krombel/oauth2
1
0
Fork 0
forked from remote/oauth2
Code Pull Requests 1 Activity

feat: adding support for external account authorized user

Browse Source
This commit is contained in:
Jin Qin
2023-09-25 22:52:50 +00:00
parent 14b275c918
commit b621b331ae
8 changed files with 534 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
google/internal/externalaccount/basecredentials.go
View File

@@ -15,6 +15,7 @@ import (
"time"
"golang.org/x/oauth2"
"golang.org/x/oauth2/google/internal/sts_exchange"
)
// now aliases time.Now for testing
@@ -230,7 +231,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
if err != nil {
return nil, err
}
stsRequest := stsTokenExchangeRequest{
stsRequest := sts_exchange.StsTokenExchangeRequest{
GrantType: "urn:ietf:params:oauth:grant-type:token-exchange",
Audience: conf.Audience,
Scope: conf.Scopes,
@@ -241,7 +242,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
header := make(http.Header)
header.Add("Content-Type", "application/x-www-form-urlencoded")
header.Add("x-goog-api-client", getMetricsHeaderValue(conf, credSource))
clientAuth := clientAuthentication{
clientAuth := sts_exchange.ClientAuthentication{
AuthStyle: oauth2.AuthStyleInHeader,
ClientID: conf.ClientID,
ClientSecret: conf.ClientSecret,
@@ -254,7 +255,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
"userProject": conf.WorkforcePoolUserProject,
}
}
stsResp, err := exchangeToken(ts.ctx, conf.TokenURL, &stsRequest, clientAuth, header, options)
stsResp, err := sts_exchange.ExchangeToken(ts.ctx, conf.TokenURL, &stsRequest, clientAuth, nil, options)
if err != nil {
return nil, err
}

45
google/internal/externalaccount/clientauth.go
View File

@@ -1,45 +0,0 @@
// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package externalaccount
import (
"encoding/base64"
"net/http"
"net/url"
"golang.org/x/oauth2"
)
// clientAuthentication represents an OAuth client ID and secret and the mechanism for passing these credentials as stated in rfc6749#2.3.1.
type clientAuthentication struct {
// AuthStyle can be either basic or request-body
AuthStyle oauth2.AuthStyle
ClientID string
ClientSecret string
}
// InjectAuthentication is used to add authentication to a Secure Token Service exchange
// request. It modifies either the passed url.Values or http.Header depending on the desired
// authentication format.
func (c *clientAuthentication) InjectAuthentication(values url.Values, headers http.Header) {
if c.ClientID == "" || c.ClientSecret == "" || values == nil || headers == nil {
return
}
switch c.AuthStyle {
case oauth2.AuthStyleInHeader: // AuthStyleInHeader corresponds to basic authentication as defined in rfc7617#2
plainHeader := c.ClientID + ":" + c.ClientSecret
headers.Add("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(plainHeader)))
case oauth2.AuthStyleInParams: // AuthStyleInParams corresponds to request-body authentication with ClientID and ClientSecret in the message body.
values.Set("client_id", c.ClientID)
values.Set("client_secret", c.ClientSecret)
case oauth2.AuthStyleAutoDetect:
values.Set("client_id", c.ClientID)
values.Set("client_secret", c.ClientSecret)
default:
values.Set("client_id", c.ClientID)
values.Set("client_secret", c.ClientSecret)
}
}

114
google/internal/externalaccount/clientauth_test.go
View File

@@ -1,114 +0,0 @@
// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package externalaccount
import (
"net/http"
"net/url"
"reflect"
"testing"
"golang.org/x/oauth2"
)
var clientID = "rbrgnognrhongo3bi4gb9ghg9g"
var clientSecret = "notsosecret"
var audience = []string{"32555940559.apps.googleusercontent.com"}
var grantType = []string{"urn:ietf:params:oauth:grant-type:token-exchange"}
var requestedTokenType = []string{"urn:ietf:params:oauth:token-type:access_token"}
var subjectTokenType = []string{"urn:ietf:params:oauth:token-type:jwt"}
var subjectToken = []string{"eyJhbGciOiJSUzI1NiIsImtpZCI6IjJjNmZhNmY1OTUwYTdjZTQ2NWZjZjI0N2FhMGIwOTQ4MjhhYzk1MmMiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIzMjU1NTk0MDU1OS5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6IjMyNTU1OTQwNTU5LmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTEzMzE4NTQxMDA5MDU3Mzc4MzI4IiwiaGQiOiJnb29nbGUuY29tIiwiZW1haWwiOiJpdGh1cmllbEBnb29nbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImF0X2hhc2giOiI5OVJVYVFrRHJsVDFZOUV0SzdiYXJnIiwiaWF0IjoxNjAxNTgxMzQ5LCJleHAiOjE2MDE1ODQ5NDl9.SZ-4DyDcogDh_CDUKHqPCiT8AKLg4zLMpPhGQzmcmHQ6cJiV0WRVMf5Lq911qsvuekgxfQpIdKNXlD6yk3FqvC2rjBbuEztMF-OD_2B8CEIYFlMLGuTQimJlUQksLKM-3B2ITRDCxnyEdaZik0OVssiy1CBTsllS5MgTFqic7w8w0Cd6diqNkfPFZRWyRYsrRDRlHHbH5_TUnv2wnLVHBHlNvU4wU2yyjDIoqOvTRp8jtXdq7K31CDhXd47-hXsVFQn2ZgzuUEAkH2Q6NIXACcVyZOrjBcZiOQI9IRWz-g03LzbzPSecO7I8dDrhqUSqMrdNUz_f8Kr8JFhuVMfVug"}
var scope = []string{"https://www.googleapis.com/auth/devstorage.full_control"}
var ContentType = []string{"application/x-www-form-urlencoded"}
func TestClientAuthentication_InjectHeaderAuthentication(t *testing.T) {
valuesH := url.Values{
"audience": audience,
"grant_type": grantType,
"requested_token_type": requestedTokenType,
"subject_token_type": subjectTokenType,
"subject_token": subjectToken,
"scope": scope,
}
headerH := http.Header{
"Content-Type": ContentType,
}
headerAuthentication := clientAuthentication{
AuthStyle: oauth2.AuthStyleInHeader,
ClientID: clientID,
ClientSecret: clientSecret,
}
headerAuthentication.InjectAuthentication(valuesH, headerH)
if got, want := valuesH["audience"], audience; !reflect.DeepEqual(got, want) {
t.Errorf("audience = %q, want %q", got, want)
}
if got, want := valuesH["grant_type"], grantType; !reflect.DeepEqual(got, want) {
t.Errorf("grant_type = %q, want %q", got, want)
}
if got, want := valuesH["requested_token_type"], requestedTokenType; !reflect.DeepEqual(got, want) {
t.Errorf("requested_token_type = %q, want %q", got, want)
}
if got, want := valuesH["subject_token_type"], subjectTokenType; !reflect.DeepEqual(got, want) {
t.Errorf("subject_token_type = %q, want %q", got, want)
}
if got, want := valuesH["subject_token"], subjectToken; !reflect.DeepEqual(got, want) {
t.Errorf("subject_token = %q, want %q", got, want)
}
if got, want := valuesH["scope"], scope; !reflect.DeepEqual(got, want) {
t.Errorf("scope = %q, want %q", got, want)
}
if got, want := headerH["Authorization"], []string{"Basic cmJyZ25vZ25yaG9uZ28zYmk0Z2I5Z2hnOWc6bm90c29zZWNyZXQ="}; !reflect.DeepEqual(got, want) {
t.Errorf("Authorization in header = %q, want %q", got, want)
}
}
func TestClientAuthentication_ParamsAuthentication(t *testing.T) {
valuesP := url.Values{
"audience": audience,
"grant_type": grantType,
"requested_token_type": requestedTokenType,
"subject_token_type": subjectTokenType,
"subject_token": subjectToken,
"scope": scope,
}
headerP := http.Header{
"Content-Type": ContentType,
}
paramsAuthentication := clientAuthentication{
AuthStyle: oauth2.AuthStyleInParams,
ClientID: clientID,
ClientSecret: clientSecret,
}
paramsAuthentication.InjectAuthentication(valuesP, headerP)
if got, want := valuesP["audience"], audience; !reflect.DeepEqual(got, want) {
t.Errorf("audience = %q, want %q", got, want)
}
if got, want := valuesP["grant_type"], grantType; !reflect.DeepEqual(got, want) {
t.Errorf("grant_type = %q, want %q", got, want)
}
if got, want := valuesP["requested_token_type"], requestedTokenType; !reflect.DeepEqual(got, want) {
t.Errorf("requested_token_type = %q, want %q", got, want)
}
if got, want := valuesP["subject_token_type"], subjectTokenType; !reflect.DeepEqual(got, want) {
t.Errorf("subject_token_type = %q, want %q", got, want)
}
if got, want := valuesP["subject_token"], subjectToken; !reflect.DeepEqual(got, want) {
t.Errorf("subject_token = %q, want %q", got, want)
}
if got, want := valuesP["scope"], scope; !reflect.DeepEqual(got, want) {
t.Errorf("scope = %q, want %q", got, want)
}
if got, want := valuesP["client_id"], []string{clientID}; !reflect.DeepEqual(got, want) {
t.Errorf("client_id = %q, want %q", got, want)
}
if got, want := valuesP["client_secret"], []string{clientSecret}; !reflect.DeepEqual(got, want) {
t.Errorf("client_secret = %q, want %q", got, want)
}
}

107
google/internal/externalaccount/sts_exchange.go
View File

@@ -1,107 +0,0 @@
// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package externalaccount
import (
"context"
"encoding/json"
"fmt"
"io"
"io/ioutil"
"net/http"
"net/url"
"strconv"
"strings"
"golang.org/x/oauth2"
)
// exchangeToken performs an oauth2 token exchange with the provided endpoint.
// The first 4 fields are all mandatory. headers can be used to pass additional
// headers beyond the bare minimum required by the token exchange. options can
// be used to pass additional JSON-structured options to the remote server.
func exchangeToken(ctx context.Context, endpoint string, request *stsTokenExchangeRequest, authentication clientAuthentication, headers http.Header, options map[string]interface{}) (*stsTokenExchangeResponse, error) {
client := oauth2.NewClient(ctx, nil)
data := url.Values{}
data.Set("audience", request.Audience)
data.Set("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange")
data.Set("requested_token_type", "urn:ietf:params:oauth:token-type:access_token")
data.Set("subject_token_type", request.SubjectTokenType)
data.Set("subject_token", request.SubjectToken)
data.Set("scope", strings.Join(request.Scope, " "))
if options != nil {
opts, err := json.Marshal(options)
if err != nil {
return nil, fmt.Errorf("oauth2/google: failed to marshal additional options: %v", err)
}
data.Set("options", string(opts))
}
authentication.InjectAuthentication(data, headers)
encodedData := data.Encode()
req, err := http.NewRequest("POST", endpoint, strings.NewReader(encodedData))
if err != nil {
return nil, fmt.Errorf("oauth2/google: failed to properly build http request: %v", err)
}
req = req.WithContext(ctx)
for key, list := range headers {
for _, val := range list {
req.Header.Add(key, val)
}
}
req.Header.Add("Content-Length", strconv.Itoa(len(encodedData)))
resp, err := client.Do(req)
if err != nil {
return nil, fmt.Errorf("oauth2/google: invalid response from Secure Token Server: %v", err)
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20))
if err != nil {
return nil, err
}
if c := resp.StatusCode; c < 200 || c > 299 {
return nil, fmt.Errorf("oauth2/google: status code %d: %s", c, body)
}
var stsResp stsTokenExchangeResponse
err = json.Unmarshal(body, &stsResp)
if err != nil {
return nil, fmt.Errorf("oauth2/google: failed to unmarshal response body from Secure Token Server: %v", err)
}
return &stsResp, nil
}
// stsTokenExchangeRequest contains fields necessary to make an oauth2 token exchange.
type stsTokenExchangeRequest struct {
ActingParty struct {
ActorToken string
ActorTokenType string
}
GrantType string
Resource string
Audience string
Scope []string
RequestedTokenType string
SubjectToken string
SubjectTokenType string
}
// stsTokenExchangeResponse is used to decode the remote server response during an oauth2 token exchange.
type stsTokenExchangeResponse struct {
AccessToken string `json:"access_token"`
IssuedTokenType string `json:"issued_token_type"`
TokenType string `json:"token_type"`
ExpiresIn int `json:"expires_in"`
Scope string `json:"scope"`
RefreshToken string `json:"refresh_token"`
}

187
google/internal/externalaccount/sts_exchange_test.go
View File

@@ -1,187 +0,0 @@
// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package externalaccount
import (
"context"
"encoding/json"
"io/ioutil"
"net/http"
"net/http/httptest"
"net/url"
"testing"
"golang.org/x/oauth2"
)
var auth = clientAuthentication{
AuthStyle: oauth2.AuthStyleInHeader,
ClientID: clientID,
ClientSecret: clientSecret,
}
var tokenRequest = stsTokenExchangeRequest{
ActingParty: struct {
ActorToken string
ActorTokenType string
}{},
GrantType: "urn:ietf:params:oauth:grant-type:token-exchange",
Resource: "",
Audience: "32555940559.apps.googleusercontent.com", //TODO: Make sure audience is correct in this test (might be mismatched)
Scope: []string{"https://www.googleapis.com/auth/devstorage.full_control"},
RequestedTokenType: "urn:ietf:params:oauth:token-type:access_token",
SubjectToken: "Sample.Subject.Token",
SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt",
}
var requestbody = "audience=32555940559.apps.googleusercontent.com&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdevstorage.full_control&subject_token=Sample.Subject.Token&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt"
var responseBody = `{"access_token":"Sample.Access.Token","issued_token_type":"urn:ietf:params:oauth:token-type:access_token","token_type":"Bearer","expires_in":3600,"scope":"https://www.googleapis.com/auth/cloud-platform"}`
var expectedToken = stsTokenExchangeResponse{
AccessToken: "Sample.Access.Token",
IssuedTokenType: "urn:ietf:params:oauth:token-type:access_token",
TokenType: "Bearer",
ExpiresIn: 3600,
Scope: "https://www.googleapis.com/auth/cloud-platform",
RefreshToken: "",
}
func TestExchangeToken(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.Method != "POST" {
t.Errorf("Unexpected request method, %v is found", r.Method)
}
if r.URL.String() != "/" {
t.Errorf("Unexpected request URL, %v is found", r.URL)
}
if got, want := r.Header.Get("Authorization"), "Basic cmJyZ25vZ25yaG9uZ28zYmk0Z2I5Z2hnOWc6bm90c29zZWNyZXQ="; got != want {
t.Errorf("Unexpected authorization header, got %v, want %v", got, want)
}
if got, want := r.Header.Get("Content-Type"), "application/x-www-form-urlencoded"; got != want {
t.Errorf("Unexpected Content-Type header, got %v, want %v", got, want)
}
body, err := ioutil.ReadAll(r.Body)
if err != nil {
t.Errorf("Failed reading request body: %v.", err)
}
if got, want := string(body), requestbody; got != want {
t.Errorf("Unexpected exchange payload, got %v but want %v", got, want)
}
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(responseBody))
}))
defer ts.Close()
headers := http.Header{}
headers.Add("Content-Type", "application/x-www-form-urlencoded")
resp, err := exchangeToken(context.Background(), ts.URL, &tokenRequest, auth, headers, nil)
if err != nil {
t.Fatalf("exchangeToken failed with error: %v", err)
}
if expectedToken != *resp {
t.Errorf("mismatched messages received by mock server. \nWant: \n%v\n\nGot:\n%v", expectedToken, *resp)
}
}
func TestExchangeToken_Err(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.Write([]byte("what's wrong with this response?"))
}))
defer ts.Close()
headers := http.Header{}
headers.Add("Content-Type", "application/x-www-form-urlencoded")
_, err := exchangeToken(context.Background(), ts.URL, &tokenRequest, auth, headers, nil)
if err == nil {
t.Errorf("Expected handled error; instead got nil.")
}
}
/* Lean test specifically for options, as the other features are tested earlier. */
type testOpts struct {
First string `json:"first"`
Second string `json:"second"`
}
var optsValues = [][]string{{"foo", "bar"}, {"cat", "pan"}}
func TestExchangeToken_Opts(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
body, err := ioutil.ReadAll(r.Body)
if err != nil {
t.Fatalf("Failed reading request body: %v.", err)
}
data, err := url.ParseQuery(string(body))
if err != nil {
t.Fatalf("Failed to parse request body: %v", err)
}
strOpts, ok := data["options"]
if !ok {
t.Errorf("Server didn't recieve an \"options\" field.")
} else if len(strOpts) < 1 {
t.Errorf("\"options\" field has length 0.")
}
var opts map[string]interface{}
err = json.Unmarshal([]byte(strOpts[0]), &opts)
if err != nil {
t.Fatalf("Couldn't parse received \"options\" field.")
}
if len(opts) < 2 {
t.Errorf("Too few options received.")
}
val, ok := opts["one"]
if !ok {
t.Errorf("Couldn't find first option parameter.")
} else {
tOpts1, ok := val.(map[string]interface{})
if !ok {
t.Errorf("Failed to assert the first option parameter as type testOpts.")
} else {
if got, want := tOpts1["first"].(string), optsValues[0][0]; got != want {
t.Errorf("First value in first options field is incorrect; got %v but want %v", got, want)
}
if got, want := tOpts1["second"].(string), optsValues[0][1]; got != want {
t.Errorf("Second value in first options field is incorrect; got %v but want %v", got, want)
}
}
}
val2, ok := opts["two"]
if !ok {
t.Errorf("Couldn't find second option parameter.")
} else {
tOpts2, ok := val2.(map[string]interface{})
if !ok {
t.Errorf("Failed to assert the second option parameter as type testOpts.")
} else {
if got, want := tOpts2["first"].(string), optsValues[1][0]; got != want {
t.Errorf("First value in second options field is incorrect; got %v but want %v", got, want)
}
if got, want := tOpts2["second"].(string), optsValues[1][1]; got != want {
t.Errorf("Second value in second options field is incorrect; got %v but want %v", got, want)
}
}
}
// Send a proper reply so that no other errors crop up.
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(responseBody))
}))
defer ts.Close()
headers := http.Header{}
headers.Add("Content-Type", "application/x-www-form-urlencoded")
firstOption := testOpts{optsValues[0][0], optsValues[0][1]}
secondOption := testOpts{optsValues[1][0], optsValues[1][1]}
inputOpts := make(map[string]interface{})
inputOpts["one"] = firstOption
inputOpts["two"] = secondOption
exchangeToken(context.Background(), ts.URL, &tokenRequest, auth, headers, inputOpts)
}