diff --git a/integration_test/credetial_plugin_test.go b/integration_test/credetial_plugin_test.go index 81b44a95..ca8b7c60 100644 --- a/integration_test/credetial_plugin_test.go +++ b/integration_test/credetial_plugin_test.go @@ -332,32 +332,6 @@ func TestCredentialPlugin(t *testing.T) { assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour)) }) - t.Run("RedirectURLHostname", func(t *testing.T) { - ctx, cancel := context.WithTimeout(context.TODO(), timeout) - defer cancel() - svc := oidcserver.New(t, keypair.None, testconfig.Config{ - Want: testconfig.Want{ - Scope: "openid", - RedirectURIPrefix: "http://127.0.0.1:", - CodeChallengeMethod: "S256", - }, - Response: testconfig.Response{ - IDTokenExpiry: now.Add(time.Hour), - CodeChallengeMethodsSupported: []string{"plain", "S256"}, - }, - }) - var stdout bytes.Buffer - runGetToken(t, ctx, getTokenConfig{ - tokenCacheDir: tokenCacheDir, - issuerURL: svc.IssuerURL(), - httpDriver: httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}), - now: now, - stdout: &stdout, - args: []string{"--oidc-redirect-url-hostname", "127.0.0.1"}, - }) - assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour)) - }) - t.Run("RedirectURLHTTPS", func(t *testing.T) { ctx, cancel := context.WithTimeout(context.TODO(), timeout) defer cancel() diff --git a/pkg/cmd/authentication.go b/pkg/cmd/authentication.go index eb969f85..c7a5f169 100644 --- a/pkg/cmd/authentication.go +++ b/pkg/cmd/authentication.go @@ -15,20 +15,18 @@ import ( ) type authenticationOptions struct { - GrantType string - ListenAddress []string - AuthenticationTimeoutSec int - SkipOpenBrowser bool - BrowserCommand string - LocalServerCertFile string - LocalServerKeyFile string - OpenURLAfterAuthentication string - RedirectURLHostname string // DEPRECATED - RedirectURLAuthCodeKeyboard string // DEPRECATED - AuthRequestAccessType string - AuthRequestExtraParams map[string]string - Username string - Password string + GrantType string + ListenAddress []string + AuthenticationTimeoutSec int + SkipOpenBrowser bool + BrowserCommand string + LocalServerCertFile string + LocalServerKeyFile string + OpenURLAfterAuthentication string + AuthRequestAccessType string + AuthRequestExtraParams map[string]string + Username string + Password string } var allGrantType = strings.Join([]string{ @@ -49,14 +47,6 @@ func (o *authenticationOptions) addFlags(f *pflag.FlagSet) { f.StringVar(&o.LocalServerCertFile, "local-server-cert", "", "[authcode] Certificate path for the local server") f.StringVar(&o.LocalServerKeyFile, "local-server-key", "", "[authcode] Certificate key path for the local server") f.StringVar(&o.OpenURLAfterAuthentication, "open-url-after-authentication", "", "[authcode] If set, open the URL in the browser after authentication") - f.StringVar(&o.RedirectURLHostname, "oidc-redirect-url-hostname", "", "[authcode] Hostname of the redirect URL") - if err := f.MarkDeprecated("oidc-redirect-url-hostname", "use --oidc-redirect-url instead."); err != nil { - panic(err) - } - f.StringVar(&o.RedirectURLAuthCodeKeyboard, "oidc-redirect-url-authcode-keyboard", "", "Equivalent to --oidc-redirect-url") - if err := f.MarkDeprecated("oidc-redirect-url-authcode-keyboard", "use --oidc-redirect-url instead."); err != nil { - panic(err) - } f.StringVar(&o.AuthRequestAccessType, "oidc-access-type", "offline", "[authcode, authcode-keyboard] Access type of the authentication request") f.StringToStringVar(&o.AuthRequestExtraParams, "oidc-auth-request-extra-params", nil, "[authcode, authcode-keyboard, client-credentials] Extra query parameters to send with an authentication request") f.StringVar(&o.Username, "username", "", "[password] Username for resource owner password credentials grant") @@ -79,7 +69,6 @@ func (o *authenticationOptions) grantOptionSet() (s authentication.GrantOptionSe LocalServerCertFile: o.LocalServerCertFile, LocalServerKeyFile: o.LocalServerKeyFile, OpenURLAfterAuthentication: o.OpenURLAfterAuthentication, - RedirectURLHostname: o.RedirectURLHostname, AuthRequestAccessType: o.AuthRequestAccessType, AuthRequestExtraParams: o.AuthRequestExtraParams, } diff --git a/pkg/cmd/authentication_test.go b/pkg/cmd/authentication_test.go index 5de54a50..004fd0b2 100644 --- a/pkg/cmd/authentication_test.go +++ b/pkg/cmd/authentication_test.go @@ -36,7 +36,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) { "--local-server-cert", "/path/to/local-server-cert", "--local-server-key", "/path/to/local-server-key", "--open-url-after-authentication", "https://example.com/success.html", - "--oidc-redirect-url-hostname", "example", "--oidc-auth-request-extra-params", "ttl=86400", "--oidc-auth-request-extra-params", "reauth=true", "--username", "USER", @@ -51,7 +50,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) { LocalServerCertFile: "/path/to/local-server-cert", LocalServerKeyFile: "/path/to/local-server-key", OpenURLAfterAuthentication: "https://example.com/success.html", - RedirectURLHostname: "example", AuthRequestExtraParams: map[string]string{"ttl": "86400", "reauth": "true"}, }, }, @@ -67,7 +65,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) { "GrantType=authcode-keyboard with full options": { args: []string{ "--grant-type", "authcode-keyboard", - "--oidc-redirect-url-authcode-keyboard", "http://localhost", "--oidc-auth-request-extra-params", "ttl=86400", "--oidc-auth-request-extra-params", "reauth=true", }, diff --git a/pkg/cmd/get_token.go b/pkg/cmd/get_token.go index 504efda9..a8ca131f 100644 --- a/pkg/cmd/get_token.go +++ b/pkg/cmd/get_token.go @@ -84,16 +84,12 @@ func (cmd *GetToken) New() *cobra.Command { if err != nil { return fmt.Errorf("get-token: %w", err) } - redirectURL := o.RedirectURL - if o.authenticationOptions.RedirectURLAuthCodeKeyboard != "" { - redirectURL = o.authenticationOptions.RedirectURLAuthCodeKeyboard - } in := credentialplugin.Input{ Provider: oidc.Provider{ IssuerURL: o.IssuerURL, ClientID: o.ClientID, ClientSecret: o.ClientSecret, - RedirectURL: redirectURL, + RedirectURL: o.RedirectURL, PKCEMethod: pkceMethod, UseAccessToken: o.UseAccessToken, ExtraScopes: o.ExtraScopes, diff --git a/pkg/oidc/client/authcode.go b/pkg/oidc/client/authcode.go index 93206898..e9835bdb 100644 --- a/pkg/oidc/client/authcode.go +++ b/pkg/oidc/client/authcode.go @@ -28,7 +28,10 @@ type ExchangeAuthCodeInput struct { type GetTokenByAuthCodeInput struct { AuthCodeURLInput BindAddress []string - RedirectURLHostname string // DEPRECATED + State string + Nonce string + PKCEParams pkce.Params + AuthRequestExtraParams map[string]string LocalServerSuccessHTML string LocalServerCertFile string LocalServerKeyFile string @@ -48,7 +51,6 @@ func (c *client) GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeIn TokenRequestOptions: tokenRequestOptions(in.PKCEParams), LocalServerBindAddress: in.BindAddress, LocalServerReadyChan: localServerReadyChan, - RedirectURLHostname: in.RedirectURLHostname, LocalServerSuccessHTML: in.LocalServerSuccessHTML, LocalServerCertFile: in.LocalServerCertFile, LocalServerKeyFile: in.LocalServerKeyFile, diff --git a/pkg/oidc/client/factory.go b/pkg/oidc/client/factory.go index d0b0f441..add7ea18 100644 --- a/pkg/oidc/client/factory.go +++ b/pkg/oidc/client/factory.go @@ -62,11 +62,17 @@ func (f *Factory) New(ctx context.Context, prov oidc.Provider, tlsClientConfig t if err != nil { return nil, fmt.Errorf("could not determine supported PKCE methods: %w", err) } + + endpoint := provider.Endpoint() + if prov.ClientSecret == "" { + endpoint.AuthStyle = oauth2.AuthStyleInParams + } + return &client{ httpClient: httpClient, provider: provider, oauth2Config: oauth2.Config{ - Endpoint: provider.Endpoint(), + Endpoint: endpoint, ClientID: prov.ClientID, ClientSecret: prov.ClientSecret, RedirectURL: prov.RedirectURL, diff --git a/pkg/usecases/authentication/authcode/browser.go b/pkg/usecases/authentication/authcode/browser.go index 83650954..e13ba504 100644 --- a/pkg/usecases/authentication/authcode/browser.go +++ b/pkg/usecases/authentication/authcode/browser.go @@ -19,7 +19,6 @@ type BrowserOption struct { BindAddress []string AuthenticationTimeout time.Duration OpenURLAfterAuthentication string - RedirectURLHostname string // DEPRECATED AuthRequestAccessType string AuthRequestExtraParams map[string]string LocalServerCertFile string @@ -59,7 +58,10 @@ func (u *Browser) Do(ctx context.Context, o *BrowserOption, oidcClient client.In AuthRequestExtraParams: o.AuthRequestExtraParams, }, BindAddress: o.BindAddress, - RedirectURLHostname: o.RedirectURLHostname, + State: state, + Nonce: nonce, + PKCEParams: pkceParams, + AuthRequestExtraParams: o.AuthRequestExtraParams, LocalServerSuccessHTML: successHTML, LocalServerCertFile: o.LocalServerCertFile, LocalServerKeyFile: o.LocalServerKeyFile,