Skip to content

Commit 86b851b

Browse files
memuratsmemurats
committed
Merge #24 [V33] Telekom bearer token: Additional secret
2 parents 974d98d + e2d9cf9 commit 86b851b

8 files changed

Lines changed: 587 additions & 5 deletions

File tree

‎lib/Command/UpsertProvider.php‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ protected function configure() {
179179
->addOption('clientid', 'c', InputOption::VALUE_REQUIRED, 'OpenID client identifier')
180180
->addOption('clientsecret', 's', InputOption::VALUE_REQUIRED, 'OpenID client secret')
181181
->addOption('discoveryuri', 'd', InputOption::VALUE_REQUIRED, 'OpenID discovery endpoint uri')
182+
->addOption('bearersecret', 'bs', InputOption::VALUE_OPTIONAL, 'Telekom bearer token requires a different client secret for bearer tokens')
182183
->addOption('endsessionendpointuri', 'e', InputOption::VALUE_REQUIRED, 'OpenID end session endpoint uri')
183184
->addOption('postlogouturi', 'p', InputOption::VALUE_REQUIRED, 'Post logout URI')
184185
->addOption('scope', 'o', InputOption::VALUE_OPTIONAL, 'OpenID requested value scopes, if not set defaults to "openid email profile"');
@@ -206,10 +207,17 @@ protected function execute(InputInterface $input, OutputInterface $output) {
206207
return $this->listProviders($input, $output);
207208
}
208209

210+
// bearersecret is usually base64 encoded, but SAM delivers it non-encoded by default
211+
// so always encode/decode for this field
212+
$bearersecret = $input->getOption('bearersecret');
213+
if ($bearersecret !== null) {
214+
$bearersecret = $this->crypto->encrypt($this->base64UrlEncode($bearersecret));
215+
}
216+
209217
// check if any option for updating is provided
210218
$updateOptions = array_filter($input->getOptions(), static function ($value, $option) {
211219
return in_array($option, [
212-
'identifier', 'clientid', 'clientsecret', 'discoveryuri', 'endsessionendpointuri', 'postlogouturi', 'scope',
220+
'identifier', 'clientid', 'clientsecret', 'discoveryuri', 'endsessionendpointuri', 'postlogouturi', 'scope', 'bearersecret',
213221
...array_keys(self::EXTRA_OPTIONS),
214222
]) && $value !== null;
215223
}, ARRAY_FILTER_USE_BOTH);
@@ -250,7 +258,7 @@ protected function execute(InputInterface $input, OutputInterface $output) {
250258
}
251259
try {
252260
$provider = $this->providerMapper->createOrUpdateProvider(
253-
$identifier, $clientid, $clientsecret, $discoveryuri, $scope, $endsessionendpointuri, $postLogoutUri
261+
$identifier, $clientid, $clientsecret, $discoveryuri, $scope, $endsessionendpointuri, $postLogoutUri, $bearersecret
254262
);
255263
// invalidate JWKS cache (even if it was just created)
256264
$this->providerService->setSetting($provider->getId(), ProviderService::SETTING_JWKS_CACHE, '');
@@ -306,4 +314,8 @@ private function listProviders(InputInterface $input, OutputInterface $output) {
306314
$table->render();
307315
return 0;
308316
}
317+
318+
private function base64UrlEncode(string $data): string {
319+
return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
320+
}
309321
}

‎lib/Controller/SettingsController.php‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ public function isDiscoveryEndpointValid($url) {
7777
}
7878

7979
#[PasswordConfirmationRequired]
80-
public function createProvider(string $identifier, string $clientId, string $clientSecret, string $discoveryEndpoint,
80+
public function createProvider(string $identifier, string $clientId, string $clientSecret, string $discoveryEndpoint, string $bearerSecret,
8181
array $settings = [], string $scope = 'openid email profile', ?string $endSessionEndpoint = null,
8282
?string $postLogoutUri = null): JSONResponse {
8383
if ($this->providerService->getProviderByIdentifier($identifier) !== null) {
@@ -102,6 +102,8 @@ public function createProvider(string $identifier, string $clientId, string $cli
102102
$provider->setEndSessionEndpoint($endSessionEndpoint ?: null);
103103
$provider->setPostLogoutUri($postLogoutUri ?: null);
104104
$provider->setScope($scope);
105+
$encryptedBearerSecret = $this->crypto->encrypt($this->base64UrlEncode($bearerSecret));
106+
$provider->setBearerSecret($encryptedBearerSecret);
105107
$provider = $this->providerMapper->insert($provider);
106108

107109
$providerSettings = $this->providerService->setSettings($provider->getId(), $settings);
@@ -110,7 +112,7 @@ public function createProvider(string $identifier, string $clientId, string $cli
110112
}
111113

112114
#[PasswordConfirmationRequired]
113-
public function updateProvider(int $providerId, string $identifier, string $clientId, string $discoveryEndpoint, ?string $clientSecret = null,
115+
public function updateProvider(int $providerId, string $identifier, string $clientId, string $discoveryEndpoint, ?string $clientSecret = null, ?string $bearerSecret = null,
114116
array $settings = [], string $scope = 'openid email profile', ?string $endSessionEndpoint = null,
115117
?string $postLogoutUri = null): JSONResponse {
116118
$provider = $this->providerMapper->getProvider($providerId);
@@ -134,6 +136,9 @@ public function updateProvider(int $providerId, string $identifier, string $clie
134136
$encryptedClientSecret = $this->crypto->encrypt($clientSecret);
135137
$provider->setClientSecret($encryptedClientSecret);
136138
}
139+
if ($bearerSecret) {
140+
$provider->setBearerSecret($this->base64UrlEncode($bearerSecret));
141+
}
137142
$provider->setDiscoveryEndpoint($discoveryEndpoint);
138143
$provider->setEndSessionEndpoint($endSessionEndpoint ?: null);
139144
$provider->setPostLogoutUri($postLogoutUri ?: null);
@@ -185,4 +190,8 @@ public function setAdminConfig(array $values): JSONResponse {
185190
}
186191
return new JSONResponse([]);
187192
}
193+
194+
private function base64UrlEncode(string $data): string {
195+
return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
196+
}
188197
}

‎lib/Db/Provider.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
* @method \void setEndSessionEndpoint(?string $endSessionEndpoint)
2424
* @method \string|\null getPostLogoutUri()
2525
* @method \void setPostLogoutUri(?string $postLogoutUri)
26+
* @method string getBearerSecret()
27+
* @method void setBearerSecret(string $bearerSecret)
28+
* @method string getScope()
2629
* @method \void setScope(string $scope)
2730
*/
2831
class Provider extends Entity implements \JsonSerializable {
@@ -40,6 +43,8 @@ class Provider extends Entity implements \JsonSerializable {
4043
/** @var string */
4144
protected $postLogoutUri;
4245
/** @var string */
46+
protected $bearerSecret;
47+
/** @var string */
4348
protected $scope;
4449

4550
/**

‎lib/Db/ProviderMapper.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ public function getProviders() {
8282
* @param string|null $clientid
8383
* @param string|null $clientsecret
8484
* @param string|null $discoveryuri
85+
* @param string|null $bearersecret
8586
* @param string $scope
8687
* @param string|null $endsessionendpointuri
8788
* @param string|null $postLogoutUri
@@ -91,7 +92,7 @@ public function getProviders() {
9192
* @throws MultipleObjectsReturnedException
9293
*/
9394
public function createOrUpdateProvider(string $identifier, ?string $clientid = null,
94-
?string $clientsecret = null, ?string $discoveryuri = null, string $scope = 'openid email profile',
95+
?string $clientsecret = null, ?string $discoveryuri = null, string $scope = 'openid email profile', ?string $bearersecret = null,
9596
?string $endsessionendpointuri = null, ?string $postLogoutUri = null) {
9697
try {
9798
$provider = $this->findProviderByIdentifier($identifier);
@@ -110,6 +111,7 @@ public function createOrUpdateProvider(string $identifier, ?string $clientid = n
110111
$provider->setDiscoveryEndpoint($discoveryuri);
111112
$provider->setEndSessionEndpoint($endsessionendpointuri);
112113
$provider->setPostLogoutUri($postLogoutUri);
114+
$provider->setBearerSecret($bearersecret ?? '');
113115
$provider->setScope($scope);
114116
return $this->insert($provider);
115117
} else {
@@ -128,6 +130,9 @@ public function createOrUpdateProvider(string $identifier, ?string $clientid = n
128130
if ($postLogoutUri !== null) {
129131
$provider->setPostLogoutUri($postLogoutUri ?: null);
130132
}
133+
if ($bearersecret !== null) {
134+
$provider->setBearerSecret($bearersecret);
135+
}
131136
$provider->setScope($scope);
132137
return $this->update($provider);
133138
}

‎lib/Migration/Version00008Date20211114183344.php‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace OCA\UserOIDC\Migration;
6+
7+
use Closure;
8+
use OCP\DB\ISchemaWrapper;
9+
use OCP\Migration\IOutput;
10+
use OCP\Migration\SimpleMigrationStep;
11+
12+
class Version00008Date20211114183344 extends SimpleMigrationStep {
13+
public function changeSchema(IOutput $output, Closure $schemaClosure, array $options) {
14+
/** @var ISchemaWrapper $schema */
15+
$schema = $schemaClosure();
16+
17+
$table = $schema->getTable('user_oidc_providers');
18+
$table->addColumn('bearer_secret', 'string', [
19+
'notnull' => true,
20+
'length' => 64,
21+
]);
22+
23+
return $schema;
24+
}
25+
}

‎lib/Migration/Version010304Date20230902125945.php‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* @copyright Copyright 2023, Julien Veyssier <julien-nc@posteo.net>
7+
*
8+
* @author B. Rederlechner <bernd.rederlechner@t-systems.com>
9+
*
10+
* @license GNU AGPL version 3 or any later version
11+
*
12+
* This program is free software: you can redistribute it and/or modify
13+
* it under the terms of the GNU Affero General Public License as
14+
* published by the Free Software Foundation, either version 3 of the
15+
* License, or (at your option) any later version.
16+
*
17+
* This program is distributed in the hope that it will be useful,
18+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
19+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20+
* GNU Affero General Public License for more details.
21+
*
22+
* You should have received a copy of the GNU Affero General Public License
23+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
24+
*
25+
*/
26+
namespace OCA\UserOIDC\Migration;
27+
28+
use Closure;
29+
use OCP\DB\ISchemaWrapper;
30+
use OCP\DB\QueryBuilder\IQueryBuilder;
31+
use OCP\IDBConnection;
32+
use OCP\Migration\IOutput;
33+
use OCP\Migration\SimpleMigrationStep;
34+
use OCP\Security\ICrypto;
35+
36+
class Version010304Date20230902125945 extends SimpleMigrationStep {
37+
38+
/**
39+
* @var IDBConnection
40+
*/
41+
private $connection;
42+
/**
43+
* @var ICrypto
44+
*/
45+
private $crypto;
46+
47+
public function __construct(
48+
IDBConnection $connection,
49+
ICrypto $crypto,
50+
) {
51+
$this->connection = $connection;
52+
$this->crypto = $crypto;
53+
}
54+
55+
public function changeSchema(IOutput $output, Closure $schemaClosure, array $options) {
56+
/** @var ISchemaWrapper $schema */
57+
$schema = $schemaClosure();
58+
$tableName = 'user_oidc_providers';
59+
60+
if ($schema->hasTable($tableName)) {
61+
$table = $schema->getTable($tableName);
62+
if ($table->hasColumn('bearer_secret')) {
63+
$column = $table->getColumn('bearer_secret');
64+
$column->setLength(512);
65+
return $schema;
66+
}
67+
}
68+
69+
return null;
70+
}
71+
72+
public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
73+
$tableName = 'user_oidc_providers';
74+
75+
// update secrets in user_oidc_providers and user_oidc_id4me
76+
$qbUpdate = $this->connection->getQueryBuilder();
77+
$qbUpdate->update($tableName)
78+
->set('bearer_secret', $qbUpdate->createParameter('updateSecret'))
79+
->where(
80+
$qbUpdate->expr()->eq('id', $qbUpdate->createParameter('updateId'))
81+
);
82+
83+
$qbSelect = $this->connection->getQueryBuilder();
84+
$qbSelect->select('id', 'bearer_secret')
85+
->from($tableName);
86+
$req = $qbSelect->executeQuery();
87+
while ($row = $req->fetch()) {
88+
$id = $row['id'];
89+
$secret = $row['bearer_secret'];
90+
$encryptedSecret = $this->crypto->encrypt($secret);
91+
$qbUpdate->setParameter('updateSecret', $encryptedSecret, IQueryBuilder::PARAM_STR);
92+
$qbUpdate->setParameter('updateId', $id, IQueryBuilder::PARAM_INT);
93+
$qbUpdate->executeStatement();
94+
}
95+
$req->closeCursor();
96+
}
97+
}

‎src/components/SettingsForm.vue‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,15 @@
3232
:required="!update"
3333
autocomplete="off">
3434
</p>
35+
<p>
36+
<label for="oidc-bearer-secret">{{ t('user_oidc', 'Bearer shared secret') }}</label>
37+
<input id="oidc-bearer-secret"
38+
v-model="localProvider.bearerSecret"
39+
:placeholder="update ? t('user_oidc', 'Leave empty to keep existing') : null"
40+
type="text"
41+
:required="!update"
42+
autocomplete="off">
43+
</p>
3544
<p class="settings-hint warning-hint">
3645
<AlertOutlineIcon :size="20" class="icon" />
3746
{{ t('user_oidc', 'Warning, if the protocol of the URLs in the discovery content is HTTP, the ID token will be delivered through an insecure connection.') }}

0 commit comments

Comments
 (0)