Use Issuer interface to allow for custom issuers

cmd/app/grpc.go

@@ -33,6 +33,7 @@ import (
 	"github.com/sigstore/fulcio/pkg/config"
 	gw "github.com/sigstore/fulcio/pkg/generated/protobuf"
 	gw_legacy "github.com/sigstore/fulcio/pkg/generated/protobuf/legacy"
+	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/sigstore/fulcio/pkg/server"
 	"github.com/spf13/viper"
@@ -64,7 +65,7 @@ func PassFulcioConfigThruContext(cfg *config.FulcioConfig) grpc.UnaryServerInter
 	}
 }
 
-func createGRPCServer(cfg *config.FulcioConfig, ctClient *ctclient.LogClient, baseca ca.CertificateAuthority) (*grpcServer, error) {
+func createGRPCServer(cfg *config.FulcioConfig, ctClient *ctclient.LogClient, baseca ca.CertificateAuthority, ip identity.IssuerPool) (*grpcServer, error) {
 	logger, opts := log.SetupGRPCLogging()
 
 	myServer := grpc.NewServer(grpc.UnaryInterceptor(
@@ -77,7 +78,7 @@ func createGRPCServer(cfg *config.FulcioConfig, ctClient *ctclient.LogClient, ba
 		)),
 		grpc.MaxRecvMsgSize(int(maxMsgSize)))
 
-	grpcCAServer := server.NewGRPCCAServer(ctClient, baseca)
+	grpcCAServer := server.NewGRPCCAServer(ctClient, baseca, ip)
 	// Register your gRPC service implementations.
 	gw.RegisterCAServer(myServer, grpcCAServer)
 

cmd/app/http_test.go

@@ -44,7 +44,7 @@ func setupHTTPServer(t *testing.T) (httpServer, string) {
 
 	viper.Set("grpc-host", "")
 	viper.Set("grpc-port", 0)
-	grpcServer, err := createGRPCServer(nil, nil, &TrivialCertificateAuthority{})
+	grpcServer, err := createGRPCServer(nil, nil, &TrivialCertificateAuthority{}, nil)
 	if err != nil {
 		t.Error(err)
 	}

cmd/app/serve.go

@@ -50,6 +50,7 @@ import (
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/generated/protobuf"
 	"github.com/sigstore/fulcio/pkg/generated/protobuf/legacy"
+	"github.com/sigstore/fulcio/pkg/identity"
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/sigstore/fulcio/pkg/server"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
@@ -269,14 +270,15 @@ func runServeCmd(cmd *cobra.Command, args []string) {
 			log.Logger.Fatal(err)
 		}
 	}
+	ip := server.NewIssuerPool(cfg)
 
 	portsMatch := viper.GetString("port") == viper.GetString("grpc-port")
 	hostsMatch := viper.GetString("host") == viper.GetString("grpc-host")
 	if portsMatch && hostsMatch {
 		port := viper.GetInt("port")
 		metricsPort := viper.GetInt("metrics-port")
 		// StartDuplexServer will always return an error, log fatally if it's non-nil
-		if err := StartDuplexServer(ctx, cfg, ctClient, baseca, viper.GetString("host"), port, metricsPort); err != http.ErrServerClosed {
+		if err := StartDuplexServer(ctx, cfg, ctClient, baseca, viper.GetString("host"), port, metricsPort, ip); err != http.ErrServerClosed {
 			log.Logger.Fatal(err)
 		}
 		return
@@ -286,7 +288,7 @@ func runServeCmd(cmd *cobra.Command, args []string) {
 
 	reg := prometheus.NewRegistry()
 
-	grpcServer, err := createGRPCServer(cfg, ctClient, baseca)
+	grpcServer, err := createGRPCServer(cfg, ctClient, baseca, ip)
 	if err != nil {
 		log.Logger.Fatal(err)
 	}
@@ -342,7 +344,7 @@ func checkServeCmdConfigFile() error {
 	return nil
 }
 
-func StartDuplexServer(ctx context.Context, cfg *config.FulcioConfig, ctClient *ctclient.LogClient, baseca ca.CertificateAuthority, host string, port, metricsPort int) error {
+func StartDuplexServer(ctx context.Context, cfg *config.FulcioConfig, ctClient *ctclient.LogClient, baseca ca.CertificateAuthority, host string, port, metricsPort int, ip identity.IssuerPool) error {
 	logger, opts := log.SetupGRPCLogging()
 
 	d := duplex.New(
@@ -361,7 +363,7 @@ func StartDuplexServer(ctx context.Context, cfg *config.FulcioConfig, ctClient *
 	)
 
 	// GRPC server
-	grpcCAServer := server.NewGRPCCAServer(ctClient, baseca)
+	grpcCAServer := server.NewGRPCCAServer(ctClient, baseca, ip)
 	protobuf.RegisterCAServer(d.Server, grpcCAServer)
 	if err := d.RegisterHandler(ctx, protobuf.RegisterCAHandlerFromEndpoint); err != nil {
 		return fmt.Errorf("registering grpc ca handler: %w", err)

cmd/app/serve_test.go

@@ -50,7 +50,7 @@ func TestDuplex(t *testing.T) {
 	metricsPort := 2114
 
 	go func() {
-		if err := StartDuplexServer(ctx, config.DefaultConfig, nil, ca, "localhost", port, metricsPort); err != nil {
+		if err := StartDuplexServer(ctx, config.DefaultConfig, nil, ca, "localhost", port, metricsPort, nil); err != nil {
 			log.Fatalf("error starting duplex server: %v", err)
 		}
 	}()

pkg/identity/base/issuer.go

@@ -20,9 +20,15 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
+var (
+	// For testing
+	CmpOptions = cmpopts.IgnoreUnexported(baseIssuer{})
+)
+
 type baseIssuer struct {
 	issuerURL string
 }

pkg/server/grpc_server.go

@@ -39,12 +39,14 @@ type grpcCAServer struct {
 	fulciogrpc.UnimplementedCAServer
 	ct *ctclient.LogClient
 	ca certauth.CertificateAuthority
+	identity.IssuerPool
 }
 
-func NewGRPCCAServer(ct *ctclient.LogClient, ca certauth.CertificateAuthority) fulciogrpc.CAServer {
+func NewGRPCCAServer(ct *ctclient.LogClient, ca certauth.CertificateAuthority, ip identity.IssuerPool) fulciogrpc.CAServer {
 	return &grpcCAServer{
-		ct: ct,
-		ca: ca,
+		ct:         ct,
+		ca:         ca,
+		IssuerPool: ip,
 	}
 }
 
@@ -70,14 +72,7 @@ func (g *grpcCAServer) CreateSigningCertificate(ctx context.Context, request *fu
 	}
 
 	// Authenticate OIDC ID token by checking signature
-	idtoken, err := identity.Authorize(ctx, token)
-	if err != nil {
-		return nil, handleFulcioGRPCError(ctx, codes.Unauthenticated, err, invalidCredentials)
-	}
-	// Parse authenticated ID token into principal
-	// TODO:(nsmith5) replace this and authorize call above with
-	// just identity.IssuerPool.Authenticate()
-	principal, err := challenges.PrincipalFromIDToken(ctx, idtoken)
+	principal, err := g.IssuerPool.Authenticate(ctx, token)
 	if err != nil {
 		return nil, handleFulcioGRPCError(ctx, codes.InvalidArgument, err, invalidIdentityToken)
 	}

pkg/server/grpc_server_test.go

@@ -83,7 +83,8 @@ func setupGRPCForTest(ctx context.Context, t *testing.T, cfg *config.FulcioConfi
 	t.Helper()
 	lis = bufconn.Listen(bufSize)
 	s := grpc.NewServer(grpc.UnaryInterceptor(passFulcioConfigThruContext(cfg)))
-	protobuf.RegisterCAServer(s, NewGRPCCAServer(ctl, ca))
+	ip := NewIssuerPool(cfg)
+	protobuf.RegisterCAServer(s, NewGRPCCAServer(ctl, ca, ip))
 	go func() {
 		if err := s.Serve(lis); err != nil && !errors.Is(err, grpc.ErrServerStopped) {
 			t.Errorf("Server exited with error: %v", err)
@@ -105,7 +106,8 @@ func bufDialer(ctx context.Context, _ string) (net.Conn, error) {
 
 func TestMissingGetTrustBundleFails(t *testing.T) {
 	ctx := context.Background()
-	server, conn := setupGRPCForTest(ctx, t, nil, nil, &FailingCertificateAuthority{})
+	cfg := &config.FulcioConfig{}
+	server, conn := setupGRPCForTest(ctx, t, cfg, nil, &FailingCertificateAuthority{})
 	defer func() {
 		server.Stop()
 		conn.Close()
@@ -553,7 +555,6 @@ func TestAPIWithUriSubject(t *testing.T) {
 			server.Stop()
 			conn.Close()
 		}()
-
 		client := protobuf.NewCAClient(conn)
 
 		pubBytes, proof := generateKeyAndProof(c.Subject, t)

pkg/server/issuer_pool.go

@@ -0,0 +1,62 @@
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"github.com/sigstore/fulcio/pkg/config"
+	"github.com/sigstore/fulcio/pkg/identity"
+	"github.com/sigstore/fulcio/pkg/identity/buildkite"
+	"github.com/sigstore/fulcio/pkg/identity/email"
+	"github.com/sigstore/fulcio/pkg/identity/github"
+	"github.com/sigstore/fulcio/pkg/identity/kubernetes"
+	"github.com/sigstore/fulcio/pkg/identity/spiffe"
+	"github.com/sigstore/fulcio/pkg/identity/uri"
+	"github.com/sigstore/fulcio/pkg/identity/username"
+)
+
+func NewIssuerPool(cfg *config.FulcioConfig) identity.IssuerPool {
+	var ip identity.IssuerPool
+	for _, i := range cfg.OIDCIssuers {
+		ip = append(ip, getIssuer("", i))
+	}
+	for meta, i := range cfg.MetaIssuers {
+		ip = append(ip, getIssuer(meta, i))
+	}
+	return ip
+}
+
+func getIssuer(meta string, i config.OIDCIssuer) identity.Issuer {
+	issuerURL := i.IssuerURL
+	if meta != "" {
+		issuerURL = meta
+	}
+	switch i.Type {
+	case config.IssuerTypeEmail:
+		return email.Issuer(issuerURL)
+	case config.IssuerTypeGithubWorkflow:
+		return github.Issuer(issuerURL)
+	case config.IssuerTypeBuildkiteJob:
+		return buildkite.Issuer(issuerURL)
+	case config.IssuerTypeKubernetes:
+		return kubernetes.Issuer(issuerURL)
+	case config.IssuerTypeSpiffe:
+		return spiffe.Issuer(issuerURL)
+	case config.IssuerTypeURI:
+		return uri.Issuer(issuerURL)
+	case config.IssuerTypeUsername:
+		return username.Issuer(issuerURL)
+	}
+	return nil
+}

pkg/server/issuer_pool_test.go

@@ -0,0 +1,133 @@
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/sigstore/fulcio/pkg/config"
+	"github.com/sigstore/fulcio/pkg/identity"
+	"github.com/sigstore/fulcio/pkg/identity/base"
+	"github.com/sigstore/fulcio/pkg/identity/email"
+	"github.com/sigstore/fulcio/pkg/identity/github"
+	"github.com/sigstore/fulcio/pkg/identity/kubernetes"
+	"github.com/sigstore/fulcio/pkg/identity/spiffe"
+	"github.com/sigstore/fulcio/pkg/identity/uri"
+	"github.com/sigstore/fulcio/pkg/identity/username"
+)
+
+func TestIssuerPool(t *testing.T) {
+	//  Test the issuer pool with the OIDCIssuers
+	cfg := &config.FulcioConfig{
+		OIDCIssuers: map[string]config.OIDCIssuer{
+			"https://oauth2.sigstore.dev/auth": {
+				IssuerURL:   "https://oauth2.sigstore.dev/auth",
+				ClientID:    "sigstore",
+				IssuerClaim: "$.federated_claims.connector_id",
+				Type:        config.IssuerTypeEmail,
+			},
+		},
+	}
+	// Build the expected issuer pool
+	expected := identity.IssuerPool{
+		email.Issuer("https://oauth2.sigstore.dev/auth"),
+	}
+	ignoreOpts := []cmp.Option{base.CmpOptions}
+	got := NewIssuerPool(cfg)
+	if d := cmp.Diff(expected, got, ignoreOpts...); d != "" {
+		t.Fatal(d)
+	}
+
+	// Test the issuer pool with a MetaIssuer
+	cfg = &config.FulcioConfig{
+		MetaIssuers: map[string]config.OIDCIssuer{
+			"https://oidc.eks.*.amazonaws.com/id/*": {
+				ClientID: "bar",
+				Type:     "kubernetes",
+			},
+		},
+	}
+	expected = identity.IssuerPool{
+		kubernetes.Issuer("https://oidc.eks.*.amazonaws.com/id/*"),
+	}
+	got = NewIssuerPool(cfg)
+	if d := cmp.Diff(expected, got, ignoreOpts...); d != "" {
+		t.Fatal(d)
+	}
+}
+
+func TestGetIssuer(t *testing.T) {
+	tests := []struct {
+		description string
+		issuer      config.OIDCIssuer
+		expected    identity.Issuer
+	}{
+		{
+			description: "email",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "email.com",
+				Type:      "email",
+			},
+			expected: email.Issuer("email.com"),
+		}, {
+			description: "github",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "github.com",
+				Type:      "github-workflow",
+			},
+			expected: github.Issuer("github.com"),
+		}, {
+			description: "spiffe",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "spiffe.com",
+				Type:      "spiffe",
+			},
+			expected: spiffe.Issuer("spiffe.com"),
+		}, {
+			description: "kubernetes",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "kubernetes.com",
+				Type:      "kubernetes",
+			},
+			expected: kubernetes.Issuer("kubernetes.com"),
+		}, {
+			description: "uri",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "uri.com",
+				Type:      "uri",
+			},
+			expected: uri.Issuer("uri.com"),
+		}, {
+			description: "username",
+			issuer: config.OIDCIssuer{
+				IssuerURL: "username.com",
+				Type:      "username",
+			},
+			expected: username.Issuer("username.com"),
+		},
+	}
+
+	ignoreOpts := []cmp.Option{base.CmpOptions}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			got := getIssuer("", test.issuer)
+			if d := cmp.Diff(got, test.expected, ignoreOpts...); d != "" {
+				t.Fatal(d)
+			}
+		})
+	}
+}