dex/connector/oauth/oauth.go

package oauth

import (
	"context"
	"crypto/tls"
	"crypto/x509"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"net"
	"net/http"
	"os"
	"strings"
	"time"

	"golang.org/x/oauth2"

	"github.com/dexidp/dex/connector"
	"github.com/dexidp/dex/pkg/log"
)

type oauthConnector struct {
	clientID             string
	clientSecret         string
	redirectURI          string
	tokenURL             string
	authorizationURL     string
	userInfoURL          string
	scopes               []string
	userIDKey            string
	userNameKey          string
	preferredUsernameKey string
	emailKey             string
	emailVerifiedKey     string
	groupsKey            string
	httpClient           *http.Client
	logger               log.Logger
}

type connectorData struct {
	AccessToken string
}

type Config struct {
	ClientID           string   `json:"clientID"`
	ClientSecret       string   `json:"clientSecret"`
	RedirectURI        string   `json:"redirectURI"`
	TokenURL           string   `json:"tokenURL"`
	AuthorizationURL   string   `json:"authorizationURL"`
	UserInfoURL        string   `json:"userInfoURL"`
	Scopes             []string `json:"scopes"`
	RootCAs            []string `json:"rootCAs"`
	InsecureSkipVerify bool     `json:"insecureSkipVerify"`
	UserIDKey          string   `json:"userIDKey"` // defaults to "id"
	ClaimMapping       struct {
		UserNameKey          string `json:"userNameKey"`          // defaults to "user_name"
		PreferredUsernameKey string `json:"preferredUsernameKey"` // defaults to "preferred_username"
		GroupsKey            string `json:"groupsKey"`            // defaults to "groups"
		EmailKey             string `json:"emailKey"`             // defaults to "email"
		EmailVerifiedKey     string `json:"emailVerifiedKey"`     // defaults to "email_verified"
	} `json:"claimMapping"`
}

func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
	var err error

	if c.UserIDKey == "" {
		c.UserIDKey = "id"
	}

	if c.ClaimMapping.UserNameKey == "" {
		c.ClaimMapping.UserNameKey = "user_name"
	}

	if c.ClaimMapping.PreferredUsernameKey == "" {
		c.ClaimMapping.PreferredUsernameKey = "preferred_username"
	}

	if c.ClaimMapping.GroupsKey == "" {
		c.ClaimMapping.GroupsKey = "groups"
	}

	if c.ClaimMapping.EmailKey == "" {
		c.ClaimMapping.EmailKey = "email"
	}

	if c.ClaimMapping.EmailVerifiedKey == "" {
		c.ClaimMapping.EmailVerifiedKey = "email_verified"
	}

	oauthConn := &oauthConnector{
		clientID:             c.ClientID,
		clientSecret:         c.ClientSecret,
		tokenURL:             c.TokenURL,
		authorizationURL:     c.AuthorizationURL,
		userInfoURL:          c.UserInfoURL,
		scopes:               c.Scopes,
		redirectURI:          c.RedirectURI,
		logger:               logger,
		userIDKey:            c.UserIDKey,
		userNameKey:          c.ClaimMapping.UserNameKey,
		preferredUsernameKey: c.ClaimMapping.PreferredUsernameKey,
		groupsKey:            c.ClaimMapping.GroupsKey,
		emailKey:             c.ClaimMapping.EmailKey,
		emailVerifiedKey:     c.ClaimMapping.EmailVerifiedKey,
	}

	oauthConn.httpClient, err = newHTTPClient(c.RootCAs, c.InsecureSkipVerify)
	if err != nil {
		return nil, err
	}

	return oauthConn, err
}

func newHTTPClient(rootCAs []string, insecureSkipVerify bool) (*http.Client, error) {
	pool, err := x509.SystemCertPool()
	if err != nil {
		return nil, err
	}

	tlsConfig := tls.Config{RootCAs: pool, InsecureSkipVerify: insecureSkipVerify}
	for _, rootCA := range rootCAs {
		rootCABytes, err := os.ReadFile(rootCA)
		if err != nil {
			return nil, fmt.Errorf("failed to read root-ca: %v", err)
		}
		if !tlsConfig.RootCAs.AppendCertsFromPEM(rootCABytes) {
			return nil, fmt.Errorf("no certs found in root CA file %q", rootCA)
		}
	}

	return &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: &tlsConfig,
			Proxy:           http.ProxyFromEnvironment,
			DialContext: (&net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
				DualStack: true,
			}).DialContext,
			MaxIdleConns:          100,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   10 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
	}, nil
}

func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
	if c.redirectURI != callbackURL {
		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
	}

	oauth2Config := &oauth2.Config{
		ClientID:     c.clientID,
		ClientSecret: c.clientSecret,
		Endpoint:     oauth2.Endpoint{TokenURL: c.tokenURL, AuthURL: c.authorizationURL},
		RedirectURL:  c.redirectURI,
		Scopes:       c.scopes,
	}

	return oauth2Config.AuthCodeURL(state), nil
}

func (c *oauthConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
	q := r.URL.Query()
	if errType := q.Get("error"); errType != "" {
		return identity, errors.New(q.Get("error_description"))
	}

	oauth2Config := &oauth2.Config{
		ClientID:     c.clientID,
		ClientSecret: c.clientSecret,
		Endpoint:     oauth2.Endpoint{TokenURL: c.tokenURL, AuthURL: c.authorizationURL},
		RedirectURL:  c.redirectURI,
		Scopes:       c.scopes,
	}

	ctx := context.WithValue(r.Context(), oauth2.HTTPClient, c.httpClient)

	token, err := oauth2Config.Exchange(ctx, q.Get("code"))
	if err != nil {
		return identity, fmt.Errorf("OAuth connector: failed to get token: %v", err)
	}

	client := oauth2.NewClient(ctx, oauth2.StaticTokenSource(token))

	userInfoResp, err := client.Get(c.userInfoURL)
	if err != nil {
		return identity, fmt.Errorf("OAuth Connector: failed to execute request to userinfo: %v", err)
	}
	defer userInfoResp.Body.Close()

	if userInfoResp.StatusCode != http.StatusOK {
		return identity, fmt.Errorf("OAuth Connector: failed to execute request to userinfo: status %d", userInfoResp.StatusCode)
	}

	var userInfoResult map[string]interface{}
	err = json.NewDecoder(userInfoResp.Body).Decode(&userInfoResult)
	if err != nil {
		return identity, fmt.Errorf("OAuth Connector: failed to parse userinfo: %v", err)
	}

	userID, found := userInfoResult[c.userIDKey].(string)
	if !found {
		return identity, fmt.Errorf("OAuth Connector: not found %v claim", c.userIDKey)
	}

	identity.UserID = userID
	identity.Username, _ = userInfoResult[c.userNameKey].(string)
	identity.PreferredUsername, _ = userInfoResult[c.preferredUsernameKey].(string)
	identity.Email, _ = userInfoResult[c.emailKey].(string)
	identity.EmailVerified, _ = userInfoResult[c.emailVerifiedKey].(bool)

	if s.Groups {
		groups := map[string]struct{}{}

		c.addGroupsFromMap(groups, userInfoResult)
		c.addGroupsFromToken(groups, token.AccessToken)

		for groupName := range groups {
			identity.Groups = append(identity.Groups, groupName)
		}
	}

	if s.OfflineAccess {
		data := connectorData{AccessToken: token.AccessToken}
		connData, err := json.Marshal(data)
		if err != nil {
			return identity, fmt.Errorf("OAuth Connector: failed to parse connector data for offline access: %v", err)
		}
		identity.ConnectorData = connData
	}

	return identity, nil
}

func (c *oauthConnector) addGroupsFromMap(groups map[string]struct{}, result map[string]interface{}) error {
	groupsClaim, ok := result[c.groupsKey].([]interface{})
	if !ok {
		return errors.New("cannot convert to slice")
	}

	for _, group := range groupsClaim {
		if groupString, ok := group.(string); ok {
			groups[groupString] = struct{}{}
		}
		if groupMap, ok := group.(map[string]interface{}); ok {
			if groupName, ok := groupMap["name"].(string); ok {
				groups[groupName] = struct{}{}
			}
		}
	}

	return nil
}

func (c *oauthConnector) addGroupsFromToken(groups map[string]struct{}, token string) error {
	parts := strings.Split(token, ".")
	if len(parts) < 2 {
		return errors.New("invalid token")
	}

	decoded, err := decode(parts[1])
	if err != nil {
		return err
	}

	var claimsMap map[string]interface{}
	err = json.Unmarshal(decoded, &claimsMap)
	if err != nil {
		return err
	}

	return c.addGroupsFromMap(groups, claimsMap)
}

func decode(seg string) ([]byte, error) {
	if l := len(seg) % 4; l > 0 {
		seg += strings.Repeat("=", 4-l)
	}

	return base64.URLEncoding.DecodeString(seg)
}