f.weber
ae30ba1240
- Added internal/vault/client.go for creating a Vault client with configuration settings. - Introduced internal/vault/errors.go to classify Vault API errors for better UI handling. - Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations. - Implemented internal/vault/mounts.go to list and describe secret engine mounts. - Developed internal/vault/service.go to provide a unified entry point for Vault operations. - Added internal/vault/kv_test.go for comprehensive testing of KV operations. - Introduced internal/ui/toast.go for transient notifications in the UI. - Added renovate.json for dependency management and updates.
103 lines
2.9 KiB
Go
103 lines
2.9 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"path"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
)
|
|
|
|
// handler builds the http.HandlerFunc that completes the OIDC exchange.
|
|
// once guards against a stray second request (retries, prefetchers, a
|
|
// double-click) sending on the already-buffered done channel more than
|
|
// once — sending twice would be harmless here (done is buffered 1 and
|
|
// nobody reads twice) but responding twice to the browser is not, so we
|
|
// gate the whole body.
|
|
func (f *Flow) handler(c *api.Client, done chan<- result, once *sync.Once) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
var res result
|
|
handled := false
|
|
defer func() {
|
|
if !handled {
|
|
return
|
|
}
|
|
if res.err != nil {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
_, _ = w.Write(errorHTML(res.err))
|
|
} else {
|
|
_, _ = w.Write(successHTML())
|
|
}
|
|
once.Do(func() { done <- res })
|
|
}()
|
|
|
|
if r.URL.Path != f.cfg.CallbackPath {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
handled = true
|
|
|
|
if err := r.ParseForm(); err != nil {
|
|
res.err = fmt.Errorf("parsing callback request: %w", err)
|
|
return
|
|
}
|
|
|
|
if errCode := r.FormValue("error"); errCode != "" {
|
|
res.err = ProviderRejectedError{Code: errCode, Description: r.FormValue("error_description")}
|
|
return
|
|
}
|
|
|
|
state := r.FormValue("state")
|
|
code := r.FormValue("code")
|
|
idToken := r.FormValue("id_token")
|
|
if state == "" {
|
|
res.err = fmt.Errorf("OIDC callback missing state parameter")
|
|
return
|
|
}
|
|
|
|
// The callback exchange is tied to the Flow's own context (captured
|
|
// via closure below is not possible here since Login already holds
|
|
// it) — use a background context bounded by a short deadline instead
|
|
// of r.Context(), so a browser tab closed mid-exchange does not abort
|
|
// an exchange that Vault is still processing.
|
|
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
|
|
defer cancel()
|
|
|
|
data := url.Values{
|
|
"state": {state},
|
|
"code": {code},
|
|
"id_token": {idToken},
|
|
"client_nonce": {f.nonce},
|
|
}
|
|
p := path.Join("auth", f.cfg.Mount, "oidc/callback")
|
|
sec, err := c.Logical().ReadWithDataWithContext(ctx, p, data)
|
|
if err != nil {
|
|
res.err = fmt.Errorf("completing OIDC login: %w", err)
|
|
return
|
|
}
|
|
if sec == nil || sec.Auth == nil || sec.Auth.ClientToken == "" {
|
|
res.err = fmt.Errorf("Vault returned no token from the OIDC callback")
|
|
return
|
|
}
|
|
res.secret = sec
|
|
}
|
|
}
|
|
|
|
// ProviderRejectedError wraps an error= / error_description= pair the
|
|
// identity provider appended to the redirect (e.g. the user clicked "deny").
|
|
type ProviderRejectedError struct {
|
|
Code string
|
|
Description string
|
|
}
|
|
|
|
func (e ProviderRejectedError) Error() string {
|
|
if e.Description != "" {
|
|
return fmt.Sprintf("identity provider rejected the login: %s (%s)", e.Code, e.Description)
|
|
}
|
|
return fmt.Sprintf("identity provider rejected the login: %s", e.Code)
|
|
}
|