Trong Huu Nguyen
062e7b09ce
fix(openid/client): prompt parameter is optional
2025-01-24 08:07:54 +01:00
Trong Huu Nguyen
0b32d8839c
test(openid/client): add negative assertions for unwanted parameters
2025-01-24 08:07:52 +01:00
Trong Huu Nguyen
110dd64750
refactor(openid/client): extract authorization code parameters
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-23 12:03:42 +01:00
Trong Huu Nguyen
642457b950
refactor(openid/client): extract oauth request method
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-23 10:17:13 +01:00
Trong Huu Nguyen
ab418c456c
fix(handler/reverseproxy): add nil check for session
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-23 10:16:13 +01:00
Trong Huu Nguyen
837323d728
refactor(mock): use oauth error response for all idp errors
2025-01-23 09:02:19 +01:00
Sindre Rødseth Hansen
ade44f0950
refactor: remove indirection layer for login client
...
Co-authored-by: tronghn <trong.huu.nguyen@nav.no >
2025-01-23 08:48:32 +01:00
Sindre Rødseth Hansen
c442000be4
feat: implement PAR for relying party
...
Fixes #235
Co-authored-by: tronghn <trong.huu.nguyen@nav.no >
2025-01-23 08:48:32 +01:00
Trong Huu Nguyen
6be5a1ebe5
wip: implement PAR for relying party
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-23 08:48:32 +01:00
Trong Huu Nguyen
909060d8fd
feat(mock): implement PAR for identity provider
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-23 08:48:28 +01:00
Trong Huu Nguyen
f2def8d00d
fix(session/data): next refresh time should account for inactivity timeouts
...
The default auto-refresh behaviour occurs 5 minutes before tokens
expire, at the earliest. Without inactivity however, tokens are still
refreshed at any point after this, as long as the session has not ended.
This however, means that refreshes don't occur often enough when inactivity
timeouts are enabled. In practice, the session is only refreshed if a
request is received within the 5 minute leeway window between a token's expiry
and the inactivity timeout.
This commit will apply auto-refreshes at the half-life of the inactivity
timeout instead, so that users' sessions and timeouts are properly
extended on activity.
2025-01-22 15:58:53 +01:00
Trong Huu Nguyen
c1dd4f1177
refactor(handler/login): improve logging when rate limiting
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-22 12:03:01 +01:00
Trong Huu Nguyen
b6bfb817a4
feat(handler/login): add rate limit to prevent redirect loops
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-22 09:46:45 +01:00
Trong Huu Nguyen
64e9167e05
refactor(openid/client): remove indirection layer for login callback
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-21 09:39:23 +01:00
Trong Huu Nguyen
75f98debc5
feat(openid/client): validate iss parameter if provider declares authorization_response_iss_parameter_supported
...
Fixes #306 .
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-21 09:39:21 +01:00
Sindre Rødseth Hansen
2feb6a3b77
feat: Add option for propagating id_token to upstream app
...
Fixes #315
Co-authored-by: tronghn <trong.huu.nguyen@nav.no >
2025-01-20 13:07:54 +01:00
Trong Huu Nguyen
3a4f656f33
style: make fmt [ci skip]
2025-01-17 14:22:48 +01:00
Trong Huu Nguyen
3e42d001f0
feat(handler/forwardauth): reduce log severity for not-existent sessions
2025-01-17 14:19:00 +01:00
Trong Huu Nguyen
3143940b08
feat: remove feature flags for session refresh
...
These feature flags were enabled by default. We specifically disallowed
the use of automatic refresh with the SSO mode, though this poses some
complexity if using the forward-auth feature.
To simplify configuration and code, we remove the flags in their
entirety as session refresh behaviour is mostly already handled by the
implementation of GetSession() in the handlers. Specifically:
- the Standalone handler needs to refresh sessions when reverse-proxying
to the upstream.
- the SSO server handler needs to refresh sessions only when using the
forward-auth feature. It does not have an upstream to reverse proxy
to.
- the SSO proxy handler is a read-only upstream proxy and does not
possess the ability to refresh sessions itself, though it will
delegate traffic for the session endpoints to the configured SSO server.
Automatic refreshing is thus only disabled when running in SSO mode
without the forward-auth feature.
2025-01-16 10:14:15 +01:00
Trong Huu Nguyen
0258ce7cfd
feat: add handler for forward-auth
2025-01-14 13:44:49 +01:00
Trong Huu Nguyen
c96e457675
test: assert unauthenticated response for session endpoints
2025-01-14 13:33:35 +01:00
Trong Huu Nguyen
724132e51c
test: correct description for secure cookie test
2024-11-06 10:17:11 +01:00
Trong Huu Nguyen
2d5d99f5ee
fix(openid): don't ignore existence check for key mutator
2024-11-06 09:40:56 +01:00
Trong Huu Nguyen
b4b38f30ef
test(openid): add missing token validation cases
2024-11-06 09:27:27 +01:00
Trong Huu Nguyen
3761d40bf6
feat(crypto): log warning for ephemeral encryption key
2024-11-06 08:47:05 +01:00
Trong Huu Nguyen
5c63a2a743
refactor(openid/client): inline unnecessary variables
2024-11-05 22:15:48 +01:00
Trong Huu Nguyen
b7b43e9793
refactor(openid): remove more indirection layers
2024-11-05 21:58:38 +01:00
Trong Huu Nguyen
d2e01b2ead
refactor: consolidate cookie config, correct documentation
2024-11-05 21:24:25 +01:00
Trong Huu Nguyen
bfb4929dc7
feat: allow disabling secure cookies for localhost
...
This is geerally only necessary when using Safari.
Most other browsers respect the Secure attribute when using localhost.
2024-11-05 21:14:14 +01:00
Trong Huu Nguyen
6b46d57422
refactor(openid): consolidate validation and verification of id_tokens
...
Also remove some indirection layers.
2024-11-05 21:10:44 +01:00
Trong Huu Nguyen
e6297750d6
feat(openid): set expected default public JWK algorithm if the OP doesn't set them
...
This allows us to verify signatures without relying on heuristics used
by jws.WithInferAlgorithmFromKey() that may introduce security and
performance implications.
2024-11-05 21:08:46 +01:00
Trong Huu Nguyen
db060a4caf
feat(handler): do not automatically retry token redemption failures
2024-11-05 19:57:48 +01:00
Trong Huu Nguyen
4c2d1f4813
docs(config): clarify description of openid.scopes flag
2024-11-05 11:44:45 +01:00
Trong Huu Nguyen
192b196d3f
refactor(config): inline samesite options
2024-11-05 08:48:46 +01:00
Trong Huu Nguyen
7c2d6d3f71
feat(templates): clean up error page after feedback
2024-10-16 12:46:29 +02:00
Trong Huu Nguyen
a4b832839c
feat(templates): make error page more generic and ✨ responsive ✨
...
Co-authored-by: Morten Lied Johansen <morten.lied.johansen@nav.no >
2024-10-09 08:58:36 +02:00
Trong Huu Nguyen
df5c78b821
feat(openid/client): add support for the client_secret_post authentication method
2024-10-08 09:19:38 +02:00
Trong Huu Nguyen
5ae325ca3d
fix(retry): correct usage of MaxDuration, remove unused code
2024-09-20 11:47:49 +02:00
Trong Huu Nguyen
d6b57a6b7d
refactor(handler/sso/proxy): correct variable name
2024-09-11 09:27:13 +02:00
Trong Huu Nguyen
9e78ba78be
fix(handler/sso/proxy): avoid duplicate headers when proxying to server
2024-09-03 12:08:38 +02:00
Trong Huu Nguyen
155ebc745b
docs: clarify forwarded headers
2024-08-23 13:56:21 +02:00
Trong Huu Nguyen
57376643ba
build: go 1.23
2024-08-23 13:56:19 +02:00
Trong Huu Nguyen
3876820aee
refactor(retry): use DoValue
2024-08-23 13:55:51 +02:00
Trong Huu Nguyen
3465d8aef3
refactor(config): clean up tests
2024-08-23 13:55:49 +02:00
Trong Huu Nguyen
f9761c3437
test(config): add some more cases, remove unneeded parameter
2024-07-02 21:58:14 +02:00
Trong Huu Nguyen
1906024da0
feat(openid/acr): remove old values and backward compatibility for new idporten
...
We no longer expect nor accept tokens with old acr values during
validation as ID-porten no longer issues tokens with these values.
This also removes backward compatibility in cases where configured
values targeted the new ID-porten while using old ID-porten.
We still maintain an internal mapping from old values to new values
for forward compatibilty when using old values provided in the login
parameter and the `openid.acr-values` flag.
2024-06-27 12:34:16 +02:00
Trong Huu Nguyen
f94d81aed7
test(config): add missing tests
2024-06-27 09:54:29 +02:00
Trong Huu Nguyen
d7b0d93f11
refactor: split out config again
2024-06-26 15:32:38 +02:00
Trong Huu Nguyen
d69cf79664
refactor: reduce noisy config logs
...
Fixes #262 .
2024-06-26 14:51:05 +02:00
Trong Huu Nguyen
16ccb3a6be
feat(config): add explicit toggle for legacy cookies
2024-06-26 12:20:05 +02:00
