hyperscale-stack / security / 38221610547

98%

push

github

feat(oidc): add an OpenID provider (code flow, ID Tokens, discovery, UserInfo)

Add oidc/provider (package oidcprovider), an OpenID Provider (OIDC Core
1.0 errata 2, Discovery 1.0) on the oauth2 extension points, depending on
oauth2, jwt and the core only: the code flow with PKCE, ID Tokens at the
code exchange and every refresh (Core §12.2), UserInfo with RFC 6750
errors, Discovery (path issuers, only what is served) and the public JWK
Set. New builds the server; Paths gives every mount path. The provider
validates authentication requests and re-checks every approval itself
(realm, prompt=login, max_age, designated subject, essential acr,
offline_access consent, fail closed); the application keeps sessions and
UI (Interaction, prompt=none without ResponseWriter), claims
(ClaimsSource) and keys (KeySource, validated rings, nothing private
published). prompt=none refusals reveal no session state.

oauth2: client_secret_basic form-decodes credentials (RFC 6749 §2.3.1);
every authorization response carries iss (RFC 9207), except the
server_error of a failed IssuerResolver (documented deviation; the review
preferred a bare 500); optional IssuerBoundClient keeps a client in its
issuers — elsewhere it reads as an unknown client at /authorize, /token,
/revoke and /introspect, byte for byte.
jwt: RFC 9068 access tokens typed at+jwt with a jti (break:
NewOAuth2AccessTokenSigner takes a PrivateKey), WithType, MarshalJWKS,
VerifySignature, key validation.

Interop with go-oidc + x/oauth2 in the test-only internal/interop/oidcop;
runnable examples/oidc-provider; docs/oidc-provider.md feature matrix (no
certification claimed); MIGRATION, CHANGELOG, LIMITATIONS and docs.

Refs #84.

1759 of 1799 new or added lines in 31 files covered. (97.78%)

9411 of 9717 relevant lines covered (96.85%)

1001.48 hits per line