mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #411 from bobbyrullo/cross_client

Browse source 
Use Client defined in dex instead of go-oidc for storing clients
This commit is contained in:
bobbyrullo 2016-04-20 14:38:18 -07:00
commit 69ca9dba2e
44 changed files with 1181 additions and 515 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

81
admin/api.go
View file

@ -5,36 +5,36 @@ import (
"net/http"
"github.com/coreos/go-oidc/oidc"
"github.com/go-gorp/gorp"
"github.com/coreos/dex/client"
"github.com/coreos/dex/db"
"github.com/coreos/dex/schema/adminschema"
"github.com/coreos/dex/user"
"github.com/coreos/dex/user/manager"
)
var (
ClientIDGenerator = oidc.GenClientID
)
// AdminAPI provides the logic necessary to implement the Admin API.
type AdminAPI struct {
userManager *manager.UserManager
userRepo user.UserRepo
passwordInfoRepo user.PasswordInfoRepo
clientIdentityRepo client.ClientIdentityRepo
localConnectorID string
userManager *manager.UserManager
userRepo user.UserRepo
passwordInfoRepo user.PasswordInfoRepo
clientRepo client.ClientRepo
localConnectorID string
}
// TODO(ericchiang): Swap the DbMap for a storage interface. See #278
func NewAdminAPI(dbMap *gorp.DbMap, userManager *manager.UserManager, localConnectorID string) *AdminAPI {
func NewAdminAPI(userRepo user.UserRepo, pwiRepo user.PasswordInfoRepo, clientRepo client.ClientRepo, userManager *manager.UserManager, localConnectorID string) *AdminAPI {
if localConnectorID == "" {
panic("must specify non-blank localConnectorID")
}
return &AdminAPI{
userManager: userManager,
userRepo: db.NewUserRepo(dbMap),
passwordInfoRepo: db.NewPasswordInfoRepo(dbMap),
clientIdentityRepo: db.NewClientIdentityRepo(dbMap),
localConnectorID: localConnectorID,
userManager: userManager,
userRepo: userRepo,
passwordInfoRepo: pwiRepo,
clientRepo: clientRepo,
localConnectorID: localConnectorID,
}
}
@ -67,10 +67,20 @@ func errorMaker(typ string, desc string, code int) func(internal error) Error {
}
var (
ErrorMissingClient = errorMaker("bad_request", "The 'client' cannot be empty", http.StatusBadRequest)(nil)
// Called when oidc.ClientMetadata.Valid() fails.
ErrorInvalidClientFunc = errorMaker("bad_request", "Your client could not be validated.", http.StatusBadRequest)
errorMap = map[error]func(error) Error{
user.ErrorNotFound: errorMaker("resource_not_found", "Resource could not be found.", http.StatusNotFound),
user.ErrorDuplicateEmail: errorMaker("bad_request", "Email already in use.", http.StatusBadRequest),
user.ErrorInvalidEmail: errorMaker("bad_request", "invalid email.", http.StatusBadRequest),
adminschema.ErrorInvalidRedirectURI: errorMaker("bad_request", "invalid redirectURI.", http.StatusBadRequest),
adminschema.ErrorInvalidLogoURI: errorMaker("bad_request", "invalid logoURI.", http.StatusBadRequest),
adminschema.ErrorInvalidClientURI: errorMaker("bad_request", "invalid clientURI.", http.StatusBadRequest),
adminschema.ErrorNoRedirectURI: errorMaker("bad_request", "invalid redirectURI.", http.StatusBadRequest),
}
)
@ -116,25 +126,38 @@ func (a *AdminAPI) GetState() (adminschema.State, error) {
return state, nil
}
type ClientRegistrationRequest struct {
IsAdmin bool `json:"isAdmin"`
Client oidc.ClientMetadata `json:"client"`
}
func (a *AdminAPI) CreateClient(req adminschema.ClientCreateRequest) (adminschema.ClientCreateResponse, error) {
if req.Client == nil {
return adminschema.ClientCreateResponse{}, ErrorMissingClient
}
func (a *AdminAPI) CreateClient(req ClientRegistrationRequest) (oidc.ClientRegistrationResponse, error) {
if err := req.Client.Valid(); err != nil {
return oidc.ClientRegistrationResponse{}, mapError(err)
}
// metadata is guarenteed to have at least one redirect_uri by earlier validation.
id, err := oidc.GenClientID(req.Client.RedirectURIs[0].Host)
cli, err := adminschema.MapSchemaClientToClient(*req.Client)
if err != nil {
return oidc.ClientRegistrationResponse{}, mapError(err)
return adminschema.ClientCreateResponse{}, mapError(err)
}
c, err := a.clientIdentityRepo.New(id, req.Client, req.IsAdmin)
if err := cli.Metadata.Valid(); err != nil {
return adminschema.ClientCreateResponse{}, ErrorInvalidClientFunc(err)
}
// metadata is guaranteed to have at least one redirect_uri by earlier validation.
id, err := ClientIDGenerator(cli.Metadata.RedirectURIs[0].Host)
if err != nil {
return oidc.ClientRegistrationResponse{}, mapError(err)
return adminschema.ClientCreateResponse{}, mapError(err)
}
return oidc.ClientRegistrationResponse{ClientID: c.ID, ClientSecret: c.Secret, ClientMetadata: req.Client}, nil
cli.Credentials.ID = id
creds, err := a.clientRepo.New(cli)
if err != nil {
return adminschema.ClientCreateResponse{}, mapError(err)
}
req.Client.Id = creds.ID
req.Client.Secret = creds.Secret
return adminschema.ClientCreateResponse{
Client: req.Client,
}, nil
}
func mapError(e error) error {

4
admin/api_test.go
View file

@ -3,6 +3,7 @@ package admin
import (
"testing"
"github.com/coreos/dex/client"
"github.com/coreos/dex/connector"
"github.com/coreos/dex/db"
"github.com/coreos/dex/schema/adminschema"
@ -15,6 +16,7 @@ import (
type testFixtures struct {
ur user.UserRepo
pwr user.PasswordInfoRepo
cr client.ClientRepo
mgr *manager.UserManager
adAPI *AdminAPI
}
@ -69,7 +71,7 @@ func makeTestFixtures() *testFixtures {
}()
f.mgr = manager.NewUserManager(f.ur, f.pwr, ccr, db.TransactionFactory(dbMap), manager.ManagerOptions{})
f.adAPI = NewAdminAPI(dbMap, f.mgr, "local")
f.adAPI = NewAdminAPI(f.ur, f.pwr, f.cr, f.mgr, "local")
return f
}

59
client/client.go
View file

@ -1,7 +1,9 @@
package client
import (
"encoding/json"
"errors"
"io"
"net/url"
"reflect"
@ -15,7 +17,15 @@ var (
ErrorNotFound = errors.New("no data found")
)
type ClientIdentityRepo interface {
type Client struct {
Credentials oidc.ClientCredentials
Metadata oidc.ClientMetadata
Admin bool
}
type ClientRepo interface {
Get(clientID string) (Client, error)
// Metadata returns one matching ClientMetadata if the given client
// exists, otherwise nil. The returned error will be non-nil only
// if the repo was unable to determine client existence.
@ -27,13 +37,13 @@ type ClientIdentityRepo interface {
// to make these assertions will a non-nil error be returned.
Authenticate(creds oidc.ClientCredentials) (bool, error)
// All returns all registered Client Identities.
All() ([]oidc.ClientIdentity, error)
// All returns all registered Clients
All() ([]Client, error)
// New registers a ClientIdentity with the repo for the given metadata.
// New registers a Client with the repo.
// An unused ID must be provided. A corresponding secret will be returned
// in a ClientCredentials struct along with the provided ID.
New(id string, meta oidc.ClientMetadata, admin bool) (*oidc.ClientCredentials, error)
New(client Client) (*oidc.ClientCredentials, error)
SetDexAdmin(clientID string, isAdmin bool) error
@ -64,3 +74,42 @@ func ValidRedirectURL(rURL *url.URL, redirectURLs []url.URL) (url.URL, error) {
}
return url.URL{}, ErrorInvalidRedirectURL
}
func ClientsFromReader(r io.Reader) ([]Client, error) {
var c []struct {
ID string `json:"id"`
Secret string `json:"secret"`
RedirectURLs []string `json:"redirectURLs"`
}
if err := json.NewDecoder(r).Decode(&c); err != nil {
return nil, err
}
clients := make([]Client, len(c))
for i, client := range c {
if client.ID == "" {
return nil, errors.New("clients must have an ID")
}
if len(client.Secret) == 0 {
return nil, errors.New("clients must have a Secret")
}
redirectURIs := make([]url.URL, len(client.RedirectURLs))
for j, u := range client.RedirectURLs {
uri, err := url.Parse(u)
if err != nil {
return nil, err
}
redirectURIs[j] = *uri
}
clients[i] = Client{
Credentials: oidc.ClientCredentials{
ID: client.ID,
Secret: client.Secret,
},
Metadata: oidc.ClientMetadata{
RedirectURIs: redirectURIs,
},
}
}
return clients, nil
}

149
client/client_test.go Normal file
View file

@ -0,0 +1,149 @@
package client
import (
"encoding/base64"
"net/url"
"strings"
"testing"
"github.com/coreos/go-oidc/oidc"
"github.com/kylelemons/godebug/pretty"
)
var (
goodSecret1 = base64.URLEncoding.EncodeToString([]byte("my_secret"))
goodSecret2 = base64.URLEncoding.EncodeToString([]byte("my_other_secret"))
goodClient1 = `{
"id": "my_id",
"secret": "` + goodSecret1 + `",
"redirectURLs": ["https://client.example.com"]
}`
goodClient2 = `{
"id": "my_other_id",
"secret": "` + goodSecret2 + `",
"redirectURLs": ["https://client2.example.com","https://client2_a.example.com"]
}`
badURLClient = `{
"id": "my_id",
"secret": "` + goodSecret1 + `",
"redirectURLs": ["hdtp:/\(bad)(u)(r)(l)"]
}`
badSecretClient = `{
"id": "my_id",
"secret": "` + "****" + `",
"redirectURLs": ["https://client.example.com"]
}`
noSecretClient = `{
"id": "my_id",
"redirectURLs": ["https://client.example.com"]
}`
noIDClient = `{
"secret": "` + goodSecret1 + `",
"redirectURLs": ["https://client.example.com"]
}`
)
func TestClientsFromReader(t *testing.T) {
tests := []struct {
json string
want []Client
wantErr bool
}{
{
json: "[]",
want: []Client{},
},
{
json: "[" + goodClient1 + "]",
want: []Client{
{
Credentials: oidc.ClientCredentials{
ID: "my_id",
Secret: "my_secret",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
mustParseURL(t, "https://client.example.com"),
},
},
},
},
},
{
json: "[" + strings.Join([]string{goodClient1, goodClient2}, ",") + "]",
want: []Client{
{
Credentials: oidc.ClientCredentials{
ID: "my_id",
Secret: "my_secret",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
mustParseURL(t, "https://client.example.com"),
},
},
},
{
Credentials: oidc.ClientCredentials{
ID: "my_other_id",
Secret: "my_other_secret",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
mustParseURL(t, "https://client2.example.com"),
mustParseURL(t, "https://client2_a.example.com"),
},
},
},
},
}, {
json: "[" + badURLClient + "]",
wantErr: true,
},
{
json: "[" + badSecretClient + "]",
wantErr: true,
},
{
json: "[" + noSecretClient + "]",
wantErr: true,
},
{
json: "[" + noIDClient + "]",
wantErr: true,
},
}
for i, tt := range tests {
r := strings.NewReader(tt.json)
cs, err := ClientsFromReader(r)
if tt.wantErr {
if err == nil {
t.Errorf("case %d: want non-nil err", i)
t.Logf(pretty.Sprint(cs))
}
continue
}
if err != nil {
t.Errorf("case %d: got unexpected error parsing clients: %v", i, err)
t.Logf(tt.json)
}
if diff := pretty.Compare(tt.want, cs); diff != "" {
t.Errorf("case %d: Compare(want, got): %v", i, diff)
}
}
}
func mustParseURL(t *testing.T, s string) url.URL {
u, err := url.Parse(s)
if err != nil {
t.Fatalf("Cannot parse %v as url: %v", s, err)
}
return *u
}

3
cmd/dex-overlord/main.go
View file

@ -116,10 +116,11 @@ func main() {
userRepo := db.NewUserRepo(dbc)
pwiRepo := db.NewPasswordInfoRepo(dbc)
connCfgRepo := db.NewConnectorConfigRepo(dbc)
clientRepo := db.NewClientRepo(dbc)
userManager := manager.NewUserManager(userRepo,
pwiRepo, connCfgRepo, db.TransactionFactory(dbc), manager.ManagerOptions{})
adminAPI := admin.NewAdminAPI(dbc, userManager, *localConnectorID)
adminAPI := admin.NewAdminAPI(userRepo, pwiRepo, clientRepo, userManager, *localConnectorID)
kRepo, err := db.NewPrivateKeySetRepo(dbc, *useOldFormat, keySecrets.BytesSlice()...)
if err != nil {
log.Fatalf(err.Error())

11
cmd/dexctl/driver_db.go
View file

@ -14,7 +14,7 @@ func newDBDriver(dsn string) (driver, error) {
}
drv := &dbDriver{
ciRepo: db.NewClientIdentityRepo(dbc),
ciRepo: db.NewClientRepo(dbc),
cfgRepo: db.NewConnectorConfigRepo(dbc),
}
@ -22,7 +22,7 @@ func newDBDriver(dsn string) (driver, error) {
}
type dbDriver struct {
ciRepo client.ClientIdentityRepo
ciRepo client.ClientRepo
cfgRepo *db.ConnectorConfigRepo
}
@ -36,7 +36,12 @@ func (d *dbDriver) NewClient(meta oidc.ClientMetadata) (*oidc.ClientCredentials,
return nil, err
}
return d.ciRepo.New(clientID, meta, false)
return d.ciRepo.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: clientID,
},
Metadata: meta,
})
}
func (d *dbDriver) ConnectorConfigs() ([]connector.ConnectorConfig, error) {

151
db/client.go
View file

@ -18,7 +18,7 @@ import (
)
const (
clientIdentityTableName = "client_identity"
clientTableName = "client_identity"
bcryptHashCost = 10
@ -34,46 +34,53 @@ const (
func init() {
register(table{
name: clientIdentityTableName,
model: clientIdentityModel{},
name: clientTableName,
model: clientModel{},
autoinc: false,
pkey: []string{"id"},
})
}
func newClientIdentityModel(id string, secret []byte, meta *oidc.ClientMetadata) (*clientIdentityModel, error) {
hashed, err := bcrypt.GenerateFromPassword(secret, bcryptHashCost)
func newClientModel(cli client.Client) (*clientModel, error) {
secretBytes, err := base64.URLEncoding.DecodeString(cli.Credentials.Secret)
if err != nil {
return nil, err
}
hashed, err := bcrypt.GenerateFromPassword([]byte(
secretBytes),
bcryptHashCost)
if err != nil {
return nil, err
}
bmeta, err := json.Marshal(meta)
bmeta, err := json.Marshal(&cli.Metadata)
if err != nil {
return nil, err
}
cim := clientIdentityModel{
ID: id,
cim := clientModel{
ID: cli.Credentials.ID,
Secret: hashed,
Metadata: string(bmeta),
DexAdmin: cli.Admin,
}
return &cim, nil
}
type clientIdentityModel struct {
type clientModel struct {
ID string `db:"id"`
Secret []byte `db:"secret"`
Metadata string `db:"metadata"`
DexAdmin bool `db:"dex_admin"`
}
func (m *clientIdentityModel) ClientIdentity() (*oidc.ClientIdentity, error) {
ci := oidc.ClientIdentity{
func (m *clientModel) Client() (*client.Client, error) {
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: m.ID,
Secret: string(m.Secret),
ID: m.ID,
},
Admin: m.DexAdmin,
}
if err := json.Unmarshal([]byte(m.Metadata), &ci.Metadata); err != nil {
@ -83,16 +90,26 @@ func (m *clientIdentityModel) ClientIdentity() (*oidc.ClientIdentity, error) {
return &ci, nil
}
func NewClientIdentityRepo(dbm *gorp.DbMap) client.ClientIdentityRepo {
return newClientIdentityRepo(dbm)
func NewClientRepo(dbm *gorp.DbMap) client.ClientRepo {
return newClientRepo(dbm)
}
func newClientIdentityRepo(dbm *gorp.DbMap) *clientIdentityRepo {
return &clientIdentityRepo{db: &db{dbm}}
func NewClientRepoWithSecretGenerator(dbm *gorp.DbMap, secGen SecretGenerator) client.ClientRepo {
rep := newClientRepo(dbm)
rep.secretGenerator = secGen
return rep
}
func NewClientIdentityRepoFromClients(dbm *gorp.DbMap, clients []oidc.ClientIdentity) (client.ClientIdentityRepo, error) {
repo := newClientIdentityRepo(dbm)
func newClientRepo(dbm *gorp.DbMap) *clientRepo {
return &clientRepo{
db: &db{dbm},
secretGenerator: DefaultSecretGenerator,
}
}
func NewClientRepoFromClients(dbm *gorp.DbMap, clients []client.Client) (client.ClientRepo, error) {
repo := newClientRepo(dbm)
tx, err := repo.begin()
if err != nil {
return nil, err
@ -103,12 +120,7 @@ func NewClientIdentityRepoFromClients(dbm *gorp.DbMap, clients []oidc.ClientIden
if c.Credentials.Secret == "" {
return nil, fmt.Errorf("client %q has no secret", c.Credentials.ID)
}
dec, err := base64.URLEncoding.DecodeString(c.Credentials.Secret)
if err != nil {
return nil, fmt.Errorf("client secrets must be base64 decodable. See issue #337. Please consider replacing %q with %q",
c.Credentials.Secret, base64.URLEncoding.EncodeToString([]byte(c.Credentials.Secret)))
}
cm, err := newClientIdentityModel(c.Credentials.ID, dec, &c.Metadata)
cm, err := newClientModel(c)
if err != nil {
return nil, err
}
@ -123,49 +135,59 @@ func NewClientIdentityRepoFromClients(dbm *gorp.DbMap, clients []oidc.ClientIden
return repo, nil
}
type clientIdentityRepo struct {
type clientRepo struct {
*db
secretGenerator SecretGenerator
}
func (r *clientIdentityRepo) Metadata(clientID string) (*oidc.ClientMetadata, error) {
m, err := r.executor(nil).Get(clientIdentityModel{}, clientID)
func (r *clientRepo) Get(clientID string) (client.Client, error) {
m, err := r.executor(nil).Get(clientModel{}, clientID)
if err == sql.ErrNoRows || m == nil {
return nil, client.ErrorNotFound
return client.Client{}, client.ErrorNotFound
}
if err != nil {
return nil, err
return client.Client{}, err
}
cim, ok := m.(*clientIdentityModel)
cim, ok := m.(*clientModel)
if !ok {
log.Errorf("expected clientIdentityModel but found %v", reflect.TypeOf(m))
return nil, errors.New("unrecognized model")
log.Errorf("expected clientModel but found %v", reflect.TypeOf(m))
return client.Client{}, errors.New("unrecognized model")
}
ci, err := cim.ClientIdentity()
ci, err := cim.Client()
if err != nil {
return nil, err
return client.Client{}, err
}
return &ci.Metadata, nil
return *ci, nil
}
func (r *clientIdentityRepo) IsDexAdmin(clientID string) (bool, error) {
m, err := r.executor(nil).Get(clientIdentityModel{}, clientID)
func (r *clientRepo) Metadata(clientID string) (*oidc.ClientMetadata, error) {
c, err := r.Get(clientID)
if err != nil {
return nil, err
}
return &c.Metadata, nil
}
func (r *clientRepo) IsDexAdmin(clientID string) (bool, error) {
m, err := r.executor(nil).Get(clientModel{}, clientID)
if m == nil || err != nil {
return false, err
}
cim, ok := m.(*clientIdentityModel)
cim, ok := m.(*clientModel)
if !ok {
log.Errorf("expected clientIdentityModel but found %v", reflect.TypeOf(m))
log.Errorf("expected clientModel but found %v", reflect.TypeOf(m))
return false, errors.New("unrecognized model")
}
return cim.DexAdmin, nil
}
func (r *clientIdentityRepo) SetDexAdmin(clientID string, isAdmin bool) error {
func (r *clientRepo) SetDexAdmin(clientID string, isAdmin bool) error {
tx, err := r.begin()
if err != nil {
return err
@ -173,14 +195,14 @@ func (r *clientIdentityRepo) SetDexAdmin(clientID string, isAdmin bool) error {
defer tx.Rollback()
exec := r.executor(tx)
m, err := exec.Get(clientIdentityModel{}, clientID)
m, err := exec.Get(clientModel{}, clientID)
if m == nil || err != nil {
return err
}
cim, ok := m.(*clientIdentityModel)
cim, ok := m.(*clientModel)
if !ok {
log.Errorf("expected clientIdentityModel but found %v", reflect.TypeOf(m))
log.Errorf("expected clientModel but found %v", reflect.TypeOf(m))
return errors.New("unrecognized model")
}
@ -193,15 +215,15 @@ func (r *clientIdentityRepo) SetDexAdmin(clientID string, isAdmin bool) error {
return tx.Commit()
}
func (r *clientIdentityRepo) Authenticate(creds oidc.ClientCredentials) (bool, error) {
m, err := r.executor(nil).Get(clientIdentityModel{}, creds.ID)
func (r *clientRepo) Authenticate(creds oidc.ClientCredentials) (bool, error) {
m, err := r.executor(nil).Get(clientModel{}, creds.ID)
if m == nil || err != nil {
return false, err
}
cim, ok := m.(*clientIdentityModel)
cim, ok := m.(*clientModel)
if !ok {
log.Errorf("expected clientIdentityModel but found %v", reflect.TypeOf(m))
log.Errorf("expected clientModel but found %v", reflect.TypeOf(m))
return false, errors.New("unrecognized model")
}
@ -238,17 +260,24 @@ func isAlreadyExistsErr(err error) bool {
return false
}
func (r *clientIdentityRepo) New(id string, meta oidc.ClientMetadata, admin bool) (*oidc.ClientCredentials, error) {
secret, err := pcrypto.RandBytes(maxSecretLength)
type SecretGenerator func() ([]byte, error)
func DefaultSecretGenerator() ([]byte, error) {
return pcrypto.RandBytes(maxSecretLength)
}
func (r *clientRepo) New(cli client.Client) (*oidc.ClientCredentials, error) {
secret, err := r.secretGenerator()
if err != nil {
return nil, err
}
cim, err := newClientIdentityModel(id, secret, &meta)
cli.Credentials.Secret = base64.URLEncoding.EncodeToString(secret)
cim, err := newClientModel(cli)
if err != nil {
return nil, err
}
cim.DexAdmin = admin
if err := r.executor(nil).Insert(cim); err != nil {
if isAlreadyExistsErr(err) {
@ -258,29 +287,29 @@ func (r *clientIdentityRepo) New(id string, meta oidc.ClientMetadata, admin bool
}
cc := oidc.ClientCredentials{
ID: id,
Secret: base64.URLEncoding.EncodeToString(secret),
ID: cli.Credentials.ID,
Secret: cli.Credentials.Secret,
}
return &cc, nil
}
func (r *clientIdentityRepo) All() ([]oidc.ClientIdentity, error) {
qt := r.quote(clientIdentityTableName)
func (r *clientRepo) All() ([]client.Client, error) {
qt := r.quote(clientTableName)
q := fmt.Sprintf("SELECT * FROM %s", qt)
objs, err := r.executor(nil).Select(&clientIdentityModel{}, q)
objs, err := r.executor(nil).Select(&clientModel{}, q)
if err != nil {
return nil, err
}
cs := make([]oidc.ClientIdentity, len(objs))
cs := make([]client.Client, len(objs))
for i, obj := range objs {
m, ok := obj.(*clientIdentityModel)
m, ok := obj.(*clientModel)
if !ok {
return nil, errors.New("unable to cast client identity to clientIdentityModel")
return nil, errors.New("unable to cast client identity to clientModel")
}
ci, err := m.ClientIdentity()
ci, err := m.Client()
if err != nil {
return nil, err
}

6
db/migrate_test.go
View file

@ -88,7 +88,7 @@ func TestMigrateClientMetadata(t *testing.T) {
}
for i, tt := range tests {
model := &clientIdentityModel{
model := &clientModel{
ID: strconv.Itoa(i),
Secret: []byte("verysecret"),
Metadata: tt.before,
@ -108,12 +108,12 @@ func TestMigrateClientMetadata(t *testing.T) {
for i, tt := range tests {
id := strconv.Itoa(i)
m, err := dbMap.Get(clientIdentityModel{}, id)
m, err := dbMap.Get(clientModel{}, id)
if err != nil {
t.Errorf("case %d: failed to get model: %v", i, err)
continue
}
cim, ok := m.(*clientIdentityModel)
cim, ok := m.(*clientModel)
if !ok {
t.Errorf("case %d: unrecognized model type: %T", i, m)
continue

12
db/refresh.go
View file

@ -11,10 +11,10 @@ import (
"github.com/go-gorp/gorp"
"golang.org/x/crypto/bcrypt"
"github.com/coreos/dex/client"
"github.com/coreos/dex/pkg/log"
"github.com/coreos/dex/refresh"
"github.com/coreos/dex/repo"
"github.com/coreos/go-oidc/oidc"
)
const (
@ -186,19 +186,19 @@ func (r *refreshTokenRepo) RevokeTokensForClient(userID, clientID string) error
return err
}
func (r *refreshTokenRepo) ClientsWithRefreshTokens(userID string) ([]oidc.ClientIdentity, error) {
func (r *refreshTokenRepo) ClientsWithRefreshTokens(userID string) ([]client.Client, error) {
q := `SELECT c.* FROM %s as c
INNER JOIN %s as r ON c.id = r.client_id WHERE r.user_id = $1;`
q = fmt.Sprintf(q, r.quote(clientIdentityTableName), r.quote(refreshTokenTableName))
q = fmt.Sprintf(q, r.quote(clientTableName), r.quote(refreshTokenTableName))
var clients []clientIdentityModel
var clients []clientModel
if _, err := r.executor(nil).Select(&clients, q, userID); err != nil {
return nil, err
}
c := make([]oidc.ClientIdentity, len(clients))
c := make([]client.Client, len(clients))
for i, client := range clients {
ident, err := client.ClientIdentity()
ident, err := client.Client()
if err != nil {
return nil, err
}

98
functional/db_test.go
View file

@ -181,8 +181,8 @@ func TestDBPrivateKeySetRepoSetGet(t *testing.T) {
}
}
func TestDBClientIdentityRepoMetadata(t *testing.T) {
r := db.NewClientIdentityRepo(connect(t))
func TestDBClientRepoMetadata(t *testing.T) {
r := db.NewClientRepo(connect(t))
cm := oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -191,7 +191,12 @@ func TestDBClientIdentityRepoMetadata(t *testing.T) {
},
}
_, err := r.New("foo", cm, false)
_, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "foo",
},
Metadata: cm,
})
if err != nil {
t.Fatalf(err.Error())
}
@ -206,8 +211,8 @@ func TestDBClientIdentityRepoMetadata(t *testing.T) {
}
}
func TestDBClientIdentityRepoMetadataNoExist(t *testing.T) {
r := db.NewClientIdentityRepo(connect(t))
func TestDBClientRepoMetadataNoExist(t *testing.T) {
r := db.NewClientRepo(connect(t))
got, err := r.Metadata("noexist")
if err != client.ErrorNotFound {
@ -218,8 +223,8 @@ func TestDBClientIdentityRepoMetadataNoExist(t *testing.T) {
}
}
func TestDBClientIdentityRepoNewDuplicate(t *testing.T) {
r := db.NewClientIdentityRepo(connect(t))
func TestDBClientRepoNewDuplicate(t *testing.T) {
r := db.NewClientRepo(connect(t))
meta1 := oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -227,7 +232,12 @@ func TestDBClientIdentityRepoNewDuplicate(t *testing.T) {
},
}
if _, err := r.New("foo", meta1, false); err != nil {
if _, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "foo",
},
Metadata: meta1,
}); err != nil {
t.Fatalf("unexpected error: %v", err)
}
@ -237,13 +247,54 @@ func TestDBClientIdentityRepoNewDuplicate(t *testing.T) {
},
}
if _, err := r.New("foo", meta2, false); err == nil {
if _, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "foo",
},
Metadata: meta2,
}); err == nil {
t.Fatalf("expected non-nil error")
}
}
func TestDBClientIdentityRepoAuthenticate(t *testing.T) {
r := db.NewClientIdentityRepo(connect(t))
func TestDBClientRepoNewAdmin(t *testing.T) {
for _, admin := range []bool{true, false} {
r := db.NewClientRepo(connect(t))
if _, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "foo",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
url.URL{Scheme: "http", Host: "foo.example.com"},
},
},
Admin: admin,
}); err != nil {
t.Fatalf("expected non-nil error: %v", err)
}
gotAdmin, err := r.IsDexAdmin("foo")
if err != nil {
t.Fatalf("expected non-nil error")
}
if gotAdmin != admin {
t.Errorf("want=%v, gotAdmin=%v", admin, gotAdmin)
}
cli, err := r.Get("foo")
if err != nil {
t.Fatalf("expected non-nil error")
}
if cli.Admin != admin {
t.Errorf("want=%v, cli.Admin=%v", admin, cli.Admin)
}
}
}
func TestDBClientRepoAuthenticate(t *testing.T) {
r := db.NewClientRepo(connect(t))
cm := oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -251,7 +302,12 @@ func TestDBClientIdentityRepoAuthenticate(t *testing.T) {
},
}
cc, err := r.New("baz", cm, false)
cc, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "baz",
},
Metadata: cm,
})
if err != nil {
t.Fatalf(err.Error())
}
@ -290,8 +346,8 @@ func TestDBClientIdentityRepoAuthenticate(t *testing.T) {
}
}
func TestDBClientIdentityAll(t *testing.T) {
r := db.NewClientIdentityRepo(connect(t))
func TestDBClientAll(t *testing.T) {
r := db.NewClientRepo(connect(t))
cm := oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -299,7 +355,12 @@ func TestDBClientIdentityAll(t *testing.T) {
},
}
_, err := r.New("foo", cm, false)
_, err := r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "foo",
},
Metadata: cm,
})
if err != nil {
t.Fatalf(err.Error())
}
@ -322,7 +383,12 @@ func TestDBClientIdentityAll(t *testing.T) {
url.URL{Scheme: "http", Host: "foo.com", Path: "/cb"},
},
}
_, err = r.New("bar", cm, false)
_, err = r.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: "bar",
},
Metadata: cm,
})
if err != nil {
t.Fatalf(err.Error())
}

12
functional/repo/client_repo_test.go
View file

@ -14,8 +14,8 @@ import (
)
var (
testClients = []oidc.ClientIdentity{
oidc.ClientIdentity{
testClients = []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "client1",
Secret: base64.URLEncoding.EncodeToString([]byte("secret-1")),
@ -30,7 +30,7 @@ var (
},
},
},
oidc.ClientIdentity{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "client2",
Secret: base64.URLEncoding.EncodeToString([]byte("secret-2")),
@ -48,7 +48,7 @@ var (
}
)
func newClientIdentityRepo(t *testing.T) client.ClientIdentityRepo {
func newClientRepo(t *testing.T) client.ClientRepo {
dsn := os.Getenv("DEX_TEST_DSN")
var dbMap *gorp.DbMap
if dsn == "" {
@ -56,7 +56,7 @@ func newClientIdentityRepo(t *testing.T) client.ClientIdentityRepo {
} else {
dbMap = connect(t)
}
repo, err := db.NewClientIdentityRepoFromClients(dbMap, testClients)
repo, err := db.NewClientRepoFromClients(dbMap, testClients)
if err != nil {
t.Fatalf("failed to create client repo from clients: %v", err)
}
@ -101,7 +101,7 @@ func TestGetSetAdminClient(t *testing.T) {
Tests:
for i, tt := range tests {
repo := newClientIdentityRepo(t)
repo := newClientRepo(t)
for _, cid := range startAdmins {
err := repo.SetDexAdmin(cid, true)
if err != nil {

7
functional/repo/refresh_repo_test.go
View file

@ -11,12 +11,13 @@ import (
"github.com/go-gorp/gorp"
"github.com/kylelemons/godebug/pretty"
"github.com/coreos/dex/client"
"github.com/coreos/dex/db"
"github.com/coreos/dex/refresh"
"github.com/coreos/dex/user"
)
func newRefreshRepo(t *testing.T, users []user.UserWithRemoteIdentities, clients []oidc.ClientIdentity) refresh.RefreshTokenRepo {
func newRefreshRepo(t *testing.T, users []user.UserWithRemoteIdentities, clients []client.Client) refresh.RefreshTokenRepo {
var dbMap *gorp.DbMap
if dsn := os.Getenv("DEX_TEST_DSN"); dsn == "" {
dbMap = db.NewMemDB()
@ -26,7 +27,7 @@ func newRefreshRepo(t *testing.T, users []user.UserWithRemoteIdentities, clients
if _, err := db.NewUserRepoFromUsers(dbMap, users); err != nil {
t.Fatalf("Unable to add users: %v", err)
}
if _, err := db.NewClientIdentityRepoFromClients(dbMap, clients); err != nil {
if _, err := db.NewClientRepoFromClients(dbMap, clients); err != nil {
t.Fatalf("Unable to add clients: %v", err)
}
return db.NewRefreshTokenRepo(dbMap)
@ -35,7 +36,7 @@ func newRefreshRepo(t *testing.T, users []user.UserWithRemoteIdentities, clients
func TestRefreshTokenRepo(t *testing.T) {
clientID := "client1"
userID := "user1"
clients := []oidc.ClientIdentity{
clients := []client.Client{
{
Credentials: oidc.ClientCredentials{
ID: clientID,

170
integration/admin_api_test.go
View file

@ -1,20 +1,23 @@
package integration
import (
"errors"
"encoding/base64"
"fmt"
"net/http"
"net/http/httptest"
"net/url"
"testing"
"github.com/coreos/go-oidc/oidc"
"github.com/kylelemons/godebug/pretty"
"google.golang.org/api/googleapi"
"github.com/coreos/dex/admin"
"github.com/coreos/dex/client"
"github.com/coreos/dex/db"
"github.com/coreos/dex/schema/adminschema"
"github.com/coreos/dex/server"
"github.com/coreos/dex/user"
"github.com/coreos/go-oidc/oidc"
)
const (
@ -24,6 +27,7 @@ const (
type adminAPITestFixtures struct {
ur user.UserRepo
pwr user.PasswordInfoRepo
cr client.ClientRepo
adAPI *admin.AdminAPI
adSrv *server.AdminServer
hSrv *httptest.Server
@ -78,9 +82,17 @@ func makeAdminAPITestFixtures() *adminAPITestFixtures {
f := &adminAPITestFixtures{}
dbMap, ur, pwr, um := makeUserObjects(adminUsers, adminPasswords)
var cliCount int
secGen := func() ([]byte, error) {
return []byte(fmt.Sprintf("client_%v", cliCount)), nil
}
cr := db.NewClientRepoWithSecretGenerator(dbMap, secGen)
f.cr = cr
f.ur = ur
f.pwr = pwr
f.adAPI = admin.NewAdminAPI(dbMap, um, "local")
f.adAPI = admin.NewAdminAPI(ur, pwr, cr, um, "local")
f.adSrv = server.NewAdminServer(f.adAPI, nil, adminAPITestSecret)
f.hSrv = httptest.NewServer(f.adSrv.HTTPHandler())
f.hc = &http.Client{
@ -256,47 +268,147 @@ func TestCreateAdmin(t *testing.T) {
}
func TestCreateClient(t *testing.T) {
oldGen := admin.ClientIDGenerator
admin.ClientIDGenerator = func(hostport string) (string, error) {
return fmt.Sprintf("client_%v", hostport), nil
}
defer func() {
admin.ClientIDGenerator = oldGen
}()
mustParseURL := func(s string) *url.URL {
u, err := url.Parse(s)
if err != nil {
t.Fatalf("couldn't parse URL: %v", err)
}
return u
}
addIDAndSecret := func(cli adminschema.Client) *adminschema.Client {
cli.Id = "client_auth.example.com"
cli.Secret = base64.URLEncoding.EncodeToString([]byte("client_0"))
return &cli
}
adminClientGood := adminschema.Client{
RedirectURIs: []string{"https://auth.example.com/"},
}
clientGood := client.Client{
Credentials: oidc.ClientCredentials{
ID: "client_auth.example.com",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{*mustParseURL("https://auth.example.com/")},
},
}
adminAdminClient := adminClientGood
adminAdminClient.IsAdmin = true
clientGoodAdmin := clientGood
clientGoodAdmin.Admin = true
adminMultiRedirect := adminClientGood
adminMultiRedirect.RedirectURIs = []string{"https://auth.example.com/", "https://auth2.example.com/"}
clientMultiRedirect := clientGoodAdmin
clientMultiRedirect.Metadata.RedirectURIs = append(
clientMultiRedirect.Metadata.RedirectURIs,
*mustParseURL("https://auth2.example.com/"))
tests := []struct {
client oidc.ClientMetadata
wantError bool
req adminschema.ClientCreateRequest
want adminschema.ClientCreateResponse
wantClient client.Client
wantError int
}{
{
client: oidc.ClientMetadata{},
wantError: true,
req: adminschema.ClientCreateRequest{},
wantError: http.StatusBadRequest,
},
{
client: oidc.ClientMetadata{
RedirectURIs: []url.URL{
{Scheme: "https", Host: "auth.example.com", Path: "/"},
req: adminschema.ClientCreateRequest{
Client: &adminschema.Client{
IsAdmin: true,
},
},
wantError: http.StatusBadRequest,
},
{
req: adminschema.ClientCreateRequest{
Client: &adminschema.Client{
RedirectURIs: []string{"909090"},
},
},
wantError: http.StatusBadRequest,
},
{
req: adminschema.ClientCreateRequest{
Client: &adminClientGood,
},
want: adminschema.ClientCreateResponse{
Client: addIDAndSecret(adminClientGood),
},
wantClient: clientGood,
},
{
req: adminschema.ClientCreateRequest{
Client: &adminAdminClient,
},
want: adminschema.ClientCreateResponse{
Client: addIDAndSecret(adminAdminClient),
},
wantClient: clientGoodAdmin,
},
{
req: adminschema.ClientCreateRequest{
Client: &adminMultiRedirect,
},
want: adminschema.ClientCreateResponse{
Client: addIDAndSecret(adminMultiRedirect),
},
wantClient: clientMultiRedirect,
},
}
for i, tt := range tests {
err := func() error {
f := makeAdminAPITestFixtures()
req := &adminschema.ClientCreateRequestClient{}
for _, redirectURI := range tt.client.RedirectURIs {
req.Redirect_uris = append(req.Redirect_uris, redirectURI.String())
if i != 3 {
continue
}
f := makeAdminAPITestFixtures()
resp, err := f.adClient.Client.Create(&tt.req).Do()
if tt.wantError != 0 {
if err == nil {
t.Errorf("case %d: want non-nil error.", i)
continue
}
resp, err := f.adClient.Client.Create(&adminschema.ClientCreateRequest{Client: req}).Do()
if err != nil {
if tt.wantError {
return nil
}
return err
aErr, ok := err.(*googleapi.Error)
if !ok {
t.Errorf("case %d: could not assert as adminSchema.Error: %v", i, err)
continue
}
if resp.Client_id == "" {
return errors.New("no client id returned")
if aErr.Code != tt.wantError {
t.Errorf("case %d: want aErr.Code=%v, got %v", i, tt.wantError, aErr.Code)
continue
}
if resp.Client_secret == "" {
return errors.New("no client secret returned")
}
return nil
}()
continue
}
if err != nil {
t.Errorf("case %d: %v", i, err)
t.Errorf("case %d: unexpected error creating client: %v", i, err)
continue
}
if diff := pretty.Compare(tt.want, resp); diff != "" {
t.Errorf("case %d: Compare(want, got) = %v", i, diff)
}
repoClient, err := f.cr.Get(resp.Client.Id)
if err != nil {
t.Errorf("case %d: Unexpected error getting client: %v", i, err)
}
if diff := pretty.Compare(tt.wantClient, repoClient); diff != "" {
t.Errorf("case %d: Compare(wantClient, repoClient) = %v", i, diff)
}
}
}

7
integration/client_api_test.go
View file

@ -7,12 +7,13 @@ import (
"reflect"
"testing"
"github.com/coreos/dex/client"
schema "github.com/coreos/dex/schema/workerschema"
"github.com/coreos/go-oidc/oidc"
)
func TestClientCreate(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "72de74a9",
Secret: base64.URLEncoding.EncodeToString([]byte("XXX")),
@ -23,7 +24,7 @@ func TestClientCreate(t *testing.T) {
},
},
}
cis := []oidc.ClientIdentity{ci}
cis := []client.Client{ci}
srv, err := mockServer(cis)
if err != nil {
@ -72,7 +73,7 @@ func TestClientCreate(t *testing.T) {
t.Error("Expected non-empty Client Secret")
}
meta, err := srv.ClientIdentityRepo.Metadata(newClient.Id)
meta, err := srv.ClientRepo.Metadata(newClient.Id)
if err != nil {
t.Errorf("Error looking up client metadata: %v", err)
} else if meta == nil {

43
integration/oidc_test.go
View file

@ -9,6 +9,7 @@ import (
"testing"
"time"
"github.com/coreos/dex/client"
"github.com/coreos/dex/connector"
"github.com/coreos/dex/db"
phttp "github.com/coreos/dex/pkg/http"
@ -22,7 +23,7 @@ import (
"github.com/coreos/go-oidc/oidc"
)
func mockServer(cis []oidc.ClientIdentity) (*server.Server, error) {
func mockServer(cis []client.Client) (*server.Server, error) {
dbMap := db.NewMemDB()
k, err := key.GeneratePrivateKey()
if err != nil {
@ -34,23 +35,23 @@ func mockServer(cis []oidc.ClientIdentity) (*server.Server, error) {
if err != nil {
return nil, err
}
clientIdentityRepo, err := db.NewClientIdentityRepoFromClients(dbMap, cis)
clientRepo, err := db.NewClientRepoFromClients(dbMap, cis)
if err != nil {
return nil, err
}
sm := manager.NewSessionManager(db.NewSessionRepo(dbMap), db.NewSessionKeyRepo(dbMap))
srv := &server.Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
ClientIdentityRepo: clientIdentityRepo,
SessionManager: sm,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
ClientRepo: clientRepo,
SessionManager: sm,
}
return srv, nil
}
func mockClient(srv *server.Server, ci oidc.ClientIdentity) (*oidc.Client, error) {
func mockClient(srv *server.Server, ci client.Client) (*oidc.Client, error) {
hdlr := srv.HTTPHandler()
sClient := &phttp.HandlerClient{Handler: hdlr}
@ -75,7 +76,7 @@ func mockClient(srv *server.Server, ci oidc.ClientIdentity) (*oidc.Client, error
return oidc.NewClient(ccfg)
}
func verifyUserClaims(claims jose.Claims, ci *oidc.ClientIdentity, user *user.User, issuerURL url.URL) error {
func verifyUserClaims(claims jose.Claims, ci *client.Client, user *user.User, issuerURL url.URL) error {
expectedSub, expectedName := ci.Credentials.ID, ci.Credentials.ID
if user != nil {
expectedSub, expectedName = user.ID, user.DisplayName
@ -116,7 +117,7 @@ func TestHTTPExchangeTokenRefreshToken(t *testing.T) {
ID: "local",
}
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "72de74a9",
Secret: base64.URLEncoding.EncodeToString([]byte("XXX")),
@ -124,7 +125,7 @@ func TestHTTPExchangeTokenRefreshToken(t *testing.T) {
}
dbMap := db.NewMemDB()
cir, err := db.NewClientIdentityRepoFromClients(dbMap, []oidc.ClientIdentity{ci})
cir, err := db.NewClientRepoFromClients(dbMap, []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: " + err.Error())
}
@ -160,15 +161,15 @@ func TestHTTPExchangeTokenRefreshToken(t *testing.T) {
refreshTokenRepo := refreshtest.NewTestRefreshTokenRepo()
srv := &server.Server{
IssuerURL: issuerURL,
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: cir,
Templates: template.New(connector.LoginPageTemplateName),
Connectors: []connector.Connector{},
UserRepo: userRepo,
PasswordInfoRepo: passwordInfoRepo,
RefreshTokenRepo: refreshTokenRepo,
IssuerURL: issuerURL,
KeyManager: km,
SessionManager: sm,
ClientRepo: cir,
Templates: template.New(connector.LoginPageTemplateName),
Connectors: []connector.Connector{},
UserRepo: userRepo,
PasswordInfoRepo: passwordInfoRepo,
RefreshTokenRepo: refreshTokenRepo,
}
if err = srv.AddConnector(cfg); err != nil {
@ -262,13 +263,13 @@ func TestHTTPExchangeTokenRefreshToken(t *testing.T) {
}
func TestHTTPClientCredsToken(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "72de74a9",
Secret: base64.URLEncoding.EncodeToString([]byte("XXX")),
},
}
cis := []oidc.ClientIdentity{ci}
cis := []client.Client{ci}
srv, err := mockServer(cis)
if err != nil {

8
integration/user_api_test.go
View file

@ -101,9 +101,9 @@ func makeUserAPITestFixtures() *userAPITestFixtures {
f := &userAPITestFixtures{}
dbMap, _, _, um := makeUserObjects(userUsers, userPasswords)
cir := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(dbMap, []oidc.ClientIdentity{
oidc.ClientIdentity{
cir := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(dbMap, []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: testClientID,
Secret: testClientSecret,
@ -114,7 +114,7 @@ func makeUserAPITestFixtures() *userAPITestFixtures {
},
},
},
oidc.ClientIdentity{
client.Client{
Credentials: oidc.ClientCredentials{
ID: userBadClientID,
Secret: base64.URLEncoding.EncodeToString([]byte("secret")),

4
refresh/repo.go
View file

@ -4,7 +4,7 @@ import (
"crypto/rand"
"errors"
"github.com/coreos/go-oidc/oidc"
"github.com/coreos/dex/client"
)
const (
@ -54,5 +54,5 @@ type RefreshTokenRepo interface {
RevokeTokensForClient(userID, clientID string) error
// ClientsWithRefreshTokens returns a list of all clients the user has an outstanding client with.
ClientsWithRefreshTokens(userID string) ([]oidc.ClientIdentity, error)
ClientsWithRefreshTokens(userID string) ([]client.Client, error)
}

35
schema/adminschema/README.md
View file

@ -20,32 +20,41 @@ __Version:__ v1
}
```
### Client
```
{
clientName: string // OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
clientURI: string // OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
id: string // The client ID. Ignored in client create requests.,
isAdmin: boolean,
logoURI: string // OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
redirectURIs: [
string
],
secret: string
}
```
### ClientCreateRequest
A request to register a client with dex.
```
{
client: {
client_name: string // OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
client_uri: string // OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
logo_uri: string // OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) .,
redirect_uris: [
string
]
},
isAdmin: boolean
client: Client
}
```
### ClientRegistrationResponse
### ClientCreateResponse
Upon successful registration, an ID and secret is assigned to the client.
```
{
client_id: string,
client_secret: string
client: Client
}
```
@ -137,7 +146,7 @@ Upon successful registration, an ID and secret is assigned to the client.
> |Code|Description|Type|
|:-----|:-----|:-----|
| 200 | | [ClientRegistrationResponse](#clientregistrationresponse) |
| 200 | | [ClientCreateResponse](#clientcreateresponse) |
| default | Unexpected error | |

83
schema/adminschema/mapper.go Normal file
View file

@ -0,0 +1,83 @@
package adminschema
import (
"errors"
"net/url"
"github.com/coreos/dex/client"
"github.com/coreos/go-oidc/oidc"
)
var (
ErrorNoRedirectURI = errors.New("No Redirect URIs")
ErrorInvalidRedirectURI = errors.New("Invalid Redirect URI")
ErrorInvalidLogoURI = errors.New("Invalid Logo URI")
ErrorInvalidClientURI = errors.New("Invalid Client URI")
)
func MapSchemaClientToClient(sc Client) (client.Client, error) {
c := client.Client{
Credentials: oidc.ClientCredentials{
ID: sc.Id,
Secret: sc.Secret,
},
Metadata: oidc.ClientMetadata{
RedirectURIs: make([]url.URL, len(sc.RedirectURIs)),
},
}
for i, ru := range sc.RedirectURIs {
if ru == "" {
return client.Client{}, ErrorNoRedirectURI
}
u, err := url.Parse(ru)
if err != nil {
return client.Client{}, ErrorInvalidRedirectURI
}
c.Metadata.RedirectURIs[i] = *u
}
c.Metadata.ClientName = sc.ClientName
if sc.LogoURI != "" {
logoURI, err := url.Parse(sc.LogoURI)
if err != nil {
return client.Client{}, ErrorInvalidLogoURI
}
c.Metadata.LogoURI = logoURI
}
if sc.ClientURI != "" {
clientURI, err := url.Parse(sc.ClientURI)
if err != nil {
return client.Client{}, ErrorInvalidClientURI
}
c.Metadata.ClientURI = clientURI
}
c.Admin = sc.IsAdmin
return c, nil
}
func MapClientToSchemaClient(c client.Client) Client {
cl := Client{
Id: c.Credentials.ID,
Secret: c.Credentials.Secret,
RedirectURIs: make([]string, len(c.Metadata.RedirectURIs)),
}
for i, u := range c.Metadata.RedirectURIs {
cl.RedirectURIs[i] = u.String()
}
cl.ClientName = c.Metadata.ClientName
if c.Metadata.LogoURI != nil {
cl.LogoURI = c.Metadata.LogoURI.String()
}
if c.Metadata.ClientURI != nil {
cl.ClientURI = c.Metadata.ClientURI.String()
}
cl.IsAdmin = c.Admin
return cl
}

129
schema/adminschema/mapper_test.go Normal file
View file

@ -0,0 +1,129 @@
package adminschema
import (
"net/url"
"testing"
"github.com/coreos/go-oidc/oidc"
"github.com/kylelemons/godebug/pretty"
"github.com/coreos/dex/client"
)
func TestMapSchemaClientToClient(t *testing.T) {
tests := []struct {
sc Client
want client.Client
wantErr bool
}{
{
sc: Client{
Id: "123",
Secret: "sec_123",
RedirectURIs: []string{
"https://client.example.com",
"https://client2.example.com",
},
ClientName: "Bill",
LogoURI: "https://logo.example.com",
ClientURI: "https://clientURI.example.com",
},
want: client.Client{
Credentials: oidc.ClientCredentials{
ID: "123",
Secret: "sec_123",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
*mustParseURL(t, "https://client.example.com"),
*mustParseURL(t, "https://client2.example.com"),
},
ClientName: "Bill",
LogoURI: mustParseURL(t, "https://logo.example.com"),
ClientURI: mustParseURL(t, "https://clientURI.example.com"),
},
},
}, {
sc: Client{
Id: "123",
Secret: "sec_123",
RedirectURIs: []string{
"ht.d://p * * *",
},
},
wantErr: true,
},
}
for i, tt := range tests {
got, err := MapSchemaClientToClient(tt.sc)
if tt.wantErr {
if err == nil {
t.Errorf("case %d: want non-nil error", i)
t.Logf(pretty.Sprint(got))
}
continue
}
if err != nil {
t.Errorf("case %d: unexpected error mapping: %v", i, err)
}
if diff := pretty.Compare(tt.want, got); diff != "" {
t.Errorf("case %d: Compare(want, got): %v", i, diff)
}
}
}
func TestMapClientToClientSchema(t *testing.T) {
tests := []struct {
c client.Client
want Client
}{
{
want: Client{
Id: "123",
Secret: "sec_123",
RedirectURIs: []string{
"https://client.example.com",
"https://client2.example.com",
},
ClientName: "Bill",
LogoURI: "https://logo.example.com",
ClientURI: "https://clientURI.example.com",
},
c: client.Client{
Credentials: oidc.ClientCredentials{
ID: "123",
Secret: "sec_123",
},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
*mustParseURL(t, "https://client.example.com"),
*mustParseURL(t, "https://client2.example.com"),
},
ClientName: "Bill",
LogoURI: mustParseURL(t, "https://logo.example.com"),
ClientURI: mustParseURL(t, "https://clientURI.example.com"),
},
},
},
}
for i, tt := range tests {
got := MapClientToSchemaClient(tt.c)
if diff := pretty.Compare(tt.want, got); diff != "" {
t.Errorf("case %d: Compare(want, got): %v", i, diff)
}
}
}
func mustParseURL(t *testing.T, s string) *url.URL {
u, err := url.Parse(s)
if err != nil {
t.Fatalf("Cannot parse %v as url: %v", s, err)
}
return u
}

47
schema/adminschema/v1-gen.go
View file

@ -97,49 +97,52 @@ type Admin struct {
Password string `json:"password,omitempty"`
}
type ClientCreateRequest struct {
Client *ClientCreateRequestClient `json:"client,omitempty"`
IsAdmin bool `json:"isAdmin,omitempty"`
}
type ClientCreateRequestClient struct {
// Client_name: OPTIONAL. Name of the Client to be presented to the
type Client struct {
// ClientName: OPTIONAL. Name of the Client to be presented to the
// End-User. If desired, representation of this Claim in different
// languages and scripts is represented as described in Section 2.1 (
// Metadata Languages and Scripts ) .
Client_name string `json:"client_name,omitempty"`
ClientName string `json:"clientName,omitempty"`
// Client_uri: OPTIONAL. URL of the home page of the Client. The value
// of this field MUST point to a valid Web page. If present, the server
// ClientURI: OPTIONAL. URL of the home page of the Client. The value of
// this field MUST point to a valid Web page. If present, the server
// SHOULD display this URL to the End-User in a followable fashion. If
// desired, representation of this Claim in different languages and
// scripts is represented as described in Section 2.1 ( Metadata
// Languages and Scripts ) .
Client_uri string `json:"client_uri,omitempty"`
ClientURI string `json:"clientURI,omitempty"`
// Logo_uri: OPTIONAL. URL that references a logo for the Client
// Id: The client ID. Ignored in client create requests.
Id string `json:"id,omitempty"`
IsAdmin bool `json:"isAdmin,omitempty"`
// LogoURI: OPTIONAL. URL that references a logo for the Client
// application. If present, the server SHOULD display this image to the
// End-User during approval. The value of this field MUST point to a
// valid image file. If desired, representation of this Claim in
// different languages and scripts is represented as described in
// Section 2.1 ( Metadata Languages and Scripts ) .
Logo_uri string `json:"logo_uri,omitempty"`
LogoURI string `json:"logoURI,omitempty"`
// Redirect_uris: REQUIRED. Array of Redirection URI values used by the
// RedirectURIs: REQUIRED. Array of Redirection URI values used by the
// Client. One of these registered Redirection URI values MUST exactly
// match the redirect_uri parameter value used in each Authorization
// Request, with the matching performed as described in Section 6.2.1 of
// [RFC3986] ( Berners-Lee, T., Fielding, R., and L. Masinter,
// “Uniform Resource Identifier (URI): Generic Syntax,” January
// 2005. ) (Simple String Comparison).
Redirect_uris []string `json:"redirect_uris,omitempty"`
RedirectURIs []string `json:"redirectURIs,omitempty"`
Secret string `json:"secret,omitempty"`
}
type ClientRegistrationResponse struct {
Client_id string `json:"client_id,omitempty"`
type ClientCreateRequest struct {
Client *Client `json:"client,omitempty"`
}
Client_secret string `json:"client_secret,omitempty"`
type ClientCreateResponse struct {
Client *Client `json:"client,omitempty"`
}
type State struct {
@ -310,7 +313,7 @@ func (c *ClientCreateCall) Fields(s ...googleapi.Field) *ClientCreateCall {
return c
}
func (c *ClientCreateCall) Do() (*ClientRegistrationResponse, error) {
func (c *ClientCreateCall) Do() (*ClientCreateResponse, error) {
var body io.Reader = nil
body, err := googleapi.WithoutDataWrapper.JSONReader(c.clientcreaterequest)
if err != nil {
@ -336,7 +339,7 @@ func (c *ClientCreateCall) Do() (*ClientRegistrationResponse, error) {
if err := googleapi.CheckResponse(res); err != nil {
return nil, err
}
var ret *ClientRegistrationResponse
var ret *ClientCreateResponse
if err := json.NewDecoder(res.Body).Decode(&ret); err != nil {
return nil, err
}
@ -350,7 +353,7 @@ func (c *ClientCreateCall) Do() (*ClientRegistrationResponse, error) {
// "$ref": "ClientCreateRequest"
// },
// "response": {
// "$ref": "ClientRegistrationResponse"
// "$ref": "ClientCreateResponse"
// }
// }

104
schema/adminschema/v1-json.go
View file

@ -1,4 +1,5 @@
package adminschema
//
// This file is automatically generated by schema/generator
//
@ -51,53 +52,66 @@ const DiscoveryJSON = `{
}
}
},
"ClientCreateRequest": {
"id": "ClientCreateRequest",
"type": "object",
"description": "A request to register a client with dex.",
"properties": {
"isAdmin": {
"type": "boolean"
},
"client": {
"type": "object",
"properties": {
"redirect_uris": {
"type": "array",
"items": {
"type": "string"
},
"description": "REQUIRED. Array of Redirection URI values used by the Client. One of these registered Redirection URI values MUST exactly match the redirect_uri parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of [RFC3986] ( Berners-Lee, T., Fielding, R., and L. Masinter, “Uniform Resource Identifier (URI): Generic Syntax,” January 2005. ) (Simple String Comparison)."
},
"client_name": {
"type": "string",
"description": "OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"logo_uri": {
"type": "string",
"description": "OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"client_uri": {
"type": "string",
"description": "OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
}
}
}
"Client": {
"id": "Client",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The client ID. Ignored in client create requests."
},
"secret": {
"type": "string",
"description": "The client secret. Ignored in client create requests."
},
"secret": {
"type": "string",
"format": "byte"
},
"isAdmin": {
"type": "boolean"
},
"redirectURIs": {
"type": "array",
"items": {
"type": "string"
},
"description": "REQUIRED. Array of Redirection URI values used by the Client. One of these registered Redirection URI values MUST exactly match the redirect_uri parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of [RFC3986] ( Berners-Lee, T., Fielding, R., and L. Masinter, “Uniform Resource Identifier (URI): Generic Syntax,” January 2005. ) (Simple String Comparison)."
},
"clientName": {
"type": "string",
"description": "OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"logoURI": {
"type": "string",
"description": "OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"clientURI": {
"type": "string",
"description": "OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
}
}
},
"ClientRegistrationResponse": {
"id": "ClientRegistrationResponse",
"type": "object",
"description": "Upon successful registration, an ID and secret is assigned to the client.",
"properties": {
"client_id": {
"type": "string"
},
"client_secret": {
"type": "string"
}
}
"ClientCreateRequest": {
"id": "ClientCreateRequest",
"type": "object",
"description": "A request to register a client with dex.",
"properties": {
"client": {
"$ref": "Client"
}
}
},
"ClientCreateResponse": {
"id": "ClientCreateResponse",
"type": "object",
"description": "Upon successful registration, an ID and secret is assigned to the client.",
"properties": {
"client":{
"$ref": "Client"
}
}
}
},
"resources": {
"Admin": {
@ -160,7 +174,7 @@ const DiscoveryJSON = `{
"$ref": "ClientCreateRequest"
},
"response": {
"$ref": "ClientRegistrationResponse"
"$ref": "ClientCreateResponse"
}
}
}

99
schema/adminschema/v1.json
View file

@ -45,53 +45,62 @@
}
}
},
"ClientCreateRequest": {
"id": "ClientCreateRequest",
"type": "object",
"description": "A request to register a client with dex.",
"properties": {
"isAdmin": {
"type": "boolean"
},
"client": {
"type": "object",
"properties": {
"redirect_uris": {
"type": "array",
"items": {
"type": "string"
},
"description": "REQUIRED. Array of Redirection URI values used by the Client. One of these registered Redirection URI values MUST exactly match the redirect_uri parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of [RFC3986] ( Berners-Lee, T., Fielding, R., and L. Masinter, “Uniform Resource Identifier (URI): Generic Syntax,” January 2005. ) (Simple String Comparison)."
},
"client_name": {
"type": "string",
"description": "OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"logo_uri": {
"type": "string",
"description": "OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"client_uri": {
"type": "string",
"description": "OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
}
}
}
"Client": {
"id": "Client",
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The client ID. Ignored in client create requests."
},
"secret": {
"type": "string",
"description": "The client secret. Ignored in client create requests."
},
"isAdmin": {
"type": "boolean"
},
"redirectURIs": {
"type": "array",
"items": {
"type": "string"
},
"description": "REQUIRED. Array of Redirection URI values used by the Client. One of these registered Redirection URI values MUST exactly match the redirect_uri parameter value used in each Authorization Request, with the matching performed as described in Section 6.2.1 of [RFC3986] ( Berners-Lee, T., Fielding, R., and L. Masinter, “Uniform Resource Identifier (URI): Generic Syntax,” January 2005. ) (Simple String Comparison)."
},
"clientName": {
"type": "string",
"description": "OPTIONAL. Name of the Client to be presented to the End-User. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"logoURI": {
"type": "string",
"description": "OPTIONAL. URL that references a logo for the Client application. If present, the server SHOULD display this image to the End-User during approval. The value of this field MUST point to a valid image file. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
},
"clientURI": {
"type": "string",
"description": "OPTIONAL. URL of the home page of the Client. The value of this field MUST point to a valid Web page. If present, the server SHOULD display this URL to the End-User in a followable fashion. If desired, representation of this Claim in different languages and scripts is represented as described in Section 2.1 ( Metadata Languages and Scripts ) ."
}
}
},
"ClientRegistrationResponse": {
"id": "ClientRegistrationResponse",
"type": "object",
"description": "Upon successful registration, an ID and secret is assigned to the client.",
"properties": {
"client_id": {
"type": "string"
},
"client_secret": {
"type": "string"
}
}
"ClientCreateRequest": {
"id": "ClientCreateRequest",
"type": "object",
"description": "A request to register a client with dex.",
"properties": {
"client": {
"$ref": "Client"
}
}
},
"ClientCreateResponse": {
"id": "ClientCreateResponse",
"type": "object",
"description": "Upon successful registration, an ID and secret is assigned to the client.",
"properties": {
"client":{
"$ref": "Client"
}
}
}
},
"resources": {
"Admin": {
@ -154,7 +163,7 @@
"$ref": "ClientCreateRequest"
},
"response": {
"$ref": "ClientRegistrationResponse"
"$ref": "ClientCreateResponse"
}
}
}

13
schema/workerschema/mapper.go
View file

@ -4,11 +4,12 @@ import (
"errors"
"net/url"
"github.com/coreos/dex/client"
"github.com/coreos/go-oidc/oidc"
)
func MapSchemaClientToClientIdentity(sc Client) (oidc.ClientIdentity, error) {
ci := oidc.ClientIdentity{
func MapSchemaClientToClient(sc Client) (client.Client, error) {
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: sc.Id,
},
@ -19,12 +20,12 @@ func MapSchemaClientToClientIdentity(sc Client) (oidc.ClientIdentity, error) {
for i, ru := range sc.RedirectURIs {
if ru == "" {
return oidc.ClientIdentity{}, errors.New("redirect URL empty")
return client.Client{}, errors.New("redirect URL empty")
}
u, err := url.Parse(ru)
if err != nil {
return oidc.ClientIdentity{}, errors.New("redirect URL invalid")
return client.Client{}, errors.New("redirect URL invalid")
}
ci.Metadata.RedirectURIs[i] = *u
@ -33,7 +34,7 @@ func MapSchemaClientToClientIdentity(sc Client) (oidc.ClientIdentity, error) {
return ci, nil
}
func MapClientIdentityToSchemaClient(c oidc.ClientIdentity) Client {
func MapClientToSchemaClient(c client.Client) Client {
cl := Client{
Id: c.Credentials.ID,
RedirectURIs: make([]string, len(c.Metadata.RedirectURIs)),
@ -44,7 +45,7 @@ func MapClientIdentityToSchemaClient(c oidc.ClientIdentity) Client {
return cl
}
func MapClientIdentityToSchemaClientWithSecret(c oidc.ClientIdentity) ClientWithSecret {
func MapClientToSchemaClientWithSecret(c client.Client) ClientWithSecret {
cl := ClientWithSecret{
Id: c.Credentials.ID,
Secret: c.Credentials.Secret,

1
schema/workerschema/v1-json.go
View file

@ -1,4 +1,5 @@
package workerschema
//
// This file is automatically generated by schema/generator
//

2
server/admin.go
View file

@ -116,7 +116,7 @@ func (s *AdminServer) getState(w http.ResponseWriter, r *http.Request, ps httpro
}
func (s *AdminServer) createClient(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
var req admin.ClientRegistrationRequest
var req = adminschema.ClientCreateRequest{}
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeInvalidRequest(w, "cannot parse JSON body")
return

4
server/auth_middleware.go
View file

@ -14,7 +14,7 @@ import (
type clientTokenMiddleware struct {
issuerURL string
ciRepo client.ClientIdentityRepo
ciRepo client.ClientRepo
keysFunc func() ([]key.PublicKey, error)
next http.Handler
}
@ -31,7 +31,7 @@ func (c *clientTokenMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request
}
if c.ciRepo == nil {
log.Errorf("Misconfigured clientTokenMiddleware, ClientIdentityRepo is not set")
log.Errorf("Misconfigured clientTokenMiddleware, ClientRepo is not set")
respondError()
return
}

8
server/auth_middleware_test.go
View file

@ -26,7 +26,7 @@ func TestClientToken(t *testing.T) {
now := time.Now()
tomorrow := now.Add(24 * time.Hour)
validClientID := "valid-client"
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: validClientID,
Secret: base64.URLEncoding.EncodeToString([]byte("secret")),
@ -37,7 +37,7 @@ func TestClientToken(t *testing.T) {
},
},
}
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{ci})
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: %v", err)
}
@ -65,7 +65,7 @@ func TestClientToken(t *testing.T) {
tests := []struct {
keys []key.PublicKey
repo client.ClientIdentityRepo
repo client.ClientRepo
header string
wantCode int
}{
@ -114,7 +114,7 @@ func TestClientToken(t *testing.T) {
// empty repo
{
keys: []key.PublicKey{pubKey},
repo: db.NewClientIdentityRepo(db.NewMemDB()),
repo: db.NewClientRepo(db.NewMemDB()),
header: fmt.Sprintf("BEARER %s", validJWT),
wantCode: http.StatusUnauthorized,
},

9
server/client_registration.go
View file

@ -4,7 +4,9 @@ import (
"encoding/json"
"net/http"
"github.com/coreos/dex/client"
"github.com/coreos/dex/pkg/log"
"github.com/coreos/go-oidc/oauth2"
"github.com/coreos/go-oidc/oidc"
)
@ -43,7 +45,12 @@ func (s *Server) handleClientRegistrationRequest(r *http.Request) (*oidc.ClientR
return nil, newAPIError(oauth2.ErrorServerError, "unable to save client metadata")
}
creds, err := s.ClientIdentityRepo.New(id, clientMetadata, false)
creds, err := s.ClientRepo.New(client.Client{
Credentials: oidc.ClientCredentials{
ID: id,
},
Metadata: clientMetadata,
})
if err != nil {
log.Errorf("Failed to create new client identity: %v", err)
return nil, newAPIError(oauth2.ErrorServerError, "unable to save client metadata")

2
server/client_registration_test.go
View file

@ -143,7 +143,7 @@ func TestClientRegistration(t *testing.T) {
return fmt.Errorf("no client id in registration response")
}
metadata, err := fixtures.clientIdentityRepo.Metadata(r.ClientID)
metadata, err := fixtures.clientRepo.Metadata(r.ClientID)
if err != nil {
return fmt.Errorf("failed to lookup client id after creation")
}

14
server/client_resource.go
View file

@ -14,10 +14,10 @@ import (
)
type clientResource struct {
repo client.ClientIdentityRepo
repo client.ClientRepo
}
func registerClientResource(prefix string, repo client.ClientIdentityRepo) (string, http.Handler) {
func registerClientResource(prefix string, repo client.ClientRepo) (string, http.Handler) {
mux := http.NewServeMux()
c := &clientResource{
repo: repo,
@ -49,7 +49,7 @@ func (c *clientResource) list(w http.ResponseWriter, r *http.Request) {
scs := make([]*schema.Client, len(cs))
for i, ci := range cs {
sc := schema.MapClientIdentityToSchemaClient(ci)
sc := schema.MapClientToSchemaClient(ci)
scs[i] = &sc
}
@ -76,7 +76,7 @@ func (c *clientResource) create(w http.ResponseWriter, r *http.Request) {
return
}
ci, err := schema.MapSchemaClientToClientIdentity(sc)
ci, err := schema.MapSchemaClientToClient(sc)
if err != nil {
log.Debugf("Invalid request data: %v", err)
writeAPIError(w, http.StatusBadRequest, newAPIError(errorInvalidClientMetadata, "missing or invalid field: redirectURIs"))
@ -96,7 +96,9 @@ func (c *clientResource) create(w http.ResponseWriter, r *http.Request) {
return
}
creds, err := c.repo.New(clientID, ci.Metadata, false)
ci.Credentials.ID = clientID
creds, err := c.repo.New(ci)
if err != nil {
log.Errorf("Failed creating client: %v", err)
writeAPIError(w, http.StatusInternalServerError, newAPIError(errorServerError, "unable to create client"))
@ -104,7 +106,7 @@ func (c *clientResource) create(w http.ResponseWriter, r *http.Request) {
}
ci.Credentials = *creds
ssc := schema.MapClientIdentityToSchemaClientWithSecret(ci)
ssc := schema.MapClientToSchemaClientWithSecret(ci)
w.Header().Add("Location", phttp.NewResourceLocation(r.URL, ci.Credentials.ID))
writeResponseWithBody(w, http.StatusCreated, ssc)
}

19
server/client_resource_test.go
View file

@ -14,6 +14,7 @@ import (
"strings"
"testing"
"github.com/coreos/dex/client"
"github.com/coreos/dex/db"
schema "github.com/coreos/dex/schema/workerschema"
"github.com/coreos/go-oidc/oidc"
@ -27,7 +28,7 @@ func makeBody(s string) io.ReadCloser {
func TestCreateInvalidRequest(t *testing.T) {
u := &url.URL{Scheme: "http", Host: "example.com", Path: "clients"}
h := http.Header{"Content-Type": []string{"application/json"}}
repo := db.NewClientIdentityRepo(db.NewMemDB())
repo := db.NewClientRepo(db.NewMemDB())
res := &clientResource{repo: repo}
tests := []struct {
req *http.Request
@ -118,7 +119,7 @@ func TestCreateInvalidRequest(t *testing.T) {
}
func TestCreate(t *testing.T) {
repo := db.NewClientIdentityRepo(db.NewMemDB())
repo := db.NewClientRepo(db.NewMemDB())
res := &clientResource{repo: repo}
tests := [][]string{
[]string{"http://example.com"},
@ -177,7 +178,7 @@ func TestList(t *testing.T) {
}
tests := []struct {
cs []oidc.ClientIdentity
cs []client.Client
want []*schema.Client
}{
// empty repo
@ -187,8 +188,8 @@ func TestList(t *testing.T) {
},
// single client
{
cs: []oidc.ClientIdentity{
oidc.ClientIdentity{
cs: []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{ID: "foo", Secret: b64Encode("bar")},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -206,8 +207,8 @@ func TestList(t *testing.T) {
},
// multi client
{
cs: []oidc.ClientIdentity{
oidc.ClientIdentity{
cs: []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{ID: "foo", Secret: b64Encode("bar")},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -215,7 +216,7 @@ func TestList(t *testing.T) {
},
},
},
oidc.ClientIdentity{
client.Client{
Credentials: oidc.ClientCredentials{ID: "biz", Secret: b64Encode("bang")},
Metadata: oidc.ClientMetadata{
RedirectURIs: []url.URL{
@ -238,7 +239,7 @@ func TestList(t *testing.T) {
}
for i, tt := range tests {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), tt.cs)
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), tt.cs)
if err != nil {
t.Errorf("case %d: failed to create client identity repo: %v", i, err)
continue

49
server/config.go
View file

@ -13,10 +13,10 @@ import (
"time"
"github.com/coreos/go-oidc/key"
"github.com/coreos/go-oidc/oidc"
"github.com/coreos/pkg/health"
"github.com/go-gorp/gorp"
"github.com/coreos/dex/client"
"github.com/coreos/dex/connector"
"github.com/coreos/dex/db"
"github.com/coreos/dex/email"
@ -114,7 +114,7 @@ func (cfg *SingleServerConfig) Configure(srv *Server) error {
if err != nil {
return fmt.Errorf("unable to read clients from file %s: %v", cfg.ClientsFile, err)
}
ciRepo, err := db.NewClientIdentityRepoFromClients(dbMap, clients)
ciRepo, err := db.NewClientRepoFromClients(dbMap, clients)
if err != nil {
return fmt.Errorf("failed to create client identity repo: %v", err)
}
@ -155,7 +155,7 @@ func (cfg *SingleServerConfig) Configure(srv *Server) error {
txnFactory := db.TransactionFactory(dbMap)
userManager := usermanager.NewUserManager(userRepo, pwiRepo, cfgRepo, txnFactory, usermanager.ManagerOptions{})
srv.ClientIdentityRepo = ciRepo
srv.ClientRepo = ciRepo
srv.KeySetRepo = kRepo
srv.ConnectorConfigRepo = cfgRepo
srv.UserRepo = userRepo
@ -214,47 +214,14 @@ func loadUsersFromReader(r io.Reader) (users []user.UserWithRemoteIdentities, pw
return
}
// loadClients parses the clients.json file and returns the clients to be created.
func loadClients(filepath string) ([]oidc.ClientIdentity, error) {
// loadClients parses the clients.json file and returns a list of clients.
func loadClients(filepath string) ([]client.Client, error) {
f, err := os.Open(filepath)
if err != nil {
return nil, err
}
defer f.Close()
return loadClientsFromReader(f)
}
func loadClientsFromReader(r io.Reader) ([]oidc.ClientIdentity, error) {
var c []struct {
ID string `json:"id"`
Secret string `json:"secret"`
RedirectURLs []string `json:"redirectURLs"`
}
if err := json.NewDecoder(r).Decode(&c); err != nil {
return nil, err
}
clients := make([]oidc.ClientIdentity, len(c))
for i, client := range c {
redirectURIs := make([]url.URL, len(client.RedirectURLs))
for j, u := range client.RedirectURLs {
uri, err := url.Parse(u)
if err != nil {
return nil, err
}
redirectURIs[j] = *uri
}
clients[i] = oidc.ClientIdentity{
Credentials: oidc.ClientCredentials{
ID: client.ID,
Secret: client.Secret,
},
Metadata: oidc.ClientMetadata{
RedirectURIs: redirectURIs,
},
}
}
return clients, nil
return client.ClientsFromReader(f)
}
func (cfg *MultiServerConfig) Configure(srv *Server) error {
@ -279,7 +246,7 @@ func (cfg *MultiServerConfig) Configure(srv *Server) error {
return fmt.Errorf("unable to create PrivateKeySetRepo: %v", err)
}
ciRepo := db.NewClientIdentityRepo(dbc)
ciRepo := db.NewClientRepo(dbc)
sRepo := db.NewSessionRepo(dbc)
skRepo := db.NewSessionKeyRepo(dbc)
cfgRepo := db.NewConnectorConfigRepo(dbc)
@ -290,7 +257,7 @@ func (cfg *MultiServerConfig) Configure(srv *Server) error {
sm := sessionmanager.NewSessionManager(sRepo, skRepo)
srv.ClientIdentityRepo = ciRepo
srv.ClientRepo = ciRepo
srv.KeySetRepo = kRepo
srv.ConnectorConfigRepo = cfgRepo
srv.UserRepo = userRepo

4
server/email_verification.go
View file

@ -28,7 +28,7 @@ func handleVerifyEmailResendFunc(
srvKeysFunc func() ([]key.PublicKey, error),
emailer *useremail.UserEmailer,
userRepo user.UserRepo,
clientIdentityRepo client.ClientIdentityRepo) http.HandlerFunc {
clientRepo client.ClientRepo) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
decoder := json.NewDecoder(r.Body)
var params struct {
@ -57,7 +57,7 @@ func handleVerifyEmailResendFunc(
return
}
cm, err := clientIdentityRepo.Metadata(clientID)
cm, err := clientRepo.Metadata(clientID)
if err == client.ErrorNotFound {
log.Errorf("No such client: %v", err)
writeAPIError(w, http.StatusBadRequest,

2
server/email_verification_test.go
View file

@ -130,7 +130,7 @@ func TestHandleVerifyEmailResend(t *testing.T) {
keysFunc,
f.srv.UserEmailer,
f.userRepo,
f.clientIdentityRepo)
f.clientRepo)
w := httptest.NewRecorder()
u := "http://example.com"

12
server/http_test.go
View file

@ -78,9 +78,9 @@ func TestHandleAuthFuncResponsesSingleRedirectURL(t *testing.T) {
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
SessionManager: manager.NewSessionManager(db.NewSessionRepo(db.NewMemDB()), db.NewSessionKeyRepo(db.NewMemDB())),
ClientIdentityRepo: func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{
ClientRepo: func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: base64.URLEncoding.EncodeToString([]byte("secrete")),
@ -230,9 +230,9 @@ func TestHandleAuthFuncResponsesMultipleRedirectURLs(t *testing.T) {
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
SessionManager: manager.NewSessionManager(db.NewSessionRepo(db.NewMemDB()), db.NewSessionKeyRepo(db.NewMemDB())),
ClientIdentityRepo: func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{
ClientRepo: func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: base64.URLEncoding.EncodeToString([]byte("secrete")),

2
server/password.go
View file

@ -29,7 +29,7 @@ type SendResetPasswordEmailHandler struct {
tpl *template.Template
emailer *useremail.UserEmailer
sm *sessionmanager.SessionManager
cr client.ClientIdentityRepo
cr client.ClientRepo
}
func (h *SendResetPasswordEmailHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {

2
server/password_test.go
View file

@ -267,7 +267,7 @@ func TestSendResetPasswordEmailHandler(t *testing.T) {
tpl: f.srv.SendResetPasswordEmailTemplate,
emailer: f.srv.UserEmailer,
sm: f.sessionManager,
cr: f.clientIdentityRepo,
cr: f.clientRepo,
}
w := httptest.NewRecorder()

20
server/server.go
View file

@ -60,7 +60,7 @@ type Server struct {
KeyManager key.PrivateKeyManager
KeySetRepo key.PrivateKeySetRepo
SessionManager *sessionmanager.SessionManager
ClientIdentityRepo client.ClientIdentityRepo
ClientRepo client.ClientRepo
ConnectorConfigRepo connector.ConnectorConfigRepo
Templates *template.Template
LoginTemplate *template.Template
@ -213,13 +213,13 @@ func (s *Server) HTTPHandler() http.Handler {
s.KeyManager.PublicKeys,
s.UserEmailer,
s.UserRepo,
s.ClientIdentityRepo)))
s.ClientRepo)))
mux.Handle(httpPathSendResetPassword, &SendResetPasswordEmailHandler{
tpl: s.SendResetPasswordEmailTemplate,
emailer: s.UserEmailer,
sm: s.SessionManager,
cr: s.ClientIdentityRepo,
cr: s.ClientRepo,
})
mux.Handle(httpPathResetPassword, &ResetPasswordHandler{
@ -256,11 +256,11 @@ func (s *Server) HTTPHandler() http.Handler {
apiBasePath := path.Join(httpPathAPI, APIVersion)
registerDiscoveryResource(apiBasePath, mux)
clientPath, clientHandler := registerClientResource(apiBasePath, s.ClientIdentityRepo)
clientPath, clientHandler := registerClientResource(apiBasePath, s.ClientRepo)
mux.Handle(path.Join(apiBasePath, clientPath), s.NewClientTokenAuthHandler(clientHandler))
usersAPI := usersapi.NewUsersAPI(s.dbMap, s.UserManager, s.UserEmailer, s.localConnectorID)
handler := NewUserMgmtServer(usersAPI, s.JWTVerifierFactory(), s.UserManager, s.ClientIdentityRepo).HTTPHandler()
handler := NewUserMgmtServer(usersAPI, s.JWTVerifierFactory(), s.UserManager, s.ClientRepo).HTTPHandler()
mux.Handle(apiBasePath+"/", handler)
@ -271,14 +271,14 @@ func (s *Server) HTTPHandler() http.Handler {
func (s *Server) NewClientTokenAuthHandler(handler http.Handler) http.Handler {
return &clientTokenMiddleware{
issuerURL: s.IssuerURL.String(),
ciRepo: s.ClientIdentityRepo,
ciRepo: s.ClientRepo,
keysFunc: s.KeyManager.PublicKeys,
next: handler,
}
}
func (s *Server) ClientMetadata(clientID string) (*oidc.ClientMetadata, error) {
return s.ClientIdentityRepo.Metadata(clientID)
return s.ClientRepo.Metadata(clientID)
}
func (s *Server) NewSession(ipdcID, clientID, clientState string, redirectURL url.URL, nonce string, register bool, scope []string) (string, error) {
@ -365,7 +365,7 @@ func (s *Server) Login(ident oidc.Identity, key string) (string, error) {
}
func (s *Server) ClientCredsToken(creds oidc.ClientCredentials) (*jose.JWT, error) {
ok, err := s.ClientIdentityRepo.Authenticate(creds)
ok, err := s.ClientRepo.Authenticate(creds)
if err != nil {
log.Errorf("Failed fetching client %s from repo: %v", creds.ID, err)
return nil, oauth2.NewError(oauth2.ErrorServerError)
@ -397,7 +397,7 @@ func (s *Server) ClientCredsToken(creds oidc.ClientCredentials) (*jose.JWT, erro
}
func (s *Server) CodeToken(creds oidc.ClientCredentials, sessionKey string) (*jose.JWT, string, error) {
ok, err := s.ClientIdentityRepo.Authenticate(creds)
ok, err := s.ClientRepo.Authenticate(creds)
if err != nil {
log.Errorf("Failed fetching client %s from repo: %v", creds.ID, err)
return nil, "", oauth2.NewError(oauth2.ErrorServerError)
@ -466,7 +466,7 @@ func (s *Server) CodeToken(creds oidc.ClientCredentials, sessionKey string) (*jo
}
func (s *Server) RefreshToken(creds oidc.ClientCredentials, token string) (*jose.JWT, error) {
ok, err := s.ClientIdentityRepo.Authenticate(creds)
ok, err := s.ClientRepo.Authenticate(creds)
if err != nil {
log.Errorf("Failed fetching client %s from repo: %v", creds.ID, err)
return nil, oauth2.NewError(oauth2.ErrorServerError)

128
server/server_test.go
View file

@ -130,7 +130,7 @@ func TestServerNewSession(t *testing.T) {
state := "pants"
nonce := "oncenay"
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: "secrete",
@ -179,7 +179,7 @@ func TestServerNewSession(t *testing.T) {
}
func TestServerLogin(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: clientTestSecret,
@ -194,8 +194,8 @@ func TestServerLogin(t *testing.T) {
},
},
}
ciRepo := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{ci})
ciRepo := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: %v", err)
}
@ -219,11 +219,11 @@ func TestServerLogin(t *testing.T) {
}
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
UserRepo: userRepo,
}
ident := oidc.Identity{ID: "YYY", Name: "elroy", Email: "elroy@example.com"}
@ -244,9 +244,9 @@ func TestServerLogin(t *testing.T) {
}
func TestServerLoginUnrecognizedSessionKey(t *testing.T) {
ciRepo := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{
ciRepo := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX", Secret: clientTestSecret,
},
@ -263,10 +263,10 @@ func TestServerLoginUnrecognizedSessionKey(t *testing.T) {
}
sm := manager.NewSessionManager(db.NewSessionRepo(db.NewMemDB()), db.NewSessionKeyRepo(db.NewMemDB()))
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
}
ident := oidc.Identity{ID: "YYY", Name: "elroy", Email: "elroy@example.com"}
@ -281,7 +281,7 @@ func TestServerLoginUnrecognizedSessionKey(t *testing.T) {
}
func TestServerLoginDisabledUser(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: clientTestSecret,
@ -296,8 +296,8 @@ func TestServerLoginDisabledUser(t *testing.T) {
},
},
}
ciRepo := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{ci})
ciRepo := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: %v", err)
}
@ -335,11 +335,11 @@ func TestServerLoginDisabledUser(t *testing.T) {
})
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
UserRepo: userRepo,
}
ident := oidc.Identity{ID: "disabled-connector-id", Name: "elroy", Email: "elroy@example.com"}
@ -355,14 +355,14 @@ func TestServerLoginDisabledUser(t *testing.T) {
}
func TestServerCodeToken(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: clientTestSecret,
},
}
ciRepo := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{ci})
ciRepo := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: %v", err)
}
@ -381,12 +381,12 @@ func TestServerCodeToken(t *testing.T) {
refreshTokenRepo := refreshtest.NewTestRefreshTokenRepo()
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
}
tests := []struct {
@ -441,14 +441,14 @@ func TestServerCodeToken(t *testing.T) {
}
func TestServerTokenUnrecognizedKey(t *testing.T) {
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: clientTestSecret,
},
}
ciRepo := func() client.ClientIdentityRepo {
repo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{ci})
ciRepo := func() client.ClientRepo {
repo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{ci})
if err != nil {
t.Fatalf("Failed to create client identity repo: %v", err)
}
@ -460,10 +460,10 @@ func TestServerTokenUnrecognizedKey(t *testing.T) {
sm := manager.NewSessionManager(db.NewSessionRepo(db.NewMemDB()), db.NewSessionKeyRepo(db.NewMemDB()))
srv := &Server{
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
IssuerURL: url.URL{Scheme: "http", Host: "server.example.com"},
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
}
sessionID, err := sm.NewSession("connector_id", ci.Credentials.ID, "bogus", url.URL{}, "", false, []string{"openid", "offline_access"})
@ -569,8 +569,8 @@ func TestServerTokenFail(t *testing.T) {
km := &StaticKeyManager{
signer: tt.signer,
}
ciRepo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{Credentials: ccFixture},
ciRepo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{Credentials: ccFixture},
})
if err != nil {
t.Errorf("case %d: failed to create client identity repo: %v", i, err)
@ -590,12 +590,12 @@ func TestServerTokenFail(t *testing.T) {
refreshTokenRepo := refreshtest.NewTestRefreshTokenRepo()
srv := &Server{
IssuerURL: issuerURL,
KeyManager: km,
SessionManager: sm,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
IssuerURL: issuerURL,
KeyManager: km,
SessionManager: sm,
ClientRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
}
_, err = sm.NewSessionKey(sessionID)
@ -731,9 +731,9 @@ func TestServerRefreshToken(t *testing.T) {
signer: tt.signer,
}
ciRepo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{Credentials: credXXX},
oidc.ClientIdentity{Credentials: credYYY},
ciRepo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{Credentials: credXXX},
client.Client{Credentials: credYYY},
})
if err != nil {
t.Errorf("case %d: failed to create client identity repo: %v", i, err)
@ -748,11 +748,11 @@ func TestServerRefreshToken(t *testing.T) {
refreshTokenRepo := refreshtest.NewTestRefreshTokenRepo()
srv := &Server{
IssuerURL: issuerURL,
KeyManager: km,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
IssuerURL: issuerURL,
KeyManager: km,
ClientRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
}
if _, err := refreshTokenRepo.Create("testid-1", tt.clientID); err != nil {
@ -784,9 +784,9 @@ func TestServerRefreshToken(t *testing.T) {
signer: signerFixture,
}
ciRepo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{Credentials: credXXX},
oidc.ClientIdentity{Credentials: credYYY},
ciRepo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{Credentials: credXXX},
client.Client{Credentials: credYYY},
})
if err != nil {
t.Fatalf("failed to create client identity repo: %v", err)
@ -808,11 +808,11 @@ func TestServerRefreshToken(t *testing.T) {
refreshTokenRepo := refreshtest.NewTestRefreshTokenRepo()
srv := &Server{
IssuerURL: issuerURL,
KeyManager: km,
ClientIdentityRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
IssuerURL: issuerURL,
KeyManager: km,
ClientRepo: ciRepo,
UserRepo: userRepo,
RefreshTokenRepo: refreshTokenRepo,
}
if _, err := refreshTokenRepo.Create("testid-2", credXXX.ID); err != nil {

44
server/testutil.go
View file

@ -73,12 +73,12 @@ var (
)
type testFixtures struct {
srv *Server
userRepo user.UserRepo
sessionManager *sessionmanager.SessionManager
emailer *email.TemplatizedEmailer
redirectURL url.URL
clientIdentityRepo client.ClientIdentityRepo
srv *Server
userRepo user.UserRepo
sessionManager *sessionmanager.SessionManager
emailer *email.TemplatizedEmailer
redirectURL url.URL
clientRepo client.ClientRepo
}
func sequentialGenerateCodeFunc() sessionmanager.GenerateCodeFunc {
@ -136,8 +136,8 @@ func makeTestFixtures() (*testFixtures, error) {
return nil, err
}
clientIdentityRepo, err := db.NewClientIdentityRepoFromClients(db.NewMemDB(), []oidc.ClientIdentity{
oidc.ClientIdentity{
clientRepo, err := db.NewClientRepoFromClients(db.NewMemDB(), []client.Client{
client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: base64.URLEncoding.EncodeToString([]byte("secrete")),
@ -167,14 +167,14 @@ func makeTestFixtures() (*testFixtures, error) {
}
srv := &Server{
IssuerURL: testIssuerURL,
SessionManager: sessionManager,
ClientIdentityRepo: clientIdentityRepo,
Templates: tpl,
UserRepo: userRepo,
PasswordInfoRepo: pwRepo,
UserManager: manager,
KeyManager: km,
IssuerURL: testIssuerURL,
SessionManager: sessionManager,
ClientRepo: clientRepo,
Templates: tpl,
UserRepo: userRepo,
PasswordInfoRepo: pwRepo,
UserManager: manager,
KeyManager: km,
}
err = setTemplates(srv, tpl)
@ -201,11 +201,11 @@ func makeTestFixtures() (*testFixtures, error) {
)
return &testFixtures{
srv: srv,
redirectURL: testRedirectURL,
userRepo: userRepo,
sessionManager: sessionManager,
emailer: emailer,
clientIdentityRepo: clientIdentityRepo,
srv: srv,
redirectURL: testRedirectURL,
userRepo: userRepo,
sessionManager: sessionManager,
emailer: emailer,
clientRepo: clientRepo,
}, nil
}

4
server/user.go
View file

@ -39,10 +39,10 @@ type UserMgmtServer struct {
api *api.UsersAPI
jwtvFactory JWTVerifierFactory
um *manager.UserManager
cir client.ClientIdentityRepo
cir client.ClientRepo
}
func NewUserMgmtServer(userMgmtAPI *api.UsersAPI, jwtvFactory JWTVerifierFactory, um *manager.UserManager, cir client.ClientIdentityRepo) *UserMgmtServer {
func NewUserMgmtServer(userMgmtAPI *api.UsersAPI, jwtvFactory JWTVerifierFactory, um *manager.UserManager, cir client.ClientRepo) *UserMgmtServer {
return &UserMgmtServer{
api: userMgmtAPI,
jwtvFactory: jwtvFactory,

24
user/api/api.go
View file

@ -88,11 +88,11 @@ func (e Error) Error() string {
// calling User. It is assumed that the clientID has already validated as an
// admin app before calling.
type UsersAPI struct {
manager *manager.UserManager
localConnectorID string
clientIdentityRepo client.ClientIdentityRepo
refreshRepo refresh.RefreshTokenRepo
emailer Emailer
manager *manager.UserManager
localConnectorID string
clientRepo client.ClientRepo
refreshRepo refresh.RefreshTokenRepo
emailer Emailer
}
type Emailer interface {
@ -107,11 +107,11 @@ type Creds struct {
// TODO(ericchiang): Don't pass a dbMap. See #385.
func NewUsersAPI(dbMap *gorp.DbMap, userManager *manager.UserManager, emailer Emailer, localConnectorID string) *UsersAPI {
return &UsersAPI{
manager: userManager,
refreshRepo: db.NewRefreshTokenRepo(dbMap),
clientIdentityRepo: db.NewClientIdentityRepo(dbMap),
localConnectorID: localConnectorID,
emailer: emailer,
manager: userManager,
refreshRepo: db.NewRefreshTokenRepo(dbMap),
clientRepo: db.NewClientRepo(dbMap),
localConnectorID: localConnectorID,
emailer: emailer,
}
}
@ -157,7 +157,7 @@ func (u *UsersAPI) CreateUser(creds Creds, usr schema.User, redirURL url.URL) (s
return schema.UserCreateResponse{}, mapError(err)
}
metadata, err := u.clientIdentityRepo.Metadata(creds.ClientID)
metadata, err := u.clientRepo.Metadata(creds.ClientID)
if err != nil {
return schema.UserCreateResponse{}, mapError(err)
}
@ -202,7 +202,7 @@ func (u *UsersAPI) ResendEmailInvitation(creds Creds, userID string, redirURL ur
return schema.ResendEmailInvitationResponse{}, ErrorUnauthorized
}
metadata, err := u.clientIdentityRepo.Metadata(creds.ClientID)
metadata, err := u.clientRepo.Metadata(creds.ClientID)
if err != nil {
return schema.ResendEmailInvitationResponse{}, mapError(err)
}

7
user/api/api_test.go
View file

@ -11,6 +11,7 @@ import (
"github.com/jonboulle/clockwork"
"github.com/kylelemons/godebug/pretty"
"github.com/coreos/dex/client"
"github.com/coreos/dex/connector"
"github.com/coreos/dex/db"
schema "github.com/coreos/dex/schema/workerschema"
@ -155,7 +156,7 @@ func makeTestFixtures() (*UsersAPI, *testEmailer) {
mgr := manager.NewUserManager(ur, pwr, ccr, db.TransactionFactory(dbMap), manager.ManagerOptions{})
mgr.Clock = clock
ci := oidc.ClientIdentity{
ci := client.Client{
Credentials: oidc.ClientCredentials{
ID: "XXX",
Secret: base64.URLEncoding.EncodeToString([]byte("secrete")),
@ -166,8 +167,8 @@ func makeTestFixtures() (*UsersAPI, *testEmailer) {
},
},
}
if _, err := db.NewClientIdentityRepoFromClients(dbMap, []oidc.ClientIdentity{ci}); err != nil {
panic("Failed to create client identity repo: " + err.Error())
if _, err := db.NewClientRepoFromClients(dbMap, []client.Client{ci}); err != nil {
panic("Failed to create client repo: " + err.Error())
}
// Used in TestRevokeRefreshToken test.