feat: OAuth 2.0 Device Authorization Grant #2416

client/registry.go

@@ -8,6 +8,7 @@ import (
 
  "github.com/ory/fosite"
  foauth2 "github.com/ory/fosite/handler/oauth2"
+ "github.com/ory/fosite/handler/rfc8628"
  "github.com/ory/hydra/v2/jwk"
  "github.com/ory/hydra/v2/x"
 )
@@ -23,5 +24,6 @@ type Registry interface {
  ClientHasher() fosite.Hasher
  OpenIDJWTStrategy() jwk.JWTSigner
  OAuth2HMACStrategy() *foauth2.HMACSHAStrategy
+ RFC8628HMACStrategy() rfc8628.RFC8628CodeStrategy
  config.Provider
 }

consent/handler.go

@@ -37,6 +37,7 @@ const (
  LoginPath = "/oauth2/auth/requests/login"
  ConsentPath = "/oauth2/auth/requests/consent"
  LogoutPath = "/oauth2/auth/requests/logout"
+ DevicePath = "/oauth2/auth/requests/device"
  SessionsPath = "/oauth2/auth/sessions"
 )
 
@@ -66,6 +67,8 @@ func (h *Handler) SetRoutes(admin *httprouterx.RouterAdmin) {
  admin.GET(LogoutPath, h.getOAuth2LogoutRequest)
  admin.PUT(LogoutPath+"/accept", h.acceptOAuth2LogoutRequest)
  admin.PUT(LogoutPath+"/reject", h.rejectOAuth2LogoutRequest)
+
+ admin.PUT(DevicePath+"/verify", h.verifyUserCodeRequest)
 }
 
 // Revoke OAuth 2.0 Consent Session Parameters
@@ -1037,3 +1040,90 @@ func (h *Handler) getOAuth2LogoutRequest(w http.ResponseWriter, r *http.Request,
 
  h.r.Writer().Write(w, r, request)
 }
+
+// Verify OAuth 2.0 User Code Request
+//
+// swagger:parameters verifyUserCodeRequest
+type verifyUserCodeRequest struct {
+ // in: query
+ // required: true
+ Challenge string `json:"device_challenge"`
+
+ // in: body
+ Body flow.DeviceGrantVerifyUserCodeRequest
+}
+
+// swagger:route PUT /admin/oauth2/auth/requests/device/verify oAuth2 verifyUserCodeRequest
+//
+// # Verifies a device grant request
+//
+// Verifies a device grant request
+//
+// Consumes:
+// - application/json
+//
+// Produces:
+// - application/json
+//
+// Schemes: http, https
+//
+// Responses:
+// 200: oAuth2RedirectTo
+// default: errorOAuth2
+func (h *Handler) verifyUserCodeRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+ challenge := stringsx.Coalesce(
+ r.URL.Query().Get("device_challenge"),
+ r.URL.Query().Get("challenge"),
+ )
+ if challenge == "" {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint(`Query parameter 'challenge' is not defined but should have been.`)))
+ return
+ }
+
+ var p flow.DeviceGrantVerifyUserCodeRequest
+ d := json.NewDecoder(r.Body)
+ d.DisallowUnknownFields()
+ if err := d.Decode(&p); err != nil {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithWrap(err).WithHintf("Unable to decode body because: %s", err)))
+ return
+ }
+
+ if p.UserCode == "" {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrInvalidRequest.WithHint("Field 'user_code' must not be empty.")))
+ return
+ }
+
+ userCodeSignature, err := h.r.RFC8628HMACStrategy().UserCodeSignature(r.Context(), p.UserCode)
+ if err != nil {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`'user_code' signature could not be computed`)))
+ return
+ }
+ userCodeRequest, err := h.r.OAuth2Storage().GetUserCodeSession(r.Context(), userCodeSignature, &fosite.DefaultSession{})
+ if err != nil {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrNotFound.WithWrap(err).WithHint(`'user_code' session not found`)))
+ return
+ }
+
+ clientId := userCodeRequest.GetClient().GetID()
+ // UserCode & DeviceCode Request shares the same RequestId as it's the same request;
+ deviceRequestId := userCodeRequest.GetID()
+ requestedScopes := userCodeRequest.GetRequestedScopes()
+ requestedAudience := userCodeRequest.GetRequestedAudience()
+
+ err = h.r.OAuth2Storage().InvalidateUserCodeSession(r.Context(), userCodeSignature)
+ if err != nil {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`Could not invalidate 'user_code'`)))
+ return
+ }
+
+ // req.GetID() is actually the DeviceCodeSignature
+ grantRequest, err := h.r.ConsentManager().AcceptDeviceGrantRequest(r.Context(), challenge, deviceRequestId, clientId, requestedScopes, requestedAudience)
+ if err != nil {
+ h.r.Writer().WriteError(w, r, errorsx.WithStack(fosite.ErrServerError.WithWrap(err).WithHint(`Could not accept device grant request`)))
+ return
+ }
+
+ h.r.Writer().Write(w, r, &flow.OAuth2RedirectTo{
+ RedirectTo: urlx.SetQuery(h.c.OAuth2DeviceAuthorisationURL(r.Context()), url.Values{"device_verifier": {grantRequest.Verifier}, "client_id": {clientId}}).String(),
+ })
+}

consent/helper.go

@@ -9,7 +9,7 @@ import (
  "github.com/ory/hydra/v2/flow"
 )
 
-func sanitizeClientFromRequest(ar fosite.AuthorizeRequester) *client.Client {
+func sanitizeClientFromRequest(ar fosite.Requester) *client.Client {
  return sanitizeClient(ar.GetClient().(*client.Client))
 }
 

consent/manager.go

@@ -8,6 +8,7 @@ import (
 
  "github.com/gofrs/uuid"
 
+ "github.com/ory/fosite"
  "github.com/ory/hydra/v2/client"
  "github.com/ory/hydra/v2/flow"
 )
@@ -60,6 +61,11 @@ type (
  AcceptLogoutRequest(ctx context.Context, challenge string) (*flow.LogoutRequest, error)
  RejectLogoutRequest(ctx context.Context, challenge string) error
  VerifyAndInvalidateLogoutRequest(ctx context.Context, verifier string) (*flow.LogoutRequest, error)
+
+ CreateDeviceGrantRequest(ctx context.Context, req *flow.DeviceGrantRequest) error
+ GetDeviceGrantRequestByVerifier(ctx context.Context, verifier string) (*flow.DeviceGrantRequest, error)
+ AcceptDeviceGrantRequest(ctx context.Context, challenge string, device_code_signature string, clientId string, requested_scopes fosite.Arguments, requested_aud fosite.Arguments) (*flow.DeviceGrantRequest, error)
+ VerifyAndInvalidateDeviceGrantRequest(ctx context.Context, verifier string) (*flow.DeviceGrantRequest, error)
  }
 
  ManagerProvider interface {

consent/strategy.go

@@ -20,6 +20,12 @@ type Strategy interface {
  r *http.Request,
  req fosite.AuthorizeRequester,
  ) (*flow.AcceptOAuth2ConsentRequest, *flow.Flow, error)
+ HandleOAuth2DeviceAuthorizationRequest(
+ ctx context.Context,
+ w http.ResponseWriter,
+ r *http.Request,
+ req fosite.DeviceUserRequester,
+ ) (*flow.AcceptOAuth2ConsentRequest, *flow.Flow, error)
  HandleOpenIDConnectLogout(ctx context.Context, w http.ResponseWriter, r *http.Request) (*flow.LogoutResult, error)
  HandleHeadlessLogout(ctx context.Context, w http.ResponseWriter, r *http.Request, sid string) error
  ObfuscateSubjectIdentifier(ctx context.Context, cl fosite.Client, subject, forcedIdentifier string) (string, error)