-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Implements an oauth provider for sign-in with apple. Requires some additional flexibility in oauth credentials / providers: - Include a map of additional data in credentials. - Allow providers to override secret behavior - configured secret in apple credentials is a private key used to sign a secret calculated at runtime, in this case a JWT that includes additional data as claims. - Allow providers to accept returns as HTTP POST instead of GET. - Allow providers to add additional oauth options to authorization request. Co-authored-by: Lance Ivy <[email protected]>
- Loading branch information
Showing
25 changed files
with
1,264 additions
and
58 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| package oauth | ||
|
|
||
| import ( | ||
| "encoding/hex" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| "github.com/keratin/authn-server/lib/oauth/apple" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| // NewAppleProvider returns a AuthN integration for sign-in with Apple OAuth | ||
| func NewAppleProvider(credentials *Credentials) (*Provider, error) { | ||
| config := &oauth2.Config{ | ||
| ClientID: credentials.ID, | ||
| // ClientSecret for apple is built using apple.GenerateSecret | ||
| // this function is passed to the provider for use as an override | ||
| // and built fresh on each call to provider.Config(returnURL). | ||
| ClientSecret: "", | ||
| Scopes: []string{"email"}, | ||
| Endpoint: apple.Endpoint(), | ||
| } | ||
|
|
||
| teamID, keyID, expiresIn, constructErr := apple.ExtractCredentialData(credentials.Additional) | ||
| if constructErr != nil { | ||
| return nil, fmt.Errorf("apple: failed to extract credentials: %w", constructErr) | ||
| } | ||
|
|
||
| keyBytes, err := hex.DecodeString(credentials.Secret) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("apple: failed to decode key from client secret: %w", err) | ||
| } | ||
|
|
||
| signingKey, constructErr := apple.ParsePrivateKey(keyBytes, keyID) | ||
| if constructErr != nil { | ||
| return nil, fmt.Errorf("apple: failed to parse signing key: %w", constructErr) | ||
| } | ||
|
|
||
| appleTokenReader := apple.NewTokenReader(config.ClientID) | ||
|
|
||
| getAppleUserInfo := func(t *oauth2.Token) (*UserInfo, error) { | ||
| id, email, err := appleTokenReader.GetUserDetailsFromToken(t) | ||
|
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &UserInfo{ | ||
| ID: id, | ||
| Email: email, | ||
| }, nil | ||
| } | ||
|
|
||
| return NewProvider(config, getAppleUserInfo, | ||
| WithSecretGenerator(func() (string, error) { | ||
| return apple.GenerateSecret(*signingKey, keyID, config.ClientID, teamID, expiresIn) | ||
| }), | ||
| // Apple requires form_post response mode if scopes are requested | ||
| WithAuthCodeOptions(oauth2.SetAuthURLParam("response_mode", "form_post")), | ||
| // So we need to handle returns via POST instead of GET | ||
| WithReturnMethod(http.MethodPost)), nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package apple | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/go-jose/go-jose/v3/jwt" | ||
| ) | ||
|
|
||
| type Claims struct { | ||
| Email string `json:"email"` | ||
| jwt.Claims | ||
| } | ||
|
|
||
| // Validate performs apple-specific id_token validation. | ||
| // `email` is the only additional claim we currently require. | ||
| // See https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple#3383773 | ||
| // for more details. | ||
| func (c Claims) Validate(clientID string) error { | ||
| if clientID == "" { | ||
| return fmt.Errorf("cannot validate with empty clientID") | ||
| } | ||
|
|
||
| if c.Email == "" { | ||
| return fmt.Errorf("missing claim 'email'") | ||
| } | ||
|
|
||
| if c.Expiry == nil { | ||
| return fmt.Errorf("missing claim 'exp'") | ||
| } | ||
|
|
||
| if c.IssuedAt == nil { | ||
| return fmt.Errorf("missing claim 'iat'") | ||
| } | ||
|
|
||
| return c.Claims.Validate(jwt.Expected{ | ||
| Issuer: BaseURL, | ||
| Audience: jwt.Audience{clientID}, | ||
| }) | ||
| } |
Oops, something went wrong.