Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow for role name to be used as entity alias #226

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+160 −89
Open

Allow for role name to be used as entity alias #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4e7255f
Allow for role name to be used as entity alias
mbillow Mar 26, 2023
b8c3531
Remove unnecessary 'use' keyword from configuration
mbillow Mar 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions path_login.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ func (b *jwtAuthBackend) pathLogin(ctx context.Context, req *logical.Request, d
return logical.ErrorResponse("audience claim found in JWT but no audiences bound to the role"), nil
}

alias, groupAliases, err := b.createIdentity(ctx, allClaims, role, nil)
alias, groupAliases, err := b.createIdentity(ctx, allClaims, roleName, role, nil)
if err != nil {
return logical.ErrorResponse(err.Error()), nil
}
Expand Down Expand Up @@ -211,9 +211,11 @@ func (b *jwtAuthBackend) pathLoginRenew(ctx context.Context, req *logical.Reques

// createIdentity creates an alias and set of groups aliases based on the role
// definition and received claims.
func (b *jwtAuthBackend) createIdentity(ctx context.Context, allClaims map[string]interface{}, role *jwtRole, tokenSource oauth2.TokenSource) (*logical.Alias, []*logical.Alias, error) {
func (b *jwtAuthBackend) createIdentity(ctx context.Context, allClaims map[string]interface{}, roleName string, role *jwtRole, tokenSource oauth2.TokenSource) (*logical.Alias, []*logical.Alias, error) {
var userClaimRaw interface{}
if role.UserClaimJSONPointer {
if role.RoleNameAsEntityAlias {
userClaimRaw = roleName
} else if role.UserClaimJSONPointer {
userClaimRaw = getClaim(b.Logger(), allClaims, role.UserClaim)
} else {
userClaimRaw = allClaims[role.UserClaim]
Expand Down
76 changes: 66 additions & 10 deletions path_login_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,17 @@ import (
type H map[string]interface{}

type testConfig struct {
oidc bool
role_type_oidc bool
audience bool
boundClaims bool
boundCIDRs bool
jwks bool
defaultLeeway int
expLeeway int
nbfLeeway int
groupsClaim string
oidc bool
role_type_oidc bool
audience bool
boundClaims bool
boundCIDRs bool
jwks bool
defaultLeeway int
expLeeway int
nbfLeeway int
groupsClaim string
roleNameAsAlias bool
}

type closeableBackend struct {
Expand Down Expand Up @@ -112,6 +113,7 @@ func setupBackend(t *testing.T, cfg testConfig) (closeableBackend, logical.Stora
"first_name": "name",
"/org/primary": "primary_org",
},
"role_name_as_entity_alias": cfg.roleNameAsAlias,
}
if cfg.role_type_oidc {
data["role_type"] = "oidc"
Expand Down Expand Up @@ -1384,6 +1386,60 @@ func TestLogin_JWKS_Concurrent(t *testing.T) {
}
}

func TestLogin_RoleNameAsEntityAlias(t *testing.T) {
cfg := testConfig{
audience: true,
roleNameAsAlias: true,
}
b, storage := setupBackend(t, cfg)

cl := sqjwt.Claims{
Subject: "r3qXcK2bix9eFECzsU3Sbmh0K16fatW6@clients",
Issuer: "https://team-vault.auth0.com/",
Expiry: sqjwt.NewNumericDate(time.Now().Add(5 * time.Second)),
Audience: sqjwt.Audience{"https://vault.plugin.auth.jwt.test"},
}

privateCl := struct {
Groups []string `json:"https://vault/groups"`
}{
[]string{"foo", "bar"},
}
jwtData, _ := getTestJWT(t, ecdsaPrivKey, cl, privateCl)

roleName := "plugin-test"
data := map[string]interface{}{
"role": roleName,
"jwt": jwtData,
}

req := &logical.Request{
Operation: logical.UpdateOperation,
Path: "login",
Storage: storage,
Data: data,
Connection: &logical.Connection{
RemoteAddr: "127.0.0.1",
},
}

resp, err := b.HandleRequest(context.Background(), req)
if err != nil {
t.Fatal(err)
}
if resp == nil {
t.Fatal("got nil response")
}
if resp.IsError() {
t.Fatalf("got error: %v", resp.Error())
}

aliasName := resp.Auth.Alias.Name
if aliasName != roleName {
t.Fatalf("Entity alias name did not match JWT role name. Expected %s, received %s", roleName, aliasName)
}
}

func TestResolveRole(t *testing.T) {
cfg := testConfig{
audience: true,
Expand Down
2 changes: 1 addition & 1 deletion path_oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,7 @@ func (b *jwtAuthBackend) pathCallback(ctx context.Context, req *logical.Request,
}
}

alias, groupAliases, err := b.createIdentity(ctx, allClaims, role, tokenSource)
alias, groupAliases, err := b.createIdentity(ctx, allClaims, roleName, role, tokenSource)
if err != nil {
return logical.ErrorResponse(err.Error()), nil
}
Expand Down
67 changes: 39 additions & 28 deletions path_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,11 @@ in OIDC responses.`,
Description: `Specifies the allowable elapsed time in seconds since the last time the
user was actively authenticated.`,
},
"role_name_as_entity_alias": {
Type: framework.TypeBool,
Description: `If true, the name of the role will be used as the entity alias name when
establishing user identity at login. Overrides user_claim, if set.`,
},
},
ExistenceCheck: b.pathRoleExistenceCheck,
Operations: map[logical.Operation]framework.OperationHandler{
Expand Down Expand Up @@ -204,18 +209,19 @@ type jwtRole struct {
ClockSkewLeeway time.Duration `json:"clock_skew_leeway"`

// Role binding properties
BoundAudiences []string `json:"bound_audiences"`
BoundSubject string `json:"bound_subject"`
BoundClaimsType string `json:"bound_claims_type"`
BoundClaims map[string]interface{} `json:"bound_claims"`
ClaimMappings map[string]string `json:"claim_mappings"`
UserClaim string `json:"user_claim"`
GroupsClaim string `json:"groups_claim"`
OIDCScopes []string `json:"oidc_scopes"`
AllowedRedirectURIs []string `json:"allowed_redirect_uris"`
VerboseOIDCLogging bool `json:"verbose_oidc_logging"`
MaxAge time.Duration `json:"max_age"`
UserClaimJSONPointer bool `json:"user_claim_json_pointer"`
BoundAudiences []string `json:"bound_audiences"`
BoundSubject string `json:"bound_subject"`
BoundClaimsType string `json:"bound_claims_type"`
BoundClaims map[string]interface{} `json:"bound_claims"`
ClaimMappings map[string]string `json:"claim_mappings"`
UserClaim string `json:"user_claim"`
GroupsClaim string `json:"groups_claim"`
OIDCScopes []string `json:"oidc_scopes"`
AllowedRedirectURIs []string `json:"allowed_redirect_uris"`
VerboseOIDCLogging bool `json:"verbose_oidc_logging"`
MaxAge time.Duration `json:"max_age"`
UserClaimJSONPointer bool `json:"user_claim_json_pointer"`
RoleNameAsEntityAlias bool `json:"role_name_as_entity_alias"`

// Deprecated by TokenParams
Policies []string `json:"policies"`
Expand Down Expand Up @@ -308,22 +314,23 @@ func (b *jwtAuthBackend) pathRoleRead(ctx context.Context, req *logical.Request,

// Create a map of data to be returned
d := map[string]interface{}{
"role_type": role.RoleType,
"expiration_leeway": int64(role.ExpirationLeeway.Seconds()),
"not_before_leeway": int64(role.NotBeforeLeeway.Seconds()),
"clock_skew_leeway": int64(role.ClockSkewLeeway.Seconds()),
"bound_audiences": role.BoundAudiences,
"bound_subject": role.BoundSubject,
"bound_claims_type": role.BoundClaimsType,
"bound_claims": role.BoundClaims,
"claim_mappings": role.ClaimMappings,
"user_claim": role.UserClaim,
"user_claim_json_pointer": role.UserClaimJSONPointer,
"groups_claim": role.GroupsClaim,
"allowed_redirect_uris": role.AllowedRedirectURIs,
"oidc_scopes": role.OIDCScopes,
"verbose_oidc_logging": role.VerboseOIDCLogging,
"max_age": int64(role.MaxAge.Seconds()),
"role_type": role.RoleType,
"expiration_leeway": int64(role.ExpirationLeeway.Seconds()),
"not_before_leeway": int64(role.NotBeforeLeeway.Seconds()),
"clock_skew_leeway": int64(role.ClockSkewLeeway.Seconds()),
"bound_audiences": role.BoundAudiences,
"bound_subject": role.BoundSubject,
"bound_claims_type": role.BoundClaimsType,
"bound_claims": role.BoundClaims,
"claim_mappings": role.ClaimMappings,
"user_claim": role.UserClaim,
"user_claim_json_pointer": role.UserClaimJSONPointer,
"groups_claim": role.GroupsClaim,
"allowed_redirect_uris": role.AllowedRedirectURIs,
"oidc_scopes": role.OIDCScopes,
"verbose_oidc_logging": role.VerboseOIDCLogging,
"max_age": int64(role.MaxAge.Seconds()),
"role_name_as_entity_alias": role.RoleNameAsEntityAlias,
}

role.PopulateTokenData(d)
Expand Down Expand Up @@ -537,6 +544,10 @@ func (b *jwtAuthBackend) pathRoleCreateUpdate(ctx context.Context, req *logical.
"'allowed_redirect_uris' must be set if 'role_type' is 'oidc' or unspecified."), nil
}

if roleNameAsEntityAlias, ok := data.GetOk("role_name_as_entity_alias"); ok {
role.RoleNameAsEntityAlias = roleNameAsEntityAlias.(bool)
}

// OIDC verification will enforce that the audience match the configured client_id.
// For other methods, require at least one bound constraint.
if roleType != "oidc" {
Expand Down
96 changes: 49 additions & 47 deletions path_role_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,24 +74,25 @@ func TestPath_Create(t *testing.T) {
TokenNumUses: 12,
TokenBoundCIDRs: []*sockaddr.SockAddrMarshaler{{SockAddr: expectedSockAddr}},
},
RoleType: "jwt",
Policies: []string{"test"},
Period: 3 * time.Second,
BoundSubject: "testsub",
BoundAudiences: []string{"vault"},
BoundClaimsType: "string",
UserClaim: "user",
UserClaimJSONPointer: true,
GroupsClaim: "groups",
TTL: 1 * time.Second,
MaxTTL: 5 * time.Second,
ExpirationLeeway: 0,
NotBeforeLeeway: 0,
ClockSkewLeeway: 0,
NumUses: 12,
BoundCIDRs: []*sockaddr.SockAddrMarshaler{{SockAddr: expectedSockAddr}},
AllowedRedirectURIs: []string(nil),
MaxAge: 60 * time.Second,
RoleType: "jwt",
Policies: []string{"test"},
Period: 3 * time.Second,
BoundSubject: "testsub",
BoundAudiences: []string{"vault"},
BoundClaimsType: "string",
UserClaim: "user",
UserClaimJSONPointer: true,
GroupsClaim: "groups",
TTL: 1 * time.Second,
MaxTTL: 5 * time.Second,
ExpirationLeeway: 0,
NotBeforeLeeway: 0,
ClockSkewLeeway: 0,
NumUses: 12,
BoundCIDRs: []*sockaddr.SockAddrMarshaler{{SockAddr: expectedSockAddr}},
AllowedRedirectURIs: []string(nil),
MaxAge: 60 * time.Second,
RoleNameAsEntityAlias: false,
}

req := &logical.Request{
Expand Down Expand Up @@ -763,35 +764,36 @@ func TestPath_Read(t *testing.T) {
}

expected := map[string]interface{}{
"role_type": "jwt",
"bound_claims_type": "string",
"bound_claims": map[string]interface{}(nil),
"claim_mappings": map[string]string(nil),
"bound_subject": "testsub",
"bound_audiences": []string{"vault"},
"allowed_redirect_uris": []string{"http://127.0.0.1"},
"oidc_scopes": []string{"email", "profile"},
"user_claim": "user",
"user_claim_json_pointer": false,
"groups_claim": "groups",
"token_policies": []string{"test"},
"policies": []string{"test"},
"token_period": int64(3),
"period": int64(3),
"token_ttl": int64(1),
"ttl": int64(1),
"token_num_uses": 12,
"num_uses": 12,
"token_max_ttl": int64(5),
"max_ttl": int64(5),
"expiration_leeway": int64(500),
"not_before_leeway": int64(500),
"clock_skew_leeway": int64(100),
"verbose_oidc_logging": false,
"token_type": logical.TokenTypeDefault.String(),
"token_no_default_policy": false,
"token_explicit_max_ttl": int64(0),
"max_age": int64(0),
"role_type": "jwt",
"bound_claims_type": "string",
"bound_claims": map[string]interface{}(nil),
"claim_mappings": map[string]string(nil),
"bound_subject": "testsub",
"bound_audiences": []string{"vault"},
"allowed_redirect_uris": []string{"http://127.0.0.1"},
"oidc_scopes": []string{"email", "profile"},
"user_claim": "user",
"user_claim_json_pointer": false,
"groups_claim": "groups",
"token_policies": []string{"test"},
"policies": []string{"test"},
"token_period": int64(3),
"period": int64(3),
"token_ttl": int64(1),
"ttl": int64(1),
"token_num_uses": 12,
"num_uses": 12,
"token_max_ttl": int64(5),
"max_ttl": int64(5),
"expiration_leeway": int64(500),
"not_before_leeway": int64(500),
"clock_skew_leeway": int64(100),
"verbose_oidc_logging": false,
"token_type": logical.TokenTypeDefault.String(),
"token_no_default_policy": false,
"token_explicit_max_ttl": int64(0),
"max_age": int64(0),
"role_name_as_entity_alias": false,
}

req := &logical.Request{
Expand Down