Token exchange support #165

ctriant · 2021-12-09T15:49:54Z

No description provided.

Fix merge

Fix tests

Support audience for refresh token

src/oidcop/oidc/token.py

nsklikas · 2022-01-12T10:40:43Z

src/oidcop/oidc/token.py

+            fun = importer(self.config["token_exchange"]["policy"][""]["callable"])
+            kwargs = self.config["token_exchange"]["policy"][""]["kwargs"]


What if that doesn't exist? Should we simply pass if a function isn't defined and accept the request?

nsklikas · 2022-01-19T17:42:25Z

src/oidcop/oauth2/token.py

+                _session_info = _mngr.get_session_info(
+                    session_id=sid, grant=True)
+            except Exception:
+                logger.error("Error retrieving token exchabge session information")


Typo Error retrieving token exchange session information

src/oidcop/oauth2/token.py

nsklikas · 2022-01-19T17:50:12Z

src/oidcop/oauth2/token.py

+        if not resource:
+            pass


This if clause is unnecessary

nsklikas · 2022-01-19T17:51:15Z

src/oidcop/oauth2/token.py

+                error_description=f"Exchange {request['subject_token_type']} to refresh token forbbiden",
+            )
+
+    scopes = list(set(request.get("scope", ["openid"])).intersection(kwargs.get("scope", ["openid"])))


Why set the scope default value to openid?

nsklikas · 2022-01-19T17:52:18Z

src/oidcop/oauth2/token.py

+        if not audience:
+            pass


This if clause is unnecessary

nsklikas · 2022-01-20T10:37:51Z

src/oidcop/session/grant.py

        issued_at: int = 0,
        expires_in: int = 0,
        expires_at: int = 0,
        revoked: bool = False,
        token_map: Optional[dict] = None,
-        users: list = None,
+        users: list = None


What is the use of this parameter? Maybe we should remove it?

nsklikas · 2022-01-21T10:29:32Z

src/oidcop/oauth2/token.py

+                error_description="Unauthorized scope requested",
+            )
+
+        subject_token_type = request["subject_token_type"]


This is already defined in https://github.com/IdentityPython/oidc-op/pull/165/files#diff-701a8905a1282dde6d1b7325ab65768a840a3942e41112d24135688431564df3R443

nsklikas · 2022-01-21T10:33:20Z

src/oidcop/oauth2/token.py

+        response_args["access_token"] = token.value
+        response_args["scope"] = token.scope
+        response_args["issued_token_type"] = token.token_class
+        response_args["expires_in"] = token.usage_rules.get("expires_in", 0)


Let's use the same logic as in https://github.com/IdentityPython/oidc-op/blob/master/src/oidcop/oauth2/token.py#L166:

if token.expires_at: _response["expires_in"] = token.expires_at - utc_time_sans_frac()

nsklikas · 2022-01-24T10:37:50Z

src/oidcop/oauth2/token.py

+def default_token_exchange_policy(request, context, subject_token, **kwargs):
+    if "resource" in request:
+        resource = kwargs.get("resource", [])
+        if not len(set(request["resource"]).intersection(set(resource))):


This is cleaner:

if not set(request["resource"]).issubset(set(resource)):

nsklikas · 2022-01-24T10:38:18Z

src/oidcop/oauth2/token.py

+                error="invalid_target", error_description="Refresh token has single owner"
+            )
+        audience = kwargs.get("audience", [])
+        if audience and not len(set(request["audience"]).intersection(set(audience))):


same (use issubset)

nsklikas · 2022-01-24T11:54:57Z

src/oidcop/session/grant.py

        self.usage_rules = {
            "access_token": {"supports_minting": ["access_token"], "expires_in": 60}
        }


I don't think this is still needed.

src/oidcop/session/manager.py

nsklikas · 2022-01-26T08:52:51Z

Run darker on this. Other than this LGTM.

@rohe @peppelinux what do you think?

nsklikas · 2022-01-26T11:02:56Z

src/oidcop/oauth2/token.py

+        response_args = {}
+        response_args["access_token"] = token.value
+        response_args["scope"] = token.scope
+        response_args["issued_token_type"] = token.token_class


This must be the issued_token_type that was requested not the one on the class (urn:ietf:params:oauth:token-type:access_token vs access_token)

rohe · 2022-02-06T08:46:12Z

Nice set of tests !

nsklikas · 2022-02-07T11:23:49Z

We merged this in our private fork, here are some things that need to be done:

Check that the new scopes are a subset of the allowed scopes for the client
Set the expires_at of the new token to be the same as the original token's. This would stop a client from getting an access token from another client and using token exchange to refresh it indefinitely.
Do we need to check whether the client using the token is allowed to do so? (in the case where the token wasn't issued for them)

peppelinux · 2022-02-24T13:34:02Z

@nsklikas we just have two conflicting files right now :)

melanger · 2022-08-01T11:30:59Z

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

ctriant · 2022-08-02T08:53:35Z

@peppelinux @nsklikas Hello, are you planning to merge this in public repository? I would really like to have token exchange in SATOSA.

Hello! It is already supported in idpy-oidc. https://github.com/IdentityPython/idpy-oidc/tree/main

rohe · 2022-08-02T14:22:06Z

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

melanger · 2022-08-03T07:30:37Z

The default OIDC frontend in SATOSA uses pyop and oic, but I am using satosa-oidcop which uses this library (oidc-op).

It's supported in idpy-oidc but the official SATOSA version at IdentityPython is still not based on idpy-oidc.

So which library is the "new" one? I though it is this one.

rohe · 2022-08-03T07:34:49Z

idpy-oidc is where the action is.

melanger · 2022-08-04T10:19:10Z

idpy-oidc is where the action is.

So let me recap:

SATOSA contains OpenIDConnectFrontend based on pyop, that's an "old" one
satosa-oidcop provides OidcOpFrontend based on oidc-op (this library), which is a "less old" one
the current library is idpy-oidc, but there is no SATOSA frontend which uses the library

What are the development plans? Are you going to support oidc-op until idpy-oidc is mature enough and integrated with SATOSA?

rohe · 2022-08-04T11:34:12Z

Good questions all.
I'm responsible for the OIDC/OAuth2 libraries within IdentityPython and I would like SATOSA to switch to using idpy-oidc as soon as possible.
I think there is a SATOSA frontend, based on idpy-oidc, in the EduTeams implementation but it isn't public yet.

angelakis and others added 5 commits December 9, 2021 17:39

Add proper token exchange tests

8927805

Fix merge

Port token exchange feature to oidcop

16aac13

Fix tests

Fix token exchange claims on userinfo endpoint

da554e0

Fix token exchange claims on introspection endpoint

77251f1

Add support of refresh token on token exchange

b40c5bc

Support audience for refresh token

nsklikas requested review from rohe, peppelinux and nsklikas and removed request for rohe and peppelinux December 13, 2021 11:05

nsklikas reviewed Dec 15, 2021

View reviewed changes