1 files changed, 235 insertions, 174 deletions

diff --git a/main.go b/main.go
index 965e72c..805c40d 100644
--- a/main.go
+++ b/main.go
@@ -4,53 +4,52 @@ import (
         "context"
         "crypto/rand"
         "encoding/hex"
-        "fmt"
-        "gopkg.in/square/go-jose.v2"
-        "log"
+        "flag"
+        "github.com/golang/glog"
+        "github.com/gorilla/handlers"
+        "github.com/pkg/errors"
         "net/http"
         "net/http/httputil"
         "net/url"
+        "os"
+        "strconv"
         "strings"
         "time"
 )
 
 const (
-        NONCE_SIZE        int    = 16
-        TOKEN_COOKIE_NAME string = "sso_token"
-        RFP_COOKIE_NAME   string = "sso_rfp"
+        NONCE_SIZE           = 16
+        TOKEN_COOKIE_NAME    = "sso_token"
+        RFP_COOKIE_NAME      = "sso_rfp"
+        DEFAULT_CLOCK_SKEW   = 5 * time.Minute
+        DEFAULT_MAX_LIFETIME = 24 * time.Hour
+        DEFAULT_COOKIE_EXP   = 48 * time.Hour
 )
 
-// TODO: Enable https checks in HTTP client
-
-// acr_values can be mfa or selective_mfa (mfa only for external users)
-// mfa amr values:
-// pas - password
-// otp - OTP code
-// u2f - U2F code
-// mfa - multi-factor
-// hrd - hardware OTP device used
-// sft - software OTP device used
+// TODO: MFA support
 
 type ProxyConfig struct {
-        IDProviderURL      string
-        ClientID           string
-        UpstreamURL        string
-        ListenOn           string
-        TrustedCACert      string
-        PKISubject         string // TODO: Should be same as IDP w/out scheme and port
-        ClockSkew          time.Duration
-        MaxLiftetime       time.Duration
-        IsOptional         bool
-        RequestMFA         bool
-        AllowedMFAMethods  []string // An OR set
-        RequiredMFAMethods []string // An AND set
-        reverseProxy       *httputil.ReverseProxy
+        IdProviderURL          *url.URL
+        IdProviderAuthEndpoint *url.URL
+        ClientId               *url.URL
+        UpstreamURL            string
+        ListenOn               string
+        TrustedCACert          string
+        ClockSkew              time.Duration
+        MaxLiftetime           time.Duration
+        IsOptional             bool
+        IsBootstrap            bool
+        RequestMFA             bool
+        AllowedMFAMethods      []string // An OR set
+        RequiredMFAMethods     []string // An AND set
+        reverseProxy           *httputil.ReverseProxy
+        jwsValidator           JWSValidator
 }
 
 type IdPConfig struct {
-        AuthorizationEndpoint string   `json:"authorization_endpoint"`
+        AuthorizationEndpoint *JSONURL `json:"authorization_endpoint"`
+        JwksUri               *JSONURL `json:"jwks_uri"`
         Issuer                string   `json:"issuer"`
-        JwksUri               string   `json:"jwks_uri"`
         GrantTypes            []string `json:"grant_types_supported"`
         IdTokenSigningAlgs    []string `json:"id_token_signing_alg_values_supported"`
         ResponseModes         []string `json:"response_modes_supported"`
@@ -59,258 +58,311 @@ type IdPConfig struct {
         SubjectTypes          []string `json:"subject_types_supported"`
 }
 
-// TODO: Optimization to fetch only if expired (per http headers)
-func FetchIdPConfig(h CautiousHTTPClient, idp_url string) (*IdPConfig, error) {
-        u, err := url.Parse(idp_url)
-        if err != nil {
-                return nil, err
-        }
+func FetchIdPConfig(h CautiousHTTPClient, u *url.URL) (*IdPConfig, error) {
+        u = URLMustParse(u.String())
         u.Path = "/.well-known/openid-configuration"
 
         var idpc IdPConfig
-        err = h.GetJSON(u.String(), &idpc)
+        err := h.GetJSON(u.String(), &idpc)
         if err != nil {
-                return nil, err
+                return nil, errors.WithStack(err)
         }
 
         return &idpc, nil
 }
 
-// TODO: Optimization to fetch only if expired (per http headers)
-func FetchJWKS(h CautiousHTTPClient, jwks_url string, val KeyValidator) (map[string]jose.JSONWebKey, error) {
-        var jwks jose.JSONWebKeySet
-        err := h.GetJSON(jwks_url, &jwks)
-        if err != nil {
-                return nil, err
-        }
-
-        keys := make(map[string]jose.JSONWebKey, len(jwks.Keys))
-
-        for _, k := range jwks.Keys {
-                err = val.Validate(k)
-                if err == nil {
-                        keys[k.KeyID] = k
-                }
-        }
-
-        return keys, nil
-}
-
 func GenerateNonce() (string, error) {
         nonce := make([]byte, NONCE_SIZE)
         n, err := rand.Read(nonce)
         if n != NONCE_SIZE || err != nil {
-                return "", err
+                return "", errors.WithStack(err)
         }
         return hex.EncodeToString(nonce), nil
 }
 
-// TODO
-// Cookie rules
-// Secure
-// HttpOnly
-// Path to /
-// Expires to iat in JWT
-func SetCookie() {
+func SetSecureCookie(w http.ResponseWriter, name string, value string, exp time.Duration) {
+        http.SetCookie(w, &http.Cookie{
+                Name:     name,
+                Value:    value,
+                Expires:  time.Now().Add(exp),
+                HttpOnly: true,
+                Secure:   true,
+                Path:     "/",
+        })
 }
 
-// TODO
-func MakeClientID(r *http.Request) string {
-        if strings.Contains(r.Host, ":") {
-                return r.Host
-        }
-        return ""
+func ExpireCookie(w http.ResponseWriter, name string) {
+        http.SetCookie(w, &http.Cookie{
+                Name:     name,
+                Value:    "",
+                Expires:  time.Now().Add(-1 * time.Hour),
+                HttpOnly: true,
+                Secure:   true,
+                Path:     "/",
+                MaxAge:   0,
+        })
 }
 
-// TODO
-func RedirectToIDP(w http.ResponseWriter, r *http.Request) {
-        nonce, _ := GenerateNonce()
-        _ = nonce
-        nonceh := "" // SHA256 nonce
+func RedirectToIdP(w http.ResponseWriter, r *http.Request, path string) {
+        ctx := r.Context().Value("ProxyConfig").(*ProxyConfig)
 
-        // Set nonce cookie
+        nonce, err := GenerateNonce()
+        if err != nil {
+                http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+                return
+        }
+
+        SetSecureCookie(w, RFP_COOKIE_NAME, nonce, DEFAULT_COOKIE_EXP)
+
+        rt := ""
+        rp := r.URL.Query().Get("redirect_uri")
+        if rp != "" {
+                rt = rp
+        } else {
+                ru := &url.URL{
+                        Scheme: "https",
+                        Host:   r.Host,
+                        Path:   path,
+                }
+                rt = ru.String()
+        }
 
         req := url.Values{}
-        req.Add("client_id", "") // fqdn + : + port
-        req.Add("nonce", nonceh)
-        req.Add("redirect_uri", "") // Requested URL
+        req.Add("client_id", ctx.ClientId.String())
+        req.Add("nonce", Sha256Hex(nonce))
+        req.Add("redirect_uri", rt)
         req.Add("scope", "openid")
         req.Add("response_type", "id_token")
+
+        u := URLMustParse(ctx.IdProviderAuthEndpoint.String())
+        u.RawQuery = req.Encode()
+
+        http.Redirect(w, r, u.String(), http.StatusFound)
 }
 
-// TODO: Remove id_token from URL, set cookie and redirect user to requested URL
 func SetTokenCookieAndRedirect(w http.ResponseWriter, r *http.Request, token string) {
-}
+        SetSecureCookie(w, TOKEN_COOKIE_NAME, token, DEFAULT_COOKIE_EXP)
 
-// TODO
-func ValidateJWT(jwt, rfp string) bool {
-        return true
-}
+        q := r.URL.Query()
+        q.Del("id_token")
+
+        u := URLMustParse(r.URL.String())
+        u.RawQuery = q.Encode()
 
-// TODO
-func GetJWTSubject(jwt string) string {
-        return ""
+        http.Redirect(w, r, u.String(), http.StatusFound)
 }
 
 func RequestHasForwardedUser(w http.ResponseWriter, r *http.Request) bool {
-        if _, ok := r.Header["X-Forwarded-User"]; ok {
-                log.Printf("ERROR: Request contains X-Forwarded-For header")
-                http.Error(w, "Bad Request", http.StatusBadRequest)
-                return true
-        } else {
-                return false
-        }
+        _, ok := r.Header["X-Forwarded-User"]
+        return ok
 }
 
 func RequestIsOverSecureChannel(w http.ResponseWriter, r *http.Request) bool {
         https, ok := r.Header["X-Forwarded-Proto"]
         if !ok || len(https) != 1 {
-                log.Printf("ERROR: Request does not contain X-Forwarded-Proto header")
-                http.Error(w, "Bad Request", http.StatusBadRequest)
+                glog.V(1).Infoln("Request does not contain X-Forwarded-Proto header")
                 return false
         }
 
         if !CompareUpper(https[0], "HTTPS") {
-                log.Printf("ERROR: Request is not over HTTPS")
-                http.Error(w, "Bad Request", http.StatusBadRequest)
+                glog.V(1).Infoln("Request is not over HTTPS")
                 return false
         }
 
         return true
 }
 
-// TODO
-// - Validate Hostname header == known hostname
 func AuthProxyController(w http.ResponseWriter, r *http.Request) {
-        proxy := r.Context().Value("ProxyConfig").(*ProxyConfig).reverseProxy
+        ctx := r.Context().Value("ProxyConfig").(*ProxyConfig)
 
         // Order matters in these checks!
         if RequestHasForwardedUser(w, r) {
+                glog.Errorln("Request already has X-Forwarded-User")
+                http.Error(w, "Bad Request", http.StatusBadRequest)
                 return
         }
 
         if !RequestIsOverSecureChannel(w, r) {
+                http.Error(w, "Bad Request", http.StatusBadRequest)
                 return
         }
 
         if CompareUpper(r.Method, "OPTIONS") {
-                proxy.ServeHTTP(w, r)
+                ctx.reverseProxy.ServeHTTP(w, r)
                 return
         }
 
         rfpc, err := r.Cookie(RFP_COOKIE_NAME)
         if err != nil {
-                log.Printf("ERROR: No rfp cookie")
-                RedirectToIDP(w, r)
-                return
+                glog.V(1).Infoln("No rfp cookie")
+                if ctx.IsOptional {
+                        ctx.reverseProxy.ServeHTTP(w, r)
+                        return
+                } else {
+                        RedirectToIdP(w, r, r.URL.Path)
+                        return
+                }
         }
 
-        token := r.URL.Query().Get("id_token")
-        if token != "" && ValidateJWT(rfpc.Value, token) {
-                SetTokenCookieAndRedirect(w, r, token)
-                return
+        if token := r.URL.Query().Get("id_token"); token != "" {
+                if _, err := ctx.jwsValidator.Validate(token, rfpc.Value); err == nil {
+                        SetTokenCookieAndRedirect(w, r, token)
+                        return
+                } else {
+                        glog.V(1).Infof("Querystring id_token invalid: %s", err)
+                }
         }
 
         tokenc, err := r.Cookie(TOKEN_COOKIE_NAME)
         if err != nil {
-                log.Printf("ERROR: No token cookie")
-                RedirectToIDP(w, r)
-                return
+                glog.V(1).Infoln("No token cookie")
+                if ctx.IsOptional {
+                        ctx.reverseProxy.ServeHTTP(w, r)
+                        return
+                } else {
+                        RedirectToIdP(w, r, r.URL.Path)
+                        return
+                }
         }
 
-        if !ValidateJWT(tokenc.Value, rfpc.Value) {
-                log.Printf("ERROR: Token is invalid")
-                RedirectToIDP(w, r)
-                return
+        claims, err := ctx.jwsValidator.Validate(tokenc.Value, rfpc.Value)
+        if err != nil {
+                glog.Errorln("Token is invalid", err)
+                if ctx.IsOptional {
+                        ctx.reverseProxy.ServeHTTP(w, r)
+                        return
+                } else {
+                        RedirectToIdP(w, r, r.URL.Path)
+                        return
+                }
         }
 
-        r.Header["X-Forwarded-User"] = []string{GetJWTSubject(tokenc.Value)}
+        r.Header["X-Forwarded-User"] = []string{claims.Subject}
+        r.Header["X-Forwarded-Token-Expires"] = []string{strconv.FormatInt(int64(claims.Expiry), 10)}
+
+        age := time.Since(claims.IssuedAt.Time()).Minutes()
+        r.Header["X-Forwarded-Token-Age"] = []string{strconv.FormatInt(int64(age), 10)}
 
-        proxy.ServeHTTP(w, r)
+        ctx.reverseProxy.ServeHTTP(w, r)
 }
 
-// Remove token and rfp cookies and redirect user to root of domain
 func LogoutController(w http.ResponseWriter, r *http.Request) {
-        http.SetCookie(w, &http.Cookie{
-                Name:   TOKEN_COOKIE_NAME,
-                Value:  "",
-                MaxAge: 0,
-        })
-
-        http.SetCookie(w, &http.Cookie{
-                Name:   TOKEN_COOKIE_NAME,
-                Value:  "",
-                MaxAge: 0,
-        })
-
+        ExpireCookie(w, RFP_COOKIE_NAME)
+        ExpireCookie(w, TOKEN_COOKIE_NAME)
         http.Redirect(w, r, "/", http.StatusFound)
 }
 
-// TODO
-func LoginController(w http.ResponseWriter, r *http.Request) {
-}
-
-// TODO
 // Optional login allows for applications that can operate in anonymous mode or
 // authenticated mode. When in anonmyous mode the request is proxied through
 // without an X-Forwarded-User header. Upstream servers should either expose or
 // map a URL for /.oidc/login to allow users to login. On successful login the
 // user will be redirected back to the main page for the site (/)
-func parseConfig() *ProxyConfig {
-        return &ProxyConfig{
-                IDProviderURL: "http://mcrute-virt:9993",
-                ClientID:      "test.crute.me:443",
-                UpstreamURL:   "http://localhost:9991/",
-                ListenOn:      ":9992",
-                TrustedCACert: "/home/mcrute/oidc_project/test_ca/ca_cert.pem",
-                IsOptional:    false,
-                PKISubject:    "Crute OpenID Signing 1",
-                MaxLiftetime:  24 * time.Hour,
-                ClockSkew:     5 * time.Minute,
+func parseConfig() (*ProxyConfig, error) {
+        c := &ProxyConfig{}
+
+        idpu := flag.String("idp", "", "URL for ID provider")
+        mfam := flag.String("allow-mfa-methods", "", "Comma seperated list of allowed mfa methods")
+        rmfa := flag.String("require-mfa-methods", "", "Comma seperated list of required mfa methods")
+        cids := flag.String("client-id", "", "Client ID for proxy with IdP")
+
+        flag.BoolVar(&c.IsOptional, "optional", false, "Allow proxying of unauthenticated calls")
+        flag.BoolVar(&c.IsBootstrap, "bootstrap", false, "Allow running a proxy for the IdP itself")
+        flag.BoolVar(&c.RequestMFA, "mfa", false, "Request user MFA authentication from IdP")
+
+        flag.DurationVar(&c.MaxLiftetime, "max-lifetime", DEFAULT_MAX_LIFETIME, "Maximum allowed time from token issuance")
+        flag.DurationVar(&c.ClockSkew, "clock-skew", DEFAULT_CLOCK_SKEW, "Allowable IdP clock skew relative to proxy")
+
+        flag.StringVar(&c.UpstreamURL, "upstream", "", "URL of upstream service for which to proxy")
+        flag.StringVar(&c.ListenOn, "listen", ":9992", "Optional port and ip on which to listen")
+        flag.StringVar(&c.TrustedCACert, "ca", "", "Path to trusted CA certificate")
+
+        flag.Parse()
+
+        c.AllowedMFAMethods = strings.Split(*mfam, ",")
+        c.RequiredMFAMethods = strings.Split(*rmfa, ",")
+
+        if c.IsBootstrap {
+                c.IsOptional = true
+        }
+
+        if _, err := os.Stat(c.TrustedCACert); os.IsNotExist(err) {
+                return nil, errors.Errorf("CA certificate does not exist")
+        }
+
+        if cids == nil {
+                return nil, errors.Errorf("Client ID is required")
+        }
+
+        if client_id, err := url.Parse(*cids); err != nil || client_id.Host == "" {
+                return nil, errors.Errorf("Invalid client ID")
+        } else {
+                c.ClientId = client_id
+        }
+
+        if c.UpstreamURL == "" {
+                return nil, errors.Errorf("Upstream URL is required")
+        }
+
+        if idpu == nil {
+                return nil, errors.Errorf("IDP url is required")
         }
+
+        if u, err := url.Parse(*idpu); err != nil {
+                return nil, errors.WithStack(err)
+        } else {
+                c.IdProviderURL = u
+
+                if h := HostFromURL(u.String()); c.IsBootstrap && (h != "localhost" && h != "127.0.0.1") {
+                        return nil, errors.Errorf("IdP must be set to localhost for bootstrap")
+                }
+        }
+
+        return c, nil
 }
 
 func main() {
-        cfg := parseConfig()
-        h := NewCautiousHTTPClient()
-
-        v := NewKeyValidator(cfg.PKISubject)
-        v.LoadRootPEM(cfg.TrustedCACert)
+        cfg, err := parseConfig()
+        if err != nil {
+                glog.Fatalln("ParseConfig", err)
+                return
+        }
 
-        idpc, err := FetchIdPConfig(h, cfg.IDProviderURL)
+        hidp, err := NewCautiousHTTPClient(cfg.IsBootstrap)
         if err != nil {
-                fmt.Printf("%s\n", err)
+                glog.Fatalln("Error building http client", err)
                 return
         }
 
-        jwks, err := FetchJWKS(h, idpc.JwksUri, v)
+        idpc, err := FetchIdPConfig(hidp, cfg.IdProviderURL)
         if err != nil {
-                fmt.Printf("%s\n", err)
+                glog.Fatalln("FetchIdPConfig:", err)
                 return
         }
 
-        jv := NewJWSValidator(jwks, idpc.Issuer, cfg.ClientID, cfg.ClockSkew, cfg.MaxLiftetime)
+        cfg.IdProviderAuthEndpoint = idpc.AuthorizationEndpoint.AsURL()
 
-        nonce := "ofspmfjuvoswhhde"
-        raw_jwt := "eyJ0eXAiOiJKV1MiLCJhbGciOiJQUzI1NiIsImtpZCI6IjEifQ.eyJub25jZSI6IjM0MjlhMjAyYzU4ZDkyYjQwNjNjOWM4MWM2MjQyNGRlNzBkMmIzZDQ4MmVlNDFhOTdjYmNhZjEwZDk5MWFiOTMiLCJpc3MiOiJpZHAuY3J1dGUubWU6NDQzIiwiaWF0IjoxNTA0NTc2Mzc0LCJuYmYiOjE1MDQ1NzYzNzQsImV4cCI6MTUwNDY2Mjc3NCwic3ViIjoibWNydXRlIiwiYXVkIjoidGVzdC5jcnV0ZS5tZTo0NDMifQ.iizlNfY1Vg7d-XRmgyYuhpNkNrOGaT9OOgO0HdjBozOWMvKzBTtATbIfoWOrNH6DiFY1as8uy3I1Pxnkrb8Ti8_cLDQeLxOv9klAbnebeuPI_wtZ0iwSUnSWaYzN6I6sqcEjHX3fibFvAQhO5dNDzSwONjw4AvcdpZKh579FO1sAvIw-1DmMyPSUun7rbC0Kf1Jtdlr3q7tOp3wdI_erkstxCNPwyuv7X1J7uetsu0BeJS25C2DxeB03BPEIUoo_C1xvcqikfSLLpoFcyToYiS-R9o-WpRjGid_yug65J5ALn2aM3vhe9rRbydKVm_omGL8-Etj06zbqM0Y6OrJUgA"
-        claims, err := jv.Validate(raw_jwt, nonce)
+        h, err := NewCautiousHTTPClient(false)
         if err != nil {
-                fmt.Printf("Error validating: %s\n", err)
+                glog.Fatalln("Error building http client", err)
                 return
         }
 
-        fmt.Printf("Valid JWT for: %+v\n", claims.Subject)
+        kf := NewJWKSFetcher(h, idpc.JwksUri.AsURL(), idpc.Issuer, cfg.TrustedCACert)
 
-        return
+        cfg.jwsValidator = NewJWSValidator(&JWSValidationContext{
+                KeyFetcher:   kf,
+                Issuer:       idpc.Issuer,
+                ClientId:     cfg.ClientId,
+                ClockSkew:    cfg.ClockSkew,
+                MaxLiftetime: cfg.MaxLiftetime,
+        })
 
         cfg.reverseProxy = httputil.NewSingleHostReverseProxy(URLMustParse(cfg.UpstreamURL))
 
-        if cfg.IsOptional {
-                http.HandleFunc("/.oidc/login", func(w http.ResponseWriter, r *http.Request) {
-                        LoginController(w,
-                                r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)))
-                })
-        }
+        http.HandleFunc("/.oidc/login", func(w http.ResponseWriter, r *http.Request) {
+                RedirectToIdP(w,
+                        r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)), "/")
+        })
 
         http.HandleFunc("/.oidc/logout", func(w http.ResponseWriter, r *http.Request) {
                 LogoutController(w,
@@ -322,5 +374,14 @@ func main() {
                         r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)))
         })
 
-        log.Fatal(http.ListenAndServe(cfg.ListenOn, nil))
+        go http.ListenAndServe(cfg.ListenOn,
+                handlers.LoggingHandler(os.Stdout, http.DefaultServeMux))
+
+        // This has to happen last in-case we're boostrapping a proxy for the IdP itself
+        if err := kf.Fetch(); err != nil {
+                glog.Fatalln("FetchJWKS:", err)
+                return
+        } else {
+                kf.Run()
+        }
 }