-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Frank Jogeleit <frank.jogeleit@lovoo.com>
- Loading branch information
Frank Jogeleit
committed
Dec 30, 2023
1 parent
25c26a0
commit 66a3203
Showing
55 changed files
with
2,037 additions
and
783 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "strings" | ||
|
|
||
| "github.com/coreos/go-oidc/v3/oidc" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| // Authenticator is used to authenticate our users. | ||
| type Authenticator struct { | ||
| *oidc.Provider | ||
| oauth2.Config | ||
| URL string | ||
| } | ||
|
|
||
| func New(domain, clientID, clientSecret, callbackURL string, scopes []string) (*Authenticator, error) { | ||
| url := strings.TrimSuffix(domain, "/") | ||
|
|
||
| provider, err := oidc.NewProvider(context.Background(), url) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| conf := oauth2.Config{ | ||
| ClientID: clientID, | ||
| ClientSecret: clientSecret, | ||
| RedirectURL: callbackURL, | ||
| Endpoint: provider.Endpoint(), | ||
| Scopes: append([]string{oidc.ScopeOpenID, "profile"}, scopes...), | ||
| } | ||
|
|
||
| return &Authenticator{ | ||
| Provider: provider, | ||
| Config: conf, | ||
| URL: url, | ||
| }, nil | ||
| } | ||
|
|
||
| // VerifyIDToken verifies that an *oauth2.Token is a valid *oidc.IDToken. | ||
| func (a *Authenticator) VerifyIDToken(ctx context.Context, token *oauth2.Token) (*oidc.IDToken, error) { | ||
| rawIDToken, ok := token.Extra("id_token").(string) | ||
| if !ok { | ||
| return nil, errors.New("no id_token field in oauth2 token") | ||
| } | ||
|
|
||
| oidcConfig := &oidc.Config{ | ||
| ClientID: a.ClientID, | ||
| } | ||
|
|
||
| return a.Verifier(oidcConfig).Verify(ctx, rawIDToken) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "crypto/rand" | ||
| "encoding/base64" | ||
| "net/http" | ||
| "net/url" | ||
| "strings" | ||
|
|
||
| "github.com/gin-contrib/sessions" | ||
| "github.com/gin-gonic/gin" | ||
| "go.uber.org/zap" | ||
| ) | ||
|
|
||
| type Handler struct { | ||
| authenticator *Authenticator | ||
| } | ||
|
|
||
| func NewHandler(auth *Authenticator) *Handler { | ||
| return &Handler{authenticator: auth} | ||
| } | ||
|
|
||
| func (h *Handler) Callback(ctx *gin.Context) { | ||
| session := sessions.Default(ctx) | ||
| if ctx.Query("state") != session.Get("state") { | ||
| ctx.String(http.StatusBadRequest, "Invalid state parameter.") | ||
| return | ||
| } | ||
|
|
||
| // Exchange an authorization code for a token. | ||
| token, err := h.authenticator.Exchange(ctx.Request.Context(), ctx.Query("code")) | ||
| if err != nil { | ||
| zap.L().Error("failed to exchange an authorization code", zap.String("code", ctx.Query("code")), zap.Error(err)) | ||
|
|
||
| ctx.String(http.StatusUnauthorized, "Failed to exchange an authorization code for a token.") | ||
| return | ||
| } | ||
|
|
||
| idToken, err := h.authenticator.VerifyIDToken(ctx.Request.Context(), token) | ||
| if err != nil { | ||
| zap.L().Error("failed to verify ID Token", zap.Error(err)) | ||
|
|
||
| ctx.String(http.StatusInternalServerError, "Failed to verify ID Token.") | ||
| return | ||
| } | ||
|
|
||
| var profile Profile | ||
| if err := idToken.Claims(&profile); err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| session.Set("access_token", token.AccessToken) | ||
| session.Set("profile", profile) | ||
| if err := session.Save(); err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| ctx.Redirect(http.StatusTemporaryRedirect, "/") | ||
| } | ||
|
|
||
| func (h *Handler) Login(ctx *gin.Context) { | ||
| state, err := generateRandomState() | ||
| if err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| // Save the state inside the session. | ||
| session := sessions.Default(ctx) | ||
| session.Set("state", state) | ||
| if err := session.Save(); err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| ctx.Redirect(http.StatusTemporaryRedirect, h.authenticator.AuthCodeURL(state)) | ||
| } | ||
|
|
||
| func (h *Handler) Logout(ctx *gin.Context) { | ||
| logoutURL, err := url.Parse(strings.TrimSuffix(h.authenticator.Config.Endpoint.AuthURL, "/auth") + "/logout") | ||
| if err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| scheme := "http" | ||
| if ctx.Request.TLS != nil { | ||
| scheme = "https" | ||
| } | ||
|
|
||
| returnTo, err := url.Parse(scheme + "://" + ctx.Request.Host) | ||
| if err != nil { | ||
| ctx.String(http.StatusInternalServerError, err.Error()) | ||
| return | ||
| } | ||
|
|
||
| parameters := url.Values{} | ||
| parameters.Add("returnTo", returnTo.String()) | ||
| parameters.Add("client_id", h.authenticator.ClientID) | ||
| logoutURL.RawQuery = parameters.Encode() | ||
|
|
||
| ctx.Redirect(http.StatusTemporaryRedirect, logoutURL.String()) | ||
| } | ||
|
|
||
| func (h *Handler) Profile(ctx *gin.Context) { | ||
| profile := ProfileFrom(ctx) | ||
| if profile == nil { | ||
| ctx.AbortWithStatus(http.StatusNotFound) | ||
| return | ||
| } | ||
|
|
||
| ctx.JSON(http.StatusOK, gin.H{ | ||
| "id": profile.ID, | ||
| "firstname": profile.Firstname, | ||
| "lastname": profile.Lastname, | ||
| }) | ||
| } | ||
|
|
||
| func generateRandomState() (string, error) { | ||
| b := make([]byte, 32) | ||
| _, err := rand.Read(b) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| state := base64.StdEncoding.EncodeToString(b) | ||
|
|
||
| return state, nil | ||
| } |
Oops, something went wrong.