-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Make OAuth provider discoverable from within a Pod
https://trello.com/c/7uYQSTdR Signed-off-by: Monis Khan <[email protected]>
- Loading branch information
Showing
8 changed files
with
180 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package discovery | ||
|
|
||
| import ( | ||
| "github.com/RangelReale/osin" | ||
| "github.com/openshift/origin/pkg/authorization/authorizer/scope" | ||
| "github.com/openshift/origin/pkg/oauth/api/validation" | ||
| "github.com/openshift/origin/pkg/oauth/server/osinserver" | ||
| ) | ||
|
|
||
| // OauthAuthorizationServerMetadata holds OAuth 2.0 Authorization Server Metadata used for discovery | ||
| // https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 | ||
| type OauthAuthorizationServerMetadata struct { | ||
| // The authorization server's issuer identifier, which is a URL that uses the https scheme and has no query or fragment components. | ||
| // This is the location where .well-known RFC 5785 [RFC5785] resources containing information about the authorization server are published. | ||
| Issuer string `json:"issuer"` | ||
|
|
||
| // URL of the authorization server's authorization endpoint [RFC6749]. | ||
| AuthorizationEndpoint string `json:"authorization_endpoint"` | ||
|
|
||
| // URL of the authorization server's token endpoint [RFC6749]. | ||
| TokenEndpoint string `json:"token_endpoint"` | ||
|
|
||
| // JSON array containing a list of the OAuth 2.0 [RFC6749] scope values that this authorization server supports. | ||
| // Servers MAY choose not to advertise some supported scope values even when this parameter is used. | ||
| ScopesSupported []string `json:"scopes_supported"` | ||
|
|
||
| // JSON array containing a list of the OAuth 2.0 response_type values that this authorization server supports. | ||
| // The array values used are the same as those used with the response_types parameter defined by "OAuth 2.0 Dynamic Client Registration Protocol" [RFC7591]. | ||
| ResponseTypesSupported osin.AllowedAuthorizeType `json:"response_types_supported"` | ||
|
|
||
| // JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports. | ||
| // The array values used are the same as those used with the grant_types parameter defined by "OAuth 2.0 Dynamic Client Registration Protocol" [RFC7591]. | ||
| GrantTypesSupported osin.AllowedAccessType `json:"grant_types_supported"` | ||
|
|
||
| // JSON array containing a list of PKCE [RFC7636] code challenge methods supported by this authorization server. | ||
| // Code challenge method values are used in the "code_challenge_method" parameter defined in Section 4.3 of [RFC7636]. | ||
| // The valid code challenge method values are those registered in the IANA "PKCE Code Challenge Methods" registry [IANA.OAuth.Parameters]. | ||
| CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"` | ||
| } | ||
|
|
||
| func Get(masterPublicURL, authorizeURL, tokenURL string) OauthAuthorizationServerMetadata { | ||
| config := osinserver.NewDefaultServerConfig() | ||
| return OauthAuthorizationServerMetadata{ | ||
| Issuer: masterPublicURL, | ||
| AuthorizationEndpoint: authorizeURL, | ||
| TokenEndpoint: tokenURL, | ||
| ScopesSupported: []string{ // Note: this list is incomplete, which is allowed per the draft spec | ||
| scope.UserFull, | ||
| scope.UserInfo, | ||
| scope.UserAccessCheck, | ||
| scope.UserListScopedProjects, | ||
| scope.UserListAllProjects, | ||
| }, | ||
| ResponseTypesSupported: config.AllowedAuthorizeTypes, | ||
| GrantTypesSupported: osin.AllowedAccessType{osin.AUTHORIZATION_CODE}, // TODO use config.AllowedAccessTypes once our implementation handles other grant types | ||
| CodeChallengeMethodsSupported: validation.CodeChallengeMethodsSupported, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package discovery | ||
|
|
||
| import ( | ||
| "reflect" | ||
| "testing" | ||
|
|
||
| "github.com/RangelReale/osin" | ||
| ) | ||
|
|
||
| func TestGet(t *testing.T) { | ||
| actual := Get("https://localhost:8443", "https://localhost:8443/oauth/authorize", "https://localhost:8443/oauth/token") | ||
| expected := OauthAuthorizationServerMetadata{ | ||
| Issuer: "https://localhost:8443", | ||
| AuthorizationEndpoint: "https://localhost:8443/oauth/authorize", | ||
| TokenEndpoint: "https://localhost:8443/oauth/token", | ||
| ScopesSupported: []string{ | ||
| "user:full", | ||
| "user:info", | ||
| "user:check-access", | ||
| "user:list-scoped-projects", | ||
| "user:list-projects", | ||
| }, | ||
| ResponseTypesSupported: osin.AllowedAuthorizeType{ | ||
| "code", | ||
| "token", | ||
| }, | ||
| GrantTypesSupported: osin.AllowedAccessType{ | ||
| "authorization_code", | ||
| }, | ||
| CodeChallengeMethodsSupported: []string{ | ||
| "plain", | ||
| "S256", | ||
| }, | ||
| } | ||
|
|
||
| if !reflect.DeepEqual(actual, expected) { | ||
| t.Errorf("Expected %#v, got %#v", expected, actual) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters