Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Jon Chery
|
c726a6a9e2 | ||
|
Jon Chery
|
5429da1f87 | ||
|
Jon Chery
|
7177ac7538 |
@@ -1,19 +1,17 @@
|
||||
{
|
||||
"phase": 0,
|
||||
"stage": "ship",
|
||||
"phase": 3,
|
||||
"stage": "complete",
|
||||
"milestone": "v0.12",
|
||||
"milestone_slug": "security-hardening",
|
||||
"phase_role": "pre_execution",
|
||||
"phase_role": "execution",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-07T09:00:00Z",
|
||||
"updated_at": "2026-08-07T10:57:00Z",
|
||||
"milestone_complete": false,
|
||||
"previous_milestone": "v0.11",
|
||||
"research_docs_ingested": 1,
|
||||
"locked_decisions": {"D-238": "v0.12 minor", "D-239": "bundled Dex + BYO", "D-240": "WebAuthn", "D-241": "seal-to-OIDC + Shamir", "D-242": "auth-code+PKCE", "D-243": "Traefik RP ID", "D-244": "SQLite 0600 public keys", "D-245": "device-code fallback", "D-246": "credentials.json 0600", "D-247": "accept-identity-migration gate"},
|
||||
"grill_verdict": "PROCEED-WITH-CONDITIONS",
|
||||
"wave": "B (P04-P08 zero-trust identity) next",
|
||||
"phases_shiped": ["P0", "P1", "P2", "P3"],
|
||||
"tags_shipped": ["v0.11.0", "v0.11.1", "v0.11.2", "v0.11.3"],
|
||||
"binding_conditions": ["C-29", "C-30", "C-31", "C-32", "C-33", "C-34", "C-35", "C-36", "C-37", "C-38"],
|
||||
"phase_count": 29,
|
||||
"load_bearing_rule": "R-021",
|
||||
"threat_model_findings": 25,
|
||||
"new_requirements": "REQ-119..REQ-148"
|
||||
"load_bearing_rule": "R-021"
|
||||
}
|
||||
|
||||
@@ -3,10 +3,14 @@ module git.cloudinit.dev/coreci/orca
|
||||
go 1.25.0
|
||||
|
||||
require (
|
||||
github.com/coreos/go-oidc/v3 v3.20.0
|
||||
github.com/go-webauthn/webauthn v0.17.4
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/hashicorp/hcl/v2 v2.24.0
|
||||
github.com/spf13/cobra v1.8.1
|
||||
golang.org/x/crypto v0.54.0
|
||||
golang.org/x/oauth2 v0.36.0
|
||||
golang.org/x/sync v0.22.0
|
||||
modernc.org/sqlite v1.51.0
|
||||
)
|
||||
|
||||
@@ -14,16 +18,24 @@ require (
|
||||
github.com/agext/levenshtein v1.2.1 // indirect
|
||||
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.9.2 // indirect
|
||||
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
||||
github.com/go-webauthn/x v0.2.6 // indirect
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
|
||||
github.com/google/go-cmp v0.7.0 // indirect
|
||||
github.com/google/go-tpm v0.9.8 // indirect
|
||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
|
||||
github.com/ncruces/go-strftime v1.0.0 // indirect
|
||||
github.com/philhofer/fwd v1.2.0 // indirect
|
||||
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/tinylib/msgp v1.6.4 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
github.com/zclconf/go-cty v1.16.3 // indirect
|
||||
golang.org/x/mod v0.37.0 // indirect
|
||||
golang.org/x/sync v0.22.0 // indirect
|
||||
golang.org/x/sys v0.47.0 // indirect
|
||||
golang.org/x/text v0.40.0 // indirect
|
||||
golang.org/x/tools v0.47.0 // indirect
|
||||
|
||||
@@ -2,15 +2,33 @@ github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tj
|
||||
github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
|
||||
github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
|
||||
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
|
||||
github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=
|
||||
github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||
github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
|
||||
github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
|
||||
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
|
||||
github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
|
||||
github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
|
||||
github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk=
|
||||
github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8=
|
||||
github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk=
|
||||
github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo=
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
|
||||
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
|
||||
github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
|
||||
github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
|
||||
github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
|
||||
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
|
||||
github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
@@ -27,6 +45,10 @@ github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQ
|
||||
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
|
||||
github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
|
||||
github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
|
||||
github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
|
||||
github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
|
||||
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
|
||||
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||
@@ -34,14 +56,24 @@ github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
|
||||
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
|
||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
|
||||
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
|
||||
github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
|
||||
github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
|
||||
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
|
||||
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
|
||||
github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk=
|
||||
github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
|
||||
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
|
||||
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
|
||||
go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
|
||||
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
|
||||
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
|
||||
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
|
||||
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
|
||||
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
|
||||
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
|
||||
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
|
||||
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
|
||||
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
@@ -54,6 +86,7 @@ golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
|
||||
modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
|
||||
|
||||
@@ -0,0 +1,206 @@
|
||||
// Package cli: auth.go implements the `orca auth` subcommand family
|
||||
// (REQ-144, D-239, D-242, D-246). The auth commands perform the OIDC
|
||||
// login/logout/status flow and the bundled Dex bootstrap (init-idp).
|
||||
//
|
||||
// R-021 invariant: Orca never issues, stores, or accepts human-identity
|
||||
// credentials. The IdP issues tokens; Orca only stores them (short-
|
||||
// lived, 0600, refreshable). No passwords, no Orca-issued tokens.
|
||||
package cli
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"runtime"
|
||||
"time"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/identity"
|
||||
)
|
||||
|
||||
var authCmd = &cobra.Command{
|
||||
Use: "auth",
|
||||
Short: "OIDC authentication (zero-trust identity, R-021)",
|
||||
Long: `Manage OIDC authentication for human operators.
|
||||
|
||||
Orca uses OIDC for human-identity authentication (R-021: no Orca-
|
||||
issued credentials). The bundled Dex (deployed by 'orca auth init-idp')
|
||||
is the default issuer; 'oidc.issuer' in config can repoint to a BYO
|
||||
external IdP. The CLI performs the authorization-code + PKCE + local
|
||||
loopback redirect flow; headless/CI uses the device-code flow.`,
|
||||
}
|
||||
|
||||
var (
|
||||
authIssuer string
|
||||
authClientID string
|
||||
authClientSecret string
|
||||
authDeviceFlow bool
|
||||
authOpenBrowser bool
|
||||
)
|
||||
|
||||
var authLoginCmd = &cobra.Command{
|
||||
Use: "login",
|
||||
Short: "Authenticate via OIDC (browser or device-code flow)",
|
||||
Long: `Perform the OIDC login. By default, opens the default browser
|
||||
for the authorization-code + PKCE + local loopback redirect flow. Use
|
||||
--device-code for the headless/CI flow. Credentials are stored at
|
||||
~/.orca/credentials.json (0600, short-lived + refresh).`,
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
cfg, err := loadOIDCConfig()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
|
||||
defer cancel()
|
||||
client, err := identity.NewOIDCClient(ctx, *cfg)
|
||||
if err != nil {
|
||||
return fmt.Errorf("auth login: %w", err)
|
||||
}
|
||||
if authDeviceFlow {
|
||||
creds, err := client.DeviceFlowLogin(ctx, os.Stdout)
|
||||
if err != nil {
|
||||
return fmt.Errorf("auth login (device): %w", err)
|
||||
}
|
||||
if err := identity.SaveCredentials(creds); err != nil {
|
||||
return fmt.Errorf("auth login: %w", err)
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "✓ Logged in as %s (sub=%s)\n", creds.Issuer, creds.Subject)
|
||||
return nil
|
||||
}
|
||||
openBrowser := func(url string) error {
|
||||
if !authOpenBrowser {
|
||||
fmt.Fprintf(os.Stdout, "Open this URL in your browser:\n %s\n", url)
|
||||
return nil
|
||||
}
|
||||
return openBrowserOS(url)
|
||||
}
|
||||
creds, err := client.Login(ctx, openBrowser)
|
||||
if err != nil {
|
||||
return fmt.Errorf("auth login: %w", err)
|
||||
}
|
||||
if err := identity.SaveCredentials(creds); err != nil {
|
||||
return fmt.Errorf("auth login: %w", err)
|
||||
}
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "✓ Logged in as %s (sub=%s, groups=%v)\n", creds.Issuer, creds.Subject, creds.Groups)
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var authLogoutCmd = &cobra.Command{
|
||||
Use: "logout",
|
||||
Short: "Clear the stored OIDC credentials",
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if err := identity.ClearCredentials(); err != nil {
|
||||
return fmt.Errorf("auth logout: %w", err)
|
||||
}
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "✓ Logged out (credentials cleared)")
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var authStatusCmd = &cobra.Command{
|
||||
Use: "status",
|
||||
Short: "Show the current OIDC authentication status",
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
creds, err := identity.LoadCredentials()
|
||||
if err != nil {
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "Not authenticated (no credentials)")
|
||||
return nil
|
||||
}
|
||||
expired := time.Now().After(creds.Expiry)
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "Issuer: %s\n", creds.Issuer)
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "Subject: %s\n", creds.Subject)
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "Groups: %v\n", creds.Groups)
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "Expiry: %s\n", creds.Expiry.Format(time.RFC3339))
|
||||
if expired {
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "Status: EXPIRED (run 'orca auth login' to refresh)")
|
||||
} else {
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "Status: valid")
|
||||
}
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
var (
|
||||
authInitIDP string
|
||||
authInitRPID string
|
||||
)
|
||||
|
||||
var authInitIDPCmd = &cobra.Command{
|
||||
Use: "init-idp",
|
||||
Short: "Bootstrap the bundled Dex OIDC provider on the lead",
|
||||
Long: `Deploy a bundled Dex instance on the lead node as a systemd
|
||||
unit, fronted by Traefik (R-017, step-ca cert). This is the default
|
||||
zero-trust identity provider; 'oidc.issuer' can be repointed to a BYO
|
||||
external IdP anytime. The WebAuthn connector (P05) provides the
|
||||
password-free upstream authenticator.
|
||||
|
||||
--rp-id <domain> sets the WebAuthn relying-party ID (must match the
|
||||
Traefik-served cluster domain; C-38).`,
|
||||
Args: cobra.NoArgs,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if authInitRPID == "" {
|
||||
return fmt.Errorf("--rp-id is required (the cluster's Traefik-served domain for WebAuthn)")
|
||||
}
|
||||
// The full Dex deploy is a systemd unit + Traefik route + config
|
||||
// template. For v0.12 P04 we emit the config + unit files; the
|
||||
// WebAuthn connector ships in P05.
|
||||
fmt.Fprintf(cmd.OutOrStdout(), "Dex bootstrap planned for RP ID: %s\n", authInitRPID)
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "Note: full Dex systemd unit + Traefik route deploy is part of P05 (WebAuthn connector).")
|
||||
fmt.Fprintln(cmd.OutOrStdout(), "This stub confirms the CLI surface; the deploy logic lands with the connector.")
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
// loadOIDCConfig loads the OIDC config from flags or the cluster config.
|
||||
func loadOIDCConfig() (*identity.OIDCConfig, error) {
|
||||
cfg := &identity.OIDCConfig{
|
||||
Issuer: authIssuer,
|
||||
ClientID: authClientID,
|
||||
ClientSecret: authClientSecret,
|
||||
}
|
||||
if cfg.Issuer == "" {
|
||||
// TODO: load from cluster config (oidc block). For v0.12 P04
|
||||
// the flags are the primary path; config-file loading lands
|
||||
// with the full Dex deploy (P05).
|
||||
return nil, fmt.Errorf("auth: --issuer is required (or set oidc.issuer in config)")
|
||||
}
|
||||
if cfg.ClientID == "" {
|
||||
cfg.ClientID = "orca-cli"
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
// openBrowserOS opens the URL in the default browser.
|
||||
func openBrowserOS(url string) error {
|
||||
switch runtime.GOOS {
|
||||
case "linux":
|
||||
return exec.Command("xdg-open", url).Start()
|
||||
case "darwin":
|
||||
return exec.Command("open", url).Start()
|
||||
case "windows":
|
||||
return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
|
||||
}
|
||||
return fmt.Errorf("unsupported OS for browser open: %s", runtime.GOOS)
|
||||
}
|
||||
|
||||
func init() {
|
||||
authLoginCmd.Flags().StringVar(&authIssuer, "issuer", "", "OIDC issuer URL (default: from config)")
|
||||
authLoginCmd.Flags().StringVar(&authClientID, "client-id", "", "OIDC client ID (default: orca-cli)")
|
||||
authLoginCmd.Flags().StringVar(&authClientSecret, "client-secret", "", "OIDC client secret (confidential clients; public PKCE clients omit)")
|
||||
authLoginCmd.Flags().BoolVar(&authDeviceFlow, "device-code", false, "use device-code flow (headless/CI)")
|
||||
authLoginCmd.Flags().BoolVar(&authOpenBrowser, "open-browser", true, "open the default browser (set false to print URL only)")
|
||||
|
||||
authInitIDPCmd.Flags().StringVar(&authInitRPID, "rp-id", "", "WebAuthn relying-party ID (cluster Traefik domain)")
|
||||
|
||||
authCmd.AddCommand(authLoginCmd)
|
||||
authCmd.AddCommand(authLogoutCmd)
|
||||
authCmd.AddCommand(authStatusCmd)
|
||||
authCmd.AddCommand(authInitIDPCmd)
|
||||
rootCmd.AddCommand(authCmd)
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
package cli
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestAuthStatusNotAuthenticated verifies auth status reports
|
||||
// "not authenticated" when no credentials exist.
|
||||
func TestAuthStatusNotAuthenticated(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"auth", "status"})
|
||||
// auth status should not error on missing credentials.
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Errorf("auth status on missing creds: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestAuthLogoutNoCreds verifies logout succeeds even with no creds.
|
||||
func TestAuthLogoutNoCreds(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"auth", "logout"})
|
||||
if err := rootCmd.Execute(); err != nil {
|
||||
t.Errorf("auth logout with no creds: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// TestAuthInitIDPRequiresRPID verifies --rp-id is required.
|
||||
func TestAuthInitIDPRequiresRPID(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"auth", "init-idp"})
|
||||
err := rootCmd.Execute()
|
||||
if err == nil {
|
||||
t.Error("auth init-idp without --rp-id should error")
|
||||
}
|
||||
}
|
||||
|
||||
// TestAuthLoginRequiresIssuer verifies --issuer is required.
|
||||
func TestAuthLoginRequiresIssuer(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
resetRootFlags(t)
|
||||
rootCmd.SetArgs([]string{"auth", "login"})
|
||||
err := rootCmd.Execute()
|
||||
if err == nil {
|
||||
t.Error("auth login without --issuer should error")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,491 @@
|
||||
// Package identity: oidc.go implements the OIDC client (REQ-144,
|
||||
// D-239, D-242, D-246). Orca uses OIDC for human-identity
|
||||
// authentication. The bundled Dex (deployed by `orca auth init-idp`)
|
||||
// is the default issuer; `oidc.issuer` in config can repoint to a BYO
|
||||
// external IdP. The CLI performs the authorization-code + PKCE +
|
||||
// local loopback redirect flow (`orca auth login`); headless/CI uses
|
||||
// the device-code flow.
|
||||
//
|
||||
// R-021 invariant: Orca never issues, stores, or accepts human-identity
|
||||
// credentials. The IdP issues tokens; Orca only stores them (short-
|
||||
// lived, 0600, refreshable). No passwords, no Orca-issued tokens.
|
||||
package identity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/coreos/go-oidc/v3/oidc"
|
||||
"golang.org/x/oauth2"
|
||||
)
|
||||
|
||||
// OIDCConfig holds the OIDC client configuration. It is loaded from
|
||||
// the cluster config block (`oidc.issuer`, `client_id`, `client_secret`,
|
||||
// `scopes`).
|
||||
type OIDCConfig struct {
|
||||
Issuer string `json:"issuer"`
|
||||
ClientID string `json:"client_id"`
|
||||
ClientSecret string `json:"client_secret,omitempty"`
|
||||
Scopes []string `json:"scopes,omitempty"`
|
||||
// RedirectPort is the local loopback port for the auth-code flow.
|
||||
// 0 means ephemeral.
|
||||
RedirectPort int `json:"redirect_port,omitempty"`
|
||||
}
|
||||
|
||||
// DefaultScopes returns the standard OIDC scopes Orca requests.
|
||||
func DefaultScopes() []string {
|
||||
return []string{oidc.ScopeOpenID, "profile", "email", "groups"}
|
||||
}
|
||||
|
||||
// Credentials is the on-disk token store at ~/.orca/credentials.json
|
||||
// (0600). Short-lived ID token + refresh token. Refresh handles
|
||||
// rotation; no long-lived Orca-issued tokens (the IdP issues them).
|
||||
type Credentials struct {
|
||||
AccessToken string `json:"access_token,omitempty"`
|
||||
RefreshToken string `json:"refresh_token,omitempty"`
|
||||
IDToken string `json:"id_token"`
|
||||
Expiry time.Time `json:"expiry"`
|
||||
Issuer string `json:"issuer"`
|
||||
Subject string `json:"subject"`
|
||||
Groups []string `json:"groups,omitempty"`
|
||||
}
|
||||
|
||||
// credentialsPath returns the on-disk credentials path (0600).
|
||||
func credentialsPath() (string, error) {
|
||||
home := os.Getenv("ORCA_HOME")
|
||||
if home == "" {
|
||||
userHome, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("oidc: ORCA_HOME unset and home dir: %w", err)
|
||||
}
|
||||
home = filepath.Join(userHome, ".orca")
|
||||
}
|
||||
return filepath.Join(home, "credentials.json"), nil
|
||||
}
|
||||
|
||||
// LoadCredentials reads the stored OIDC credentials (0600). Returns
|
||||
// an error if the file is missing or has looser permissions.
|
||||
func LoadCredentials() (*Credentials, error) {
|
||||
path, err := credentialsPath()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
info, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: no credentials: %w", err)
|
||||
}
|
||||
if info.Mode().Perm()&0o077 != 0 {
|
||||
return nil, fmt.Errorf("oidc: credentials %s has mode %o, expected 0600", path, info.Mode().Perm())
|
||||
}
|
||||
data, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: read credentials: %w", err)
|
||||
}
|
||||
var c Credentials
|
||||
if err := json.Unmarshal(data, &c); err != nil {
|
||||
return nil, fmt.Errorf("oidc: parse credentials: %w", err)
|
||||
}
|
||||
return &c, nil
|
||||
}
|
||||
|
||||
// SaveCredentials writes the OIDC credentials to disk at 0600.
|
||||
func SaveCredentials(c *Credentials) error {
|
||||
path, err := credentialsPath()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
|
||||
return fmt.Errorf("oidc: mkdir: %w", err)
|
||||
}
|
||||
data, err := json.MarshalIndent(c, "", " ")
|
||||
if err != nil {
|
||||
return fmt.Errorf("oidc: marshal: %w", err)
|
||||
}
|
||||
return writeAtomic0600(path, data)
|
||||
}
|
||||
|
||||
// ClearCredentials removes the stored credentials (logout).
|
||||
func ClearCredentials() error {
|
||||
path, err := credentialsPath()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
|
||||
return fmt.Errorf("oidc: clear credentials: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// writeAtomic0600 writes data to path atomically at mode 0600
|
||||
// (temp + chmod + rename).
|
||||
func writeAtomic0600(path string, data []byte) error {
|
||||
tmp := path + ".tmp"
|
||||
if err := os.WriteFile(tmp, data, 0o600); err != nil {
|
||||
return fmt.Errorf("oidc: write tmp: %w", err)
|
||||
}
|
||||
return os.Rename(tmp, path)
|
||||
}
|
||||
|
||||
// OIDCClient wraps the OIDC provider + oauth2 config for the auth flow.
|
||||
type OIDCClient struct {
|
||||
provider *oidc.Provider
|
||||
oauth2 *oauth2.Config
|
||||
verifier *oidc.IDTokenVerifier
|
||||
cfg OIDCConfig
|
||||
}
|
||||
|
||||
// NewOIDCClient discovers the issuer and builds the client.
|
||||
func NewOIDCClient(ctx context.Context, cfg OIDCConfig) (*OIDCClient, error) {
|
||||
if cfg.Issuer == "" {
|
||||
return nil, fmt.Errorf("oidc: issuer is empty")
|
||||
}
|
||||
if cfg.ClientID == "" {
|
||||
return nil, fmt.Errorf("oidc: client_id is empty")
|
||||
}
|
||||
provider, err := oidc.NewProvider(ctx, cfg.Issuer)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: discover %s: %w", cfg.Issuer, err)
|
||||
}
|
||||
scopes := cfg.Scopes
|
||||
if len(scopes) == 0 {
|
||||
scopes = DefaultScopes()
|
||||
}
|
||||
oauthCfg := &oauth2.Config{
|
||||
ClientID: cfg.ClientID,
|
||||
ClientSecret: cfg.ClientSecret,
|
||||
Endpoint: provider.Endpoint(),
|
||||
Scopes: scopes,
|
||||
}
|
||||
verifier := provider.Verifier(&oidc.Config{ClientID: cfg.ClientID})
|
||||
return &OIDCClient{
|
||||
provider: provider,
|
||||
oauth2: oauthCfg,
|
||||
verifier: verifier,
|
||||
cfg: cfg,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// pkcePair holds the PKCE verifier + challenge.
|
||||
type pkcePair struct {
|
||||
verifier string
|
||||
challenge string
|
||||
}
|
||||
|
||||
func generatePKCE() (pkcePair, error) {
|
||||
b := make([]byte, 32)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return pkcePair{}, fmt.Errorf("oidc: pkce rand: %w", err)
|
||||
}
|
||||
verifier := base64.RawURLEncoding.EncodeToString(b)
|
||||
h := sha256.Sum256([]byte(verifier))
|
||||
challenge := base64.RawURLEncoding.EncodeToString(h[:])
|
||||
return pkcePair{verifier: verifier, challenge: challenge}, nil
|
||||
}
|
||||
|
||||
// Login performs the authorization-code + PKCE + local loopback
|
||||
// redirect flow. It opens a local HTTP server on an ephemeral port,
|
||||
// builds the auth URL, and waits for the callback. The caller is
|
||||
// responsible for opening the URL in a browser (the CLI does this).
|
||||
// Returns the credentials after exchanging the code.
|
||||
func (c *OIDCClient) Login(ctx context.Context, openBrowser func(string) error) (*Credentials, error) {
|
||||
pkce, err := generatePKCE()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
port := c.cfg.RedirectPort
|
||||
if port == 0 {
|
||||
port = 0
|
||||
}
|
||||
listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: listen: %w", err)
|
||||
}
|
||||
defer listener.Close()
|
||||
actualPort := listener.Addr().(*net.TCPAddr).Port
|
||||
redirectURL := fmt.Sprintf("http://127.0.0.1:%d/callback", actualPort)
|
||||
c.oauth2.RedirectURL = redirectURL
|
||||
|
||||
state, err := randString(16)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
authURL := c.oauth2.AuthCodeURL(state,
|
||||
oauth2.SetAuthURLParam("code_challenge", pkce.challenge),
|
||||
oauth2.SetAuthURLParam("code_challenge_method", "S256"),
|
||||
)
|
||||
|
||||
if openBrowser != nil {
|
||||
if err := openBrowser(authURL); err != nil {
|
||||
return nil, fmt.Errorf("oidc: open browser: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
type result struct {
|
||||
code string
|
||||
err error
|
||||
}
|
||||
resultCh := make(chan result, 1)
|
||||
srv := &http.Server{}
|
||||
srv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.URL.Path != "/callback" {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
q := r.URL.Query()
|
||||
if errVal := q.Get("error"); errVal != "" {
|
||||
resultCh <- result{err: fmt.Errorf("oidc: auth error: %s", errVal)}
|
||||
fmt.Fprintf(w, "Authentication failed: %s. You can close this tab.", errVal)
|
||||
return
|
||||
}
|
||||
if q.Get("state") != state {
|
||||
resultCh <- result{err: fmt.Errorf("oidc: state mismatch")}
|
||||
http.Error(w, "state mismatch", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
code := q.Get("code")
|
||||
if code == "" {
|
||||
resultCh <- result{err: fmt.Errorf("oidc: no code in callback")}
|
||||
http.Error(w, "missing code", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
resultCh <- result{code: code}
|
||||
fmt.Fprintf(w, "Authentication successful. You can close this tab and return to the CLI.")
|
||||
})
|
||||
|
||||
go srv.Serve(listener)
|
||||
defer srv.Shutdown(context.Background())
|
||||
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return nil, ctx.Err()
|
||||
case res := <-resultCh:
|
||||
if res.err != nil {
|
||||
return nil, res.err
|
||||
}
|
||||
token, err := c.oauth2.Exchange(ctx, res.code,
|
||||
oauth2.SetAuthURLParam("code_verifier", pkce.verifier),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: token exchange: %w", err)
|
||||
}
|
||||
return c.tokenToCredentials(token)
|
||||
}
|
||||
}
|
||||
|
||||
// tokenToCredentials extracts the ID token, verifies it, and builds
|
||||
// the Credentials struct.
|
||||
func (c *OIDCClient) tokenToCredentials(token *oauth2.Token) (*Credentials, error) {
|
||||
rawID, ok := token.Extra("id_token").(string)
|
||||
if !ok || rawID == "" {
|
||||
return nil, fmt.Errorf("oidc: no id_token in token response")
|
||||
}
|
||||
idToken, err := c.verifier.Verify(context.Background(), rawID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: verify id_token: %w", err)
|
||||
}
|
||||
var claims struct {
|
||||
Groups []string `json:"groups"`
|
||||
}
|
||||
_ = idToken.Claims(&claims)
|
||||
return &Credentials{
|
||||
AccessToken: token.AccessToken,
|
||||
RefreshToken: token.RefreshToken,
|
||||
IDToken: rawID,
|
||||
Expiry: token.Expiry,
|
||||
Issuer: c.cfg.Issuer,
|
||||
Subject: idToken.Subject,
|
||||
Groups: claims.Groups,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Refresh refreshes the credentials using the refresh token.
|
||||
func (c *OIDCClient) Refresh(ctx context.Context, creds *Credentials) (*Credentials, error) {
|
||||
if creds.RefreshToken == "" {
|
||||
return nil, fmt.Errorf("oidc: no refresh token")
|
||||
}
|
||||
ts := c.oauth2.TokenSource(ctx, &oauth2.Token{
|
||||
RefreshToken: creds.RefreshToken,
|
||||
})
|
||||
token, err := ts.Token()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: refresh: %w", err)
|
||||
}
|
||||
return c.tokenToCredentials(token)
|
||||
}
|
||||
|
||||
// VerifyIDToken verifies an ID token string against the issuer's JWKS.
|
||||
// Returns the verified claims (subject, issuer, expiry, groups).
|
||||
func (c *OIDCClient) VerifyIDToken(ctx context.Context, rawID string) (*IDTokenClaims, error) {
|
||||
idToken, err := c.verifier.Verify(ctx, rawID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: verify: %w", err)
|
||||
}
|
||||
var claims IDTokenClaims
|
||||
if err := idToken.Claims(&claims); err != nil {
|
||||
return nil, fmt.Errorf("oidc: parse claims: %w", err)
|
||||
}
|
||||
claims.Expiry = idToken.Expiry
|
||||
return &claims, nil
|
||||
}
|
||||
|
||||
// IDTokenClaims holds the verified OIDC ID token claims used by Orca.
|
||||
type IDTokenClaims struct {
|
||||
Subject string `json:"sub"`
|
||||
Issuer string `json:"iss"`
|
||||
Groups []string `json:"groups,omitempty"`
|
||||
Email string `json:"email,omitempty"`
|
||||
Expiry time.Time `json:"-"`
|
||||
}
|
||||
|
||||
// VerifyIDTokenStatic is a standalone verifier that doesn't require
|
||||
// a long-lived OIDCClient. It discovers the issuer, verifies the
|
||||
// token, and returns the claims. Used by the SSH-push applier (which
|
||||
// validates the ORCA_OIDC_TOKEN env var before applying any txn).
|
||||
func VerifyIDTokenStatic(ctx context.Context, issuer, clientID, rawID string) (*IDTokenClaims, error) {
|
||||
provider, err := oidc.NewProvider(ctx, issuer)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: discover %s: %w", issuer, err)
|
||||
}
|
||||
verifier := provider.Verifier(&oidc.Config{ClientID: clientID})
|
||||
idToken, err := verifier.Verify(ctx, rawID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: verify: %w", err)
|
||||
}
|
||||
var claims IDTokenClaims
|
||||
if err := idToken.Claims(&claims); err != nil {
|
||||
return nil, fmt.Errorf("oidc: parse claims: %w", err)
|
||||
}
|
||||
claims.Expiry = idToken.Expiry
|
||||
return &claims, nil
|
||||
}
|
||||
|
||||
// randString generates a URL-safe random string of n bytes.
|
||||
func randString(n int) (string, error) {
|
||||
b := make([]byte, n)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
// DiscoverDeviceFlow checks if the issuer supports the device-code
|
||||
// grant (OIDC device flow). Returns the device endpoint URL if
|
||||
// supported. Used by the headless/CI fallback (D-245).
|
||||
func DiscoverDeviceFlow(ctx context.Context, issuer string) (deviceAuthURL string, tokenURL string, err error) {
|
||||
provider, err := oidc.NewProvider(ctx, issuer)
|
||||
if err != nil {
|
||||
return "", "", fmt.Errorf("oidc: discover: %w", err)
|
||||
}
|
||||
var claims struct {
|
||||
DeviceAuth string `json:"device_authorization_endpoint"`
|
||||
}
|
||||
if err := provider.Claims(&claims); err != nil {
|
||||
return "", "", fmt.Errorf("oidc: claims: %w", err)
|
||||
}
|
||||
if claims.DeviceAuth == "" {
|
||||
return "", "", fmt.Errorf("oidc: issuer %s does not support device flow", issuer)
|
||||
}
|
||||
return claims.DeviceAuth, provider.Endpoint().TokenURL, nil
|
||||
}
|
||||
|
||||
// DeviceFlowLogin performs the device-code flow (headless/CI).
|
||||
// It requests a device code, prints the user URL + code to the
|
||||
// provided writer, and polls for the token. Returns the credentials.
|
||||
func (c *OIDCClient) DeviceFlowLogin(ctx context.Context, w io.Writer) (*Credentials, error) {
|
||||
deviceAuthURL, tokenURL, err := DiscoverDeviceFlow(ctx, c.cfg.Issuer)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
form := url.Values{}
|
||||
form.Set("client_id", c.cfg.ClientID)
|
||||
if c.cfg.ClientSecret != "" {
|
||||
form.Set("client_secret", c.cfg.ClientSecret)
|
||||
}
|
||||
resp, err := http.PostForm(deviceAuthURL, form)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("oidc: device auth request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
var dr struct {
|
||||
DeviceCode string `json:"device_code"`
|
||||
UserCode string `json:"user_code"`
|
||||
VerificationURI string `json:"verification_uri"`
|
||||
Interval int `json:"interval"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&dr); err != nil {
|
||||
return nil, fmt.Errorf("oidc: device auth decode: %w", err)
|
||||
}
|
||||
if dr.Interval == 0 {
|
||||
dr.Interval = 5
|
||||
}
|
||||
fmt.Fprintf(w, "Open %s and enter code: %s\n", dr.VerificationURI, dr.UserCode)
|
||||
|
||||
deadline := time.Now().Add(time.Duration(dr.ExpiresIn) * time.Second)
|
||||
interval := time.Duration(dr.Interval) * time.Second
|
||||
for time.Now().Before(deadline) {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return nil, ctx.Err()
|
||||
case <-time.After(interval):
|
||||
}
|
||||
tform := url.Values{}
|
||||
tform.Set("grant_type", "urn:ietf:params:oauth:grant-type:device_code")
|
||||
tform.Set("device_code", dr.DeviceCode)
|
||||
tform.Set("client_id", c.cfg.ClientID)
|
||||
if c.cfg.ClientSecret != "" {
|
||||
tform.Set("client_secret", c.cfg.ClientSecret)
|
||||
}
|
||||
tresp, err := http.PostForm(tokenURL, tform)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
var tr struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
IDToken string `json:"id_token"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
Error string `json:"error"`
|
||||
}
|
||||
json.NewDecoder(tresp.Body).Decode(&tr)
|
||||
tresp.Body.Close()
|
||||
if tr.Error == "authorization_pending" || tr.Error == "slow_down" {
|
||||
if tr.Error == "slow_down" {
|
||||
interval += 5 * time.Second
|
||||
}
|
||||
continue
|
||||
}
|
||||
if tr.Error != "" {
|
||||
return nil, fmt.Errorf("oidc: device flow: %s", tr.Error)
|
||||
}
|
||||
if tr.IDToken == "" {
|
||||
continue
|
||||
}
|
||||
token := &oauth2.Token{
|
||||
AccessToken: tr.AccessToken,
|
||||
RefreshToken: tr.RefreshToken,
|
||||
Expiry: time.Now().Add(time.Duration(tr.ExpiresIn) * time.Second),
|
||||
}
|
||||
token = token.WithExtra(map[string]any{"id_token": tr.IDToken})
|
||||
return c.tokenToCredentials(token)
|
||||
}
|
||||
return nil, fmt.Errorf("oidc: device flow timed out")
|
||||
}
|
||||
|
||||
// Issuer returns the configured issuer URL.
|
||||
func (c *OIDCClient) Issuer() string { return c.cfg.Issuer }
|
||||
|
||||
// Ensure no unused import for strings (used in error formatting).
|
||||
var _ = strings.Contains
|
||||
@@ -0,0 +1,184 @@
|
||||
package identity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// mockOIDCProvider starts a minimal OIDC provider that serves
|
||||
// discovery + JWKS + token endpoint, signing self-signed ID tokens.
|
||||
// It returns the issuer URL + a cleanup function.
|
||||
func mockOIDCProvider(t *testing.T, clientID string) (issuer string, privateKey any, cleanup func()) {
|
||||
t.Helper()
|
||||
// We use a very minimal mock: discovery returns a JWKS URL +
|
||||
// token URL pointing to the same test server. The token
|
||||
// endpoint returns a fake ID token. For full verification
|
||||
// we'd need RSA signing, but for the client logic tests we
|
||||
// verify the flow wiring, not the crypto (the verifier is
|
||||
// tested via integration in P26).
|
||||
var srv *httptest.Server
|
||||
srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch r.URL.Path {
|
||||
case "/.well-known/openid-configuration":
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(map[string]any{
|
||||
"issuer": srvURL(srv),
|
||||
"authorization_endpoint": srvURL(srv) + "/auth",
|
||||
"token_endpoint": srvURL(srv) + "/token",
|
||||
"jwks_uri": srvURL(srv) + "/jwks",
|
||||
"device_authorization_endpoint": srvURL(srv) + "/device",
|
||||
"response_types_supported": []string{"code"},
|
||||
"subject_types_supported": []string{"public"},
|
||||
"id_token_signing_alg_values_supported": []string{"none"},
|
||||
})
|
||||
case "/jwks":
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(map[string]any{"keys": []any{}})
|
||||
case "/token":
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
// Return a minimal unsigned ID token (header.payload.sig
|
||||
// with empty sig). The verifier in production validates
|
||||
// against JWKS; for tests we only check the flow wiring.
|
||||
payload := map[string]any{
|
||||
"iss": srvURL(srv),
|
||||
"sub": "test-user-123",
|
||||
"aud": clientID,
|
||||
"exp": time.Now().Add(time.Hour).Unix(),
|
||||
"iat": time.Now().Unix(),
|
||||
"groups": []string{"orca-admins"},
|
||||
"email": "test@example.com",
|
||||
}
|
||||
payloadBytes, _ := json.Marshal(payload)
|
||||
enc := base64Raw(payloadBytes)
|
||||
idToken := "eyJhbGciOiJub25lIn0." + enc + "."
|
||||
json.NewEncoder(w).Encode(map[string]any{
|
||||
"access_token": "at-123",
|
||||
"refresh_token": "rt-456",
|
||||
"id_token": idToken,
|
||||
"expires_in": 3600,
|
||||
"token_type": "Bearer",
|
||||
})
|
||||
case "/device":
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(map[string]any{
|
||||
"device_code": "dc-123",
|
||||
"user_code": "ORCA-CODE",
|
||||
"verification_uri": srvURL(srv) + "/device-verify",
|
||||
"interval": 1,
|
||||
"expires_in": 300,
|
||||
})
|
||||
default:
|
||||
http.NotFound(w, r)
|
||||
}
|
||||
}))
|
||||
return srvURL(srv), nil, srv.Close
|
||||
}
|
||||
|
||||
func srvURL(srv *httptest.Server) string {
|
||||
return "http://" + srv.Listener.Addr().String()
|
||||
}
|
||||
|
||||
func base64Raw(b []byte) string {
|
||||
return base64.RawURLEncoding.EncodeToString(b)
|
||||
}
|
||||
|
||||
// TestOIDCClientDiscovery verifies NewOIDCClient discovers the issuer.
|
||||
func TestOIDCClientDiscovery(t *testing.T) {
|
||||
issuer, _, cleanup := mockOIDCProvider(t, "test-client")
|
||||
defer cleanup()
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
client, err := NewOIDCClient(ctx, OIDCConfig{
|
||||
Issuer: issuer,
|
||||
ClientID: "test-client",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("NewOIDCClient: %v", err)
|
||||
}
|
||||
if client.Issuer() != issuer {
|
||||
t.Errorf("issuer = %q, want %q", client.Issuer(), issuer)
|
||||
}
|
||||
}
|
||||
|
||||
// TestCredentialsRoundTrip verifies Save + Load credentials round-trip
|
||||
// at 0600.
|
||||
func TestCredentialsRoundTrip(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
creds := &Credentials{
|
||||
IDToken: "id-123",
|
||||
AccessToken: "at-456",
|
||||
RefreshToken: "rt-789",
|
||||
Expiry: time.Now().Add(time.Hour),
|
||||
Issuer: "https://idp.example",
|
||||
Subject: "user-1",
|
||||
Groups: []string{"admins"},
|
||||
}
|
||||
if err := SaveCredentials(creds); err != nil {
|
||||
t.Fatalf("Save: %v", err)
|
||||
}
|
||||
loaded, err := LoadCredentials()
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if loaded.Subject != "user-1" {
|
||||
t.Errorf("subject = %q, want user-1", loaded.Subject)
|
||||
}
|
||||
if len(loaded.Groups) != 1 || loaded.Groups[0] != "admins" {
|
||||
t.Errorf("groups = %v, want [admins]", loaded.Groups)
|
||||
}
|
||||
}
|
||||
|
||||
// TestCredentialsModeEnforced verifies LoadCredentials rejects looser
|
||||
// than 0600.
|
||||
func TestCredentialsModeEnforced(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
creds := &Credentials{IDToken: "x", Issuer: "x", Subject: "x"}
|
||||
if err := SaveCredentials(creds); err != nil {
|
||||
t.Fatalf("Save: %v", err)
|
||||
}
|
||||
// Loosen to 0644.
|
||||
path := dir + "/credentials.json"
|
||||
if err := os.Chmod(path, 0o644); err != nil {
|
||||
t.Fatalf("chmod: %v", err)
|
||||
}
|
||||
_, err := LoadCredentials()
|
||||
if err == nil {
|
||||
t.Error("LoadCredentials should reject 0644")
|
||||
}
|
||||
}
|
||||
|
||||
// TestClearCredentials verifies logout removes the file.
|
||||
func TestClearCredentials(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("ORCA_HOME", dir)
|
||||
creds := &Credentials{IDToken: "x", Issuer: "x", Subject: "x"}
|
||||
_ = SaveCredentials(creds)
|
||||
if err := ClearCredentials(); err != nil {
|
||||
t.Fatalf("Clear: %v", err)
|
||||
}
|
||||
if _, err := LoadCredentials(); err == nil {
|
||||
t.Error("Load after clear should fail")
|
||||
}
|
||||
}
|
||||
|
||||
// TestDefaultScopes verifies the scopes include openid.
|
||||
func TestDefaultScopes(t *testing.T) {
|
||||
scopes := DefaultScopes()
|
||||
found := false
|
||||
for _, s := range scopes {
|
||||
if s == "openid" {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
t.Error("DefaultScopes missing openid")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,308 @@
|
||||
// Package webauthn: connector.go implements the WebAuthn ceremony
|
||||
// handler for the bundled Dex (REQ-148, D-240, C-38). It serves
|
||||
// registration + login endpoints at /orca/webauthn/{register,login}
|
||||
// behind Traefik (R-017, step-ca cert, HTTPS secure context).
|
||||
//
|
||||
// The connector uses github.com/go-webauthn/webauthn for the
|
||||
// cryptographic ceremony logic. Credential storage is in store.go
|
||||
// (SQLite, 0600, public keys only).
|
||||
package webauthn
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/go-webauthn/webauthn/protocol"
|
||||
"github.com/go-webauthn/webauthn/webauthn"
|
||||
)
|
||||
|
||||
// Connector is the WebAuthn ceremony handler. It is mounted behind
|
||||
// Traefik and called by the bundled Dex.
|
||||
type Connector struct {
|
||||
w *webauthn.WebAuthn
|
||||
store *Store
|
||||
rpID string
|
||||
origin string
|
||||
}
|
||||
|
||||
// NewConnector builds a WebAuthn connector with the given RP ID
|
||||
// (the cluster's Traefik-served domain, C-38) and origin (the full
|
||||
// HTTPS URL).
|
||||
func NewConnector(store *Store, rpID, rpOrigin string) (*Connector, error) {
|
||||
wconfig := &webauthn.Config{
|
||||
RPDisplayName: "Orca",
|
||||
RPID: rpID,
|
||||
RPOrigins: []string{rpOrigin},
|
||||
}
|
||||
w, err := webauthn.New(wconfig)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("webauthn: new: %w", err)
|
||||
}
|
||||
return &Connector{
|
||||
w: w,
|
||||
store: store,
|
||||
rpID: rpID,
|
||||
origin: rpOrigin,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// RegistrationSession holds the in-flight registration challenge.
|
||||
type RegistrationSession struct {
|
||||
UserID string
|
||||
Challenge *webauthn.SessionData
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
// sessionStore holds in-flight sessions (registration + login). In
|
||||
// production this would be a Redis/shared cache; for the bundled
|
||||
// single-lead Dex, an in-memory map with TTL is sufficient.
|
||||
type sessionStore struct {
|
||||
sessions map[string]*RegistrationSession
|
||||
}
|
||||
var regSessions = &sessionStore{sessions: make(map[string]*RegistrationSession)}
|
||||
|
||||
// sessionTTL is the max time a registration/login session is valid.
|
||||
const sessionTTL = 5 * time.Minute
|
||||
|
||||
// cleanSessions removes expired sessions.
|
||||
func cleanSessions() {
|
||||
now := time.Now()
|
||||
for id, s := range regSessions.sessions {
|
||||
if now.Sub(s.CreatedAt) > sessionTTL {
|
||||
delete(regSessions.sessions, id)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// BeginRegistration starts the WebAuthn registration ceremony.
|
||||
// GET /orca/webauthn/register?username=<name>
|
||||
// Returns the creation options (challenge) for the browser.
|
||||
func (c *Connector) BeginRegistration(w http.ResponseWriter, r *http.Request) {
|
||||
username := r.URL.Query().Get("username")
|
||||
if username == "" {
|
||||
http.Error(w, "username required", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
userID := []byte(username)
|
||||
existing, _ := c.store.GetCredential(username)
|
||||
var creds []webauthn.Credential
|
||||
if existing != nil {
|
||||
creds = append(creds, webauthn.Credential{
|
||||
ID: existing.CredentialID,
|
||||
PublicKey: existing.PublicKey,
|
||||
AttestationType: "none",
|
||||
})
|
||||
}
|
||||
user := &webauthnUser{id: userID, name: username, credentials: creds}
|
||||
options, session, err := c.w.BeginRegistration(user)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("begin registration: %v", err), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
sessionID := base64.RawURLEncoding.EncodeToString(userID)
|
||||
regSessions.sessions[sessionID] = &RegistrationSession{
|
||||
UserID: username,
|
||||
Challenge: session,
|
||||
CreatedAt: time.Now(),
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(options)
|
||||
}
|
||||
|
||||
// FinishRegistration completes the WebAuthn registration ceremony.
|
||||
// POST /orca/webauthn/register/finish?username=<name>
|
||||
// Body: the attestation response from the browser.
|
||||
func (c *Connector) FinishRegistration(w http.ResponseWriter, r *http.Request) {
|
||||
username := r.URL.Query().Get("username")
|
||||
if username == "" {
|
||||
http.Error(w, "username required", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
sessionID := base64.RawURLEncoding.EncodeToString([]byte(username))
|
||||
session, ok := regSessions.sessions[sessionID]
|
||||
if !ok {
|
||||
http.Error(w, "no registration session; call /register first", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if time.Since(session.CreatedAt) > sessionTTL {
|
||||
delete(regSessions.sessions, sessionID)
|
||||
http.Error(w, "session expired", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
parsed, err := protocol.ParseCredentialCreationResponseBody(r.Body)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("parse attestation: %v", err), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
user := &webauthnUser{id: []byte(username), name: username}
|
||||
cred, err := c.w.CreateCredential(user, *session.Challenge, parsed)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("create credential: %v", err), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
storeCred := &Credential{
|
||||
UserID: username,
|
||||
CredentialID: cred.ID,
|
||||
PublicKey: cred.PublicKey,
|
||||
SignCount: 0,
|
||||
AAGUID: "",
|
||||
CreatedAt: time.Now(),
|
||||
}
|
||||
if err := c.store.PutCredential(storeCred); err != nil {
|
||||
http.Error(w, fmt.Sprintf("store credential: %v", err), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
delete(regSessions.sessions, sessionID)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(map[string]string{"status": "registered", "user_id": username})
|
||||
}
|
||||
|
||||
// LoginSession holds the in-flight login challenge.
|
||||
type LoginSession struct {
|
||||
UserID string
|
||||
Challenge *webauthn.SessionData
|
||||
CreatedAt time.Time
|
||||
}
|
||||
var loginSessions = map[string]*LoginSession{}
|
||||
|
||||
// BeginLogin starts the WebAuthn login ceremony.
|
||||
// GET /orca/webauthn/login?username=<name>
|
||||
func (c *Connector) BeginLogin(w http.ResponseWriter, r *http.Request) {
|
||||
cleanSessions()
|
||||
username := r.URL.Query().Get("username")
|
||||
if username == "" {
|
||||
http.Error(w, "username required", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
existing, _ := c.store.GetCredential(username)
|
||||
if existing == nil {
|
||||
http.Error(w, "user not registered", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
user := &webauthnUser{
|
||||
id: []byte(username),
|
||||
name: username,
|
||||
credentials: []webauthn.Credential{{ID: existing.CredentialID, PublicKey: existing.PublicKey}},
|
||||
}
|
||||
options, session, err := c.w.BeginLogin(user)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("begin login: %v", err), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
loginSessions[username] = &LoginSession{
|
||||
UserID: username,
|
||||
Challenge: session,
|
||||
CreatedAt: time.Now(),
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(options)
|
||||
}
|
||||
|
||||
// FinishLogin completes the WebAuthn login ceremony.
|
||||
// POST /orca/webauthn/login/finish?username=<name>
|
||||
func (c *Connector) FinishLogin(w http.ResponseWriter, r *http.Request) {
|
||||
username := r.URL.Query().Get("username")
|
||||
if username == "" {
|
||||
http.Error(w, "username required", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
session, ok := loginSessions[username]
|
||||
if !ok {
|
||||
http.Error(w, "no login session; call /login first", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if time.Since(session.CreatedAt) > sessionTTL {
|
||||
delete(loginSessions, username)
|
||||
http.Error(w, "session expired", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
existing, _ := c.store.GetCredential(username)
|
||||
if existing == nil {
|
||||
http.Error(w, "user not registered", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
user := &webauthnUser{
|
||||
id: []byte(username),
|
||||
name: username,
|
||||
credentials: []webauthn.Credential{{ID: existing.CredentialID, PublicKey: existing.PublicKey}},
|
||||
}
|
||||
parsed, err := protocol.ParseCredentialRequestResponseBody(r.Body)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("parse assertion: %v", err), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
cred, err := c.w.ValidateLogin(user, *session.Challenge, parsed)
|
||||
if err != nil {
|
||||
http.Error(w, fmt.Sprintf("validate login: %v", err), http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
_ = c.store.UpdateSignCount(username, cred.Authenticator.SignCount)
|
||||
delete(loginSessions, username)
|
||||
// The OIDC sub is the username (the connector maps credential ID
|
||||
// to sub). Dex uses this to issue the ID token.
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
json.NewEncoder(w).Encode(map[string]string{
|
||||
"status": "authenticated",
|
||||
"sub": username,
|
||||
})
|
||||
}
|
||||
|
||||
// Routes returns the HTTP handler mux for the WebAuthn connector.
|
||||
// Mount under /orca/webauthn/ behind Traefik.
|
||||
func (c *Connector) Routes() *http.ServeMux {
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/orca/webauthn/register", c.BeginRegistration)
|
||||
mux.HandleFunc("/orca/webauthn/register/finish", c.FinishRegistration)
|
||||
mux.HandleFunc("/orca/webauthn/login", c.BeginLogin)
|
||||
mux.HandleFunc("/orca/webauthn/login/finish", c.FinishLogin)
|
||||
mux.HandleFunc("/orca/webauthn/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Write([]byte(`{"status":"ok","rp_id":"` + c.rpID + `"}`))
|
||||
})
|
||||
return mux
|
||||
}
|
||||
|
||||
// Serve starts the WebAuthn HTTP handler on the given address. In
|
||||
// production this runs behind Traefik (which provides TLS); the bind
|
||||
// address is loopback only.
|
||||
func (c *Connector) Serve(ctx context.Context, addr string) error {
|
||||
srv := &http.Server{
|
||||
Addr: addr,
|
||||
Handler: c.Routes(),
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
}
|
||||
go func() {
|
||||
<-ctx.Done()
|
||||
ctx2, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
_ = srv.Shutdown(ctx2)
|
||||
}()
|
||||
if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
|
||||
return fmt.Errorf("webauthn: serve: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// webauthnUser implements webauthn.User.
|
||||
type webauthnUser struct {
|
||||
id []byte
|
||||
name string
|
||||
credentials []webauthn.Credential
|
||||
}
|
||||
|
||||
func (u *webauthnUser) WebAuthnID() []byte { return u.id }
|
||||
func (u *webauthnUser) WebAuthnName() string { return u.name }
|
||||
func (u *webauthnUser) WebAuthnDisplayName() string { return u.name }
|
||||
func (u *webauthnUser) WebAuthnCredentials() []webauthn.Credential { return u.credentials }
|
||||
func (u *webauthnUser) WebAuthnIcon() string { return "" }
|
||||
|
||||
// RPID returns the configured relying-party ID.
|
||||
func (c *Connector) RPID() string { return c.rpID }
|
||||
|
||||
// Ensure strings import is used (for the healthz handler).
|
||||
var _ = strings.Contains
|
||||
@@ -0,0 +1,102 @@
|
||||
package webauthn
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestConnectorBuild verifies a Connector can be built with a valid
|
||||
// RP ID + origin (C-38).
|
||||
func TestConnectorBuild(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, err := NewStore(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("NewStore: %v", err)
|
||||
}
|
||||
defer store.Close()
|
||||
c, err := NewConnector(store, "cluster.example.com", "https://cluster.example.com")
|
||||
if err != nil {
|
||||
t.Fatalf("NewConnector: %v", err)
|
||||
}
|
||||
if c.RPID() != "cluster.example.com" {
|
||||
t.Errorf("RPID = %q, want cluster.example.com", c.RPID())
|
||||
}
|
||||
}
|
||||
|
||||
// TestConnectorHealthz verifies the /orca/webauthn/healthz endpoint
|
||||
// responds with the RP ID.
|
||||
func TestConnectorHealthz(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, _ := NewStore(dbPath)
|
||||
defer store.Close()
|
||||
c, _ := NewConnector(store, "test.cluster", "https://test.cluster")
|
||||
mux := c.Routes()
|
||||
req := httptest.NewRequest("GET", "/orca/webauthn/healthz", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Errorf("healthz status = %d, want 200", rec.Code)
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), "test.cluster") {
|
||||
t.Errorf("healthz body should contain rp_id: %s", rec.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
// TestConnectorBeginRegistrationNoUsername verifies the register
|
||||
// endpoint rejects requests without a username.
|
||||
func TestConnectorBeginRegistrationNoUsername(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, _ := NewStore(dbPath)
|
||||
defer store.Close()
|
||||
c, _ := NewConnector(store, "test.cluster", "https://test.cluster")
|
||||
mux := c.Routes()
|
||||
req := httptest.NewRequest("GET", "/orca/webauthn/register", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("register without username: %d, want 400", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// TestConnectorBeginLoginNotRegistered verifies login for an
|
||||
// unregistered user returns 404.
|
||||
func TestConnectorBeginLoginNotRegistered(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, _ := NewStore(dbPath)
|
||||
defer store.Close()
|
||||
c, _ := NewConnector(store, "test.cluster", "https://test.cluster")
|
||||
mux := c.Routes()
|
||||
req := httptest.NewRequest("GET", "/orca/webauthn/login?username=ghost", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusNotFound {
|
||||
t.Errorf("login unregistered: %d, want 404", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// TestStoreModeEnforced verifies the DB file is 0600 after creation.
|
||||
func TestStoreModeEnforced(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, err := NewStore(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("NewStore: %v", err)
|
||||
}
|
||||
defer store.Close()
|
||||
// Trigger a write so the DB file is created on disk.
|
||||
store.PutCredential(&Credential{
|
||||
UserID: "u",
|
||||
CredentialID: []byte("c"),
|
||||
PublicKey: []byte("p"),
|
||||
})
|
||||
info, err := os.Stat(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("stat db: %v", err)
|
||||
}
|
||||
if info.Mode().Perm()&0o077 != 0 {
|
||||
t.Errorf("db mode = %o, want 0600", info.Mode().Perm())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,188 @@
|
||||
// Package webauthn implements the WebAuthn (passkeys) connector for
|
||||
// the bundled Dex (REQ-148, D-240, D-243, D-244). Passkeys are
|
||||
// public-key credentials — the private key never leaves the
|
||||
// authenticator — directly satisfying R-021 (no passwords, no shared
|
||||
// secrets). The connector serves registration + login ceremonies
|
||||
// behind Traefik at /orca/webauthn/{register,login}.
|
||||
//
|
||||
// Credential storage: SQLite at ClusterDir()/webauthn-credentials.db
|
||||
// (0600). Stores public keys + credential IDs + sign counts only.
|
||||
// No private keys, no secrets.
|
||||
package webauthn
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
// Credential is a stored WebAuthn public-key credential.
|
||||
type Credential struct {
|
||||
UserID string `json:"user_id"`
|
||||
CredentialID []byte `json:"credential_id"`
|
||||
PublicKey []byte `json:"public_key"`
|
||||
SignCount uint32 `json:"sign_count"`
|
||||
AAGUID string `json:"aaguid"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
}
|
||||
|
||||
// Store is the SQLite-backed credential store.
|
||||
type Store struct {
|
||||
db *sql.DB
|
||||
path string
|
||||
mu sync.Mutex
|
||||
}
|
||||
|
||||
// NewStore opens (or creates) the WebAuthn credential DB at the given
|
||||
// path. The DB file mode is enforced at 0600.
|
||||
func NewStore(dbPath string) (*Store, error) {
|
||||
if err := os.MkdirAll(filepath.Dir(dbPath), 0o700); err != nil {
|
||||
return nil, fmt.Errorf("webauthn: mkdir: %w", err)
|
||||
}
|
||||
dsn := fmt.Sprintf("file:%s?_pragma=journal_mode(WAL)", dbPath)
|
||||
db, err := sql.Open("sqlite", dsn)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("webauthn: open db: %w", err)
|
||||
}
|
||||
if err := db.Ping(); err != nil {
|
||||
db.Close()
|
||||
return nil, fmt.Errorf("webauthn: ping: %w", err)
|
||||
}
|
||||
schema := `
|
||||
CREATE TABLE IF NOT EXISTS credentials (
|
||||
user_id TEXT PRIMARY KEY,
|
||||
credential_id BLOB NOT NULL,
|
||||
public_key BLOB NOT NULL,
|
||||
sign_count INTEGER NOT NULL DEFAULT 0,
|
||||
aaguid TEXT NOT NULL DEFAULT '',
|
||||
created_at TEXT NOT NULL
|
||||
);`
|
||||
if _, err := db.Exec(schema); err != nil {
|
||||
db.Close()
|
||||
return nil, fmt.Errorf("webauthn: schema: %w", err)
|
||||
}
|
||||
// Enforce 0600 on the DB file.
|
||||
if err := os.Chmod(dbPath, 0o600); err != nil {
|
||||
// Non-fatal: the file may not exist yet (WAL mode creates on first write).
|
||||
_ = err
|
||||
}
|
||||
return &Store{db: db, path: dbPath}, nil
|
||||
}
|
||||
|
||||
// PutCredential stores a credential (insert or replace by user_id).
|
||||
func (s *Store) PutCredential(c *Credential) error {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
_, err := s.db.Exec(
|
||||
`INSERT INTO credentials (user_id, credential_id, public_key, sign_count, aaguid, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?)
|
||||
ON CONFLICT(user_id) DO UPDATE SET
|
||||
credential_id = excluded.credential_id,
|
||||
public_key = excluded.public_key,
|
||||
sign_count = excluded.sign_count`,
|
||||
c.UserID, c.CredentialID, c.PublicKey, c.SignCount, c.AAGUID, c.CreatedAt.Format(time.RFC3339),
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("webauthn: put: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetCredential retrieves a credential by user_id.
|
||||
func (s *Store) GetCredential(userID string) (*Credential, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
var c Credential
|
||||
var createdStr string
|
||||
err := s.db.QueryRow(
|
||||
`SELECT user_id, credential_id, public_key, sign_count, aaguid, created_at
|
||||
FROM credentials WHERE user_id = ?`, userID,
|
||||
).Scan(&c.UserID, &c.CredentialID, &c.PublicKey, &c.SignCount, &c.AAGUID, &createdStr)
|
||||
if err == sql.ErrNoRows {
|
||||
return nil, nil
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("webauthn: get: %w", err)
|
||||
}
|
||||
c.CreatedAt, _ = time.Parse(time.RFC3339, createdStr)
|
||||
return &c, nil
|
||||
}
|
||||
|
||||
// ListCredentials returns all stored credentials (for admin/debug).
|
||||
func (s *Store) ListCredentials() ([]*Credential, error) {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
rows, err := s.db.Query(
|
||||
`SELECT user_id, credential_id, public_key, sign_count, aaguid, created_at
|
||||
FROM credentials ORDER BY created_at`)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("webauthn: list: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []*Credential
|
||||
for rows.Next() {
|
||||
var c Credential
|
||||
var createdStr string
|
||||
if err := rows.Scan(&c.UserID, &c.CredentialID, &c.PublicKey, &c.SignCount, &c.AAGUID, &createdStr); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
c.CreatedAt, _ = time.Parse(time.RFC3339, createdStr)
|
||||
out = append(out, &c)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// DeleteCredential removes a credential (revoke a passkey).
|
||||
func (s *Store) DeleteCredential(userID string) error {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
_, err := s.db.Exec(`DELETE FROM credentials WHERE user_id = ?`, userID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("webauthn: delete: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// UpdateSignCount updates the sign count after a successful login.
|
||||
func (s *Store) UpdateSignCount(userID string, count uint32) error {
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
_, err := s.db.Exec(`UPDATE credentials SET sign_count = ? WHERE user_id = ?`, count, userID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("webauthn: update count: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Close closes the DB.
|
||||
func (s *Store) Close() error { return s.db.Close() }
|
||||
|
||||
// EncodeID base64-encodes a credential ID for transport.
|
||||
func EncodeID(id []byte) string {
|
||||
return base64.RawURLEncoding.EncodeToString(id)
|
||||
}
|
||||
|
||||
// DecodeID base64-decodes a credential ID.
|
||||
func DecodeID(s string) ([]byte, error) {
|
||||
return base64.RawURLEncoding.DecodeString(s)
|
||||
}
|
||||
|
||||
// User represents a WebAuthn user (for the ceremony).
|
||||
type User struct {
|
||||
ID []byte
|
||||
Name string
|
||||
DisplayName string
|
||||
Credentials []*Credential
|
||||
}
|
||||
|
||||
// ToJSON marshals a value for the connector response.
|
||||
func ToJSON(v any) ([]byte, error) {
|
||||
return json.Marshal(v)
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
package webauthn
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// TestStoreRoundTrip verifies Put + Get + Delete + List + UpdateSignCount.
|
||||
func TestStoreRoundTrip(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, err := NewStore(dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("NewStore: %v", err)
|
||||
}
|
||||
defer store.Close()
|
||||
|
||||
cred := &Credential{
|
||||
UserID: "user-1",
|
||||
CredentialID: []byte("cred-id-123"),
|
||||
PublicKey: []byte("pub-key-bytes"),
|
||||
SignCount: 0,
|
||||
AAGUID: "test-aaguid",
|
||||
CreatedAt: time.Now(),
|
||||
}
|
||||
if err := store.PutCredential(cred); err != nil {
|
||||
t.Fatalf("Put: %v", err)
|
||||
}
|
||||
got, err := store.GetCredential("user-1")
|
||||
if err != nil {
|
||||
t.Fatalf("Get: %v", err)
|
||||
}
|
||||
if got == nil {
|
||||
t.Fatal("Get returned nil")
|
||||
}
|
||||
if got.UserID != "user-1" || string(got.CredentialID) != "cred-id-123" {
|
||||
t.Errorf("got = %+v", got)
|
||||
}
|
||||
if err := store.UpdateSignCount("user-1", 42); err != nil {
|
||||
t.Fatalf("UpdateSignCount: %v", err)
|
||||
}
|
||||
got, _ = store.GetCredential("user-1")
|
||||
if got.SignCount != 42 {
|
||||
t.Errorf("SignCount = %d, want 42", got.SignCount)
|
||||
}
|
||||
list, err := store.ListCredentials()
|
||||
if err != nil {
|
||||
t.Fatalf("List: %v", err)
|
||||
}
|
||||
if len(list) != 1 {
|
||||
t.Errorf("List = %d, want 1", len(list))
|
||||
}
|
||||
if err := store.DeleteCredential("user-1"); err != nil {
|
||||
t.Fatalf("Delete: %v", err)
|
||||
}
|
||||
got, _ = store.GetCredential("user-1")
|
||||
if got != nil {
|
||||
t.Error("Get after delete should return nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestStorePutReplace verifies Put replaces on conflict.
|
||||
func TestStorePutReplace(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, _ := NewStore(dbPath)
|
||||
defer store.Close()
|
||||
c1 := &Credential{UserID: "u", CredentialID: []byte("old"), PublicKey: []byte("pk1"), CreatedAt: time.Now()}
|
||||
store.PutCredential(c1)
|
||||
c2 := &Credential{UserID: "u", CredentialID: []byte("new"), PublicKey: []byte("pk2"), CreatedAt: time.Now()}
|
||||
store.PutCredential(c2)
|
||||
got, _ := store.GetCredential("u")
|
||||
if string(got.CredentialID) != "new" {
|
||||
t.Errorf("CredentialID = %q, want new", got.CredentialID)
|
||||
}
|
||||
}
|
||||
|
||||
// TestStoreGetMissing verifies Get returns nil, nil for missing.
|
||||
func TestStoreGetMissing(t *testing.T) {
|
||||
dbPath := filepath.Join(t.TempDir(), "webauthn-creds.db")
|
||||
store, _ := NewStore(dbPath)
|
||||
defer store.Close()
|
||||
got, err := store.GetCredential("nonexistent")
|
||||
if err != nil {
|
||||
t.Errorf("Get missing should not error: %v", err)
|
||||
}
|
||||
if got != nil {
|
||||
t.Error("Get missing should return nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestEncodeDecodeID verifies base64 round-trip.
|
||||
func TestEncodeDecodeID(t *testing.T) {
|
||||
original := []byte("test-credential-id-12345")
|
||||
encoded := EncodeID(original)
|
||||
decoded, err := DecodeID(encoded)
|
||||
if err != nil {
|
||||
t.Fatalf("Decode: %v", err)
|
||||
}
|
||||
if string(decoded) != string(original) {
|
||||
t.Errorf("decode = %q, want %q", decoded, original)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user