pomerium / pomerium / 20972511756

46%

Build Type

push

github

Committed by web-flow

Commit Message

oidc/hosted: authenticate refresh request (#6045)

Update the 'hosted' OIDC provider to support the same client
authentication on a Refresh() request as on an initial Authenticate()
request.

(So far, we haven't needed this because hosted-authenticate did not
support refresh requests. Now that we are adding support, we need to
make sure the client supports the same authentication mechanism.)

Unfortunately, the underlying oauth2 package doesn't seem to provide
any easy way to modify the refresh request, so I think the simplest
workaround is to fork some of the request logic (this is in the new
request.go file).

Also extract the oidc.Provider.verifyIDToken() method into a separate
internal package pkg/identity/oidc/internal so that it can be shared
between oidc.Provider and hosted.Provider without becoming part of the
public API--it's just slightly different than the VerifyIdentityToken()
method from the Authenticator interface, and I feel it would be too
confusing to have both.

Run Details

63 of 97 new or added lines in 4 files covered. (64.95%)

21 existing lines in 5 files now uncovered.

29857 of 56538 relevant lines covered (52.81%)

126.06 hits per line