From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 218A41FF168 for ; Tue, 24 Dec 2024 21:25:43 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 4B0F318F68; Tue, 24 Dec 2024 21:25:33 +0100 (CET) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1735071894; x=1735676694; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=eO2br3NAwwPV1MDKEIlBZeqsztm+kr7mOMpfTjsIB/s=; b=QX/8uQ24CCC6TCFm1U/EA8N/h8eZ15BlQd/9AeL9yX4GeQMKkDp4pDu8LWT6TTgtOR eojLa+4rFt+4JXOLHis/ysB7G5cZhJEt6dAZ3OsJW0g3w7vg5QbLy6zdlQ73tLp7He/i /YAQG/Pc5cIaxYsqjz8nDpy112i8YYa2gz6FxYZFUFyk/2x+UUJ3mEa3ZsyqzA6MrgRD Bm+aDD1fjYDtDLwyRalXFccYUPM7LdwQZrHrt988mL3UzXcIYjVtkN5t1NBUhSSyCRJL KqiGHvB0rZFEygzHfZH83JRDHOISjF3E1tYap549k44GfzCkbsn5oO7XjDrmlnj6/Tmr Bmhw== X-Gm-Message-State: AOJu0YxlTvi0hPTVLu2zBkRzhaLsK1/MIiLY9tOvJ3N5i1Dk7jh1/18u M46xJoOewaMu71eUWIWyBOl7Myakz0Sm9eRFig/CI9z9IHMiqMvL4OKepA== X-Gm-Gg: ASbGnctS3xzZCI+zuWOzNuyVrnwS+29r3QGo+d5MZrHlMIN2x+TE9jKontcWiF1kOI1 uEszDG5dPNf8jDqHHQHzjIWjFtjz5EYlUcVDRYTpAnBi2Z3z8y9ZO8wAriKe9kzDwiY+RNjTnqY k/9L6+JNeTpsg+eyPo+c/LnH2ypBhoEmC4bs7ZmrnTJL4sUX/bsTeWhQrKYcWB4Yha5ow7RY1RG 49AWoALa5fgPHw0CNk5HjY01LQ+XTi8ODaxec1pj4GzOvS2fTKAu7S0j91wjVkuP6oQNTYyz087 IoBJfr+QqqEQEI6fCsBK26nTH+eKWjViChRccbXZw+Pb0ZaMnQX9CCoF00GZm1dE0vaAKw== X-Google-Smtp-Source: AGHT+IHO5vZHbL+94emFJaHDL/0LD/3UR7+stoRtxrRld4d69Ri24MKYuHg8zXqzZcsjEwLxjN2CoQ== X-Received: by 2002:a25:ce91:0:b0:e53:9c36:895 with SMTP id 3f1490d57ef6-e539c36094amr9897785276.21.1735071893658; Tue, 24 Dec 2024 12:24:53 -0800 (PST) From: Thomas Skinner To: pve-devel@lists.proxmox.com Date: Tue, 24 Dec 2024 14:24:27 -0600 Message-Id: <20241224202429.3072813-3-thomas@atskinner.net> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20241224202429.3072813-1-thomas@atskinner.net> References: <20241224202429.3072813-1-thomas@atskinner.net> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.083 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy FREEMAIL_FORGED_FROMDOMAIN 0.001 2nd level domains in From and EnvelopeFrom freemail headers are different FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider HEADER_FROM_DIFFERENT_DOMAINS 0.156 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH proxmox v2 1/1] fix #4411: openid: add library code for generic id token claim support X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Thomas Skinner Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Signed-off-by: Thomas Skinner --- proxmox-openid/src/lib.rs | 55 +++++++++++++++++++++++++++++++++------ 1 file changed, 47 insertions(+), 8 deletions(-) diff --git a/proxmox-openid/src/lib.rs b/proxmox-openid/src/lib.rs index fe65fded..bf8c650b 100644 --- a/proxmox-openid/src/lib.rs +++ b/proxmox-openid/src/lib.rs @@ -15,8 +15,11 @@ pub use auth_state::*; use openidconnect::{ //curl::http_client, core::{ - CoreAuthDisplay, CoreAuthPrompt, CoreAuthenticationFlow, CoreClient, CoreGenderClaim, - CoreIdTokenClaims, CoreIdTokenVerifier, CoreProviderMetadata, + CoreAuthDisplay, CoreAuthPrompt, CoreAuthenticationFlow, CoreErrorResponseType, + CoreGenderClaim, CoreIdTokenVerifier, CoreJsonWebKey, CoreJsonWebKeyType, + CoreJsonWebKeyUse, CoreJweContentEncryptionAlgorithm, CoreJwsSigningAlgorithm, + CoreProviderMetadata, CoreRevocableToken, CoreRevocationErrorResponse, + CoreTokenIntrospectionResponse, CoreTokenType, }, AdditionalClaims, AuthenticationContextClass, @@ -24,6 +27,9 @@ use openidconnect::{ ClientId, ClientSecret, CsrfToken, + EmptyExtraTokenFields, + IdTokenClaims, + IdTokenFields, IssuerUrl, Nonce, OAuth2TokenResponse, @@ -31,15 +37,47 @@ use openidconnect::{ PkceCodeVerifier, RedirectUrl, Scope, + StandardErrorResponse, + StandardTokenResponse, UserInfoClaims, }; /// Stores Additional Claims into a serde_json::Value; -#[derive(Debug, Deserialize, Serialize)] +#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)] pub struct GenericClaims(Value); impl AdditionalClaims for GenericClaims {} pub type GenericUserInfoClaims = UserInfoClaims; +pub type GenericIdTokenClaims = IdTokenClaims; + +pub type GenericIdTokenFields = IdTokenFields< + GenericClaims, + EmptyExtraTokenFields, + CoreGenderClaim, + CoreJweContentEncryptionAlgorithm, + CoreJwsSigningAlgorithm, + CoreJsonWebKeyType, +>; + +pub type GenericTokenResponse = StandardTokenResponse; + +pub type GenericClient = openidconnect::Client< + GenericClaims, + CoreAuthDisplay, + CoreGenderClaim, + CoreJweContentEncryptionAlgorithm, + CoreJwsSigningAlgorithm, + CoreJsonWebKeyType, + CoreJsonWebKeyUse, + CoreJsonWebKey, + CoreAuthPrompt, + StandardErrorResponse, + GenericTokenResponse, + CoreTokenType, + CoreTokenIntrospectionResponse, + CoreRevocableToken, + CoreRevocationErrorResponse, +>; #[derive(Debug, Deserialize, Serialize, Clone)] pub struct OpenIdConfig { @@ -56,7 +94,7 @@ pub struct OpenIdConfig { } pub struct OpenIdAuthenticator { - client: CoreClient, + client: GenericClient, config: OpenIdConfig, } @@ -120,8 +158,9 @@ impl OpenIdAuthenticator { let provider_metadata = CoreProviderMetadata::discover(&issuer_url, http_client)?; - let client = CoreClient::from_provider_metadata(provider_metadata, client_id, client_key) - .set_redirect_uri(RedirectUrl::new(String::from(redirect_url))?); + let client = + GenericClient::from_provider_metadata(provider_metadata, client_id, client_key) + .set_redirect_uri(RedirectUrl::new(String::from(redirect_url))?); Ok(Self { client, @@ -195,7 +234,7 @@ impl OpenIdAuthenticator { &self, code: &str, private_auth_state: &PrivateAuthState, - ) -> Result<(CoreIdTokenClaims, GenericUserInfoClaims), Error> { + ) -> Result<(GenericIdTokenClaims, GenericUserInfoClaims), Error> { let code = AuthorizationCode::new(code.to_string()); // Exchange the code with a token. let token_response = self @@ -206,7 +245,7 @@ impl OpenIdAuthenticator { .map_err(|err| format_err!("Failed to contact token endpoint: {}", err))?; let id_token_verifier: CoreIdTokenVerifier = self.client.id_token_verifier(); - let id_token_claims: &CoreIdTokenClaims = token_response + let id_token_claims: &GenericIdTokenClaims = token_response .extra_fields() .id_token() .expect("Server did not return an ID token") -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel