mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add parametrization of grant type supported in discovery endpoint

Browse source 
Signed-off-by: ariary <ariary9.2@hotmail.fr>
This commit is contained in:
kali 2021-09-03 05:48:37 -04:00 committed by ariary
parent 1b8f544873
commit 1497e70225
2 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
server/handlers.go Normal file → Executable file
View file

@ -94,7 +94,6 @@ func (s *Server) discoveryHandler() (http.HandlerFunc, error) {
UserInfo: s.absURL("/userinfo"), UserInfo: s.absURL("/userinfo"),
DeviceEndpoint: s.absURL("/device/code"), DeviceEndpoint: s.absURL("/device/code"),
Subjects: []string{"public"}, Subjects: []string{"public"},
GrantTypes: []string{grantTypeAuthorizationCode, grantTypeRefreshToken, grantTypeDeviceCode},
IDTokenAlgs: []string{string(jose.RS256)}, IDTokenAlgs: []string{string(jose.RS256)},
CodeChallengeAlgs: []string{codeChallengeMethodS256, codeChallengeMethodPlain}, CodeChallengeAlgs: []string{codeChallengeMethodS256, codeChallengeMethodPlain},
Scopes: []string{"openid", "email", "groups", "profile", "offline_access"}, Scopes: []string{"openid", "email", "groups", "profile", "offline_access"},
@ -110,6 +109,9 @@ func (s *Server) discoveryHandler() (http.HandlerFunc, error) {
} }
sort.Strings(d.ResponseTypes) sort.Strings(d.ResponseTypes)
d.GrantTypes = s.supportedGrantTypes
sort.Strings(d.GrantTypes)
data, err := json.MarshalIndent(d, "", " ") data, err := json.MarshalIndent(d, "", " ")
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to marshal discovery data: %v", err) return nil, fmt.Errorf("failed to marshal discovery data: %v", err)

14
server/server.go Normal file → Executable file
View file

@ -169,6 +169,8 @@ type Server struct {
supportedResponseTypes map[string]bool supportedResponseTypes map[string]bool
supportedGrantTypes []string
now func() time.Time now func() time.Time
idTokensValidFor time.Duration idTokensValidFor time.Duration
@ -209,14 +211,19 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
c.SupportedResponseTypes = []string{responseTypeCode} c.SupportedResponseTypes = []string{responseTypeCode}
} }
supported := make(map[string]bool) supportedRes := make(map[string]bool)
for _, respType := range c.SupportedResponseTypes { for _, respType := range c.SupportedResponseTypes {
switch respType { switch respType {
case responseTypeCode, responseTypeIDToken, responseTypeToken: case responseTypeCode, responseTypeIDToken, responseTypeToken:
default: default:
return nil, fmt.Errorf("unsupported response_type %q", respType) return nil, fmt.Errorf("unsupported response_type %q", respType)
} }
supported[respType] = true supportedRes[respType] = true
}
supportedGrant := []string{grantTypeAuthorizationCode, grantTypeRefreshToken, grantTypeDeviceCode} //default
if c.PasswordConnector != "" {
supportedGrant = append(supportedGrant, grantTypePassword)
} }
webFS := web.FS() webFS := web.FS()
@ -249,7 +256,8 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
issuerURL: *issuerURL, issuerURL: *issuerURL,
connectors: make(map[string]Connector), connectors: make(map[string]Connector),
storage: newKeyCacher(c.Storage, now), storage: newKeyCacher(c.Storage, now),
supportedResponseTypes: supported, supportedResponseTypes: supportedRes,
supportedGrantTypes: supportedGrant,
idTokensValidFor: value(c.IDTokensValidFor, 24*time.Hour), idTokensValidFor: value(c.IDTokensValidFor, 24*time.Hour),
authRequestsValidFor: value(c.AuthRequestsValidFor, 24*time.Hour), authRequestsValidFor: value(c.AuthRequestsValidFor, 24*time.Hour),
deviceRequestsValidFor: value(c.DeviceRequestsValidFor, 5*time.Minute), deviceRequestsValidFor: value(c.DeviceRequestsValidFor, 5*time.Minute),