1 files changed, 38 insertions, 80 deletions

diff --git a/main.go b/main.go
index 44501c0..965e72c 100644
--- a/main.go
+++ b/main.go
@@ -11,6 +11,7 @@ import (
         "net/http/httputil"
         "net/url"
         "strings"
+        "time"
 )
 
 const (
@@ -19,6 +20,8 @@ const (
         RFP_COOKIE_NAME   string = "sso_rfp"
 )
 
+// TODO: Enable https checks in HTTP client
+
 // acr_values can be mfa or selective_mfa (mfa only for external users)
 // mfa amr values:
 // pas - password
@@ -34,6 +37,9 @@ type ProxyConfig struct {
         UpstreamURL        string
         ListenOn           string
         TrustedCACert      string
+        PKISubject         string // TODO: Should be same as IDP w/out scheme and port
+        ClockSkew          time.Duration
+        MaxLiftetime       time.Duration
         IsOptional         bool
         RequestMFA         bool
         AllowedMFAMethods  []string // An OR set
@@ -45,7 +51,7 @@ type IdPConfig struct {
         AuthorizationEndpoint string   `json:"authorization_endpoint"`
         Issuer                string   `json:"issuer"`
         JwksUri               string   `json:"jwks_uri"`
-        SupportedGrantTypes   []string `json:"grant_types_supported"`
+        GrantTypes            []string `json:"grant_types_supported"`
         IdTokenSigningAlgs    []string `json:"id_token_signing_alg_values_supported"`
         ResponseModes         []string `json:"response_modes_supported"`
         ResponseTypes         []string `json:"response_types_supported"`
@@ -53,6 +59,7 @@ type IdPConfig struct {
         SubjectTypes          []string `json:"subject_types_supported"`
 }
 
+// TODO: Optimization to fetch only if expired (per http headers)
 func FetchIdPConfig(h CautiousHTTPClient, idp_url string) (*IdPConfig, error) {
         u, err := url.Parse(idp_url)
         if err != nil {
@@ -70,7 +77,7 @@ func FetchIdPConfig(h CautiousHTTPClient, idp_url string) (*IdPConfig, error) {
 }
 
 // TODO: Optimization to fetch only if expired (per http headers)
-func FetchJWKS(h CautiousHTTPClient, jwks_url string) (map[string]jose.JSONWebKey, error) {
+func FetchJWKS(h CautiousHTTPClient, jwks_url string, val KeyValidator) (map[string]jose.JSONWebKey, error) {
         var jwks jose.JSONWebKeySet
         err := h.GetJSON(jwks_url, &jwks)
         if err != nil {
@@ -80,20 +87,15 @@ func FetchJWKS(h CautiousHTTPClient, jwks_url string) (map[string]jose.JSONWebKe
         keys := make(map[string]jose.JSONWebKey, len(jwks.Keys))
 
         for _, k := range jwks.Keys {
-                keys[k.KeyID] = k
+                err = val.Validate(k)
+                if err == nil {
+                        keys[k.KeyID] = k
+                }
         }
 
         return keys, nil
 }
 
-func URLMustParse(u string) *url.URL {
-        o, err := url.Parse(u)
-        if err != nil {
-                panic(err)
-        }
-        return o
-}
-
 func GenerateNonce() (string, error) {
         nonce := make([]byte, NONCE_SIZE)
         n, err := rand.Read(nonce)
@@ -103,10 +105,6 @@ func GenerateNonce() (string, error) {
         return hex.EncodeToString(nonce), nil
 }
 
-func CompareUpper(lhs, rhs string) bool {
-        return strings.ToUpper(lhs) == strings.ToUpper(rhs)
-}
-
 // TODO
 // Cookie rules
 // Secure
@@ -117,28 +115,6 @@ func SetCookie() {
 }
 
 // TODO
-// Fetch (connect timeout 1s, read timeout 30s, read size 1M)
-func DownloadCertificate() {
-}
-
-// TODO
-// Fetch (connect timeout 1s, read timeout 30s, read size 1M)
-func DownloadCRL() {
-}
-
-// TODO
-// Cert validation
-// Validate cert not in CRL
-// Validate cert chains to trusted CA cert (ship with proxy)
-// Validate CRL signed by trusted CA
-// Cert "Subject CN " must match exactly PKI setting (ex: foo-pki.foo.com)
-// Current time bust be within "Validity Not Before" and "Validity Not After" in cert +- 5 minutes
-// Cert Key length >= 2048
-// Certificate usage must include "digitalSignature"
-func ValidateCertificate() {
-}
-
-// TODO
 func MakeClientID(r *http.Request) string {
         if strings.Contains(r.Host, ":") {
                 return r.Host
@@ -167,42 +143,6 @@ func SetTokenCookieAndRedirect(w http.ResponseWriter, r *http.Request, token str
 }
 
 // TODO
-// Occasionally refresh IDP config (per HTTP caching headers)
-//
-// Fetch ${IDP_HOST}/.well-known/openid-configuration
-// - validate certificate chains to a trusted root
-// - validate scopes_supported contains "openid"
-// - validate response_types_supported contains "id_token"
-// - validate grant_types_supported contains "implicit"
-// - validate id_token_signing_alg_values_supported contains a supported signing type (see below)
-// - Cache authorization_endpoint for redirecting users
-//
-// Fetch jwks_uri endpoint
-// - Build key map indexed by kid for all keys that are suppored by our rules
-//   - kty == RSA
-//   - alg header must be one of [PS256, PS385, PS512]
-//   - pem decode x5c and validate the certificate chain as below
-//   - validate first item of x5c matches n and e
-func RefreshIDPConfig() {
-}
-
-// TODO
-// If x5u exists in header
-// Fetch cert from x5u URL
-// Get CRL from cert, fetch (connect timeout 1s, read timeout 30s, read size 1M)
-//
-// exp claim has passed +- 5 minutes
-// iat claim is greater than 24 hours +- 5 minutes
-// aud claim is exact match for client_id
-// iss claim is exact match for idp (ex: foo.example.com)
-// if other aud claims validate that they are known
-// nonce in JWT must be SHA256 of rfp cookie value
-// Validate cert
-// alg jwt header must be one of [PS256, PS385, PS512]
-// typ jwt header must be JWS
-// validate jwt signature
-// validate amr claim contains requested acr values (selective_mfa will be just mfa)
-// validate acr claim is the same as requested acr_values
 func ValidateJWT(jwt, rfp string) bool {
         return true
 }
@@ -318,33 +258,51 @@ func LoginController(w http.ResponseWriter, r *http.Request) {
 // user will be redirected back to the main page for the site (/)
 func parseConfig() *ProxyConfig {
         return &ProxyConfig{
-                IDProviderURL: "",
-                ClientID:      "",
+                IDProviderURL: "http://mcrute-virt:9993",
+                ClientID:      "test.crute.me:443",
                 UpstreamURL:   "http://localhost:9991/",
                 ListenOn:      ":9992",
-                TrustedCACert: "",
+                TrustedCACert: "/home/mcrute/oidc_project/test_ca/ca_cert.pem",
                 IsOptional:    false,
+                PKISubject:    "Crute OpenID Signing 1",
+                MaxLiftetime:  24 * time.Hour,
+                ClockSkew:     5 * time.Minute,
         }
 }
 
 func main() {
+        cfg := parseConfig()
         h := NewCautiousHTTPClient()
 
-        idpc, err := FetchIdPConfig(h, "http://mcrute-virt:9993")
+        v := NewKeyValidator(cfg.PKISubject)
+        v.LoadRootPEM(cfg.TrustedCACert)
+
+        idpc, err := FetchIdPConfig(h, cfg.IDProviderURL)
         if err != nil {
                 fmt.Printf("%s\n", err)
                 return
         }
 
-        jwks, err := FetchJWKS(h, idpc.JwksUri)
+        jwks, err := FetchJWKS(h, idpc.JwksUri, v)
         if err != nil {
                 fmt.Printf("%s\n", err)
                 return
         }
-        fmt.Printf("%+v\n", jwks)
+
+        jv := NewJWSValidator(jwks, idpc.Issuer, cfg.ClientID, cfg.ClockSkew, cfg.MaxLiftetime)
+
+        nonce := "ofspmfjuvoswhhde"
+        raw_jwt := "eyJ0eXAiOiJKV1MiLCJhbGciOiJQUzI1NiIsImtpZCI6IjEifQ.eyJub25jZSI6IjM0MjlhMjAyYzU4ZDkyYjQwNjNjOWM4MWM2MjQyNGRlNzBkMmIzZDQ4MmVlNDFhOTdjYmNhZjEwZDk5MWFiOTMiLCJpc3MiOiJpZHAuY3J1dGUubWU6NDQzIiwiaWF0IjoxNTA0NTc2Mzc0LCJuYmYiOjE1MDQ1NzYzNzQsImV4cCI6MTUwNDY2Mjc3NCwic3ViIjoibWNydXRlIiwiYXVkIjoidGVzdC5jcnV0ZS5tZTo0NDMifQ.iizlNfY1Vg7d-XRmgyYuhpNkNrOGaT9OOgO0HdjBozOWMvKzBTtATbIfoWOrNH6DiFY1as8uy3I1Pxnkrb8Ti8_cLDQeLxOv9klAbnebeuPI_wtZ0iwSUnSWaYzN6I6sqcEjHX3fibFvAQhO5dNDzSwONjw4AvcdpZKh579FO1sAvIw-1DmMyPSUun7rbC0Kf1Jtdlr3q7tOp3wdI_erkstxCNPwyuv7X1J7uetsu0BeJS25C2DxeB03BPEIUoo_C1xvcqikfSLLpoFcyToYiS-R9o-WpRjGid_yug65J5ALn2aM3vhe9rRbydKVm_omGL8-Etj06zbqM0Y6OrJUgA"
+        claims, err := jv.Validate(raw_jwt, nonce)
+        if err != nil {
+                fmt.Printf("Error validating: %s\n", err)
+                return
+        }
+
+        fmt.Printf("Valid JWT for: %+v\n", claims.Subject)
+
         return
 
-        cfg := parseConfig()
         cfg.reverseProxy = httputil.NewSingleHostReverseProxy(URLMustParse(cfg.UpstreamURL))
 
         if cfg.IsOptional {