Support nonce and acr with OIDC + Tests #883

fflorent · 2024-03-06T10:49:43Z

Context

Some Identity provider don't support PKCE and instead impose Nonce;
They also may impose passing some ACR values;
And require to pass the state and the idToken in the logout

Proposed solution

Introduce the GRIST_OIDC_IDP_ENABLED_PROTECTIONS variable who can contain comma-separated values with either: STATE, NONCE and PKCE, and defaults to STATE,PKCE;
Introduce the GRIST_OIDC_IDP_ACR_VALUES variable with space separated values;
Once logged in (after the callback), store the state and the idToken for the logout, and clear any other values;
Introduce unit tests with mocks;
Also redirect to the error page when something went wrong while signing in;

fflorent · 2024-03-19T09:03:30Z

app/server/lib/OIDCConfig.ts

+ post_logout_redirect_uri: redirectUrl.href,
+ state: mreq.session.oidc?.state,
+ id_token_hint: mreq.session.oidc?.idToken,
+ });


Note to the reviewers: I don't clear either the state or the idToken from the session in this method, as I feel like it's more secure to secure the logout if the first attempt fails (the following attempts may succeed).

This makes sense, but I can't see where this info is cleaned up. Can you point me to that?

fflorent · 2024-03-19T11:23:40Z

Opening the PR for checking whether the tests work in the CI

SleepyLeslie

Thanks @fflorent for the work. I left some thoughts. I am new to these security features so I had to learn before commenting - sorry for the delay!
Also, feel free to point out any mistakes I make and any misunderstandings I have - I've just joined Grist Labs last week and I'm still largely unfamiliar with this codebase.

app/client/ui/errorPages.ts

app/server/lib/FlexServer.ts

SleepyLeslie · 2024-05-23T18:48:34Z

app/server/lib/OIDCConfig.ts

+ .omitBy(_.isFunction)
+ .mapValues((value, key) => {
+ const showValueInClear = ['token_type', 'expires_in', 'expires_at', 'scope'].includes(key);
+ return showValueInClear ? value : 'REDACTED';


Why not just show these 4 values?

These four values are the only ones that are displayed (they are whitelisted, not blacklisted).

I prefer removing any other field as they might contain sensible data.

SleepyLeslie · 2024-05-24T01:19:17Z

app/server/lib/OIDCConfig.ts

 res.redirect(targetUrl ?? '/');
 } catch (err) {
 log.error(`OIDC callback failed: ${err.stack}`);
+ if (Object.prototype.hasOwnProperty.call(err, 'response')) {
+ log.error(`Response received: ${err.response?.body ?? err.response}`);
+ }
 // Delete the session data even if the login failed.
 // This way, we prevent several login attempts.
 //
 // Also session deletion must be done before sending the response.
 delete mreq.session.oidc;


Comments here should be updated. It's no longer "even if the login failed" - if I understand correctly, OIDC-related session data now needs to be preserved until logout if login succeeds.
I don't quite understand the "we prevent several login attempts" part - can you explain that a bit more?

app/server/lib/OIDCConfig.ts

test/server/lib/OIDCConfig.ts

SleepyLeslie · 2024-05-24T15:20:42Z

test/server/lib/OIDCConfig.ts

+ const promise = OIDCConfigStubbed.buildWithStub(client.asClient());
+ if (ctx.errorMsg) {
+ await assert.isRejected(promise, ctx.errorMsg);
+ assert.isFalse(logInfoStub.calledOnce);


Is this test making sure log.info(`OIDCConfig: initialized with issuer ${issuerUrl}`) wasn't called?

You're right!

test/server/lib/OIDCConfig.ts

SleepyLeslie · 2024-05-24T15:47:40Z

test/server/lib/OIDCConfig.ts

+ }
+ },
+ expectedErrorMsg: /Login is stale/,
+ },


Maybe it's helpful for long-term maintenance to explicitly specify GRIST_OIDC_IDP_ENABLED_PROTECTIONS here?

I've added something, I hope I understood correctly what you suggested

test/server/lib/OIDCConfig.ts

SleepyLeslie · 2024-05-24T18:49:43Z

* Some Identity provider don't support PKCE and instead impose Nonce;
* They also may impose passing some ACR values;
* And require to pass the state and the idToken in the logout

By the way, can you provide some examples for these IdPs?

fflorent force-pushed the support-nonce-and-acr-with-oidc branch 3 times, most recently from e78e2f3 to 8b90c90 Compare March 7, 2024 10:59

fflorent commented Mar 19, 2024

View reviewed changes

fflorent marked this pull request as ready for review March 19, 2024 11:23

fflorent changed the title ~~Support nonce and acr with OIDC + Tests~~ [Draft] Support nonce and acr with OIDC + Tests Mar 19, 2024

fflorent force-pushed the support-nonce-and-acr-with-oidc branch 21 times, most recently from 56706b3 to 1bf114a Compare March 21, 2024 06:49

fflorent changed the title ~~[Draft] Support nonce and acr with OIDC + Tests~~ Support nonce and acr with OIDC + Tests Mar 21, 2024

fflorent requested a review from CamilleLegeron March 21, 2024 18:24

SleepyLeslie requested changes May 24, 2024

View reviewed changes

fflorent added 26 commits May 29, 2024 09:38

First unit test for OIDCConfig

b06b6ce

WIP

915ee17

WIP

193cd19

WIP

093ae21

More tests

2887f5e

More tests, finish implementation

6315543

Test getLogoutRedirectUrl

afdde49

Minor changes

d8d14e9

WIP: LoginWithOIDC

5a6a7f4

Log err.response if present

2439e9f

Add support for extra OIDC client metadata

5138126

Log userinfo in debug and check passed info in endSessionUrl

be4a173

Many other stuffs + cleanup + working version with Agent Connect

1adfb04

WIP: integration tests

abc26cc

Improve formatTokenForLogs + format file

735ef21

Selenium tests working

e57b7d5

Fix CI?

26fb2d6

Tests with keycloak are not in test:server

7935028

Fix CI ? + Skip in LoginWithOIDC

da4a909

Remove health-checks for keycloak, curl being not avaible in container

29f9b53

Attempt fix using docker-run-action

5ed2ec2

Remove integration tests (for now)

cc57a11

Add friendly page for login failure

df42177

Fix bad indentation

b18c6e4

PR remark

a62a29e

Fix after rebase

085ce57

fflorent force-pushed the support-nonce-and-acr-with-oidc branch from a992efa to 085ce57 Compare May 29, 2024 07:43

PR remarks

bb81a2a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support nonce and acr with OIDC + Tests #883

Support nonce and acr with OIDC + Tests #883

fflorent commented Mar 6, 2024 •

edited

fflorent Mar 19, 2024 •

edited

SleepyLeslie May 24, 2024

fflorent commented Mar 19, 2024

SleepyLeslie left a comment

SleepyLeslie May 23, 2024

fflorent May 29, 2024

SleepyLeslie May 24, 2024

SleepyLeslie May 24, 2024

fflorent May 29, 2024

SleepyLeslie May 24, 2024

fflorent May 30, 2024

SleepyLeslie commented May 24, 2024 •

edited

Support nonce and acr with OIDC + Tests #883

Are you sure you want to change the base?

Support nonce and acr with OIDC + Tests #883

Conversation

fflorent commented Mar 6, 2024 • edited

Context

Proposed solution

fflorent Mar 19, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fflorent commented Mar 19, 2024

SleepyLeslie left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SleepyLeslie commented May 24, 2024 • edited

fflorent commented Mar 6, 2024 •

edited

fflorent Mar 19, 2024 •

edited

SleepyLeslie commented May 24, 2024 •

edited