Skip to content

Commit

Permalink
fix: support issuer with and without trailing slash
Browse files Browse the repository at this point in the history 
BREAKING CHANGE: The `iss` (issuer) value no longer appends a trailing slash but instead uses the raw value set in the config.

Setting

```yaml
urls:
  self:
    issuer: https://auth.example.com
```

has changed

```patch
-  "iss": "https://auth.example.com/"
+  "iss": "https://auth.example.com"
```

To set a trailing slash make sure to set it in the config value:

```yaml
urls:
  self:
    issuer: https://auth.example.com/
```

Closes #1482
  • Loading branch information
@aeneasr
aeneasr committed Sep 7, 2022
1 parent 1ab345b commit d746fa4
Show file tree
Hide file tree
Showing 5 changed files with 13 additions and 16 deletions.
4 changes: 1 addition & 3 deletions driver/config/provider.go
View file
Expand Up @@ -314,9 +314,7 @@ func (p *DefaultProvider) PublicURL(ctx context.Context) *url.URL {
}

func (p *DefaultProvider) IssuerURL(ctx context.Context) *url.URL {
issuerURL := p.getProvider(ctx).RequestURIF(KeyIssuerURL, p.fallbackURL(ctx, "/", p.host(PublicInterface), p.port(PublicInterface)))
issuerURL.Path = strings.TrimRight(issuerURL.Path, "/") + "/"
return urlRoot(issuerURL)
return p.getProvider(ctx).RequestURIF(KeyIssuerURL, p.fallbackURL(ctx, "/", p.host(PublicInterface), p.port(PublicInterface)))
}

func (p *DefaultProvider) OAuth2ClientRegistrationURL(ctx context.Context) *url.URL {
Expand Down
8 changes: 4 additions & 4 deletions driver/config/provider_test.go
View file
Expand Up @@ -154,7 +154,7 @@ func TestProviderIssuerURL(t *testing.T) {
l.Logrus().SetOutput(ioutil.Discard)
p := MustNew(context.Background(), l)
p.MustSet(ctx, KeyIssuerURL, "http://hydra.localhost")
assert.Equal(t, "http://hydra.localhost/", p.IssuerURL(ctx).String())
assert.Equal(t, "http://hydra.localhost", p.IssuerURL(ctx).String())

p2 := MustNew(context.Background(), l)
p2.MustSet(ctx, KeyIssuerURL, "http://hydra.localhost/")
Expand All @@ -169,7 +169,7 @@ func TestProviderIssuerPublicURL(t *testing.T) {
p.MustSet(ctx, KeyIssuerURL, "http://hydra.localhost")
p.MustSet(ctx, KeyPublicURL, "http://hydra.example")

assert.Equal(t, "http://hydra.localhost/", p.IssuerURL(ctx).String())
assert.Equal(t, "http://hydra.localhost", p.IssuerURL(ctx).String())
assert.Equal(t, "http://hydra.example/", p.PublicURL(ctx).String())
assert.Equal(t, "http://hydra.localhost/.well-known/jwks.json", p.JWKSURL(ctx).String())
assert.Equal(t, "http://hydra.example/oauth2/fallbacks/consent", p.ConsentURL(ctx).String())
Expand All @@ -180,7 +180,7 @@ func TestProviderIssuerPublicURL(t *testing.T) {
assert.Equal(t, "http://hydra.example/userinfo", p.OIDCDiscoveryUserinfoEndpoint(ctx).String())

p2 := MustNew(context.Background(), l)
p2.MustSet(ctx, KeyIssuerURL, "http://hydra.localhost")
p2.MustSet(ctx, KeyIssuerURL, "http://hydra.localhost/")
assert.Equal(t, "http://hydra.localhost/", p2.IssuerURL(ctx).String())
assert.Equal(t, "http://hydra.localhost/", p2.PublicURL(ctx).String())
assert.Equal(t, "http://hydra.localhost/.well-known/jwks.json", p2.JWKSURL(ctx).String())
Expand Down Expand Up @@ -283,7 +283,7 @@ func TestViperProviderValidates(t *testing.T) {
assert.Equal(t, []string{"whatever"}, c.DefaultClientScope(ctx))

// urls
assert.Equal(t, urlx.ParseOrPanic("https://issuer/"), c.IssuerURL(ctx))
assert.Equal(t, urlx.ParseOrPanic("https://issuer"), c.IssuerURL(ctx))
assert.Equal(t, urlx.ParseOrPanic("https://public/"), c.PublicURL(ctx))
assert.Equal(t, urlx.ParseOrPanic("https://login/"), c.LoginURL(ctx))
assert.Equal(t, urlx.ParseOrPanic("https://consent/"), c.ConsentURL(ctx))
Expand Down
2 changes: 1 addition & 1 deletion oauth2/.snapshots/TestHandlerWellKnown-hsm_enabled=false.json
View file
@@ -1,5 +1,5 @@
{
"issuer": "http://hydra.localhost/",
"issuer": "http://hydra.localhost",
"authorization_endpoint": "http://hydra.localhost/oauth2/auth",
"registration_endpoint": "http://client-register/registration",
"token_endpoint": "http://hydra.localhost/oauth2/token",
Expand Down
11 changes: 5 additions & 6 deletions oauth2/handler.go
View file
Expand Up @@ -237,7 +237,7 @@ func (h *Handler) WellKnownHandler(w http.ResponseWriter, r *http.Request) {
return
}
h.r.Writer().Write(w, r, &WellKnown{
Issuer: strings.TrimRight(h.c.IssuerURL(r.Context()).String(), "/") + "/",
Issuer: h.c.IssuerURL(r.Context()).String(),
AuthURL: h.c.OAuth2AuthURL(r.Context()).String(),
TokenURL: h.c.OAuth2TokenURL(r.Context()).String(),
JWKsURI: h.c.JWKSURL(r.Context()).String(),
Expand Down Expand Up @@ -506,7 +506,7 @@ func (h *Handler) IntrospectHandler(w http.ResponseWriter, r *http.Request, _ ht
Username: session.GetUsername(),
Extra: session.Extra,
Audience: audience,
Issuer: strings.TrimRight(h.c.IssuerURL(ctx).String(), "/") + "/",
Issuer: h.c.IssuerURL(ctx).String(),
ObfuscatedSubject: obfuscated,
TokenType: resp.GetAccessTokenType(),
TokenUse: string(resp.GetTokenUse()),
Expand Down Expand Up @@ -616,7 +616,7 @@ func (h *Handler) TokenHandler(w http.ResponseWriter, r *http.Request) {
}
session.ClientID = accessRequest.GetClient().GetID()
session.KID = accessTokenKeyID
session.DefaultSession.Claims.Issuer = strings.TrimRight(h.c.IssuerURL(r.Context()).String(), "/") + "/"
session.DefaultSession.Claims.Issuer = h.c.IssuerURL(r.Context()).String()
session.DefaultSession.Claims.IssuedAt = time.Now().UTC()

var scopes = accessRequest.GetRequestedScopes()
Expand Down Expand Up @@ -749,9 +749,8 @@ func (h *Handler) AuthHandler(w http.ResponseWriter, r *http.Request, _ httprout

authorizeRequest.SetID(session.ID)
claims := &jwt.IDTokenClaims{
Subject: obfuscatedSubject,
Issuer: strings.TrimRight(h.c.IssuerURL(ctx).String(), "/") + "/",

Subject: obfuscatedSubject,
Issuer: h.c.IssuerURL(ctx).String(),
AuthTime: time.Time(session.AuthenticatedAt),
RequestedAt: session.RequestedAt,
Extra: session.Session.IDToken,
Expand Down
4 changes: 2 additions & 2 deletions oauth2/introspector_test.go
View file
Expand Up @@ -137,7 +137,7 @@ func TestIntrospectorSDK(t *testing.T) {
assert.Equal(t, "alice", c.Sub)
assert.Equal(t, now.Add(time.Hour).Unix(), c.Exp, "expires at")
assert.Equal(t, now.Unix(), c.Iat, "issued at")
assert.Equal(t, "https://foobariss/", c.Iss, "issuer")
assert.Equal(t, "https://foobariss", c.Iss, "issuer")
assert.Equal(t, map[string]interface{}{"foo": "bar"}, c.Ext)
},
},
Expand All @@ -151,7 +151,7 @@ func TestIntrospectorSDK(t *testing.T) {
assert.Equal(t, "alice", c.Sub)
assert.Equal(t, now.Add(time.Hour).Unix(), c.Exp, "expires at")
assert.Equal(t, now.Unix(), c.Iat, "issued at")
assert.Equal(t, "https://foobariss/", c.Iss, "issuer")
assert.Equal(t, "https://foobariss", c.Iss, "issuer")
assert.Equal(t, map[string]interface{}{"foo": "bar"}, c.Ext)
},
},
Expand Down

0 comments on commit d746fa4

Please sign in to comment.