stores the session and returns the generated authorization code.
|
|
func (s *SessionStore) Create(sess *PKCESession) string {
|
|
code := generateCode()
|
|
sess.Code = code
|
|
|
|
s.mu.Lock()
|
|
s.sessions[code] = sess
|
|
s.mu.Unlock()
|
|
|
|
return code
|
|
}
|
|
|
|
// Get retrieves a session by code. Returns false if not found or expired.
|
|
func (s *SessionStore) Get(code string) (*PKCESession, bool) {
|
|
s.mu.Lock()
|
|
sess, ok := s.sessions[code]
|
|
s.mu.Unlock()
|
|
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
if time.Now().After(sess.ExpiresAt) {
|
|
s.Delete(code)
|
|
return nil, false
|
|
}
|
|
return sess, true
|
|
}
|
|
|
|
// Consume retrieves a session by code and removes it in the same critical
|
|
// section, so exactly one caller can ever observe a given code. Returns false
|
|
// if the code is not present or has expired. The token endpoint must use this
|
|
// rather than Get/Delete: signing happens between those two calls, which is
|
|
// long enough for two concurrent exchanges to both observe the same session
|
|
// (KEY-WP-0016-T01). A consumed code is gone even if the exchange then fails,
|
|
// which is the intended single-use semantics -- a failed attempt must not leave
|
|
// a replayable code.
|
|
func (s *SessionStore) Consume(code string) (*PKCESession, bool) {
|
|
s.mu.Lock()
|
|
sess, ok := s.sessions[code]
|
|
if ok {
|
|
delete(s.sessions, code)
|
|
}
|
|
s.mu.Unlock()
|
|
|
|
if !ok || time.Now().After(sess.ExpiresAt) {
|
|
return nil, false
|
|
}
|
|
return sess, true
|
|
}
|
|
|
|
// Delete removes a session by code. No-op if the code is not present.
|
|
func (s *SessionStore) Delete(code string) {
|
|
s.mu.Lock()
|
|
delete(s.sessions, code)
|
|
s.mu.Unlock()
|
|
}
|
|
|
|
// generateCode returns a cryptographically random, URL-safe string suitable
|
|
// for use as an authorization code.
|
|
func generateCode() string {
|
|
b := make([]byte, 32)
|
|
if _, err := rand.Read(b); err != nil {
|
|
panic("oidc: failed to generate random code: " + err.Error())
|
|
}
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
|
}
|