sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(deps): bump github.com/libregraph/lico from 0.64.0 to 0.65.0

Browse Source 
Bumps [github.com/libregraph/lico](https://github.com/libregraph/lico) from 0.64.0 to 0.65.0.
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.64.0...v0.65.0)

---
updated-dependencies:
- dependency-name: github.com/libregraph/lico
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
This commit is contained in:
dependabot[bot]
2024-12-04 09:19:55 +01:00
committed by Ralf Haferkamp
parent 58410b0b10
commit e08899d224
10 changed files with 99 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/libregraph/lico/oidc/payload/authentication.go
Generated Vendored
+1 -1
View File
@@ -332,7 +332,7 @@ func (ar *AuthenticationRequest) Validate(keyFunc jwt.Keyfunc) error {
}
// TODO(longsleep): implement client_id white list.
if ar.RedirectURI == nil || ar.RedirectURI.Host == "" || ar.RedirectURI.Scheme == "" {
if ar.RedirectURI == nil || !ar.RedirectURI.IsAbs() {
return ar.NewBadRequest(oidc.ErrorCodeOAuth2InvalidRequest, "invalid or missing redirect_uri")
}
vendor/github.com/libregraph/lico/oidc/provider/handlers.go
Generated Vendored
+9 -5
View File
@@ -239,7 +239,7 @@ func (p *Provider) AuthorizeResponse(rw http.ResponseWriter, req *http.Request,
// Create access token when requested.
if _, ok := ar.ResponseTypes[oidc.ResponseTypeToken]; ok {
accessTokenString, err = p.makeAccessToken(ctx, ar.ClientID, auth, nil)
accessTokenString, err = p.makeAccessToken(ctx, ar.ClientID, auth, nil, nil)
if err != nil {
goto done
}
@@ -248,7 +248,7 @@ func (p *Provider) AuthorizeResponse(rw http.ResponseWriter, req *http.Request,
// Create ID token when requested and granted.
if authorizedScopes[oidc.ScopeOpenID] {
if _, ok := ar.ResponseTypes[oidc.ResponseTypeIDToken]; ok {
idTokenString, err = p.makeIDToken(ctx, ar, auth, session, accessTokenString, codeString, nil)
idTokenString, err = p.makeIDToken(ctx, ar, auth, session, accessTokenString, codeString, nil, nil)
if err != nil {
goto done
}
@@ -330,6 +330,7 @@ func (p *Provider) TokenHandler(rw http.ResponseWriter, req *http.Request) {
var accessTokenString string
var idTokenString string
var refreshTokenString string
var refreshTokenClaims *konnect.RefreshTokenClaims
var approvedScopes map[string]bool
var authorizedScopes map[string]bool
var clientDetails *clients.Details
@@ -498,22 +499,25 @@ func (p *Provider) TokenHandler(rw http.ResponseWriter, req *http.Request) {
ClientID: claims.Audience,
}
// Remember refresh token claims, for use in access and id token generators later on.
refreshTokenClaims = claims
default:
err = konnectoidc.NewOAuth2Error(oidc.ErrorCodeOAuth2UnsupportedGrantType, "grant_type value not implemented")
goto done
}
// Create access token.
accessTokenString, err = p.makeAccessToken(ctx, ar.ClientID, auth, signinMethod)
accessTokenString, err = p.makeAccessToken(ctx, ar.ClientID, auth, signinMethod, refreshTokenClaims)
if err != nil {
goto done
}
switch tr.GrantType {
case oidc.GrantTypeAuthorizationCode:
case oidc.GrantTypeAuthorizationCode, oidc.GrantTypeRefreshToken:
// Create ID token when not previously requested amd openid scope is authorized.
if !ar.ResponseTypes[oidc.ResponseTypeIDToken] && authorizedScopes[oidc.ScopeOpenID] {
idTokenString, err = p.makeIDToken(ctx, ar, auth, session, accessTokenString, "", signinMethod)
idTokenString, err = p.makeIDToken(ctx, ar, auth, session, accessTokenString, "", signinMethod, refreshTokenClaims)
if err != nil {
goto done
}
vendor/github.com/libregraph/lico/oidc/provider/tokens.go
Generated Vendored
+26 -3
View File
@@ -35,10 +35,10 @@ import (
// MakeAccessToken implements the oidc.AccessTokenProvider interface.
func (p *Provider) MakeAccessToken(ctx context.Context, audience string, auth identity.AuthRecord) (string, error) {
return p.makeAccessToken(ctx, audience, auth, nil)
return p.makeAccessToken(ctx, audience, auth, nil, nil)
}
func (p *Provider) makeAccessToken(ctx context.Context, audience string, auth identity.AuthRecord, signingMethod jwt.SigningMethod) (string, error) {
func (p *Provider) makeAccessToken(ctx context.Context, audience string, auth identity.AuthRecord, signingMethod jwt.SigningMethod, refreshTokenClaims *konnect.RefreshTokenClaims) (string, error) {
sk, ok := p.getSigningKey(signingMethod)
if !ok {
return "", fmt.Errorf("no signing key")
@@ -67,6 +67,17 @@ func (p *Provider) makeAccessToken(ctx context.Context, audience string, auth id
accessTokenClaims.IdentityClaims = userWithClaims.Claims()
}
accessTokenClaims.IdentityProvider = auth.Manager().Name()
if accessTokenClaims.IdentityClaims != nil && refreshTokenClaims != nil && refreshTokenClaims.IdentityClaims != nil {
if refreshTokenClaims.IdentityProvider != accessTokenClaims.IdentityProvider {
return "", fmt.Errorf("refresh token claims provider mismatch")
}
for k, v := range refreshTokenClaims.IdentityClaims {
// Force to use refresh token identity claim values. This also locks all
// the extra claims for id and access tokens to the ones provided from
// the refresh token claims (which currently includes the session id).
accessTokenClaims.IdentityClaims[k] = v
}
}
}
// Support additional custom user specific claims.
@@ -113,7 +124,7 @@ func (p *Provider) makeAccessToken(ctx context.Context, audience string, auth id
return accessToken.SignedString(sk.PrivateKey)
}
func (p *Provider) makeIDToken(ctx context.Context, ar *payload.AuthenticationRequest, auth identity.AuthRecord, session *payload.Session, accessTokenString string, codeString string, signingMethod jwt.SigningMethod) (string, error) {
func (p *Provider) makeIDToken(ctx context.Context, ar *payload.AuthenticationRequest, auth identity.AuthRecord, session *payload.Session, accessTokenString string, codeString string, signingMethod jwt.SigningMethod, refreshTokenClaims *konnect.RefreshTokenClaims) (string, error) {
sk, ok := p.getSigningKey(signingMethod)
if !ok {
return "", fmt.Errorf("no signing key")
@@ -160,6 +171,18 @@ func (p *Provider) makeIDToken(ctx context.Context, ar *payload.AuthenticationRe
if userWithClaims, ok := user.(identity.UserWithClaims); ok {
accessTokenClaims.IdentityClaims = userWithClaims.Claims()
}
accessTokenClaims.IdentityProvider = auth.Manager().Name()
if accessTokenClaims.IdentityClaims != nil && refreshTokenClaims != nil && refreshTokenClaims.IdentityClaims != nil {
if refreshTokenClaims.IdentityProvider != accessTokenClaims.IdentityProvider {
return "", fmt.Errorf("refresh token claims provider mismatch")
}
for k, v := range refreshTokenClaims.IdentityClaims {
// Force to use refresh token identity claim values. This also locks all
// the extra claims for id and access tokens to the ones provided from
// the refresh token claims (which currently includes the session id).
accessTokenClaims.IdentityClaims[k] = v
}
}
if withIDTokenClaimsRequest {
// Apply additional information from ID token claims request.