-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into oauth-unlink-social-accounts
- Loading branch information
Showing
26 changed files
with
1,267 additions
and
59 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| package oauth | ||
|
|
||
| import ( | ||
| "encoding/hex" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| "github.com/keratin/authn-server/lib/oauth/apple" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| // NewAppleProvider returns a AuthN integration for sign-in with Apple OAuth | ||
| func NewAppleProvider(credentials *Credentials) (*Provider, error) { | ||
| config := &oauth2.Config{ | ||
| ClientID: credentials.ID, | ||
| // ClientSecret for apple is built using apple.GenerateSecret | ||
| // this function is passed to the provider for use as an override | ||
| // and built fresh on each call to provider.Config(returnURL). | ||
| ClientSecret: "", | ||
| Scopes: []string{"email"}, | ||
| Endpoint: apple.Endpoint(), | ||
| } | ||
|
|
||
| teamID, keyID, expiresIn, constructErr := apple.ExtractCredentialData(credentials.Additional) | ||
| if constructErr != nil { | ||
| return nil, fmt.Errorf("apple: failed to extract credentials: %w", constructErr) | ||
| } | ||
|
|
||
| keyBytes, err := hex.DecodeString(credentials.Secret) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("apple: failed to decode key from client secret: %w", err) | ||
| } | ||
|
|
||
| signingKey, constructErr := apple.ParsePrivateKey(keyBytes, keyID) | ||
| if constructErr != nil { | ||
| return nil, fmt.Errorf("apple: failed to parse signing key: %w", constructErr) | ||
| } | ||
|
|
||
| appleTokenReader := apple.NewTokenReader(config.ClientID) | ||
|
|
||
| getAppleUserInfo := func(t *oauth2.Token) (*UserInfo, error) { | ||
| id, email, err := appleTokenReader.GetUserDetailsFromToken(t) | ||
|
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &UserInfo{ | ||
| ID: id, | ||
| Email: email, | ||
| }, nil | ||
| } | ||
|
|
||
| return NewProvider(config, getAppleUserInfo, | ||
| WithSecretGenerator(func() (string, error) { | ||
| return apple.GenerateSecret(*signingKey, keyID, config.ClientID, teamID, expiresIn) | ||
| }), | ||
| // Apple requires form_post response mode if scopes are requested | ||
| WithAuthCodeOptions(oauth2.SetAuthURLParam("response_mode", "form_post")), | ||
| // So we need to handle returns via POST instead of GET | ||
| WithReturnMethod(http.MethodPost)), nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package apple | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/go-jose/go-jose/v3/jwt" | ||
| ) | ||
|
|
||
| type Claims struct { | ||
| Email string `json:"email"` | ||
| jwt.Claims | ||
| } | ||
|
|
||
| // Validate performs apple-specific id_token validation. | ||
| // `email` is the only additional claim we currently require. | ||
| // See https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple#3383773 | ||
| // for more details. | ||
| func (c Claims) Validate(clientID string) error { | ||
| if clientID == "" { | ||
| return fmt.Errorf("cannot validate with empty clientID") | ||
| } | ||
|
|
||
| if c.Email == "" { | ||
| return fmt.Errorf("missing claim 'email'") | ||
| } | ||
|
|
||
| if c.Expiry == nil { | ||
| return fmt.Errorf("missing claim 'exp'") | ||
| } | ||
|
|
||
| if c.IssuedAt == nil { | ||
| return fmt.Errorf("missing claim 'iat'") | ||
| } | ||
|
|
||
| return c.Claims.Validate(jwt.Expected{ | ||
| Issuer: BaseURL, | ||
| Audience: jwt.Audience{clientID}, | ||
| }) | ||
| } |
Oops, something went wrong.