Add implicit authentication flow (#255)

Reviewed-on: #255
Co-authored-by: Pierre HUBERT <pierre.git@communiquons.org>
Co-committed-by: Pierre HUBERT <pierre.git@communiquons.org>

README.md

@@ -13,10 +13,15 @@ BasicOIDC operates without any database, just with three files :
 ## Configuration
 You can configure a list of clients (Relying Parties) in a `clients.yaml` file with the following syntax :
 ```yaml
+  # Client ID
 - id: gitea
+  # Client name
   name: Gitea
+  # Client description
   description: Git with a cup of tea
+  # Client secret. Specify this value to use authorization code flow, remove it for implicit authentication flow
   secret: TOP_SECRET
+  # The URL where user shall be redirected after authentication
   redirect_uri: https://mygit.mywebsite.com/
   # If you want new accounts to be granted access to this client by default
   default: true
@@ -32,6 +37,7 @@ In order to run BasicOIDC for development, you will need to create a least an em
 
 ## Features
 * [x] `authorization_code` flow
+* [x] `implicit` flow
 * [x] Client authentication using secrets 
 * [x] Bruteforce protection 
 * [x] 2 factors authentication

src/constants.rs

@@ -69,6 +69,7 @@ pub const OPEN_ID_AUTHORIZATION_CODE_LEN: usize = 120;
 pub const OPEN_ID_AUTHORIZATION_CODE_TIMEOUT: u64 = 300;
 pub const OPEN_ID_ACCESS_TOKEN_LEN: usize = 50;
 pub const OPEN_ID_ACCESS_TOKEN_TIMEOUT: u64 = 3600;
+pub const OPEN_ID_ID_TOKEN_TIMEOUT: u64 = 3600;
 pub const OPEN_ID_REFRESH_TOKEN_LEN: usize = 120;
 pub const OPEN_ID_REFRESH_TOKEN_TIMEOUT: u64 = 360000;
 

src/controllers/openid_controller.rs

@@ -16,7 +16,7 @@ use crate::constants::*;
 use crate::controllers::base_controller::{build_fatal_error_page, redirect_user};
 use crate::data::action_logger::{Action, ActionLogger};
 use crate::data::app_config::AppConfig;
-use crate::data::client::{ClientID, ClientManager};
+use crate::data::client::{AuthenticationFlow, ClientID, ClientManager};
 use crate::data::code_challenge::CodeChallenge;
 use crate::data::current_user::CurrentUser;
 use crate::data::id_token::IdToken;
@@ -97,7 +97,7 @@ pub struct AuthorizeQuery {
     redirect_uri: String,
 
     /// RECOMMENDED. Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.
-    state: String,
+    state: Option<String>,
 
     /// OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values.
     nonce: Option<String>,
@@ -118,16 +118,20 @@ fn error_redirect(query: &AuthorizeQuery, error: &str, description: &str) -> Htt
         .append_header((
             "Location",
             format!(
-                "{}?error={}?error_description={}&state={}",
+                "{}?error={}?error_description={}{}",
                 query.redirect_uri,
                 urlencoding::encode(error),
                 urlencoding::encode(description),
-                urlencoding::encode(&query.state)
+                match &query.state {
+                    Some(s) => format!("&state={}", urlencoding::encode(s)),
+                    None => "".to_string(),
+                }
             ),
         ))
         .finish()
 }
 
+#[allow(clippy::too_many_arguments)]
 pub async fn authorize(
     req: HttpRequest,
     user: CurrentUser,
@@ -136,10 +140,13 @@ pub async fn authorize(
     clients: web::Data<Arc<ClientManager>>,
     sessions: web::Data<Addr<OpenIDSessionsActor>>,
     logger: ActionLogger,
-) -> impl Responder {
+    jwt_signer: web::Data<JWTSigner>,
+) -> actix_web::Result<HttpResponse> {
     let client = match clients.find_by_id(&query.client_id) {
         None => {
-            return HttpResponse::BadRequest().body(build_fatal_error_page("Client is invalid!"));
+            return Ok(
+                HttpResponse::BadRequest().body(build_fatal_error_page("Client is invalid!"))
+            );
         }
         Some(c) => c,
     };
@@ -147,39 +154,42 @@ pub async fn authorize(
     // Check if 2FA is required
     if client.enforce_2fa_auth && user.should_request_2fa_for_critical_functions() {
         let uri = get_2fa_url(&LoginRedirect::from_req(&req), true);
-        return redirect_user(&uri);
+        return Ok(redirect_user(&uri));
     }
 
+    // Validate specified redirect URI
     let redirect_uri = query.redirect_uri.trim().to_string();
     if !redirect_uri.starts_with(&client.redirect_uri) {
-        return HttpResponse::BadRequest().body(build_fatal_error_page("Redirect URI is invalid!"));
-    }
-
-    if !query.scope.split(' ').any(|x| x == "openid") {
-        return error_redirect(&query, "invalid_request", "openid scope missing!");
-    }
-
-    if !query.response_type.eq("code") {
-        return error_redirect(
-            &query,
-            "invalid_request",
-            "Only code response type is supported!",
+        return Ok(
+            HttpResponse::BadRequest().body(build_fatal_error_page("Redirect URI is invalid!"))
         );
     }
 
-    if query.state.is_empty() {
-        return error_redirect(&query, "invalid_request", "State is empty!");
+    if !query.scope.split(' ').any(|x| x == "openid") {
+        return Ok(error_redirect(
+            &query,
+            "invalid_request",
+            "openid scope missing!",
+        ));
+    }
+
+    if query.state.as_ref().map(String::is_empty).unwrap_or(false) {
+        return Ok(error_redirect(
+            &query,
+            "invalid_request",
+            "State is specified but empty!",
+        ));
     }
 
     let code_challenge = match query.0.code_challenge.clone() {
         Some(chal) => {
             let meth = query.0.code_challenge_method.as_deref().unwrap_or("plain");
             if !meth.eq("S256") && !meth.eq("plain") {
-                return error_redirect(
+                return Ok(error_redirect(
                     &query,
                     "invalid_request",
                     "Only S256 and plain code challenge methods are supported!",
-                );
+                ));
             }
             Some(CodeChallenge {
                 code_challenge: chal,
@@ -191,49 +201,110 @@ pub async fn authorize(
 
     // Check if user is authorized to access the application
     if !user.can_access_app(&client) {
-        return error_redirect(
+        return Ok(error_redirect(
             &query,
             "invalid_request",
             "User is not authorized to access this application!",
-        );
+        ));
     }
 
-    // Save all authentication information in memory
-    let session = Session {
-        session_id: SessionID(rand_str(OPEN_ID_SESSION_LEN)),
-        client: client.id.clone(),
-        user: user.uid.clone(),
-        auth_time: SessionIdentity(Some(&id)).auth_time(),
-        redirect_uri,
-        authorization_code: rand_str(OPEN_ID_AUTHORIZATION_CODE_LEN),
-        authorization_code_expire_at: time() + OPEN_ID_AUTHORIZATION_CODE_TIMEOUT,
-        access_token: None,
-        access_token_expire_at: time() + OPEN_ID_ACCESS_TOKEN_TIMEOUT,
-        refresh_token: "".to_string(),
-        refresh_token_expire_at: 0,
-        nonce: query.0.nonce,
-        code_challenge,
-    };
-    sessions
-        .send(openid_sessions_actor::PushNewSession(session.clone()))
-        .await
-        .unwrap();
+    // Check that requested authorization flow is supported
+    if query.response_type != "code" && query.response_type != "id_token" {
+        return Ok(error_redirect(
+            &query,
+            "invalid_request",
+            "Unsupported authorization flow!",
+        ));
+    }
 
-    log::trace!("New OpenID session: {:#?}", session);
-    logger.log(Action::NewOpenIDSession { client: &client });
+    match (client.auth_flow(), query.response_type.as_str()) {
+        (AuthenticationFlow::AuthorizationCode, "code") => {
+            // Save all authentication information in memory
+            let session = Session {
+                session_id: SessionID(rand_str(OPEN_ID_SESSION_LEN)),
+                client: client.id.clone(),
+                user: user.uid.clone(),
+                auth_time: SessionIdentity(Some(&id)).auth_time(),
+                redirect_uri,
+                authorization_code: rand_str(OPEN_ID_AUTHORIZATION_CODE_LEN),
+                authorization_code_expire_at: time() + OPEN_ID_AUTHORIZATION_CODE_TIMEOUT,
+                access_token: None,
+                access_token_expire_at: time() + OPEN_ID_ACCESS_TOKEN_TIMEOUT,
+                refresh_token: "".to_string(),
+                refresh_token_expire_at: 0,
+                nonce: query.0.nonce,
+                code_challenge,
+            };
+            sessions
+                .send(openid_sessions_actor::PushNewSession(session.clone()))
+                .await
+                .unwrap();
 
-    HttpResponse::Found()
-        .append_header((
-            "Location",
-            format!(
-                "{}?state={}&session_state={}&code={}",
-                session.redirect_uri,
-                urlencoding::encode(&query.0.state),
-                urlencoding::encode(&session.session_id.0),
-                urlencoding::encode(&session.authorization_code)
-            ),
-        ))
-        .finish()
+            log::trace!("New OpenID session: {:#?}", session);
+            logger.log(Action::NewOpenIDSession { client: &client });
+
+            Ok(HttpResponse::Found()
+                .append_header((
+                    "Location",
+                    format!(
+                        "{}?{}session_state={}&code={}",
+                        session.redirect_uri,
+                        match &query.0.state {
+                            Some(state) => format!("state={}&", urlencoding::encode(state)),
+                            None => "".to_string(),
+                        },
+                        urlencoding::encode(&session.session_id.0),
+                        urlencoding::encode(&session.authorization_code)
+                    ),
+                ))
+                .finish())
+        }
+
+        (AuthenticationFlow::Implicit, "id_token") => {
+            let id_token = IdToken {
+                issuer: AppConfig::get().website_origin.to_string(),
+                subject_identifier: user.uid.0.clone(),
+                audience: client.id.0.to_string(),
+                expiration_time: time() + OPEN_ID_ID_TOKEN_TIMEOUT,
+                issued_at: time(),
+                auth_time: SessionIdentity(Some(&id)).auth_time(),
+                nonce: query.nonce.clone(),
+                email: user.email.clone(),
+            };
+
+            log::trace!("New OpenID id token: {:#?}", &id_token);
+            logger.log(Action::NewOpenIDSuccessfulImplicitAuth { client: &client });
+
+            Ok(HttpResponse::Found()
+                .append_header((
+                    "Location",
+                    format!(
+                        "{}?{}token_type=bearer&id_token={}&expires_in={OPEN_ID_ID_TOKEN_TIMEOUT}",
+                        client.redirect_uri,
+                        match &query.0.state {
+                            Some(state) => format!("state={}&", urlencoding::encode(state)),
+                            None => "".to_string(),
+                        },
+                        jwt_signer.sign_token(id_token.to_jwt_claims())?
+                    ),
+                ))
+                .finish())
+        }
+
+        (flow, code) => {
+            log::warn!(
+                "For client {:?}, configured with flow {:?}, made request with code {}",
+                client.id,
+                flow,
+                code
+            );
+            Ok(error_redirect(
+                &query,
+                "invalid_request",
+                "Requested authentication flow is unsupported / not configured for this client!",
+            ))
+        }
+    }
 }
 
 #[derive(serde::Serialize)]
@@ -344,7 +415,8 @@ pub async fn token(
         .find_by_id(&client_id)
         .ok_or_else(|| ErrorUnauthorized("Client not found"))?;
 
-    if !client.secret.eq(&client_secret) {
+    // Retrieving token requires the client to have a defined secret
+    if client.secret != Some(client_secret) {
         return Ok(error_response(
             &query,
             "invalid_request",

src/data/action_logger.rs

@@ -90,6 +90,9 @@ pub enum Action<'a> {
     NewOpenIDSession {
         client: &'a Client,
     },
+    NewOpenIDSuccessfulImplicitAuth {
+        client: &'a Client,
+    },
     ChangedHisPassword,
     ClearedHisLoginHistory,
     AddNewFactor(&'a TwoFactor),
@@ -199,6 +202,7 @@ impl<'a> Action<'a> {
             Action::NewOpenIDSession { client } => {
                 format!("opened a new OpenID session with {:?}", client.id)
             }
+            Action::NewOpenIDSuccessfulImplicitAuth { client } => format!("finished an implicit flow connection for client {:?}", client.id),
             Action::ChangedHisPassword => "changed his password".to_string(),
             Action::ClearedHisLoginHistory => "cleared his login history".to_string(),
             Action::AddNewFactor(factor) => format!(
@@ -206,7 +210,6 @@ impl<'a> Action<'a> {
                 factor.quick_description(),
             ),
             Action::Removed2FAFactor { factor_id } => format!("Removed his factor {factor_id:?}"),
-
         }
     }
 }

src/data/client.rs

@@ -4,6 +4,12 @@ use crate::utils::string_utils::apply_env_vars;
 #[derive(Clone, Debug, serde::Serialize, serde::Deserialize, Eq, PartialEq)]
 pub struct ClientID(pub String);
 
+#[derive(Debug, Copy, Clone, Eq, PartialEq)]
+pub enum AuthenticationFlow {
+    AuthorizationCode,
+    Implicit,
+}
+
 #[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
 pub struct Client {
     /// The ID of the client
@@ -16,7 +22,8 @@ pub struct Client {
     pub description: String,
 
     /// The secret used by the client to retrieve authenticated users information
-    pub secret: String,
+    /// This value is absent if implicit authentication flow is used
+    pub secret: Option<String>,
 
     /// The URI where the users should be redirected once authenticated
     pub redirect_uri: String,
@@ -42,6 +49,16 @@ impl PartialEq for Client {
 
 impl Eq for Client {}
 
+impl Client {
+    /// Get the client authentication flow
+    pub fn auth_flow(&self) -> AuthenticationFlow {
+        match self.secret {
+            None => AuthenticationFlow::Implicit,
+            Some(_) => AuthenticationFlow::AuthorizationCode,
+        }
+    }
+}
+
 pub type ClientManager = EntityManager<Client>;
 
 impl EntityManager<Client> {
@@ -66,7 +83,7 @@ impl EntityManager<Client> {
             c.id = ClientID(apply_env_vars(&c.id.0));
             c.name = apply_env_vars(&c.name);
             c.description = apply_env_vars(&c.description);
-            c.secret = apply_env_vars(&c.secret);
+            c.secret = c.secret.as_deref().map(apply_env_vars);
             c.redirect_uri = apply_env_vars(&c.redirect_uri);
         }
     }

src/data/id_token.rs

@@ -1,7 +1,7 @@
 use jwt_simple::claims::Audiences;
 use jwt_simple::prelude::{Duration, JWTClaims};
 
-#[derive(serde::Serialize)]
+#[derive(serde::Serialize, Debug)]
 pub struct IdToken {
     /// REQUIRED. Issuer Identifier for the Issuer of the response. The iss value is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components.
     #[serde(rename = "iss")]