Add separate protected resource page
This commit adds a separate protected resource page to demonstrate how to selectively require logins. Add code to improve client performance by providing modification timestamps and Cache-Control headers for embedded static files.main
parent
0a4cc75bd3
commit
7ec9e393e0
@ -0,0 +1,51 @@
|
||||
/*
|
||||
Copyright 2020-2023 CAcert Inc.
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
)
|
||||
|
||||
type LoginHandler struct{}
|
||||
|
||||
func (l *LoginHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
if r.URL.Path != "/login" {
|
||||
http.NotFound(w, r)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
next := r.URL.Query().Get("next")
|
||||
if next != "" {
|
||||
http.Redirect(w, r, next, http.StatusFound)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
}
|
||||
|
||||
func NewLoginHandler() *LoginHandler {
|
||||
return &LoginHandler{}
|
||||
}
|
||||
@ -0,0 +1,155 @@
|
||||
/*
|
||||
Copyright 2020-2023 CAcert Inc.
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"html/template"
|
||||
"net/http"
|
||||
"net/url"
|
||||
|
||||
"github.com/nicksnyder/go-i18n/v2/i18n"
|
||||
log "github.com/sirupsen/logrus"
|
||||
|
||||
"code.cacert.org/cacert/oidc-demo-app/internal/services"
|
||||
"code.cacert.org/cacert/oidc-demo-app/ui"
|
||||
)
|
||||
|
||||
type ProtectedResource struct {
|
||||
bundle *i18n.Bundle
|
||||
logger *log.Logger
|
||||
protectedTemplate *template.Template
|
||||
logoutURL string
|
||||
tokenInfo *services.TokenInfoService
|
||||
messageCatalog *services.MessageCatalog
|
||||
publicURL string
|
||||
}
|
||||
|
||||
func (h *ProtectedResource) GetBundle() *i18n.Bundle {
|
||||
return h.bundle
|
||||
}
|
||||
|
||||
func (h *ProtectedResource) GetCatalog() *services.MessageCatalog {
|
||||
return h.messageCatalog
|
||||
}
|
||||
|
||||
func (h *ProtectedResource) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
if r.URL.Path != "/protected" {
|
||||
http.NotFound(w, r)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
localizer := GetLocalizer(h, r)
|
||||
|
||||
logoutURL, err := url.Parse(h.logoutURL)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
session, err := GetSession(r)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
tokenInfo, err := h.tokenInfo.GetTokenInfo(session)
|
||||
if err != nil {
|
||||
h.logger.WithError(err).Error("failed to get token info for request")
|
||||
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
if !tokenInfo.Expires.IsZero() {
|
||||
h.logger.WithField("expires", tokenInfo.Expires).Info("id token expires at")
|
||||
}
|
||||
|
||||
if tokenInfo.IDToken == "" {
|
||||
http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Add("Content-Type", "text/html")
|
||||
|
||||
msgLookup := h.messageCatalog.LookupMessage
|
||||
|
||||
logoutURL.RawQuery = url.Values{
|
||||
"id_token_hint": []string{tokenInfo.IDToken},
|
||||
"post_logout_redirect_uri": []string{fmt.Sprintf("%s/after-logout", h.publicURL)},
|
||||
}.Encode()
|
||||
|
||||
data := BaseTemplateData(h, localizer)
|
||||
|
||||
data["Title"] = msgLookup("IndexTitle", nil, localizer)
|
||||
data["Greeting"] = msgLookup(
|
||||
"GreetingAuthenticated", map[string]interface{}{"Name": tokenInfo.Name}, localizer,
|
||||
)
|
||||
data["LoginLabel"] = msgLookup("LoginLabel", nil, localizer)
|
||||
data["IntroductionText"] = msgLookup("ProtectedIntroductionText", nil, localizer)
|
||||
data["IsAuthenticated"] = true
|
||||
data["LogoutLabel"] = msgLookup("LogoutLabel", nil, localizer)
|
||||
data["LogoutURL"] = logoutURL.String()
|
||||
data["AuthenticatedAs"] = msgLookup("AuthenticatedAs", map[string]interface{}{
|
||||
"Name": tokenInfo.Name,
|
||||
"Email": tokenInfo.Email,
|
||||
}, localizer)
|
||||
|
||||
err = h.protectedTemplate.Lookup("base").Execute(w, data)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
func NewProtectedResourceHandler(
|
||||
logger *log.Logger,
|
||||
bundle *i18n.Bundle,
|
||||
catalog *services.MessageCatalog,
|
||||
oidcInfo *services.OIDCInformation,
|
||||
publicURL string, tokenInfoService *services.TokenInfoService,
|
||||
) (*ProtectedResource, error) {
|
||||
protectedTemplate, err := template.ParseFS(
|
||||
ui.Templates,
|
||||
"templates/base.gohtml", "templates/protected.gohtml")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not parse templates: %w", err)
|
||||
}
|
||||
|
||||
return &ProtectedResource{
|
||||
logger: logger,
|
||||
bundle: bundle,
|
||||
protectedTemplate: protectedTemplate,
|
||||
logoutURL: oidcInfo.OIDCConfiguration.EndSessionEndpoint,
|
||||
tokenInfo: tokenInfoService,
|
||||
messageCatalog: catalog,
|
||||
publicURL: publicURL,
|
||||
}, nil
|
||||
}
|
||||
@ -0,0 +1,100 @@
|
||||
/*
|
||||
Copyright 2023 CAcert Inc.
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package services
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/gorilla/sessions"
|
||||
"github.com/lestrrat-go/jwx/jwk"
|
||||
"github.com/lestrrat-go/jwx/jwt"
|
||||
"github.com/lestrrat-go/jwx/jwt/openid"
|
||||
log "github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
type OIDCTokenInfo struct {
|
||||
AccessToken string
|
||||
IDToken string
|
||||
RefreshToken string
|
||||
Expires time.Time
|
||||
Name string
|
||||
Email string
|
||||
}
|
||||
|
||||
type TokenInfoService struct {
|
||||
logger *log.Logger
|
||||
keySet jwk.Set
|
||||
}
|
||||
|
||||
func (s *TokenInfoService) GetTokenInfo(session *sessions.Session) (*OIDCTokenInfo, error) {
|
||||
tokenInfo := &OIDCTokenInfo{}
|
||||
|
||||
var ok bool
|
||||
|
||||
if tokenInfo.AccessToken, ok = session.Values[SessionAccessToken].(string); ok {
|
||||
s.logger.WithField("access_token", tokenInfo.AccessToken).Debug("found access token in session")
|
||||
}
|
||||
|
||||
if tokenInfo.RefreshToken, ok = session.Values[SessionRefreshToken].(string); ok {
|
||||
s.logger.WithField("refresh_token", tokenInfo.RefreshToken).Debug("found refresh token in session")
|
||||
}
|
||||
|
||||
if tokenInfo.IDToken, ok = session.Values[SessionIDToken].(string); ok {
|
||||
s.logger.WithField("id_token", tokenInfo.IDToken).Debug("found ID token in session")
|
||||
}
|
||||
|
||||
if tokenInfo.IDToken == "" {
|
||||
return tokenInfo, nil
|
||||
}
|
||||
|
||||
oidcToken, err := ParseIDToken(tokenInfo.IDToken, s.keySet)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not parse ID token: %w", err)
|
||||
}
|
||||
|
||||
tokenInfo.Expires = oidcToken.Expiration()
|
||||
|
||||
tokenInfo.Name = oidcToken.Name()
|
||||
|
||||
tokenInfo.Email = oidcToken.Email()
|
||||
|
||||
return tokenInfo, nil
|
||||
}
|
||||
|
||||
func InitTokenInfoService(logger *log.Logger, oidcInfo *OIDCInformation) (*TokenInfoService, error) {
|
||||
return &TokenInfoService{logger: logger, keySet: oidcInfo.KeySet}, nil
|
||||
}
|
||||
|
||||
func ParseIDToken(token string, keySet jwk.Set) (openid.Token, error) {
|
||||
var (
|
||||
parsedIDToken jwt.Token
|
||||
err error
|
||||
)
|
||||
|
||||
if parsedIDToken, err = jwt.ParseString(token, jwt.WithKeySet(keySet), jwt.WithToken(openid.New())); err != nil {
|
||||
return nil, fmt.Errorf("could not parse ID token: %w", err)
|
||||
}
|
||||
|
||||
if v, ok := parsedIDToken.(openid.Token); ok {
|
||||
return v, nil
|
||||
}
|
||||
|
||||
return nil, errors.New("ID token is no OpenID Connect Identity Token")
|
||||
}
|
||||
@ -1,9 +1,23 @@
|
||||
AuthenticatedAs = "The identity provider authenticated your identity as {{ .Name }} with the email address {{ .Email }}."
|
||||
ErrorTitle = "An error has occurred"
|
||||
IndexGreeting = "Hello {{ .User }}"
|
||||
IndexIntroductionText = "This is an authorization protected resource"
|
||||
GreetingAnonymous = "Hello"
|
||||
GreetingAuthenticated = "Hello {{ .Name }}"
|
||||
IndexIntroductionText = "This is a public resource."
|
||||
IndexTitle = "Welcome to the Demo application"
|
||||
ProtectedIntroductionText = "This is an authorization protected resource."
|
||||
|
||||
[IndexNavLabel]
|
||||
description = "Label for the index page in the top navigation"
|
||||
other = "Welcome"
|
||||
|
||||
[LoginLabel]
|
||||
description = "A label on a login button or link"
|
||||
other = "Login"
|
||||
|
||||
[LogoutLabel]
|
||||
description = "A label on a logout button or link"
|
||||
other = "Logout"
|
||||
|
||||
[ProtectedNavLabel]
|
||||
description = "Label for the protected resource page in the top navigation"
|
||||
other = "Protected area"
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
{{ define "content" }}
|
||||
<main class="container">
|
||||
<h1>{{ .Greeting }}</h1>
|
||||
<p>{{ .IntroductionText }}</p>
|
||||
<p>{{ .AuthenticatedAs }}</p>
|
||||
<a class="btn btn-outline-primary" href="{{ .LogoutURL }}">{{ .LogoutLabel }}</a>
|
||||
</main>
|
||||
{{ end }}
|
||||
Loading…
Reference in New Issue