-
-
Notifications
You must be signed in to change notification settings - Fork 930
/
provider_microsoft.go
79 lines (63 loc) · 2.1 KB
/
provider_microsoft.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
package oidc
import (
"context"
"net/url"
"strings"
"github.com/dgrijalva/jwt-go"
"github.com/gofrs/uuid"
gooidc "github.com/coreos/go-oidc"
"github.com/pkg/errors"
"golang.org/x/oauth2"
"github.com/ory/herodot"
)
type ProviderMicrosoft struct {
*ProviderGenericOIDC
}
func NewProviderMicrosoft(
config *Configuration,
public *url.URL,
) *ProviderMicrosoft {
return &ProviderMicrosoft{
ProviderGenericOIDC: &ProviderGenericOIDC{
config: config,
public: public,
},
}
}
func (m *ProviderMicrosoft) OAuth2(ctx context.Context) (*oauth2.Config, error) {
if len(strings.TrimSpace(m.config.Tenant)) == 0 {
return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("No Tenant specified for the `microsoft` oidc provider %s", m.config.ID))
}
endpointPrefix := "https://login.microsoftonline.com/" + m.config.Tenant
endpoint := oauth2.Endpoint{
AuthURL: endpointPrefix + "/oauth2/v2.0/authorize",
TokenURL: endpointPrefix + "/oauth2/v2.0/token",
}
return m.oauth2ConfigFromEndpoint(endpoint), nil
}
func (m *ProviderMicrosoft) Claims(ctx context.Context, exchange *oauth2.Token) (*Claims, error) {
raw, ok := exchange.Extra("id_token").(string)
if !ok || len(raw) == 0 {
return nil, errors.WithStack(ErrIDTokenMissing)
}
parser := new(jwt.Parser)
unverifiedClaims := microsoftUnverifiedClaims{}
if _, _, err := parser.ParseUnverified(raw, &unverifiedClaims); err != nil {
return nil, err
}
if _, err := uuid.FromString(unverifiedClaims.TenantID); err != nil {
return nil, errors.WithStack(herodot.ErrBadRequest.WithReasonf("TenantID claim is not a valid UUID: %s", err))
}
issuer := "https://login.microsoftonline.com/" + unverifiedClaims.TenantID + "/v2.0"
p, err := gooidc.NewProvider(context.Background(), issuer)
if err != nil {
return nil, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to initialize OpenID Connect Provider: %s", err))
}
return m.verifyAndDecodeClaimsWithProvider(ctx, p, raw)
}
type microsoftUnverifiedClaims struct {
TenantID string `json:"tid,omitempty"`
}
func (c *microsoftUnverifiedClaims) Valid() error {
return nil
}