8000 [DRAFT] Add checking id-token issuer against known/configured value. by creechy · Pull Request #841 · unitycatalog/unitycatalog · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[DRAFT] Add checking id-token issuer against known/configured value. #841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[DRAFT] Add checking id-token issuer against known/configured value. #841

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions etc/conf/server.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,13 @@ server.env=dev
# token-url=https://oauth2.googleapis.com/token
# client-id=111122223333-abab1212cdcd3434.apps.googleusercontent.com
# client-secret=GOCSPX-ababfoobarcdcd-5q
# idp-issuer=https://accounts.google.com
server.authorization=disable
server.authorization-url=
server.token-url=
server.client-id=
server.client-secret=
server.idp-issuer=
server.redirect-port=
# D-Days H-Hours M-Minutes S-Seconds (P5D = 5 days,PT5H = 5 hours, PT5M = 5 minutes, PT5S = 5 seconds)
server.cookie-timeout=P5D
Expand Down
10 changes: 10 additions & 0 deletions server/src/main/java/io/unitycatalog/server/service/AuthService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,13 +64,15 @@ interface AuthTypes {

private final SecurityContext securityContext;
private final JwksOperations jwksOperations;
private final String iDpIssuer;

private static final String COOKIE = "cookie";
private static final String EMPTY_RESPONSE = "{}";

public AuthService(SecurityContext securityContext) {
this.securityContext = securityContext;
this.jwksOperations = new JwksOperations(securityContext);
this.iDpIssuer = ServerProperties.getInstance().getProperty("server.idp-issuer");
}

/**
Expand Down Expand Up @@ -145,6 +147,7 @@ public HttpResponse grantToken(

LOGGER.debug("Validating token for issuer: {} and keyId: {}", issuer, keyId);

validateIssuer(issuer);
JWTVerifier jwtVerifier = jwksOperations.verifierForIssuerAndKey(issuer, keyId);
decodedJWT = jwtVerifier.verify(decodedJWT);
verifyPrincipal(decodedJWT);
Expand Down Expand Up @@ -197,6 +200,13 @@ public HttpResponse logout(HttpRequest request) {
.orElse(HttpResponse.of(HttpStatus.OK, MediaType.JSON, EMPTY_RESPONSE));
}

private void validateIssuer(String issuer) {
if (!issuer.equals(securityContext.getLocalIssuer()) && !issuer.equals(iDpIssuer)) {
throw new OAuthInvalidRequestException(
ErrorCode.INVALID_ARGUMENT, "Invalid issuer: " + issuer);
}
}

private static void verifyPrincipal(DecodedJWT decodedJWT) {
String subject =
decodedJWT
Expand Down
Loading
0