path: root/main.go

package main

import (
	"context"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"gopkg.in/square/go-jose.v2"
	"log"
	"net/http"
	"net/http/httputil"
	"net/url"
	"strings"
)

const (
	NONCE_SIZE        int    = 16
	TOKEN_COOKIE_NAME string = "sso_token"
	RFP_COOKIE_NAME   string = "sso_rfp"
)

// acr_values can be mfa or selective_mfa (mfa only for external users)
// mfa amr values:
// pas - password
// otp - OTP code
// u2f - U2F code
// mfa - multi-factor
// hrd - hardware OTP device used
// sft - software OTP device used

type ProxyConfig struct {
	IDProviderURL      string
	ClientID           string
	UpstreamURL        string
	ListenOn           string
	TrustedCACert      string
	IsOptional         bool
	RequestMFA         bool
	AllowedMFAMethods  []string // An OR set
	RequiredMFAMethods []string // An AND set
	reverseProxy       *httputil.ReverseProxy
}

type IdPConfig struct {
	AuthorizationEndpoint string   `json:"authorization_endpoint"`
	Issuer                string   `json:"issuer"`
	JwksUri               string   `json:"jwks_uri"`
	SupportedGrantTypes   []string `json:"grant_types_supported"`
	IdTokenSigningAlgs    []string `json:"id_token_signing_alg_values_supported"`
	ResponseModes         []string `json:"response_modes_supported"`
	ResponseTypes         []string `json:"response_types_supported"`
	Scopes                []string `json:"scopes_supported"`
	SubjectTypes          []string `json:"subject_types_supported"`
}

func FetchIdPConfig(h CautiousHTTPClient, idp_url string) (*IdPConfig, error) {
	u, err := url.Parse(idp_url)
	if err != nil {
		return nil, err
	}
	u.Path = "/.well-known/openid-configuration"

	var idpc IdPConfig
	err = h.GetJSON(u.String(), &idpc)
	if err != nil {
		return nil, err
	}

	return &idpc, nil
}

// TODO: Optimization to fetch only if expired (per http headers)
func FetchJWKS(h CautiousHTTPClient, jwks_url string) (map[string]jose.JSONWebKey, error) {
	var jwks jose.JSONWebKeySet
	err := h.GetJSON(jwks_url, &jwks)
	if err != nil {
		return nil, err
	}

	keys := make(map[string]jose.JSONWebKey, len(jwks.Keys))

	for _, k := range jwks.Keys {
		keys[k.KeyID] = k
	}

	return keys, nil
}

func URLMustParse(u string) *url.URL {
	o, err := url.Parse(u)
	if err != nil {
		panic(err)
	}
	return o
}

func GenerateNonce() (string, error) {
	nonce := make([]byte, NONCE_SIZE)
	n, err := rand.Read(nonce)
	if n != NONCE_SIZE || err != nil {
		return "", err
	}
	return hex.EncodeToString(nonce), nil
}

func CompareUpper(lhs, rhs string) bool {
	return strings.ToUpper(lhs) == strings.ToUpper(rhs)
}

// TODO
// Cookie rules
// Secure
// HttpOnly
// Path to /
// Expires to iat in JWT
func SetCookie() {
}

// TODO
// Fetch (connect timeout 1s, read timeout 30s, read size 1M)
func DownloadCertificate() {
}

// TODO
// Fetch (connect timeout 1s, read timeout 30s, read size 1M)
func DownloadCRL() {
}

// TODO
// Cert validation
// Validate cert not in CRL
// Validate cert chains to trusted CA cert (ship with proxy)
// Validate CRL signed by trusted CA
// Cert "Subject CN " must match exactly PKI setting (ex: foo-pki.foo.com)
// Current time bust be within "Validity Not Before" and "Validity Not After" in cert +- 5 minutes
// Cert Key length >= 2048
// Certificate usage must include "digitalSignature"
func ValidateCertificate() {
}

// TODO
func MakeClientID(r *http.Request) string {
	if strings.Contains(r.Host, ":") {
		return r.Host
	}
	return ""
}

// TODO
func RedirectToIDP(w http.ResponseWriter, r *http.Request) {
	nonce, _ := GenerateNonce()
	_ = nonce
	nonceh := "" // SHA256 nonce

	// Set nonce cookie

	req := url.Values{}
	req.Add("client_id", "") // fqdn + : + port
	req.Add("nonce", nonceh)
	req.Add("redirect_uri", "") // Requested URL
	req.Add("scope", "openid")
	req.Add("response_type", "id_token")
}

// TODO: Remove id_token from URL, set cookie and redirect user to requested URL
func SetTokenCookieAndRedirect(w http.ResponseWriter, r *http.Request, token string) {
}

// TODO
// Occasionally refresh IDP config (per HTTP caching headers)
//
// Fetch ${IDP_HOST}/.well-known/openid-configuration
// - validate certificate chains to a trusted root
// - validate scopes_supported contains "openid"
// - validate response_types_supported contains "id_token"
// - validate grant_types_supported contains "implicit"
// - validate id_token_signing_alg_values_supported contains a supported signing type (see below)
// - Cache authorization_endpoint for redirecting users
//
// Fetch jwks_uri endpoint
// - Build key map indexed by kid for all keys that are suppored by our rules
//   - kty == RSA
//   - alg header must be one of [PS256, PS385, PS512]
//   - pem decode x5c and validate the certificate chain as below
//   - validate first item of x5c matches n and e
func RefreshIDPConfig() {
}

// TODO
// If x5u exists in header
// Fetch cert from x5u URL
// Get CRL from cert, fetch (connect timeout 1s, read timeout 30s, read size 1M)
//
// exp claim has passed +- 5 minutes
// iat claim is greater than 24 hours +- 5 minutes
// aud claim is exact match for client_id
// iss claim is exact match for idp (ex: foo.example.com)
// if other aud claims validate that they are known
// nonce in JWT must be SHA256 of rfp cookie value
// Validate cert
// alg jwt header must be one of [PS256, PS385, PS512]
// typ jwt header must be JWS
// validate jwt signature
// validate amr claim contains requested acr values (selective_mfa will be just mfa)
// validate acr claim is the same as requested acr_values
func ValidateJWT(jwt, rfp string) bool {
	return true
}

// TODO
func GetJWTSubject(jwt string) string {
	return ""
}

func RequestHasForwardedUser(w http.ResponseWriter, r *http.Request) bool {
	if _, ok := r.Header["X-Forwarded-User"]; ok {
		log.Printf("ERROR: Request contains X-Forwarded-For header")
		http.Error(w, "Bad Request", http.StatusBadRequest)
		return true
	} else {
		return false
	}
}

func RequestIsOverSecureChannel(w http.ResponseWriter, r *http.Request) bool {
	https, ok := r.Header["X-Forwarded-Proto"]
	if !ok || len(https) != 1 {
		log.Printf("ERROR: Request does not contain X-Forwarded-Proto header")
		http.Error(w, "Bad Request", http.StatusBadRequest)
		return false
	}

	if !CompareUpper(https[0], "HTTPS") {
		log.Printf("ERROR: Request is not over HTTPS")
		http.Error(w, "Bad Request", http.StatusBadRequest)
		return false
	}

	return true
}

// TODO
// - Validate Hostname header == known hostname
func AuthProxyController(w http.ResponseWriter, r *http.Request) {
	proxy := r.Context().Value("ProxyConfig").(*ProxyConfig).reverseProxy

	// Order matters in these checks!
	if RequestHasForwardedUser(w, r) {
		return
	}

	if !RequestIsOverSecureChannel(w, r) {
		return
	}

	if CompareUpper(r.Method, "OPTIONS") {
		proxy.ServeHTTP(w, r)
		return
	}

	rfpc, err := r.Cookie(RFP_COOKIE_NAME)
	if err != nil {
		log.Printf("ERROR: No rfp cookie")
		RedirectToIDP(w, r)
		return
	}

	token := r.URL.Query().Get("id_token")
	if token != "" && ValidateJWT(rfpc.Value, token) {
		SetTokenCookieAndRedirect(w, r, token)
		return
	}

	tokenc, err := r.Cookie(TOKEN_COOKIE_NAME)
	if err != nil {
		log.Printf("ERROR: No token cookie")
		RedirectToIDP(w, r)
		return
	}

	if !ValidateJWT(tokenc.Value, rfpc.Value) {
		log.Printf("ERROR: Token is invalid")
		RedirectToIDP(w, r)
		return
	}

	r.Header["X-Forwarded-User"] = []string{GetJWTSubject(tokenc.Value)}

	proxy.ServeHTTP(w, r)
}

// Remove token and rfp cookies and redirect user to root of domain
func LogoutController(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:   TOKEN_COOKIE_NAME,
		Value:  "",
		MaxAge: 0,
	})

	http.SetCookie(w, &http.Cookie{
		Name:   TOKEN_COOKIE_NAME,
		Value:  "",
		MaxAge: 0,
	})

	http.Redirect(w, r, "/", http.StatusFound)
}

// TODO
func LoginController(w http.ResponseWriter, r *http.Request) {
}

// TODO
// Optional login allows for applications that can operate in anonymous mode or
// authenticated mode. When in anonmyous mode the request is proxied through
// without an X-Forwarded-User header. Upstream servers should either expose or
// map a URL for /.oidc/login to allow users to login. On successful login the
// user will be redirected back to the main page for the site (/)
func parseConfig() *ProxyConfig {
	return &ProxyConfig{
		IDProviderURL: "",
		ClientID:      "",
		UpstreamURL:   "http://localhost:9991/",
		ListenOn:      ":9992",
		TrustedCACert: "",
		IsOptional:    false,
	}
}

func main() {
	h := NewCautiousHTTPClient()

	idpc, err := FetchIdPConfig(h, "http://mcrute-virt:9993")
	if err != nil {
		fmt.Printf("%s\n", err)
		return
	}

	jwks, err := FetchJWKS(h, idpc.JwksUri)
	if err != nil {
		fmt.Printf("%s\n", err)
		return
	}
	fmt.Printf("%+v\n", jwks)
	return

	cfg := parseConfig()
	cfg.reverseProxy = httputil.NewSingleHostReverseProxy(URLMustParse(cfg.UpstreamURL))

	if cfg.IsOptional {
		http.HandleFunc("/.oidc/login", func(w http.ResponseWriter, r *http.Request) {
			LoginController(w,
				r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)))
		})
	}

	http.HandleFunc("/.oidc/logout", func(w http.ResponseWriter, r *http.Request) {
		LogoutController(w,
			r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)))
	})

	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		AuthProxyController(w,
			r.WithContext(context.WithValue(r.Context(), "ProxyConfig", cfg)))
	})

	log.Fatal(http.ListenAndServe(cfg.ListenOn, nil))
}