You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
334 lines
9.3 KiB
334 lines
9.3 KiB
## @file
|
|
# OpenIDConnect Issuer file
|
|
|
|
## @class
|
|
# OpenIDConnect Issuer class
|
|
package Lemonldap::NG::Portal::IssuerDBOpenIDConnect;
|
|
|
|
use strict;
|
|
use Lemonldap::NG::Portal::Simple;
|
|
use URI::Escape;
|
|
use JSON;
|
|
use MIME::Base64;
|
|
use Digest::SHA qw/hmac_sha256_base64/;
|
|
use base qw(Lemonldap::NG::Portal::_OpenIDConnect);
|
|
|
|
our $VERSION = '2.00';
|
|
|
|
## @method void issuerDBInit()
|
|
# Do nothing
|
|
# @return Lemonldap::NG::Portal error code
|
|
sub issuerDBInit {
|
|
return PE_OK;
|
|
}
|
|
|
|
## @apmethod int issuerForUnAuthUser()
|
|
# Get OIDC request
|
|
# @return Lemonldap::NG::Portal error code
|
|
sub issuerForUnAuthUser {
|
|
|
|
my $self = shift;
|
|
|
|
my $issuerDBOpenIDConnectPath = $self->{issuerDBOpenIDConnectPath};
|
|
my $authorize_uri = $self->{issuerDBOpenIDConnectAuthorizeURI};
|
|
my $token_uri = $self->{issuerDBOpenIDConnectTokenURI};
|
|
|
|
# Called URL
|
|
my $url = $self->url();
|
|
my $url_path = $self->url( -absolute => 1 );
|
|
$url_path =~ s#^//#/#;
|
|
|
|
# AUTHORIZE
|
|
if ( $url_path =~ m#${issuerDBOpenIDConnectPath}${authorize_uri}# ) {
|
|
|
|
$self->lmLog( "URL $url detected as an OpenID Connect AUTHORIZE URL",
|
|
'debug' );
|
|
|
|
# Save parameters
|
|
foreach my $param (qw/response_type scope client_id state redirect_uri/)
|
|
{
|
|
$self->setHiddenFormValue( $param, $self->param($param) );
|
|
}
|
|
|
|
}
|
|
|
|
# TOKEN
|
|
if ( $url_path =~ m#${issuerDBOpenIDConnectPath}${token_uri}# ) {
|
|
|
|
$self->lmLog( "URL $url detected as an OpenID Connect TOKEN URL",
|
|
'debug' );
|
|
|
|
# TODO check authorization header or other authentication scheme
|
|
|
|
# Get code session
|
|
my $code = $self->param('code');
|
|
|
|
my $codeSession = $self->getOpenIDConnectSession($code);
|
|
|
|
unless ($codeSession) {
|
|
$self->lmLog( "Unable to find OIDC session $code", "error" );
|
|
$self->returnJSONError("invalid_request");
|
|
$self->quit;
|
|
}
|
|
|
|
# Check we have the same redirect_uri value
|
|
unless (
|
|
$self->param("redirect_uri") eq $codeSession->data->{redirect_uri} )
|
|
{
|
|
$self->lmLog(
|
|
"Provided redirect_uri is different from "
|
|
. $codeSession->{redirect_uri},
|
|
"error"
|
|
);
|
|
$self->returnJSONError("invalid_request");
|
|
$self->quit;
|
|
}
|
|
|
|
# Get user identifier
|
|
my $apacheSession =
|
|
$self->getApacheSession( $codeSession->data->{user_session_id} );
|
|
|
|
unless ($apacheSession) {
|
|
$self->lmLog(
|
|
"Unable to find user session linked to OIDC session $code",
|
|
"error" );
|
|
$self->returnJSONError("invalid_request");
|
|
$self->quit;
|
|
}
|
|
|
|
my $user_id = $apacheSession->data->{_user}; # TODO configure attribute
|
|
|
|
# Generate access_token
|
|
my $accessTokenSession = $self->getOpenIDConnectSession;
|
|
|
|
unless ($accessTokenSession) {
|
|
$self->lmLog( "Unable to create OIDC session for access_token",
|
|
"error" );
|
|
$self->returnJSONError("invalid_request");
|
|
$self->quit;
|
|
}
|
|
|
|
my $access_token = $accessTokenSession->id;
|
|
|
|
# Create id_token
|
|
my $id_token_payload_hash = {
|
|
iss => $self->{portal}, # Issuer Identifier
|
|
sub => $user_id, # Subject Identifier
|
|
aud => "dummy", # client_id TODO
|
|
exp => "3600", # expiration TODO
|
|
iat => time, # Issued time
|
|
auth_time => time # Authentication time TODO
|
|
# TODO acr
|
|
# TODO amr
|
|
# TODO azp
|
|
};
|
|
|
|
# JSON and base64
|
|
my $id_token_payload =
|
|
encode_base64( encode_json($id_token_payload_hash), "" );
|
|
|
|
# Sign id_token with JWS
|
|
# TODO Choose alg
|
|
my $id_token_header_hash = { typ => "JWT", alg => "HS256" };
|
|
my $id_token_header =
|
|
encode_base64( encode_json($id_token_header_hash), "" );
|
|
|
|
# Signature
|
|
# TODO shared key
|
|
my $key = "ABCDEFGHIJKL";
|
|
my $digest =
|
|
hmac_sha256_base64( $id_token_header . "." . $id_token_payload,
|
|
$key );
|
|
|
|
# TODO configure expiration
|
|
my $expires_in = "3600";
|
|
|
|
# Send token response
|
|
my $token_response = {
|
|
access_token => $access_token,
|
|
token_type => 'Bearer',
|
|
expires_in => $expires_in,
|
|
id_token => $id_token_header . "."
|
|
. $id_token_payload . "."
|
|
. $digest,
|
|
};
|
|
|
|
$self->returnJSON($token_response);
|
|
|
|
$self->quit;
|
|
|
|
}
|
|
|
|
PE_OK;
|
|
}
|
|
|
|
## @apmethod int issuerForAuthUser()
|
|
# Do nothing
|
|
# @return Lemonldap::NG::Portal error code
|
|
sub issuerForAuthUser {
|
|
|
|
my $self = shift;
|
|
|
|
my $issuerDBOpenIDConnectPath = $self->{issuerDBOpenIDConnectPath};
|
|
my $authorize_uri = $self->{issuerDBOpenIDConnectAuthorizeURI};
|
|
my $token_uri = $self->{issuerDBOpenIDConnectTokenURI};
|
|
|
|
# Session ID
|
|
my $session_id = $self->{sessionInfo}->{_session_id} || $self->{id};
|
|
|
|
# Called URL
|
|
my $url = $self->url();
|
|
my $url_path = $self->url( -absolute => 1 );
|
|
$url_path =~ s#^//#/#;
|
|
|
|
# AUTHORIZE
|
|
if ( $url_path =~ m#${issuerDBOpenIDConnectPath}${authorize_uri}# ) {
|
|
|
|
$self->lmLog( "URL $url detected as an OpenID Connect AUTHORIZE URL",
|
|
'debug' );
|
|
|
|
# Get parameters
|
|
my $oidc_request = {};
|
|
foreach my $param (qw/response_type scope client_id state redirect_uri/)
|
|
{
|
|
$oidc_request->{$param} = $self->getHiddenFormValue($param)
|
|
|| $self->param($param);
|
|
$self->lmLog(
|
|
"OIDC request parameter $param: " . $oidc_request->{$param},
|
|
'debug' );
|
|
}
|
|
|
|
# TODO check all required parameters
|
|
# TODO validate parameters against OAuth 2.0 spec
|
|
|
|
# Authorization Code Flow
|
|
if ( $oidc_request->{'response_type'} eq "code" ) {
|
|
$self->lmLog( "OIDC auhtorization code flow requested", 'debug' );
|
|
|
|
# Check openid scope
|
|
unless ( $oidc_request->{'scope'} =~ /\bopenid\b/ ) {
|
|
$self->lmLog( "No openid scope found", 'debug' );
|
|
|
|
#TODO manage standard OAuth request
|
|
return PE_OK;
|
|
}
|
|
|
|
# Check client_id
|
|
$self->lmLog(
|
|
"Request from client id " . $oidc_request->{'client_id'},
|
|
'debug' );
|
|
|
|
# TODO verify that client_id is registered in configuration
|
|
|
|
# TODO obtain consent
|
|
|
|
# Prepare response
|
|
my $response_url = $oidc_request->{'redirect_uri'};
|
|
|
|
$response_url .=
|
|
( $oidc_request->{'redirect_uri'} =~ /\?/ ? '&' : '?' );
|
|
|
|
# Generate code
|
|
my $codeSession = $self->getOpenIDConnectSession();
|
|
my $code = $codeSession->id();
|
|
$response_url .= "code=" . uri_escape($code);
|
|
|
|
# Store data in session
|
|
$codeSession->update(
|
|
{
|
|
redirect_uri => $oidc_request->{'redirect_uri'},
|
|
user_session_id => $session_id,
|
|
}
|
|
);
|
|
|
|
if ( $oidc_request->{state} ) {
|
|
$response_url .=
|
|
"&state=" . uri_escape( $oidc_request->{'state'} );
|
|
}
|
|
|
|
$self->{'urldc'} = $response_url;
|
|
|
|
$self->_sub('autoRedirect');
|
|
}
|
|
}
|
|
|
|
# TOKEN
|
|
if ( $url_path =~ m#${issuerDBOpenIDConnectPath}${token_uri}# ) {
|
|
|
|
$self->lmLog( "URL $url detected as an OpenID Connect TOKEN URL",
|
|
'debug' );
|
|
|
|
# This should not happen
|
|
$self->returnJSONError("invalid_request");
|
|
|
|
$self->quit;
|
|
}
|
|
|
|
PE_OK;
|
|
}
|
|
|
|
## @apmethod int issuerLogout()
|
|
# Do nothing
|
|
# @return Lemonldap::NG::Portal error code
|
|
sub issuerLogout {
|
|
PE_OK;
|
|
}
|
|
|
|
1;
|
|
|
|
__END__
|
|
|
|
=head1 NAME
|
|
|
|
=encoding utf8
|
|
|
|
Lemonldap::NG::Portal::IssuerDBOpenIDConnect - OpenIDConnect Provider for Lemonldap::NG
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
This is an OpenID Connect provider implementation in LemonLDAP::NG
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<Lemonldap::NG::Portal>
|
|
|
|
=head1 AUTHOR
|
|
|
|
=over
|
|
|
|
=item Clement Oudot, E<lt>clem.oudot@gmail.comE<gt>
|
|
|
|
=back
|
|
|
|
=head1 BUG REPORT
|
|
|
|
Use OW2 system to report bug or ask for features:
|
|
L<http://jira.ow2.org>
|
|
|
|
=head1 DOWNLOAD
|
|
|
|
Lemonldap::NG is available at
|
|
L<http://forge.objectweb.org/project/showfiles.php?group_id=274>
|
|
|
|
=head1 COPYRIGHT AND LICENSE
|
|
|
|
=over
|
|
|
|
=item Copyright (C) 2014 by Clement Oudot, E<lt>clem.oudot@gmail.comE<gt>
|
|
|
|
=back
|
|
|
|
This library is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2, or (at your option)
|
|
any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see L<http://www.gnu.org/licenses/>.
|
|
|
|
=cut
|
|
|