adam/guacamole-client
1
0 Fork 0
Code Issues Pull Requests 1 Packages Releases Wiki Activity

Compare commits

base: adam/guacamole-client:f930e76bfa9de9d7515548458f0f460348db2ba6
adam/guacamole-client:main adam/guacamole-client:shs-patch adam/guacamole-client:adam/1.6.0 adam/guacamole-client:scolling-fix adam/guacamole-client:openid adam/guacamole-client:epcc-patch
...
compare: adam/guacamole-client:openid
adam/guacamole-client:shs-patch adam/guacamole-client:adam/1.6.0 adam/guacamole-client:scolling-fix adam/guacamole-client:main adam/guacamole-client:openid adam/guacamole-client:epcc-patch
11 Commits
f930e76bfa ... openid
Author SHA1 Message Date
David Bateman 9bc2847712 Correct typos and error in all comments of the PR 2026-04-15 13:14:01 +01:00
David Bateman 00ff730051 Stupid cut/paste/edit mistake 2026-04-13 15:49:41 +01:00
David Bateman fd0ae00836 Copy/Paste editing error 2026-04-13 15:49:37 +01:00
David Bateman 024a69695c Replace openid-auth-timeout with openid-max-pkce-verifier-validity for consistency with openid-max-nonce-validity 2026-04-13 15:49:33 +01:00
David Bateman b302cf5276 No body in JsonUrlReader for GET method 2026-04-13 15:49:28 +01:00
David Bateman 21e97e480c Replace use of java.net.HttpURLConnection with jav.net.http.HttpClient, make the outboud url connection asynchronous 2026-04-13 15:49:23 +01:00
David Bateman a48665bf60 Print detected OIDC well-known information at debug-level equals info 2026-04-13 15:49:19 +01:00
David Bateman 64f0abeafb Remove some no longer used imports for TokenValidationService 2026-04-13 15:49:14 +01:00
David Bateman ae22b4116a Treat review comments 2026-04-13 15:49:08 +01:00
David Bateman 08bcd1f9e8 - Add openid-well-known-endpoint and treat it to automatically find the : 
* issuer,
  * authorization_endpoint,
  * token_endpoint,
  * jwks_uri
- Replace openid-flow-type with openid-response-type
- Use an Enum for openid-response-type to limit to the values 'id_token',
  'token' or 'cod'
- Treat the response type as an implicit flow type allowing use of AWS
  Cognito
 2026-04-13 15:49:01 +01:00
David Bateman 4dfb4b5c66 Remove accidentally committed files 2026-04-13 15:48:57 +01:00
13 changed files with 584 additions and 1545 deletions
Expand all files Collapse all files

No files matched your search

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
+20 -23
View File
@@ -63,6 +63,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
/**
* The standard HTTP parameter which will be included within the URL by all
* OpenID services upon successful implicit flow authentication.
*
*/
public static final String IMPLICIT_TOKEN_PARAMETER_NAME = "id_token";
@@ -136,23 +137,24 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
Set<String> groups = null;
Map<String,String> tokens = Collections.emptyMap();
logger.debug("OpenID authentication with {} flow (ID: {}, Secret: {}, PKCE: {})",
confService.getFlowType(),
logger.debug("OpenID authentication with '{}' reponse type (ID: {}, Secret: {}, PKCE: {})",
confService.getResponseType(),
confService.getClientID(),
confService.getClientSecret(),
confService.isPKCERequired());
if (confService.getFlowType().equals("implicit")) {
if (confService.isImplicitFlow()) {
String token = credentials.getParameter(IMPLICIT_TOKEN_PARAMETER_NAME);
if (token != null) {
JwtClaims claims = tokenService.validateToken(token);
JwtClaims claims = tokenService.validateTokenOrCode(token, "");
if (claims != null) {
username = tokenService.processUsername(claims);
groups = tokenService.processGroups(claims);
tokens = tokenService.processAttributes(claims);
}
}
} else {
}
else {
String verifier = null;
if (confService.isPKCERequired()) {
// Recover session
@@ -163,7 +165,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
}
String code = credentials.getParameter("code");
if (code != null && (confService.isPKCERequired() == false || verifier != null)) {
JwtClaims claims = tokenService.validateCode(code, verifier);
JwtClaims claims = tokenService.validateTokenOrCode(code, verifier);
if (claims != null) {
username = tokenService.processUsername(claims);
groups = tokenService.processGroups(claims);
@@ -194,21 +196,16 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
@Override
public URI getLoginURI() throws GuacamoleException {
if (confService.getFlowType().equals("implicit")) {
return UriBuilder.fromUri(confService.getAuthorizationEndpoint())
.queryParam("scope", confService.getScope())
.queryParam("response_type", IMPLICIT_TOKEN_PARAMETER_NAME)
.queryParam("client_id", confService.getClientID())
.queryParam("redirect_uri", confService.getRedirectURI())
.queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L))
.build();
} else {
UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
.queryParam("scope", confService.getScope())
.queryParam("response_type", CODE_TOKEN_PARAMETER_NAME)
.queryParam("client_id", confService.getClientID())
.queryParam("redirect_uri", confService.getRedirectURI());
UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
.queryParam("scope", confService.getScope())
.queryParam("response_type", confService.getResponseType().toString())
.queryParam("client_id", confService.getClientID())
.queryParam("redirect_uri", confService.getRedirectURI());
if (confService.isImplicitFlow()) {
builder.queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L));
}
else {
if (confService.isPKCERequired()) {
String codeVerifier = PKCEUtil.generateCodeVerifier();
String codeChallenge;
@@ -222,7 +219,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
// Store verifier for authenticateUser
OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
confService.getAuthenticationTimeout() * 60000L);
confService.getMaxPKCEVerifierValidity() * 60000L);
String identifier = IdentifierGenerator.generateIdentifier();
sessionManager.defer(session, identifier);
@@ -230,9 +227,9 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
.queryParam("code_challenge_method", "S256")
.queryParam(AUTH_SESSION_QUERY_PARAM, identifier);
}
return builder.build();
}
return builder.build();
}
@Override
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java.orig
-274
View File
@@ -1,274 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid;
import com.google.inject.Inject;
import com.google.inject.Provider;
import com.google.inject.Singleton;
import java.net.URI;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.Map;
import java.util.Set;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.auth.openid.conf.ConfigurationService;
import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
import org.apache.guacamole.auth.openid.token.TokenValidationService;
import org.apache.guacamole.auth.openid.util.PKCEUtil;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.sso.NonceService;
import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
import org.apache.guacamole.form.Field;
import org.apache.guacamole.form.RedirectField;
import org.apache.guacamole.language.TranslatableMessage;
import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
import org.apache.guacamole.net.auth.IdentifierGenerator;
import org.jose4j.jwt.JwtClaims;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.apache.guacamole.net.auth.IdentifierGenerator;
/**
* Service that authenticates Guacamole users by processing OpenID tokens.
*/
@Singleton
public class AuthenticationProviderService implements SSOAuthenticationProviderService {
/**
* Logger for this class.
*/
private final Logger logger = LoggerFactory.getLogger(AuthenticationProviderService.class);
/**
* The standard HTTP parameter which will be included within the URL by all
* OpenID services upon successful implicit flow authentication.
*/
public static final String IMPLICIT_TOKEN_PARAMETER_NAME = "id_token";
/**
* The standard HTTP parameter which will be included within the URL by all
* OpenID services upon successful code flow authentication. Used to recover
* the stored user state.
*/
public static final String CODE_TOKEN_PARAMETER_NAME = "code";
/**
* The name of the query parameter that identifies an active authentication
* session (in-progress OpenID authentication attempt).
*/
public static final String AUTH_SESSION_QUERY_PARAM = "state";
/**
* The REST API used for a local rediect and callback for the IdP to
* return a code and access stored PKCE verifiers
*/
public static final String CODE_REDIRECT_API = "/api/ext/openid/redirect";
/**
* Service for retrieving OpenID configuration information.
*/
@Inject
private ConfigurationService confService;
/**
* Manager of active SAML authentication attempts.
*/
@Inject
private OpenIDAuthenticationSessionManager sessionManager;
/**
* Service for validating and generating unique nonce values.
*/
@Inject
private NonceService nonceService;
/**
* Service for validating received ID tokens.
*/
@Inject
private TokenValidationService tokenService;
/**
* Provider for AuthenticatedUser objects.
*/
@Inject
private Provider<SSOAuthenticatedUser> authenticatedUserProvider;
/**
* Return the value of the session identifier associated with the given
* credentials, or null if no session identifier is found in the
* credentials.
*
* @param credentials
* The credentials from which to extract the session identifier.
*
* @return
* The session identifier associated with the given credentials, or
* null if no identifier is found.
*/
public static String getSessionIdentifier(Credentials credentials) {
// Return the session identifier from the request params, if set, or
// null otherwise
return credentials != null ? credentials.getParameter(AUTH_SESSION_QUERY_PARAM) : null;
}
@Override
public SSOAuthenticatedUser authenticateUser(Credentials credentials)
throws GuacamoleException {
String username = null;
Set<String> groups = null;
Map<String,String> tokens = Collections.emptyMap();
logger.debug("OpenID authentication with {} flow (ID: {}, Secret: {}, PKCE: {})",
confService.getFlowType(),
confService.getClientID(),
confService.getClientSecret(),
confService.isPKCERequired());
if (confService.getFlowType().equals("implicit")) {
String token = credentials.getParameter(IMPLICIT_TOKEN_PARAMETER_NAME);
if (token != null) {
JwtClaims claims = tokenService.validateToken(token);
if (claims != null) {
username = tokenService.processUsername(claims);
groups = tokenService.processGroups(claims);
tokens = tokenService.processAttributes(claims);
}
}
} else {
String verifier = null;
if (confService.isPKCERequired()) {
// Recover session
String identifier = getSessionIdentifier(credentials);
if (identifier != null) {
verifier = sessionManager.getVerifier(identifier);
}
}
String code = credentials.getParameter("code");
if (code != null && (confService.isPKCERequired() == false || verifier != null)) {
JwtClaims claims = tokenService.validateCode(code, verifier);
if (claims != null) {
username = tokenService.processUsername(claims);
groups = tokenService.processGroups(claims);
tokens = tokenService.processAttributes(claims);
}
}
}
// If the username was successfully retrieved from the token, produce
// authenticated user
if (username != null) {
// Create corresponding authenticated user
SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
authenticatedUser.init(username, credentials, groups, tokens);
return authenticatedUser;
}
// Request OpenID token (will automatically redirect the user to the
// OpenID authorization page via JavaScript)
throw new GuacamoleInvalidCredentialsException("Invalid login.",
new CredentialsInfo(Arrays.asList(new Field[] {
new RedirectField(AUTH_SESSION_QUERY_PARAM, getLoginURI(),
new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
}))
);
}
@Override
public URI getLoginURI() throws GuacamoleException {
if (confService.getFlowType().equals("implicit")) {
return UriBuilder.fromUri(confService.getAuthorizationEndpoint())
.queryParam("scope", confService.getScope())
.queryParam("response_type", IMPLICIT_TOKEN_PARAMETER_NAME)
.queryParam("client_id", confService.getClientID())
.queryParam("redirect_uri", confService.getRedirectURI())
.queryParam("nonce", nonceService.generate(confService.getMaxNonceValidity() * 60000L))
.build();
} else {
UriBuilder builder = UriBuilder.fromUri(confService.getAuthorizationEndpoint())
.queryParam("scope", confService.getScope())
.queryParam("response_type", CODE_TOKEN_PARAMETER_NAME)
.queryParam("client_id", confService.getClientID())
.queryParam("redirect_uri", confService.getRedirectURI());
if (confService.isPKCERequired()) {
String codeVerifier = PKCEUtil.generateCodeVerifier();
String codeChallenge;
try {
codeChallenge = PKCEUtil.generateCodeChallenge(codeVerifier);
}
catch (Exception e) {
throw new GuacamoleException("Unable to compute PKCE challenge", e);
}
// Store verifier for authenticateUser
OpenIDAuthenticationSession session = new OpenIDAuthenticationSession(codeVerifier,
confService.getAuthenticationTimeout() * 60000L);
String identifier = IdentifierGenerator.generateIdentifier();
sessionManager.defer(session, identifier);
builder.queryParam("code_challenge", codeChallenge)
.queryParam("code_challenge_method", "S256")
.queryParam(AUTH_SESSION_QUERY_PARAM, identifier);
}
return builder.build();
}
}
@Override
public URI getLogoutURI(String idToken) throws GuacamoleException {
// If no logout endpoint is configured, return null
URI logoutEndpoint = confService.getLogoutEndpoint();
if (logoutEndpoint == null)
return null;
// Build the logout URI with appropriate parameters
UriBuilder logoutUriBuilder = UriBuilder.fromUri(logoutEndpoint);
// Add post_logout_redirect_uri parameter
logoutUriBuilder.queryParam("post_logout_redirect_uri",
confService.getPostLogoutRedirectURI());
// Add id_token_hint if available, otherwise add client_id
if (idToken != null && !idToken.isEmpty())
logoutUriBuilder.queryParam("id_token_hint", idToken);
else
logoutUriBuilder.queryParam("client_id", confService.getClientID());
return logoutUriBuilder.build();
}
@Override
public void shutdown() {
sessionManager.shutdown();
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
+3
View File
@@ -21,8 +21,10 @@ package org.apache.guacamole.auth.openid;
import com.google.inject.AbstractModule;
import com.google.inject.Scopes;
import com.google.inject.Singleton;
import org.apache.guacamole.auth.openid.conf.ConfigurationService;
import org.apache.guacamole.auth.openid.conf.OpenIDEnvironment;
import org.apache.guacamole.auth.openid.conf.OpenIDWellKnown;
import org.apache.guacamole.auth.openid.OpenIDAuthenticationSessionManager;
import org.apache.guacamole.auth.sso.NonceService;
import org.apache.guacamole.auth.openid.token.TokenValidationService;
@@ -44,6 +46,7 @@ public class OpenIDAuthenticationProviderModule extends AbstractModule {
bind(NonceService.class).in(Scopes.SINGLETON);
bind(TokenValidationService.class);
bind(OpenIDAuthenticationSessionManager.class);
bind(Environment.class).toInstance(environment);
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java.rej
-11
View File
@@ -1,11 +0,0 @@
--- extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java 2026-04-08 19:37:41.518619970 +0200
+++ extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java 2026-04-08 16:43:54.617087120 +0200
@@ -37,7 +37,7 @@
* The configuration environment for this server and extension.
*/
private final Environment environment = new OpenIDEnvironment();
-
+
@Override
protected void configure() {
bind(ConfigurationService.class);
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationSession.java
+1
View File
@@ -24,6 +24,7 @@ import org.apache.guacamole.net.auth.AuthenticationSession;
/**
* Representation of an in-progress OpenID authentication attempt.
*/
public class OpenIDAuthenticationSession extends AuthenticationSession {
/**
* The PKCE challenge verifier.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
+97 -51
View File
@@ -24,9 +24,12 @@ import java.net.URI;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.auth.openid.conf.OpenIDResponseType;
import org.apache.guacamole.auth.openid.conf.OpenIDWellKnown;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.BooleanGuacamoleProperty;
import org.apache.guacamole.properties.EnumGuacamoleProperty;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
@@ -38,9 +41,9 @@ import org.apache.guacamole.properties.URIGuacamoleProperty;
public class ConfigurationService {
/**
* The default OICD flow type
* The default OICD reponse type
*/
private static final String DEFAULT_FLOW_TYPE = "implicit";
private static final OpenIDResponseType DEFAULT_RESPONSE_TYPE = OpenIDResponseType.ID_TOKEN;
/**
* The default claim type to use to retrieve an authenticated user's
@@ -82,6 +85,12 @@ public class ConfigurationService {
*/
private static final int DEFAULT_MAX_NONCE_VALIDITY = 10;
/**
* The default maximum amount of time that a pkce verifier generated by the
* Guacamole server should remain valid, in minutes.
*/
private static final int DEFAULT_MAX_PKCE_VERIFIER_VALIDITY = 10;
/**
* The authorization endpoint (URI) of the OpenID service.
*/
@@ -121,20 +130,19 @@ public class ConfigurationService {
*/
private static final URIGuacamoleProperty OPENID_TOKEN_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() {
return "openid-token-endpoint";
}
public String getName() { return "openid-token-endpoint"; }
};
/**
* The flow type of the OpenID service.
* The reponse type of the OpenID service.
*/
private static final StringGuacamoleProperty OPENID_FLOW_TYPE =
new StringGuacamoleProperty() {
private static final EnumGuacamoleProperty<OpenIDResponseType> OPENID_RESPONSE_TYPE =
new EnumGuacamoleProperty<OpenIDResponseType>(OpenIDResponseType.class) {
@Override
public String getName() { return "openid-flow-type"; }
public String getName() { return "openid-response-type"; }
};
@@ -144,10 +152,9 @@ public class ConfigurationService {
*/
private static final StringGuacamoleProperty OPENID_CLIENT_SECRET =
new StringGuacamoleProperty() {
@Override
public String getName() {
return "openid-client-secret";
}
public String getName() { return "openid-client-secret"; }
};
/**
@@ -155,27 +162,27 @@ public class ConfigurationService {
*/
private static final BooleanGuacamoleProperty OPENID_PKCE_REQUIRED =
new BooleanGuacamoleProperty() {
@Override
public String getName() {
return "openid-pkce-required";
}
public String getName() { return "openid-pkce-required"; }
};
/**
* The maximum amount of time to allow for an in-progress OpenID
* authentication attempt to be completed, in minutes. A user that takes
* longer than this amount of time to complete authentication with their
* identity provider will be redirected back to the identity provider to
* try again.
* The maximum amount of time that a PKCE verifier generated by the
* Guacamole server should remain valid, in minutes. As each OpenID request
* requiring PKCE has a unique verifier, this imposes an upper limit on the
* amount of time any particular OpenID request can result in successful
* authentication within Guacamole. By default, each generated PKCE verifier
* expires after 10 minutes.
*/
private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT =
private static final IntegerGuacamoleProperty OPENID_MAX_PKCE_VERIFIER_VALIDITY =
new IntegerGuacamoleProperty() {
@Override
public String getName() { return "openid-auth-timeout"; }
public String getName() { return "openid-max-pkce-verifier-validity"; }
};
/**
* The claim type which contains the authenticated user's username within
* any valid JWT.
@@ -316,6 +323,12 @@ public class ConfigurationService {
*/
@Inject
private Environment environment;
/**
* Service for retrieving OpenID well-known data.
*/
@Inject
private OpenIDWellKnown confWellKnown;
/**
* Returns the authorization endpoint (URI) of the OpenID service as
@@ -326,11 +339,16 @@ public class ConfigurationService {
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the authorization
* endpoint property is missing.
* If guacamole.properties cannot be parsed, or it authorization and
* well-known endpoints are property is missing.
*/
public URI getAuthorizationEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_AUTHORIZATION_ENDPOINT);
URI authorization_endpoint = environment.getProperty(OPENID_AUTHORIZATION_ENDPOINT);
authorization_endpoint = authorization_endpoint == null ? confWellKnown.getAuthorizationEndpoint() : authorization_endpoint;
if (authorization_endpoint == null) {
throw new GuacamoleException("Property openid-authorization-endpoint or openid-well-known-endpoint is required");
}
return authorization_endpoint;
}
/**
@@ -379,10 +397,15 @@ public class ConfigurationService {
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the issuer property
* is missing.
* and well-known endpoints are property is missing.
*/
public String getIssuer() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_ISSUER);
String issuer = environment.getProperty(OPENID_ISSUER);
issuer = issuer == null ? confWellKnown.getIssuer() : issuer;
if (issuer == null) {
throw new GuacamoleException("Property openid-issuer or openid-well-known-endpoint is required");
}
return issuer;
}
/**
@@ -396,11 +419,16 @@ public class ConfigurationService {
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the JWKS endpoint
* property is missing.
* If guacamole.properties cannot be parsed, or if the JWKS and
* well-known endpoints are property is missing.
*/
public URI getJWKSEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_JWKS_ENDPOINT);
URI jwks_uri = environment.getProperty(OPENID_JWKS_ENDPOINT);
jwks_uri = jwks_uri == null ? confWellKnown.getJWKSEndpoint() : jwks_uri;
if (jwks_uri == null) {
throw new GuacamoleException("Property openid-jwks-endpoint or openid-well-known-endpoint is required");
}
return jwks_uri;
}
/**
@@ -412,25 +440,44 @@ public class ConfigurationService {
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the authorization
* endpoint property is missing.
* If guacamole.properties cannot be parsed, or if the token and
* well-known endpoints are property is missing.
*/
public URI getTokenEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_TOKEN_ENDPOINT);
URI token_endpoint = environment.getProperty(OPENID_TOKEN_ENDPOINT);
token_endpoint = token_endpoint == null ? confWellKnown.getTokenEndpoint() : token_endpoint;
if (token_endpoint == null) {
throw new GuacamoleException("Property openid-token-endpoint or openid-well-known-endpoint is required");
}
return token_endpoint;
}
/**
* Returns the flow type of the OpenID service as configured with guacamole.properties.
* Returns the reponse type of the OpenID service as configured with guacamole.properties.
*
* @return
* The flow type of the OpenID service, as configured with guacamole.properties. Can
* be either 'implicit' or 'code'.
* The reponse type of the OpenID service, as configured with guacamole.properties. Can
* be either 'id_token', 'token' or 'code'.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public String getFlowType() throws GuacamoleException {
return environment.getProperty(OPENID_FLOW_TYPE, DEFAULT_FLOW_TYPE);
public OpenIDResponseType getResponseType() throws GuacamoleException {
return environment.getProperty(OPENID_RESPONSE_TYPE, DEFAULT_RESPONSE_TYPE);
}
/**
* Returns true if the response type defines an implict flow
*
* @return
* The whether implicit flow is used or not, as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public boolean isImplicitFlow() throws GuacamoleException {
OpenIDResponseType response_type = environment.getProperty(OPENID_RESPONSE_TYPE, DEFAULT_RESPONSE_TYPE);
return response_type != OpenIDResponseType.CODE;
}
/**
@@ -444,8 +491,7 @@ public class ConfigurationService {
* as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the client ID
* property is missing.
* If guacamole.properties cannot be parsed.
*/
public String getClientSecret() throws GuacamoleException {
return environment.getProperty(OPENID_CLIENT_SECRET);
@@ -469,21 +515,21 @@ public class ConfigurationService {
}
/**
* Returns the maximum amount of time to allow for an in-progress OpenID
* authentication attempt to be completed, in minutes. A user that takes
* longer than this amount of time to complete authentication with their
* identity provider will be redirected back to the identity provider to
* try again.
* Returns the maximum amount of time that a PKCE verifier generated by the
* Guacamole server should remain valid, in minutes. As each OpenID request
* requiring PKCE has a unique verifier, this imposes an upper limit on the
* amount of time any particular OpenID request can result in successful
* authentication within Guacamole. By default, this will be 10.
*
* @return
* The maximum amount of time to allow for an in-progress SAML
* authentication attempt to be completed, in minutes.
* The maximum amount of time that a PKCE verifier generated by the
* Guacamole server should remain valid, in minutes.
*
* @throws GuacamoleException
* If the authentication timeout cannot be parsed.
* If guacamole.properties cannot be parsed.
*/
public int getAuthenticationTimeout() throws GuacamoleException {
return environment.getProperty(OPENID_AUTH_TIMEOUT, 5);
public int getMaxPKCEVerifierValidity() throws GuacamoleException {
return environment.getProperty(OPENID_MAX_PKCE_VERIFIER_VALIDITY, DEFAULT_MAX_PKCE_VERIFIER_VALIDITY);
}
/**
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java.orig
-639
View File
@@ -1,639 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid.conf;
import com.google.inject.Inject;
import java.net.URI;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.BooleanGuacamoleProperty;
import org.apache.guacamole.properties.IntegerGuacamoleProperty;
import org.apache.guacamole.properties.StringGuacamoleProperty;
import org.apache.guacamole.properties.URIGuacamoleProperty;
/**
* Service for retrieving configuration information regarding the OpenID
* service.
*/
public class ConfigurationService {
/**
* The default OICD flow type
*/
private static final String DEFAULT_FLOW_TYPE = "implicit";
/**
* The default claim type to use to retrieve an authenticated user's
* username.
*/
private static final String DEFAULT_USERNAME_CLAIM_TYPE = "email";
/**
* The default claim type to use to retrieve an authenticated user's
* groups.
*/
private static final String DEFAULT_GROUPS_CLAIM_TYPE = "groups";
/**
* The default JWT claims list to map to tokens.
*/
private static final List<String> DEFAULT_ATTRIBUTES_CLAIM_TYPE = Collections.emptyList();
/**
* The default space-separated list of OpenID scopes to request.
*/
private static final String DEFAULT_SCOPE = "openid email profile";
/**
* The default amount of clock skew tolerated for timestamp comparisons
* between the Guacamole server and OpenID service clocks, in seconds.
*/
private static final int DEFAULT_ALLOWED_CLOCK_SKEW = 30;
/**
* The default maximum amount of time that an OpenID token should remain
* valid, in minutes.
*/
private static final int DEFAULT_MAX_TOKEN_VALIDITY = 300;
/**
* The default maximum amount of time that a nonce generated by the
* Guacamole server should remain valid, in minutes.
*/
private static final int DEFAULT_MAX_NONCE_VALIDITY = 10;
/**
* The authorization endpoint (URI) of the OpenID service.
*/
private static final URIGuacamoleProperty OPENID_AUTHORIZATION_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-authorization-endpoint"; }
};
/**
* The endpoint (URI) of the JWKS service which defines how received ID
* tokens (JWTs) shall be validated.
*/
private static final URIGuacamoleProperty OPENID_JWKS_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-jwks-endpoint"; }
};
/**
* The issuer to expect for all received ID tokens.
*/
private static final StringGuacamoleProperty OPENID_ISSUER =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-issuer"; }
};
/**
* The token endpoint (URI) of the OIDC service.
*/
private static final URIGuacamoleProperty OPENID_TOKEN_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() {
return "openid-token-endpoint";
}
};
/**
* The flow type of the OpenID service.
*/
private static final StringGuacamoleProperty OPENID_FLOW_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-flow-type"; }
};
/**
* OIDC client secret which should be submitted to the OIDC service when
* validating tokens with code flow
*/
private static final StringGuacamoleProperty OPENID_CLIENT_SECRET =
new StringGuacamoleProperty() {
@Override
public String getName() {
return "openid-client-secret";
}
};
/**
* True if "Proof Key for Code Exchange" (PKCE) must be used.
*/
private static final BooleanGuacamoleProperty OPENID_PKCE_REQUIRED =
new BooleanGuacamoleProperty() {
@Override
public String getName() {
return "openid-pkce-required";
}
};
/**
* The maximum amount of time to allow for an in-progress OpenID
* authentication attempt to be completed, in minutes. A user that takes
* longer than this amount of time to complete authentication with their
* identity provider will be redirected back to the identity provider to
* try again.
*/
private static final IntegerGuacamoleProperty OPENID_AUTH_TIMEOUT =
new IntegerGuacamoleProperty() {
@Override
public String getName() { return "openid-auth-timeout"; }
};
/**
* The claim type which contains the authenticated user's username within
* any valid JWT.
*/
private static final StringGuacamoleProperty OPENID_USERNAME_CLAIM_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-username-claim-type"; }
};
/**
* The claim type which contains the authenticated user's groups within
* any valid JWT.
*/
private static final StringGuacamoleProperty OPENID_GROUPS_CLAIM_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-groups-claim-type"; }
};
/**
* The claims within any valid JWT that should be mapped to
* the authenticated user's tokens, as configured with guacamole.properties.
*/
private static final StringGuacamoleProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-attributes-claim-type"; }
};
/**
* The space-separated list of OpenID scopes to request.
*/
private static final StringGuacamoleProperty OPENID_SCOPE =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-scope"; }
};
/**
* The amount of clock skew tolerated for timestamp comparisons between the
* Guacamole server and OpenID service clocks, in seconds.
*/
private static final IntegerGuacamoleProperty OPENID_ALLOWED_CLOCK_SKEW =
new IntegerGuacamoleProperty() {
@Override
public String getName() { return "openid-allowed-clock-skew"; }
};
/**
* The maximum amount of time that an OpenID token should remain valid, in
* minutes.
*/
private static final IntegerGuacamoleProperty OPENID_MAX_TOKEN_VALIDITY =
new IntegerGuacamoleProperty() {
@Override
public String getName() { return "openid-max-token-validity"; }
};
/**
* The maximum amount of time that a nonce generated by the Guacamole server
* should remain valid, in minutes. As each OpenID request has a unique
* nonce value, this imposes an upper limit on the amount of time any
* particular OpenID request can result in successful authentication within
* Guacamole.
*/
private static final IntegerGuacamoleProperty OPENID_MAX_NONCE_VALIDITY =
new IntegerGuacamoleProperty() {
@Override
public String getName() { return "openid-max-nonce-validity"; }
};
/**
* OpenID client ID which should be submitted to the OpenID service when
* necessary. This value is typically provided by the OpenID service when
* OpenID credentials are generated for your application.
*/
private static final StringGuacamoleProperty OPENID_CLIENT_ID =
new StringGuacamoleProperty() {
@Override
public String getName() { return "openid-client-id"; }
};
/**
* The URI that the OpenID service should redirect to after the
* authentication process is complete. This must be the full URL that a
* user would enter into their browser to access Guacamole.
*/
private static final URIGuacamoleProperty OPENID_REDIRECT_URI =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-redirect-uri"; }
};
/**
* The logout endpoint (URI) of the OpenID service. If specified, users
* will be redirected to this endpoint when they log out, allowing them
* to log out from the OpenID provider as well.
*/
private static final URIGuacamoleProperty OPENID_LOGOUT_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-logout-endpoint"; }
};
/**
* The URI that the OpenID service should redirect to after logout is
* complete. If not specified, the main redirect URI will be used.
*/
private static final URIGuacamoleProperty OPENID_POST_LOGOUT_REDIRECT_URI =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-post-logout-redirect-uri"; }
};
/**
* The Guacamole server environment.
*/
@Inject
private Environment environment;
/**
* Returns the authorization endpoint (URI) of the OpenID service as
* configured with guacamole.properties.
*
* @return
* The authorization endpoint of the OpenID service, as configured with
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the authorization
* endpoint property is missing.
*/
public URI getAuthorizationEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_AUTHORIZATION_ENDPOINT);
}
/**
* Returns the OpenID client ID which should be submitted to the OpenID
* service when necessary, as configured with guacamole.properties. This
* value is typically provided by the OpenID service when OpenID credentials
* are generated for your application.
*
* @return
* The client ID to use when communicating with the OpenID service,
* as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the client ID
* property is missing.
*/
public String getClientID() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_CLIENT_ID);
}
/**
* Returns the URI that the OpenID service should redirect to after
* the authentication process is complete, as configured with
* guacamole.properties. This must be the full URL that a user would enter
* into their browser to access Guacamole.
*
* @return
* The client secret to use when communicating with the OpenID service,
* as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the redirect URI
* property is missing.
*/
public URI getRedirectURI() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_REDIRECT_URI);
}
/**
* Returns the issuer to expect for all received ID tokens, as configured
* with guacamole.properties.
*
* @return
* The issuer to expect for all received ID tokens, as configured with
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the issuer property
* is missing.
*/
public String getIssuer() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_ISSUER);
}
/**
* Returns the endpoint (URI) of the JWKS service which defines how
* received ID tokens (JWTs) shall be validated, as configured with
* guacamole.properties.
*
* @return
* The endpoint (URI) of the JWKS service which defines how received ID
* tokens (JWTs) shall be validated, as configured with
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the JWKS endpoint
* property is missing.
*/
public URI getJWKSEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_JWKS_ENDPOINT);
}
/**
* Returns the token endpoint (URI) of the OIDC service as
* configured with guacamole.properties.
*
* @return
* The token endpoint of the OIDC service, as configured with
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the authorization
* endpoint property is missing.
*/
public URI getTokenEndpoint() throws GuacamoleException {
return environment.getRequiredProperty(OPENID_TOKEN_ENDPOINT);
}
/**
* Returns the flow type of the OpenID service as configured with guacamole.properties.
*
* @return
* The flow type of the OpenID service, as configured with guacamole.properties. Can
* be either 'implicit' or 'code'.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public String getFlowType() throws GuacamoleException {
return environment.getProperty(OPENID_FLOW_TYPE, DEFAULT_FLOW_TYPE);
}
/**
* Returns the OIDC client secret used for toen validation, as configured
* with guacamole.properties. This value is typically provided by the OIDC
* service when OIDC credentials are generated for your application, and
* may be null.
*
* @return
* The client secret to use when communicating with the OIDC service,
* as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the client ID
* property is missing.
*/
public String getClientSecret() throws GuacamoleException {
return environment.getProperty(OPENID_CLIENT_SECRET);
}
/**
* Returns a boolean value of whether "Proof Key for Code Exchange (PKCE)"
* will be used, as configured with guacamole.properties. The choice of
* whether to use PKCE is up to you, but the OIDC service must support
* it. By default will be false.
*
* @return
* The whether to use PKCE or not, as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public boolean isPKCERequired() throws GuacamoleException {
Boolean enabled = environment.getProperty(OPENID_PKCE_REQUIRED);
return enabled != null && enabled;
}
/**
* Returns the maximum amount of time to allow for an in-progress OpenID
* authentication attempt to be completed, in minutes. A user that takes
* longer than this amount of time to complete authentication with their
* identity provider will be redirected back to the identity provider to
* try again.
*
* @return
* The maximum amount of time to allow for an in-progress SAML
* authentication attempt to be completed, in minutes.
*
* @throws GuacamoleException
* If the authentication timeout cannot be parsed.
*/
public int getAuthenticationTimeout() throws GuacamoleException {
return environment.getProperty(OPENID_AUTH_TIMEOUT, 5);
}
/**
* Returns the claim type which contains the authenticated user's username
* within any valid JWT, as configured with guacamole.properties. By
* default, this will be "email".
*
* @return
* The claim type which contains the authenticated user's username
* within any valid JWT, as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public String getUsernameClaimType() throws GuacamoleException {
return environment.getProperty(OPENID_USERNAME_CLAIM_TYPE, DEFAULT_USERNAME_CLAIM_TYPE);
}
/**
* Returns the claim type which contains the authenticated user's groups
* within any valid JWT, as configured with guacamole.properties. By
* default, this will be "groups".
*
* @return
* The claim type which contains the authenticated user's groups
* within any valid JWT, as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public String getGroupsClaimType() throws GuacamoleException {
return environment.getProperty(OPENID_GROUPS_CLAIM_TYPE, DEFAULT_GROUPS_CLAIM_TYPE);
}
/**
* Returns the claims list within any valid JWT that should be mapped to
* the authenticated user's tokens, as configured with guacamole.properties.
* Empty by default.
*
* @return
* The claims list within any valid JWT that should be mapped to
* the authenticated user's tokens, as configured with guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public Collection<String> getAttributesClaimType() throws GuacamoleException {
return environment.getPropertyCollection(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
}
/**
* Returns the space-separated list of OpenID scopes to request. By default,
* this will be "openid email profile". The OpenID scopes determine the
* information returned within the OpenID token, and thus affect what
* values can be used as an authenticated user's username.
*
* @return
* The space-separated list of OpenID scopes to request when identifying
* a user.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public String getScope() throws GuacamoleException {
return environment.getProperty(OPENID_SCOPE, DEFAULT_SCOPE);
}
/**
* Returns the amount of clock skew tolerated for timestamp comparisons
* between the Guacamole server and OpenID service clocks, in seconds. Too
* much clock skew will affect token expiration calculations, possibly
* allowing old tokens to be used. By default, this will be 30.
*
* @return
* The amount of clock skew tolerated for timestamp comparisons, in
* seconds.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public int getAllowedClockSkew() throws GuacamoleException {
return environment.getProperty(OPENID_ALLOWED_CLOCK_SKEW, DEFAULT_ALLOWED_CLOCK_SKEW);
}
/**
* Returns the maximum amount of time that an OpenID token should remain
* valid, in minutes. A token received from an OpenID service which is
* older than this amount of time will be rejected, even if it is otherwise
* valid. By default, this will be 300 (5 hours).
*
* @return
* The maximum amount of time that an OpenID token should remain valid,
* in minutes.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public int getMaxTokenValidity() throws GuacamoleException {
return environment.getProperty(OPENID_MAX_TOKEN_VALIDITY, DEFAULT_MAX_TOKEN_VALIDITY);
}
/**
* Returns the maximum amount of time that a nonce generated by the
* Guacamole server should remain valid, in minutes. As each OpenID request
* has a unique nonce value, this imposes an upper limit on the amount of
* time any particular OpenID request can result in successful
* authentication within Guacamole. By default, this will be 10.
*
* @return
* The maximum amount of time that a nonce generated by the Guacamole
* server should remain valid, in minutes.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public int getMaxNonceValidity() throws GuacamoleException {
return environment.getProperty(OPENID_MAX_NONCE_VALIDITY, DEFAULT_MAX_NONCE_VALIDITY);
}
/**
* Returns the logout endpoint (URI) of the OpenID service, as configured
* with guacamole.properties. If configured, users will be redirected to
* this endpoint when they log out from Guacamole.
*
* @return
* The logout endpoint of the OpenID service, as configured with
* guacamole.properties, or null if not configured.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public URI getLogoutEndpoint() throws GuacamoleException {
return environment.getProperty(OPENID_LOGOUT_ENDPOINT);
}
/**
* Returns the URI that the OpenID service should redirect to after logout
* is complete, as configured with guacamole.properties. If not configured,
* the main redirect URI will be used.
*
* @return
* The post-logout redirect URI, as configured with
* guacamole.properties, or the main redirect URI if not specified.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed.
*/
public URI getPostLogoutRedirectURI() throws GuacamoleException {
return environment.getProperty(OPENID_POST_LOGOUT_REDIRECT_URI, getRedirectURI());
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/OpenIDResponseType.java
+67
View File
@@ -0,0 +1,67 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid.conf;
import org.apache.guacamole.properties.EnumGuacamoleProperty.PropertyValue;
/**
* This enum represents the valid OIDC reponse types that can be used
*/
public enum OpenIDResponseType {
/*
* Response type "id_token" used for implciit flow as specified in the OpenID standard
*/
@PropertyValue("id_token")
ID_TOKEN("id_token"),
/* Response type "token" used for implicit flow by certain Identity Providers, notably
* AWS Cognito. This corresponds to the official OIDC response_type "id_token token"
* that returns both the "id_token" and "access_token" parameters
*/
@PropertyValue("token")
TOKEN("token"),
/**
* Response type "code" used for code flow authentication
*/
@PropertyValue("code")
CODE("code");
/*
* The string value of the response type used
*/
public final String STRING_VALUE;
/**
* Initializes the response type such that it is associated with the
* given string value.
*
* @param value
* The string value that will be associated with the enum value.
*/
private OpenIDResponseType(String value) {
this.STRING_VALUE = value;
}
@Override
public String toString() {
return STRING_VALUE;
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/OpenIDWellKnown.java
+227
View File
@@ -0,0 +1,227 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid.conf;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import java.io.IOException;
import java.net.URI;
import java.net.URL;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
import java.util.Map;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.auth.openid.util.JsonUrlReader;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.environment.Environment;
import org.apache.guacamole.properties.URIGuacamoleProperty;
import org.jose4j.json.JsonUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* Class for retrieving well-known endpoint data.
*/
@Singleton
public class OpenIDWellKnown {
/**
* Logger for this class.
*/
private static final Logger logger = LoggerFactory.getLogger(OpenIDWellKnown.class);
/**
* The number of attempts to the well-known endpoint to get the values before giving up
*/
private static final int MAX_ATTEMPTS = 24;
/**
* The delay between each attempt to well-known endpoint in seconds
*/
private static final long DELAY_SECONDS = 5;
/**
* The detected issuer
*/
private static String issuer = null;
/**
* The detected authorization endpoint
*/
private static URI authorization_endpoint = null;
/**
* The detected token endpoint
*/
private static URI token_endpoint = null;
/**
* The detected jwks_uri
*/
private static URI jwks_uri = null;
/**
* Empty constructor of the class to populate data recovered from a OIDC
* well-known URL. The class will be populated on injection by Guice
*/
public OpenIDWellKnown() { }
/**
* The well-known endpoint (URI) of the OIDC service.
*/
private static final URIGuacamoleProperty OPENID_WELL_KNOWN_ENDPOINT =
new URIGuacamoleProperty() {
@Override
public String getName() { return "openid-well-known-endpoint"; }
};
/**
* Returns the well-known endpoint (URI) of the OIDC service as
* configured with guacamole.properties.
*
* @return
* The well-known endpoint of the OIDC service, as configured with
* guacamole.properties.
*
* @throws GuacamoleException
* If guacamole.properties cannot be parsed, or if the well-known
* endpoint property is missing.
*/
private URI getWellKnownEndpoint() throws GuacamoleException {
return environment.getProperty(OPENID_WELL_KNOWN_ENDPOINT);
}
/**
* Returns the issuer to expect for all received ID tokens, as configured
* from the well_known endpoint.
*
* @return
* The issuer to expect for all received ID tokens, as returned by the
* well-known endpoint.
*/
public String getIssuer() {
return issuer;
}
/**
* Returns the authorization endpoint (URI) of the OpenID service as
* configured from the well_known endpoint.
*
* @return
* The authorization endpoint of the OpenID service, as returned by the
* well-known endpoint.
*/
public URI getAuthorizationEndpoint() {
return authorization_endpoint;
}
/**
* Returns the token endpoint (URI) of the OpenID service as
* configured from the well_known endpoint.
*
* @return
* The token endpoint of the OpenID service, as returned by the
* well-known endpoint.
*/
public URI getTokenEndpoint() {
return token_endpoint;
}
/**
* Returns the endpoint (URI) of the JWKS service which defines how
* received ID tokens (JWTs) shall be validated, as configured from
* the well-known endpoint.
*
* @return
* The endpoint (URI) of the JWKS service which defines how received ID
* tokens (JWTs) shall be validated, as configured from the
* well-known endpoint.
*/
public URI getJWKSEndpoint() {
return jwks_uri;
}
/**
* The Guacamole server environment.
*/
@Inject
private Environment environment;
/*
* On injection, when the environment is non null, populates the OpenIDWellKnown
* class by reading the json from an OIDC well-known endpoint and saves these values
* for later use. Use Guice to ensure environment exists before initializing.
*/
@Inject
public void init() {
// Fast return if there is no well-known endpoint or its unreadable
try {
if (getWellKnownEndpoint() == null) {
return;
}
}
catch (Exception e) {
return;
}
// Call to well-known endpoint might fail, so allow several tries before giving up
ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
Runnable task = new Runnable() {
int attempts = 0;
@Override
public void run() {
attempts++;
try {
Map<String,Object> json = JsonUrlReader.fetch("GET", getWellKnownEndpoint(), "");
issuer = (String) json.get("issuer");
authorization_endpoint = UriBuilder.fromUri((String) json.get("authorization_endpoint")).build();
token_endpoint = UriBuilder.fromUri((String) json.get("token_endpoint")).build();
jwks_uri = UriBuilder.fromUri((String) json.get("jwks_uri")).build();
logger.info("OIDC well-known\n" +
" issuer : {}\n" +
" authorization_endpoint : {}\n" +
" token_endpoint : {}\n" +
" jwks_uri : {}\n",
issuer, authorization_endpoint, token_endpoint, jwks_uri);
scheduler.shutdown();
return;
}
catch (Exception e) {
logger.debug("Rejecting well-known endpoint : {}", e.getMessage());
}
if (attempts >= MAX_ATTEMPTS) {
logger.info("Timeout on well-known on endpoint");
scheduler.shutdown();
}
}
};
scheduler.scheduleAtFixedRate(task, 0, DELAY_SECONDS, TimeUnit.SECONDS);
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
+41 -116
View File
@@ -20,13 +20,7 @@
package org.apache.guacamole.auth.openid.token;
import com.google.inject.Inject;
import java.io.BufferedReader;
import java.io.OutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLEncoder;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.util.Collection;
import java.util.Collections;
@@ -35,13 +29,11 @@ import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.openid.conf.ConfigurationService;
import org.apache.guacamole.auth.openid.util.JsonUrlReader;
import org.apache.guacamole.auth.sso.NonceService;
import org.apache.guacamole.token.TokenName;
import org.jose4j.json.JsonUtil;
import org.jose4j.jwk.HttpsJwks;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.jwt.MalformedClaimException;
@@ -81,20 +73,26 @@ public class TokenValidationService {
private NonceService nonceService;
/**
* Validates the given ID token, using implicit flow, returning the JwtClaims
* contained therein. If the ID token is invalid, null is returned.
* Validates the given ID token, using implicit flow. Also validates codes,
* exchanging them for id_tokens before validation. If the id_token or
* code is invalid, null is returned, otherwise the JwtClaims in the
* id_token are returned.
*
* @param token
* The ID token to validate.
* The ID token to validate if implicit flow or the code to exchange for
* an id_token and then validate.
*
* @param verifier
* A PKCE verifier or null if not used. Only used with code flow
*
* @return
* The JWT claims contained within the given ID token if it passes tests,
* or null if the token is not valid.
* The JWT claims contained within the id_token if it passes tests,
* or null if the id_token is not valid.
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public JwtClaims validateToken(String token) throws GuacamoleException {
public JwtClaims validateTokenOrCode(String token, String verifier) throws GuacamoleException {
// Validating the token requires a JWKS key resolver
HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
@@ -109,26 +107,36 @@ public class TokenValidationService {
.setExpectedAudience(confService.getClientID())
.setVerificationKeyResolver(resolver)
.build();
/* Exchange code → token */
if (! confService.isImplicitFlow()) {
token = exchangeCode(token, verifier);
}
try {
// Validate JWT
JwtClaims claims = jwtConsumer.processToClaims(token);
// Verify a nonce is present
String nonce = claims.getStringClaimValue("nonce");
if (nonce != null) {
// Verify that we actually generated the nonce, and that it has not
// already been used
if (nonceService.isValid(nonce)) {
// nonce is valid, consider claims valid
return claims;
if (confService.isImplicitFlow()) {
// Verify a nonce is present
String nonce = claims.getStringClaimValue("nonce");
if (nonce != null) {
// Verify that we actually generated the nonce, and that it has not
// already been used
if (nonceService.isValid(nonce)) {
// nonce is valid, consider claims valid
return claims;
}
else {
logger.info("Rejected OpenID token with invalid/old nonce.");
}
}
else {
logger.info("Rejected OpenID token with invalid/old nonce.");
logger.info("Rejected OpenID token without nonce.");
}
}
else {
logger.info("Rejected OpenID token without nonce.");
return claims;
}
}
// Log any failures to validate/parse the JWT
@@ -142,54 +150,6 @@ public class TokenValidationService {
return null;
}
/**
* Validates the given ID token, using code flow, returning the JwtClaims
* contained therein. If the ID token is invalid, null is returned.
*
* @param code
* The code to validate and receive the id_token.
*
* @param verifier
* A PKCE verifier or null if not used.
*
* @return
* The JWT claims contained within the given ID token if it passes tests,
* or null if the token is not valid.
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public JwtClaims validateCode(String code, String verifier) throws GuacamoleException {
// Validating the token requires a JWKS key resolver
HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
/* Exchange code → token */
String token = exchangeCode(code, verifier);
// Create JWT consumer for validating received token
JwtConsumer jwtConsumer = new JwtConsumerBuilder()
.setRequireExpirationTime()
.setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
.setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
.setRequireSubject()
.setExpectedIssuer(confService.getIssuer())
.setExpectedAudience(confService.getClientID())
.setVerificationKeyResolver(resolver)
.build();
try {
// Validate JWT
return jwtConsumer.processToClaims(token);
}
// Log any failures to validate/parse the JWT
catch (InvalidJwtException e) {
logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
}
return null;
}
/**
* URLEncodes a key/value pair
*
@@ -215,6 +175,7 @@ public class TokenValidationService {
*
* @param code
* The authorization code received from the IdP.
*
* @param codeVerifier
* The PKCE verifier (or null if PKCE is disabled).
*
@@ -243,50 +204,14 @@ public class TokenValidationService {
bodyBuilder.append("&").append(urlencode("code_verifier", verifier));
}
// Build the final URI and convert to a URL
URL url = confService.getTokenEndpoint().toURL();
// Open connection, using HttpURLConnection
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8"
);
try (OutputStream out = conn.getOutputStream()) {
byte [] body = bodyBuilder.toString().getBytes(StandardCharsets.UTF_8);
out.write(body, 0, body.length);
}
// Read response
int status = conn.getResponseCode();
BufferedReader reader = new BufferedReader(
new InputStreamReader(
status >= 200 && status < 300
? conn.getInputStream()
: conn.getErrorStream(),
StandardCharsets.UTF_8
)
);
StringBuilder responseBody = new StringBuilder();
String line;
while ((line = reader.readLine()) != null) {
responseBody.append(line);
}
reader.close();
Map<String,Object> json = JsonUtil.parseJson(responseBody.toString());
if (status < 200 || status >= 300) {
throw new GuacamoleException("Token endpoint error (" + status + "): " + json.toString());
}
Map<String,Object> json =
JsonUrlReader.fetch("POST", confService.getTokenEndpoint(),
bodyBuilder.toString());
return (String) json.get("id_token");
} catch (Exception e) {
}
catch (Exception e) {
logger.info("Rejected invalid OpenID code exchange: {}", e.getMessage(), e);
}
return null;
@@ -359,7 +284,7 @@ public class TokenValidationService {
List<String> oidcGroups = claims.getStringListClaimValue(groupsClaim);
if (oidcGroups != null && !oidcGroups.isEmpty())
return Collections.unmodifiableSet(new HashSet<>(oidcGroups));
}
}
catch (MalformedClaimException e) {
logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java.orig
-430
View File
@@ -1,430 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid.token;
import com.google.inject.Inject;
import java.io.BufferedReader;
import java.io.OutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLEncoder;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.core.UriBuilder;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.openid.conf.ConfigurationService;
import org.apache.guacamole.auth.sso.NonceService;
import org.apache.guacamole.token.TokenName;
import org.jose4j.json.JsonUtil;
import org.jose4j.jwk.HttpsJwks;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.jwt.MalformedClaimException;
import org.jose4j.jwt.consumer.InvalidJwtException;
import org.jose4j.jwt.consumer.JwtConsumer;
import org.jose4j.jwt.consumer.JwtConsumerBuilder;
import org.jose4j.keys.resolvers.HttpsJwksVerificationKeyResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* Service for validating ID tokens forwarded to us by the client, verifying
* that they did indeed come from the OpenID service.
*/
public class TokenValidationService {
/**
* Logger for this class.
*/
private final Logger logger = LoggerFactory.getLogger(TokenValidationService.class);
/**
* The prefix to use when generating token names.
*/
public static final String OIDC_ATTRIBUTE_TOKEN_PREFIX = "OIDC_";
/**
* Service for retrieving OpenID configuration information.
*/
@Inject
private ConfigurationService confService;
/**
* Service for validating and generating unique nonce values.
*/
@Inject
private NonceService nonceService;
/**
* Validates the given ID token, using implicit flow, returning the JwtClaims
* contained therein. If the ID token is invalid, null is returned.
*
* @param token
* The ID token to validate.
*
* @return
* The JWT claims contained within the given ID token if it passes tests,
* or null if the token is not valid.
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public JwtClaims validateToken(String token) throws GuacamoleException {
// Validating the token requires a JWKS key resolver
HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
// Create JWT consumer for validating received token
JwtConsumer jwtConsumer = new JwtConsumerBuilder()
.setRequireExpirationTime()
.setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
.setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
.setRequireSubject()
.setExpectedIssuer(confService.getIssuer())
.setExpectedAudience(confService.getClientID())
.setVerificationKeyResolver(resolver)
.build();
try {
// Validate JWT
JwtClaims claims = jwtConsumer.processToClaims(token);
// Verify a nonce is present
String nonce = claims.getStringClaimValue("nonce");
if (nonce != null) {
// Verify that we actually generated the nonce, and that it has not
// already been used
if (nonceService.isValid(nonce)) {
// nonce is valid, consider claims valid
return claims;
}
else {
logger.info("Rejected OpenID token with invalid/old nonce.");
}
}
else {
logger.info("Rejected OpenID token without nonce.");
}
}
// Log any failures to validate/parse the JWT
catch (MalformedClaimException e) {
logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
}
catch (InvalidJwtException e) {
logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
}
return null;
}
/**
* Validates the given ID token, using code flow, returning the JwtClaims
* contained therein. If the ID token is invalid, null is returned.
*
* @param code
* The code to validate and receive the id_token.
*
* @param verifier
* A PKCE verifier or null if not used.
*
* @return
* The JWT claims contained within the given ID token if it passes tests,
* or null if the token is not valid.
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public JwtClaims validateCode(String code, String verifier) throws GuacamoleException {
// Validating the token requires a JWKS key resolver
HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);
/* Exchange code → token */
String token = exchangeCode(code, verifier);
// Create JWT consumer for validating received token
JwtConsumer jwtConsumer = new JwtConsumerBuilder()
.setRequireExpirationTime()
.setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
.setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
.setRequireSubject()
.setExpectedIssuer(confService.getIssuer())
.setExpectedAudience(confService.getClientID())
.setVerificationKeyResolver(resolver)
.build();
try {
// Validate JWT
return jwtConsumer.processToClaims(token);
}
// Log any failures to validate/parse the JWT
catch (InvalidJwtException e) {
logger.info("Rejected invalid OpenID token: {}", e.getMessage(), e);
}
return null;
}
/**
* URLEncodes a key/value pair
*
* @param key
* The key to encode
*
* @param value
* The value to encode
*
* @return
* The urlencoded kay/value pair
*/
private String urlencode(String key, String value) {
StringBuilder builder = new StringBuilder();
return builder.append(URLEncoder.encode(key, StandardCharsets.UTF_8))
.append("=")
.append(URLEncoder.encode(value, StandardCharsets.UTF_8))
.toString();
}
/**
* Exchanges the authorization code for tokens.
*
* @param code
* The authorization code received from the IdP.
* @param codeVerifier
* The PKCE verifier (or null if PKCE is disabled).
*
* @return
* The token string returned.
*
* @throws GuacamoleException
* If a valid token is not returned.
*/
private String exchangeCode(String code, String verifier) throws GuacamoleException {
try {
StringBuilder bodyBuilder = new StringBuilder();
bodyBuilder.append(urlencode("grant_type", "authorization_code")).append("&");
bodyBuilder.append(urlencode("code", code)).append("&");
bodyBuilder.append(urlencode("redirect_uri", confService.getRedirectURI().toString())).append("&");
bodyBuilder.append(urlencode("scope", confService.getScope())).append("&");
bodyBuilder.append(urlencode("client_id", confService.getClientID()));
String clientSecret = confService.getClientSecret();
if (clientSecret != null && !clientSecret.trim().isEmpty()) {
bodyBuilder.append("&").append(urlencode("client_secret", clientSecret));
}
if (confService.isPKCERequired()) {
bodyBuilder.append("&").append(urlencode("code_verifier", verifier));
}
// Build the final URI and convert to a URL
URL url = confService.getTokenEndpoint().toURL();
// Open connection, using HttpURLConnection
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8"
);
try (OutputStream out = conn.getOutputStream()) {
byte [] body = bodyBuilder.toString().getBytes(StandardCharsets.UTF_8);
out.write(body, 0, body.length);
}
// Read response
int status = conn.getResponseCode();
BufferedReader reader = new BufferedReader(
new InputStreamReader(
status >= 200 && status < 300
? conn.getInputStream()
: conn.getErrorStream(),
StandardCharsets.UTF_8
)
);
StringBuilder responseBody = new StringBuilder();
String line;
while ((line = reader.readLine()) != null) {
responseBody.append(line);
}
reader.close();
Map<String,Object> json = JsonUtil.parseJson(responseBody.toString());
if (status < 200 || status >= 300) {
throw new GuacamoleException("Token endpoint error (" + status + "): " + json.toString());
}
return (String) json.get("id_token");
} catch (Exception e) {
logger.info("Rejected invalid OpenID code exchange: {}", e.getMessage(), e);
}
return null;
}
/**
* Parses the given JwtClaims, returning the username contained
* therein, as defined by the username claim type given in
* guacamole.properties. If the username claim type is missing or
* is invalid, null is returned.
*
* @param claims
* A valid JwtClaims to extract the username from.
*
* @return
* The username contained within the given JwtClaims, or null if the
* claim is not valid or the username claim type is missing,
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public String processUsername(JwtClaims claims) throws GuacamoleException {
String usernameClaim = confService.getUsernameClaimType();
if (claims != null) {
try {
// Pull username from claims
String username = claims.getStringClaimValue(usernameClaim);
if (username != null)
return username;
}
catch (MalformedClaimException e) {
logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
}
// Warn if username was not present in token, as it likely means
// the system is not set up correctly
logger.warn("Username claim \"{}\" missing from token. Perhaps the "
+ "OpenID scope and/or username claim type are "
+ "misconfigured?", usernameClaim);
}
// Could not retrieve username from JWT
return null;
}
/**
* Parses the given JwtClaims, returning the groups contained
* therein, as defined by the groups claim type given in
* guacamole.properties. If the groups claim type is missing or
* is invalid, an empty set is returned.
*
* @param claims
* A valid JwtClaims to extract groups from.
*
* @return
* A Set of String representing the groups the user is member of
* from the OpenID provider point of view, or an empty Set if
* claim is not valid or the groups claim type is missing,
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public Set<String> processGroups(JwtClaims claims) throws GuacamoleException {
String groupsClaim = confService.getGroupsClaimType();
if (claims != null) {
try {
// Pull groups from claims
List<String> oidcGroups = claims.getStringListClaimValue(groupsClaim);
if (oidcGroups != null && !oidcGroups.isEmpty())
return Collections.unmodifiableSet(new HashSet<>(oidcGroups));
}
catch (MalformedClaimException e) {
logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
}
}
// Could not retrieve groups from JWT
return Collections.emptySet();
}
/**
* Parses the given JwtClaims, returning the attributes contained
* therein, as defined by the attributes claim type given in
* guacamole.properties. If the attributes claim type is missing or
* is invalid, an empty set is returned.
*
* @param claims
* A valid JwtClaims to extract attributes from.
*
* @return
* A Map of String,String representing the attributes and values
* from the OpenID provider point of view, or an empty Map if
* claim is not valid or the attributes claim type is missing.
*
* @throws GuacamoleException
* If guacamole.properties could not be parsed.
*/
public Map<String, String> processAttributes(JwtClaims claims) throws GuacamoleException {
Collection<String> attributesClaim = confService.getAttributesClaimType();
if (claims != null && !attributesClaim.isEmpty()) {
try {
logger.debug("Iterating over attributes claim list : {}", attributesClaim);
// We suppose all claims are resolved, so the hashmap is initialised to
// the size of the configuration list
Map<String, String> tokens = new HashMap<String, String>(attributesClaim.size());
// We iterate over the configured attributes
for (String key: attributesClaim) {
// Retrieve the corresponding claim
String oidcAttr = claims.getStringClaimValue(key);
// We do have a matching claim and it is not empty
if (oidcAttr != null && !oidcAttr.isEmpty()) {
// append the prefixed claim value to the token map with its value
String tokenName = TokenName.canonicalize(key, OIDC_ATTRIBUTE_TOKEN_PREFIX);
tokens.put(tokenName, oidcAttr);
logger.debug("Claim {} found and set to {}", key, tokenName);
}
else {
// wanted attribute is not found in the claim
logger.debug("Claim {} not found in JWT.", key);
}
}
// We did process all the expected claims
return Collections.unmodifiableMap(tokens);
}
catch (MalformedClaimException e) {
logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage(), e);
}
}
// Could not retrieve attributes from JWT
logger.debug("Attributes claim not defined. Returning empty map.");
return Collections.emptyMap();
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/JsonUrlReader.java
+106
View File
@@ -0,0 +1,106 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.guacamole.auth.openid.util;
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.util.Map;
import java.util.concurrent.CompletableFuture;
import org.jose4j.json.JsonUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/*
* Utility class to open a http connection to a URL, send a body
* and receive a response in the form of a parsed JSON
*/
public final class JsonUrlReader {
/**
* Logger for this class.
*/
private static final Logger logger = LoggerFactory.getLogger(JsonUrlReader.class);
/**
* Class to GET and POST to a URL and read the returned JSON. This class should
* not be instantiated.
*/
private JsonUrlReader() {}
/**
* Method to POST or GET to a URL and recover the JSON in the form of a Map
*
* @param String method
* The http method to use. Should be "GET", "POST" or "PATCH".
*
* @param URI uri
* A URI value giving the address where to recover the JSON
*
* @param String body
* A pre-encoded body string to be sent to the address if the method is
* "POST" or "PATCH". Ignored if the method is "GET".
*
* @return
* A Map<String,Object> containing the decoded json values.
*/
public static Map<String, Object> fetch(String method, URI uri, String body) throws IOException {
if (uri == null || uri.toString().isEmpty()) {
throw new IOException("JsonUrlReader: Missing URL");
}
try {
HttpClient client = HttpClient.newHttpClient();
HttpRequest.Builder requestBuilder = HttpRequest.newBuilder().uri(uri);
if (method != "GET") {
// FIXME: If this function is ever used to post json bodies this header
// will need to be configurable
requestBuilder.header("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
.method(method, HttpRequest.BodyPublishers.ofString(body == null ? "" : body,
StandardCharsets.UTF_8));
}
else {
requestBuilder.GET();
}
// Asynchronous, non-blocking send, so that tomcat servlets are not blocked by outbound connection
CompletableFuture<HttpResponse<String>> future = client.sendAsync(requestBuilder.build(),
HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
HttpResponse<String> response = future.join();
int status = response.statusCode();
logger.debug("Response body: {}", response.body());
Map<String, Object> json = JsonUtil.parseJson(response.body());
if (status < 200 || status >= 300) {
throw new IOException("(status: " + status + "): " + json.toString());
}
return json;
}
catch (Exception e) {
throw new IOException("JsonUrlReader error: " + e.getMessage());
}
}
}
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/util/PKCEUtil.java
+22 -1
View File
@@ -30,13 +30,21 @@ import java.security.SecureRandom;
* - code_challenge (S256)
*/
public final class PKCEUtil {
/**
* Get the verifier data from a cryptographically secure random source
*/
private static final SecureRandom RANDOM = new SecureRandom();
/*
* Class to create PKCE challenges and verifiers. This class should not be instantiated
*/
private PKCEUtil() {}
/**
* Generates a high-entropy PKCE code_verifier.
*
* @return
* A 256bit or 64 byte random Base64 URL encode string
*/
public static String generateCodeVerifier() {
byte[] bytes = new byte[64];
@@ -46,6 +54,13 @@ public final class PKCEUtil {
/**
* Computes the PKCE code_challenge = BASE64URL(SHA256(code_verifier)).
*
* @param String verifier
* A string containing the S256 verifier calculated bu generateCodeVerifier
*
* @return
* The generated S256 code challenge used for the PKCE request encoded
* in Base64 URL format.
*/
public static String generateCodeChallenge(String verifier) throws Exception {
MessageDigest sha = MessageDigest.getInstance("SHA-256");
@@ -55,6 +70,12 @@ public final class PKCEUtil {
/**
* Base64URL encoding without padding.
*
* @param bytes
* The bytes to be Base64 URL encoded
*
* @return
* The Base64 URL encoded string value corresponding to the bytes
*/
public static String base64Url(byte[] bytes) {
return java.util.Base64.getUrlEncoder()