Add separate protected resource page
This commit adds a separate protected resource page to demonstrate how to selectively require logins. Add code to improve client performance by providing modification timestamps and Cache-Control headers for embedded static files.main
parent
0a4cc75bd3
commit
7ec9e393e0
@ -0,0 +1,51 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2020-2023 CAcert Inc.
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package handlers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
)
|
||||||
|
|
||||||
|
type LoginHandler struct{}
|
||||||
|
|
||||||
|
func (l *LoginHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||||
|
if r.Method != http.MethodGet {
|
||||||
|
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.URL.Path != "/login" {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
next := r.URL.Query().Get("next")
|
||||||
|
if next != "" {
|
||||||
|
http.Redirect(w, r, next, http.StatusFound)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
http.Redirect(w, r, "/", http.StatusFound)
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewLoginHandler() *LoginHandler {
|
||||||
|
return &LoginHandler{}
|
||||||
|
}
|
||||||
@ -0,0 +1,155 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2020-2023 CAcert Inc.
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package handlers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"html/template"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
|
||||||
|
"github.com/nicksnyder/go-i18n/v2/i18n"
|
||||||
|
log "github.com/sirupsen/logrus"
|
||||||
|
|
||||||
|
"code.cacert.org/cacert/oidc-demo-app/internal/services"
|
||||||
|
"code.cacert.org/cacert/oidc-demo-app/ui"
|
||||||
|
)
|
||||||
|
|
||||||
|
type ProtectedResource struct {
|
||||||
|
bundle *i18n.Bundle
|
||||||
|
logger *log.Logger
|
||||||
|
protectedTemplate *template.Template
|
||||||
|
logoutURL string
|
||||||
|
tokenInfo *services.TokenInfoService
|
||||||
|
messageCatalog *services.MessageCatalog
|
||||||
|
publicURL string
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ProtectedResource) GetBundle() *i18n.Bundle {
|
||||||
|
return h.bundle
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ProtectedResource) GetCatalog() *services.MessageCatalog {
|
||||||
|
return h.messageCatalog
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *ProtectedResource) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||||
|
if r.Method != http.MethodGet {
|
||||||
|
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if r.URL.Path != "/protected" {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
localizer := GetLocalizer(h, r)
|
||||||
|
|
||||||
|
logoutURL, err := url.Parse(h.logoutURL)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
session, err := GetSession(r)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
tokenInfo, err := h.tokenInfo.GetTokenInfo(session)
|
||||||
|
if err != nil {
|
||||||
|
h.logger.WithError(err).Error("failed to get token info for request")
|
||||||
|
|
||||||
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if !tokenInfo.Expires.IsZero() {
|
||||||
|
h.logger.WithField("expires", tokenInfo.Expires).Info("id token expires at")
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenInfo.IDToken == "" {
|
||||||
|
http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
w.Header().Add("Content-Type", "text/html")
|
||||||
|
|
||||||
|
msgLookup := h.messageCatalog.LookupMessage
|
||||||
|
|
||||||
|
logoutURL.RawQuery = url.Values{
|
||||||
|
"id_token_hint": []string{tokenInfo.IDToken},
|
||||||
|
"post_logout_redirect_uri": []string{fmt.Sprintf("%s/after-logout", h.publicURL)},
|
||||||
|
}.Encode()
|
||||||
|
|
||||||
|
data := BaseTemplateData(h, localizer)
|
||||||
|
|
||||||
|
data["Title"] = msgLookup("IndexTitle", nil, localizer)
|
||||||
|
data["Greeting"] = msgLookup(
|
||||||
|
"GreetingAuthenticated", map[string]interface{}{"Name": tokenInfo.Name}, localizer,
|
||||||
|
)
|
||||||
|
data["LoginLabel"] = msgLookup("LoginLabel", nil, localizer)
|
||||||
|
data["IntroductionText"] = msgLookup("ProtectedIntroductionText", nil, localizer)
|
||||||
|
data["IsAuthenticated"] = true
|
||||||
|
data["LogoutLabel"] = msgLookup("LogoutLabel", nil, localizer)
|
||||||
|
data["LogoutURL"] = logoutURL.String()
|
||||||
|
data["AuthenticatedAs"] = msgLookup("AuthenticatedAs", map[string]interface{}{
|
||||||
|
"Name": tokenInfo.Name,
|
||||||
|
"Email": tokenInfo.Email,
|
||||||
|
}, localizer)
|
||||||
|
|
||||||
|
err = h.protectedTemplate.Lookup("base").Execute(w, data)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
|
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewProtectedResourceHandler(
|
||||||
|
logger *log.Logger,
|
||||||
|
bundle *i18n.Bundle,
|
||||||
|
catalog *services.MessageCatalog,
|
||||||
|
oidcInfo *services.OIDCInformation,
|
||||||
|
publicURL string, tokenInfoService *services.TokenInfoService,
|
||||||
|
) (*ProtectedResource, error) {
|
||||||
|
protectedTemplate, err := template.ParseFS(
|
||||||
|
ui.Templates,
|
||||||
|
"templates/base.gohtml", "templates/protected.gohtml")
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("could not parse templates: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &ProtectedResource{
|
||||||
|
logger: logger,
|
||||||
|
bundle: bundle,
|
||||||
|
protectedTemplate: protectedTemplate,
|
||||||
|
logoutURL: oidcInfo.OIDCConfiguration.EndSessionEndpoint,
|
||||||
|
tokenInfo: tokenInfoService,
|
||||||
|
messageCatalog: catalog,
|
||||||
|
publicURL: publicURL,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
@ -0,0 +1,100 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2023 CAcert Inc.
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package services
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/gorilla/sessions"
|
||||||
|
"github.com/lestrrat-go/jwx/jwk"
|
||||||
|
"github.com/lestrrat-go/jwx/jwt"
|
||||||
|
"github.com/lestrrat-go/jwx/jwt/openid"
|
||||||
|
log "github.com/sirupsen/logrus"
|
||||||
|
)
|
||||||
|
|
||||||
|
type OIDCTokenInfo struct {
|
||||||
|
AccessToken string
|
||||||
|
IDToken string
|
||||||
|
RefreshToken string
|
||||||
|
Expires time.Time
|
||||||
|
Name string
|
||||||
|
Email string
|
||||||
|
}
|
||||||
|
|
||||||
|
type TokenInfoService struct {
|
||||||
|
logger *log.Logger
|
||||||
|
keySet jwk.Set
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *TokenInfoService) GetTokenInfo(session *sessions.Session) (*OIDCTokenInfo, error) {
|
||||||
|
tokenInfo := &OIDCTokenInfo{}
|
||||||
|
|
||||||
|
var ok bool
|
||||||
|
|
||||||
|
if tokenInfo.AccessToken, ok = session.Values[SessionAccessToken].(string); ok {
|
||||||
|
s.logger.WithField("access_token", tokenInfo.AccessToken).Debug("found access token in session")
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenInfo.RefreshToken, ok = session.Values[SessionRefreshToken].(string); ok {
|
||||||
|
s.logger.WithField("refresh_token", tokenInfo.RefreshToken).Debug("found refresh token in session")
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenInfo.IDToken, ok = session.Values[SessionIDToken].(string); ok {
|
||||||
|
s.logger.WithField("id_token", tokenInfo.IDToken).Debug("found ID token in session")
|
||||||
|
}
|
||||||
|
|
||||||
|
if tokenInfo.IDToken == "" {
|
||||||
|
return tokenInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
oidcToken, err := ParseIDToken(tokenInfo.IDToken, s.keySet)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("could not parse ID token: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tokenInfo.Expires = oidcToken.Expiration()
|
||||||
|
|
||||||
|
tokenInfo.Name = oidcToken.Name()
|
||||||
|
|
||||||
|
tokenInfo.Email = oidcToken.Email()
|
||||||
|
|
||||||
|
return tokenInfo, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func InitTokenInfoService(logger *log.Logger, oidcInfo *OIDCInformation) (*TokenInfoService, error) {
|
||||||
|
return &TokenInfoService{logger: logger, keySet: oidcInfo.KeySet}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func ParseIDToken(token string, keySet jwk.Set) (openid.Token, error) {
|
||||||
|
var (
|
||||||
|
parsedIDToken jwt.Token
|
||||||
|
err error
|
||||||
|
)
|
||||||
|
|
||||||
|
if parsedIDToken, err = jwt.ParseString(token, jwt.WithKeySet(keySet), jwt.WithToken(openid.New())); err != nil {
|
||||||
|
return nil, fmt.Errorf("could not parse ID token: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if v, ok := parsedIDToken.(openid.Token); ok {
|
||||||
|
return v, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, errors.New("ID token is no OpenID Connect Identity Token")
|
||||||
|
}
|
||||||
@ -1,9 +1,23 @@
|
|||||||
AuthenticatedAs = "The identity provider authenticated your identity as {{ .Name }} with the email address {{ .Email }}."
|
AuthenticatedAs = "The identity provider authenticated your identity as {{ .Name }} with the email address {{ .Email }}."
|
||||||
ErrorTitle = "An error has occurred"
|
ErrorTitle = "An error has occurred"
|
||||||
IndexGreeting = "Hello {{ .User }}"
|
GreetingAnonymous = "Hello"
|
||||||
IndexIntroductionText = "This is an authorization protected resource"
|
GreetingAuthenticated = "Hello {{ .Name }}"
|
||||||
|
IndexIntroductionText = "This is a public resource."
|
||||||
IndexTitle = "Welcome to the Demo application"
|
IndexTitle = "Welcome to the Demo application"
|
||||||
|
ProtectedIntroductionText = "This is an authorization protected resource."
|
||||||
|
|
||||||
|
[IndexNavLabel]
|
||||||
|
description = "Label for the index page in the top navigation"
|
||||||
|
other = "Welcome"
|
||||||
|
|
||||||
|
[LoginLabel]
|
||||||
|
description = "A label on a login button or link"
|
||||||
|
other = "Login"
|
||||||
|
|
||||||
[LogoutLabel]
|
[LogoutLabel]
|
||||||
description = "A label on a logout button or link"
|
description = "A label on a logout button or link"
|
||||||
other = "Logout"
|
other = "Logout"
|
||||||
|
|
||||||
|
[ProtectedNavLabel]
|
||||||
|
description = "Label for the protected resource page in the top navigation"
|
||||||
|
other = "Protected area"
|
||||||
|
|||||||
@ -0,0 +1,8 @@
|
|||||||
|
{{ define "content" }}
|
||||||
|
<main class="container">
|
||||||
|
<h1>{{ .Greeting }}</h1>
|
||||||
|
<p>{{ .IntroductionText }}</p>
|
||||||
|
<p>{{ .AuthenticatedAs }}</p>
|
||||||
|
<a class="btn btn-outline-primary" href="{{ .LogoutURL }}">{{ .LogoutLabel }}</a>
|
||||||
|
</main>
|
||||||
|
{{ end }}
|
||||||
Loading…
Reference in New Issue