Skip to content

Commit 5bc9e54

Browse files
JoergerJoerger
authored
Remove remaining uses of github.com/coreos/go-oidc/v3 with github.com/zitadel/oidc/v3 (#54939)
* Use zitadel library for oidce token validation logic. * Add generic ValidateToken - only functional change is that the 15s provider timeout is used for all providers. * Use oidc.ValidateToken for azure. * Use zitadel to check discovery for tctl sso configure. * Update .golangci.yml. * go mod tidy. * Address linter/go.mod comments. * Add GetSubject. * Fix tests. * Re-embed jwt.Claims for Azure; Fix tests. * Use oidc.TokenClaims as a superset of jwt.Claims for azure claims. * Address comments.
1 parent 520cfe9 commit 5bc9e54

34 files changed

+267
-406
lines changed

‎.golangci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,8 @@ linters:
161161
desc: use "crypto" or "x/crypto" instead
162162
oidc:
163163
deny:
164-
- pkg: github.com/coreos/go-oidc$
165-
desc: 'github.com/coreos/go-oidc/v3 or github.com/zitadel/oidc/v3 should be used instead'
164+
- pkg: github.com/coreos/go-oidc
165+
desc: 'github.com/zitadel/oidc/v3 should be used instead'
166166
- pkg: github.com/zitadel/oidc$
167167
desc: 'github.com/zitadel/oidc/v3 should be used instead'
168168
testify:

‎go.mod‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,6 @@ require (
9191
github.com/charmbracelet/bubbletea v1.3.5
9292
github.com/charmbracelet/huh v0.7.0
9393
github.com/charmbracelet/lipgloss v1.1.0
94-
github.com/coreos/go-oidc/v3 v3.14.1
9594
github.com/coreos/go-semver v0.3.1
9695
github.com/coreos/go-systemd/v22 v22.5.0
9796
github.com/creack/pty v1.1.24

‎go.sum‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1111,6 +1111,7 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
11111111
github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
11121112
github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
11131113
github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
1114+
github.com/coreos/go-oidc v2.3.0+incompatible h1:+5vEsrgprdLjjQ9FzIKAzQz1wwPD+83hQRfUIPh7rO0=
11141115
github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
11151116
github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
11161117
github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=

‎integrations/event-handler/go.mod‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ require (
117117
github.com/containerd/errdefs v0.3.0 // indirect
118118
github.com/containerd/log v0.1.0 // indirect
119119
github.com/containerd/platforms v0.2.1 // indirect
120-
github.com/coreos/go-oidc/v3 v3.14.1 // indirect
121120
github.com/coreos/go-semver v0.3.1 // indirect
122121
github.com/crewjam/httperr v0.2.0 // indirect
123122
github.com/crewjam/saml v0.4.14 // indirect
@@ -387,7 +386,6 @@ replace (
387386
// replace statements from teleport
388387
replace (
389388
github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
390-
github.com/coreos/go-oidc => github.com/gravitational/go-oidc v0.1.1
391389
github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
392390
github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1
393391
github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4

‎integrations/event-handler/go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -262,8 +262,6 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
262262
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
263263
github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
264264
github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
265-
github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
266-
github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
267265
github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
268266
github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
269267
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

‎integrations/terraform/go.mod‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,6 @@ require (
129129
github.com/containerd/log v0.1.0 // indirect
130130
github.com/containerd/platforms v0.2.1 // indirect
131131
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
132-
github.com/coreos/go-oidc/v3 v3.14.1 // indirect
133132
github.com/coreos/go-semver v0.3.1 // indirect
134133
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
135134
github.com/crewjam/httperr v0.2.0 // indirect
@@ -464,7 +463,6 @@ replace (
464463
// replace statements from teleport
465464
replace (
466465
github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33
467-
github.com/coreos/go-oidc => github.com/gravitational/go-oidc v0.1.1
468466
github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
469467
github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.1
470468
github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4

‎integrations/terraform/go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -389,8 +389,6 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
389389
github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
390390
github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8=
391391
github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU=
392-
github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
393-
github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
394392
github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
395393
github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
396394
github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=

‎lib/auth/auth.go‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -647,19 +647,15 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
647647

648648
if as.ghaIDTokenValidator == nil {
649649
as.ghaIDTokenValidator = githubactions.NewIDTokenValidator(
650-
githubactions.IDTokenValidatorConfig{
651-
Clock: as.clock,
652-
},
650+
githubactions.IDTokenValidatorConfig{},
653651
)
654652
}
655653
if as.ghaIDTokenJWKSValidator == nil {
656654
as.ghaIDTokenJWKSValidator = githubactions.ValidateTokenWithJWKS
657655
}
658656
if as.spaceliftIDTokenValidator == nil {
659657
as.spaceliftIDTokenValidator = spacelift.NewIDTokenValidator(
660-
spacelift.IDTokenValidatorConfig{
661-
Clock: as.clock,
662-
},
658+
spacelift.IDTokenValidatorConfig{},
663659
)
664660
}
665661
if as.gitlabIDTokenValidator == nil {
@@ -681,7 +677,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
681677
ctx context.Context, organizationID, token string,
682678
) (*circleci.IDTokenClaims, error) {
683679
return circleci.ValidateToken(
684-
ctx, as.clock, circleci.IssuerURLTemplate, organizationID, token,
680+
ctx, circleci.IssuerURLTemplate, organizationID, token,
685681
)
686682
}
687683
}
@@ -697,20 +693,16 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
697693

698694
if as.gcpIDTokenValidator == nil {
699695
as.gcpIDTokenValidator = gcp.NewIDTokenValidator(
700-
gcp.IDTokenValidatorConfig{
701-
Clock: as.clock,
702-
},
696+
gcp.IDTokenValidatorConfig{},
703697
)
704698
}
705699

706700
if as.terraformIDTokenValidator == nil {
707-
as.terraformIDTokenValidator = terraformcloud.NewIDTokenValidator(terraformcloud.IDTokenValidatorConfig{
708-
Clock: as.clock,
709-
})
701+
as.terraformIDTokenValidator = terraformcloud.NewIDTokenValidator(terraformcloud.IDTokenValidatorConfig{})
710702
}
711703

712704
if as.bitbucketIDTokenValidator == nil {
713-
as.bitbucketIDTokenValidator = bitbucket.NewIDTokenValidator(as.clock)
705+
as.bitbucketIDTokenValidator = bitbucket.NewIDTokenValidator()
714706
}
715707

716708
if as.createBoundKeypairValidator == nil {

‎lib/auth/join_azure.go‎

Lines changed: 20 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -34,17 +34,17 @@ import (
3434
"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
3535
armpolicy "github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/policy"
3636
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
37-
"github.com/coreos/go-oidc/v3/oidc"
3837
"github.com/digitorus/pkcs7"
3938
"github.com/go-jose/go-jose/v3/jwt"
4039
"github.com/gravitational/trace"
41-
"github.com/jonboulle/clockwork"
40+
"github.com/zitadel/oidc/v3/pkg/oidc"
4241

4342
"github.com/gravitational/teleport/api/client"
4443
"github.com/gravitational/teleport/api/client/proto"
4544
workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
4645
"github.com/gravitational/teleport/api/types"
4746
"github.com/gravitational/teleport/lib/cloud/azure"
47+
liboidc "github.com/gravitational/teleport/lib/oidc"
4848
"github.com/gravitational/teleport/lib/utils"
4949
)
5050

@@ -87,7 +87,7 @@ type attestedData struct {
8787
}
8888

8989
type accessTokenClaims struct {
90-
jwt.Claims
90+
oidc.TokenClaims
9191
TenantID string `json:"tid"`
9292
Version string `json:"ver"`
9393

@@ -107,18 +107,29 @@ type accessTokenClaims struct {
107107
AzureResourceID string `json:"xms_az_rid"`
108108
}
109109

110+
func (c *accessTokenClaims) AsJWTClaims() jwt.Claims {
111+
return jwt.Claims{
112+
Issuer: c.Issuer,
113+
Subject: c.Subject,
114+
Audience: jwt.Audience(c.Audience),
115+
Expiry: jwt.NewNumericDate(c.Expiration.AsTime()),
116+
NotBefore: jwt.NewNumericDate(c.NotBefore.AsTime()),
117+
IssuedAt: jwt.NewNumericDate(c.IssuedAt.AsTime()),
118+
ID: c.JWTID,
119+
}
120+
}
121+
110122
type azureVerifyTokenFunc func(ctx context.Context, rawIDToken string) (*accessTokenClaims, error)
111123

112124
type vmClientGetter func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error)
113125

114126
type azureRegisterConfig struct {
115-
clock clockwork.Clock
116127
certificateAuthorities []*x509.Certificate
117128
verify azureVerifyTokenFunc
118129
getVMClient vmClientGetter
119130
}
120131

121-
func azureVerifyFuncFromOIDCVerifier(cfg *oidc.Config) azureVerifyTokenFunc {
132+
func azureVerifyFuncFromOIDCVerifier(clientID string) azureVerifyTokenFunc {
122133
return func(ctx context.Context, rawIDToken string) (*accessTokenClaims, error) {
123134
token, err := jwt.ParseSigned(rawIDToken)
124135
if err != nil {
@@ -133,32 +144,13 @@ func azureVerifyFuncFromOIDCVerifier(cfg *oidc.Config) azureVerifyTokenFunc {
133144
if err != nil {
134145
return nil, trace.Wrap(err)
135146
}
136-
provider, err := oidc.NewProvider(ctx, issuer)
137-
if err != nil {
138-
return nil, trace.Wrap(err)
139-
}
140-
verifiedToken, err := provider.Verifier(cfg).Verify(ctx, rawIDToken)
141-
if err != nil {
142-
return nil, trace.Wrap(err)
143-
}
144-
var tokenClaims accessTokenClaims
145-
if err := verifiedToken.Claims(&tokenClaims); err != nil {
146-
return nil, trace.Wrap(err)
147-
}
148-
return &tokenClaims, nil
147+
return liboidc.ValidateToken[*accessTokenClaims](ctx, issuer, clientID, rawIDToken)
149148
}
150149
}
151150

152151
func (cfg *azureRegisterConfig) CheckAndSetDefaults(ctx context.Context) error {
153-
if cfg.clock == nil {
154-
cfg.clock = clockwork.NewRealClock()
155-
}
156152
if cfg.verify == nil {
157-
oidcConfig := &oidc.Config{
158-
ClientID: azureAccessTokenAudience,
159-
Now: cfg.clock.Now,
160-
}
161-
cfg.verify = azureVerifyFuncFromOIDCVerifier(oidcConfig)
153+
cfg.verify = azureVerifyFuncFromOIDCVerifier(azureAccessTokenAudience)
162154
}
163155

164156
if cfg.certificateAuthorities == nil {
@@ -278,7 +270,7 @@ func verifyVMIdentity(
278270
Time: requestStart,
279271
}
280272

281-
if err := tokenClaims.Validate(expectedClaims); err != nil {
273+
if err := tokenClaims.AsJWTClaims().Validate(expectedClaims); err != nil {
282274
return nil, trace.Wrap(err)
283275
}
284276

@@ -301,7 +293,7 @@ func verifyVMIdentity(
301293

302294
tokenCredential := azure.NewStaticCredential(azcore.AccessToken{
303295
Token: accessToken,
304-
ExpiresOn: tokenClaims.Expiry.Time(),
296+
ExpiresOn: tokenClaims.GetExpiration(),
305297
})
306298
vmClient, err := cfg.getVMClient(subscriptionID, tokenCredential)
307299
if err != nil {

‎lib/auth/join_azure_test.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
"github.com/google/uuid"
3535
"github.com/gravitational/trace"
3636
"github.com/stretchr/testify/require"
37+
"github.com/zitadel/oidc/v3/pkg/oidc"
3738

3839
"github.com/gravitational/teleport/api/client/proto"
3940
"github.com/gravitational/teleport/api/types"
@@ -144,14 +145,14 @@ func makeToken(managedIdentityResourceID, azureResourceID string, issueTime time
144145
return "", trace.Wrap(err)
145146
}
146147
claims := accessTokenClaims{
147-
Claims: jwt.Claims{
148-
Issuer: "https://sts.windows.net/test-tenant-id/",
149-
Audience: []string{azureAccessTokenAudience},
150-
Subject: "test",
151-
IssuedAt: jwt.NewNumericDate(issueTime),
152-
NotBefore: jwt.NewNumericDate(issueTime),
153-
Expiry: jwt.NewNumericDate(issueTime.Add(time.Minute)),
154-
ID: "id",
148+
TokenClaims: oidc.TokenClaims{
149+
Issuer: "https://sts.windows.net/test-tenant-id/",
150+
Audience: []string{azureAccessTokenAudience},
151+
Subject: "test",
152+
IssuedAt: oidc.FromTime(issueTime),
153+
NotBefore: oidc.FromTime(issueTime),
154+
Expiration: oidc.FromTime(issueTime.Add(time.Minute)),
155+
JWTID: "id",
155156
},
156157
ManangedIdentityResourceID: managedIdentityResourceID,
157158
AzureResourceID: azureResourceID,

0 commit comments

Comments
 (0)