sispeo
6 years ago
committed by
rpo
rpo
5 changed files with 311 additions and 35 deletions
@ -0,0 +1,86 @@ |
|||||
|
package keycloak |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"fmt" |
||||
|
"net/url" |
||||
|
"time" |
||||
|
|
||||
|
oidc "github.com/coreos/go-oidc" |
||||
|
"github.com/pkg/errors" |
||||
|
) |
||||
|
|
||||
|
// OidcVerifierProvider is an interface for a provider of OidcVerifier instances
|
||||
|
type OidcVerifierProvider interface { |
||||
|
GetOidcVerifier(realm string) (OidcVerifier, error) |
||||
|
} |
||||
|
|
||||
|
// OidcVerifier is an interface for OIDC token verifiers
|
||||
|
type OidcVerifier interface { |
||||
|
Verify(accessToken string) error |
||||
|
} |
||||
|
|
||||
|
type verifierCache struct { |
||||
|
duration time.Duration |
||||
|
errorTolerance time.Duration |
||||
|
tokenProviderURL *url.URL |
||||
|
verifiers map[string]cachedVerifier |
||||
|
} |
||||
|
|
||||
|
type cachedVerifier struct { |
||||
|
verifier *oidc.IDTokenVerifier |
||||
|
createdAt time.Time |
||||
|
expireAt time.Time |
||||
|
invalidateOnErrorAt time.Time |
||||
|
} |
||||
|
|
||||
|
// NewVerifierCache create an instance of OIDC verifier cache
|
||||
|
func NewVerifierCache(tokenProviderURL *url.URL, timeToLive time.Duration, errorTolerance time.Duration) OidcVerifierProvider { |
||||
|
return &verifierCache{ |
||||
|
duration: timeToLive, |
||||
|
errorTolerance: errorTolerance, |
||||
|
tokenProviderURL: tokenProviderURL, |
||||
|
verifiers: make(map[string]cachedVerifier), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
func (vc *verifierCache) GetOidcVerifier(realm string) (OidcVerifier, error) { |
||||
|
v, ok := vc.verifiers[realm] |
||||
|
if ok && v.isValid() { |
||||
|
return &v, nil |
||||
|
} |
||||
|
var oidcProvider *oidc.Provider |
||||
|
{ |
||||
|
var err error |
||||
|
var issuer = fmt.Sprintf("%s/auth/realms/%s", vc.tokenProviderURL.String(), realm) |
||||
|
oidcProvider, err = oidc.NewProvider(context.Background(), issuer) |
||||
|
if err != nil { |
||||
|
return nil, errors.Wrap(err, "could not create oidc provider") |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
ov := oidcProvider.Verifier(&oidc.Config{SkipClientIDCheck: true}) |
||||
|
res := cachedVerifier{ |
||||
|
createdAt: time.Now(), |
||||
|
expireAt: time.Now().Add(vc.duration), |
||||
|
invalidateOnErrorAt: time.Now().Add(vc.errorTolerance), |
||||
|
verifier: ov, |
||||
|
} |
||||
|
vc.verifiers[realm] = res |
||||
|
|
||||
|
return &res, nil |
||||
|
} |
||||
|
|
||||
|
func (cv *cachedVerifier) isValid() bool { |
||||
|
return time.Now().Before(cv.expireAt) |
||||
|
} |
||||
|
|
||||
|
func (cv *cachedVerifier) Verify(accessToken string) error { |
||||
|
_, err := cv.verifier.Verify(context.Background(), accessToken) |
||||
|
if err != nil && time.Now().After(cv.invalidateOnErrorAt) { |
||||
|
// An error occured and current time is after invalidateOnErrorAt
|
||||
|
// Let's make this verifier expire
|
||||
|
cv.expireAt = cv.createdAt |
||||
|
} |
||||
|
return err |
||||
|
} |
||||
@ -0,0 +1,114 @@ |
|||||
|
package keycloak |
||||
|
|
||||
|
//go:generate mockgen -destination=./mock/authmanager.go -package=mock -mock_names=AuthorizationManager=AuthorizationManager github.com/cloudtrust/common-service/security AuthorizationManager
|
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"encoding/json" |
||||
|
"net/http" |
||||
|
"net/http/httptest" |
||||
|
"net/url" |
||||
|
"strings" |
||||
|
"testing" |
||||
|
"time" |
||||
|
|
||||
|
http_transport "github.com/go-kit/kit/transport/http" |
||||
|
"github.com/gorilla/mux" |
||||
|
"github.com/stretchr/testify/assert" |
||||
|
) |
||||
|
|
||||
|
func decodeRequest(_ context.Context, req *http.Request) (interface{}, error) { |
||||
|
res := map[string]string{"realm": mux.Vars(req)["realm"], "host": req.Host} |
||||
|
return res, nil |
||||
|
} |
||||
|
|
||||
|
func encodeReply(_ context.Context, w http.ResponseWriter, rep interface{}) error { |
||||
|
if rep == nil { |
||||
|
w.WriteHeader(404) |
||||
|
return nil |
||||
|
} |
||||
|
w.Header().Set("Content-Type", "application/json; charset=utf-8") |
||||
|
w.WriteHeader(200) |
||||
|
|
||||
|
var json, err = json.Marshal(rep) |
||||
|
if err == nil { |
||||
|
w.Write(json) |
||||
|
} |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func errorHandler(_ context.Context, _ error, w http.ResponseWriter) { |
||||
|
w.WriteHeader(500) |
||||
|
} |
||||
|
|
||||
|
func endpoint(_ context.Context, request interface{}) (response interface{}, err error) { |
||||
|
var query = request.(map[string]string) |
||||
|
if !strings.Contains(query["realm"], "realm") { |
||||
|
return nil, nil |
||||
|
} |
||||
|
return map[string]string{ |
||||
|
"issuer": "http://" + query["host"] + "/auth/realms/" + query["realm"], |
||||
|
"authorization_endpoint": "", |
||||
|
"token_endpoint": "", |
||||
|
"jwks_uri": "", |
||||
|
"userinfo_endpoint": "", |
||||
|
}, nil |
||||
|
} |
||||
|
|
||||
|
func TestGetOidcVerifier(t *testing.T) { |
||||
|
verifierHandler := http_transport.NewServer(endpoint, decodeRequest, encodeReply, http_transport.ServerErrorEncoder(errorHandler)) |
||||
|
|
||||
|
r := mux.NewRouter() |
||||
|
r.Handle("/auth/realms/{realm}/.well-known/openid-configuration", verifierHandler) |
||||
|
|
||||
|
ts := httptest.NewServer(r) |
||||
|
defer ts.Close() |
||||
|
|
||||
|
url, _ := url.Parse(ts.URL) |
||||
|
|
||||
|
{ |
||||
|
// First test with a verifier which hardly expires
|
||||
|
verifier := NewVerifierCache(url, time.Minute, 10*time.Minute) |
||||
|
|
||||
|
{ |
||||
|
// Unknown realm: can't get verifier
|
||||
|
_, err := verifier.GetOidcVerifier("unknown") |
||||
|
assert.NotNil(t, err) |
||||
|
} |
||||
|
|
||||
|
v1, e := verifier.GetOidcVerifier("realm1") |
||||
|
assert.Nil(t, e) |
||||
|
{ |
||||
|
// Ask for the same realm before its verifier expires
|
||||
|
v2, _ := verifier.GetOidcVerifier("realm1") |
||||
|
assert.Equal(t, v1, v2) |
||||
|
} |
||||
|
{ |
||||
|
// Ask for a different verifier
|
||||
|
v3, _ := verifier.GetOidcVerifier("realm2") |
||||
|
assert.NotEqual(t, v1, v3) |
||||
|
} |
||||
|
|
||||
|
time.Sleep(100 * time.Millisecond) |
||||
|
assert.NotNil(t, v1.Verify("abcdef")) |
||||
|
} |
||||
|
|
||||
|
{ |
||||
|
// Now, test with a verifier which quickly expires on error
|
||||
|
verifier := NewVerifierCache(url, time.Minute, time.Millisecond) |
||||
|
v1, _ := verifier.GetOidcVerifier("realm1") |
||||
|
time.Sleep(100 * time.Millisecond) |
||||
|
{ |
||||
|
// Ask for the same realm before its verifier expires
|
||||
|
v2, _ := verifier.GetOidcVerifier("realm1") |
||||
|
assert.Equal(t, v1, v2) |
||||
|
} |
||||
|
{ |
||||
|
// Verify an invalid token
|
||||
|
assert.NotNil(t, v1.Verify("abcdef")) |
||||
|
// Ask for the same realm before its verifier expires but after an error occured
|
||||
|
v2, _ := verifier.GetOidcVerifier("realm1") |
||||
|
assert.NotEqual(t, v1, v2) |
||||
|
} |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue