tls_client_auth (#7)

Author: mbilski

README.md

@@ -148,7 +148,7 @@ oauth2c https://oauth2c.us.authz.cloudentity.io/oauth2c/demo \
   --grant-type urn:ietf:params:oauth:grant-type:jwt-bearer \
   --auth-method client_secret_basic \
   --scopes email \
-  --signing-key https://pastebin.com/raw/WMkzhjhm \
+  --signing-key https://raw.githubusercontent.com/cloudentity/oauth2c/master/data/key.json \
   --assertion '{"sub":"[email protected]"}'
 ```
 
@@ -192,8 +192,20 @@ oauth2c https://oauth2c.us.authz.cloudentity.io/oauth2c/demo \
 ``` sh
 oauth2c https://oauth2c.us.authz.cloudentity.io/oauth2c/demo \
   --client-id 582af0afb0d74554aa7af47849edb222 \
-  --signing-key https://pastebin.com/raw/WMkzhjhm \
+  --signing-key https://raw.githubusercontent.com/cloudentity/oauth2c/master/data/key.json \
   --grant-type client_credentials \
   --auth-method private_key_jwt \
   --scopes introspect_tokens,revoke_tokens
 ```
+
+### TLS Client Auth
+
+``` sh
+oauth2c https://oauth2c.us.authz.cloudentity.io/oauth2c/demo \
+  --client-id 3f07a8c2adea4c1ab353f3ca8e16b8fd \
+  --tls-cert https://raw.githubusercontent.com/cloudentity/oauth2c/master/data/cert.pem \
+  --tls-key https://raw.githubusercontent.com/cloudentity/oauth2c/master/data/key.pem \
+  --grant-type client_credentials \
+  --auth-method tls_client_auth \
+  --scopes introspect_tokens,revoke_tokens
+```

cmd/log.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/cloudentity/oauth2c/internal/oauth2"
 	"github.com/golang-jwt/jwt"
+	"github.com/grantae/certinfo"
 	"github.com/pterm/pterm"
 	"github.com/tidwall/pretty"
 )
@@ -60,6 +61,13 @@ func LogRequest(r oauth2.Request) {
 	for k, vs := range r.Form {
 		pterm.Println(pterm.FgLightBlue.Sprintf("  %s: ", k) + strings.Join(vs, ", "))
 	}
+
+	if r.Cert != nil {
+		if info, err := certinfo.CertificateText(r.Cert); err == nil {
+			pterm.Println()
+			pterm.FgGray.Println(info)
+		}
+	}
 }
 
 func LogRequestln(request oauth2.Request) {

cmd/oauth2.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/cloudentity/oauth2c/internal/oauth2"
 	"github.com/golang-jwt/jwt"
@@ -40,6 +41,9 @@ func init() {
 	OAuth2Cmd.PersistentFlags().BoolVar(&cconfig.NoPKCE, "no-pkce", false, "disable proof key for code exchange (PKCE)")
 	OAuth2Cmd.PersistentFlags().StringVar(&cconfig.Assertion, "assertion", "", "claims for jwt bearer assertion (standard claims such as iss, aud, iat, exp, jti are automatically generated)")
 	OAuth2Cmd.PersistentFlags().StringVar(&cconfig.SigningKey, "signing-key", "", "path or url to signing key in jwks format")
+	OAuth2Cmd.PersistentFlags().StringVar(&cconfig.TLSCert, "tls-cert", "", "path to tls cert pem file")
+	OAuth2Cmd.PersistentFlags().StringVar(&cconfig.TLSKey, "tls-key", "", "path to tls key pem file")
+	OAuth2Cmd.PersistentFlags().StringVar(&cconfig.TLSRootCA, "tls-root-ca", "", "path to tls root ca pem file")
 	OAuth2Cmd.PersistentFlags().BoolVar(&cconfig.Insecure, "insecure", false, "allow insecure connections")
 }
 
@@ -51,6 +55,7 @@ var OAuth2Cmd = &cobra.Command{
 		var (
 			config Config
 			data   []byte
+			cert   tls.Certificate
 			err    error
 		)
 
@@ -68,14 +73,31 @@ var OAuth2Cmd = &cobra.Command{
 			cconfig.IssuerURL = strings.TrimSuffix(args[0], oauth2.OpenIDConfigurationPath)
 		}
 
-		hc := &http.Client{
-			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{
-					InsecureSkipVerify: cconfig.Insecure,
-				},
+		tr := &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: cconfig.Insecure,
+				MinVersion:         tls.VersionTLS12,
 			},
 		}
 
+		hc := &http.Client{Timeout: 10 * time.Second, Transport: tr}
+
+		if cconfig.TLSCert != "" && cconfig.TLSKey != "" {
+			if cert, err = oauth2.ReadKeyPair(cconfig.TLSCert, cconfig.TLSKey, hc); err != nil {
+				pterm.Error.PrintOnError(err)
+				os.Exit(1)
+			}
+
+			tr.TLSClientConfig.Certificates = []tls.Certificate{cert}
+		}
+
+		if cconfig.TLSRootCA != "" {
+			if tr.TLSClientConfig.RootCAs, err = oauth2.ReadRootCA(cconfig.TLSRootCA, hc); err != nil {
+				pterm.Error.PrintOnError(err)
+				os.Exit(1)
+			}
+		}
+
 		if err := Authorize(cconfig, hc); err != nil {
 			var oauth2Error *oauth2.Error
 

go.mod

@@ -5,6 +5,7 @@ go 1.19
 require (
 	github.com/go-jose/go-jose/v3 v3.0.0
 	github.com/golang-jwt/jwt v3.2.2+incompatible
+	github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b
 	github.com/imdario/mergo v0.3.13
 	github.com/lithammer/shortuuid/v4 v4.0.0
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8

go.sum

@@ -28,6 +28,8 @@ github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/gookit/color v1.4.2/go.mod h1:fqRyamkC1W8uxl+lxCQxOT09l/vYfZ+QeiX3rKQHCoQ=
 github.com/gookit/color v1.5.0 h1:1Opow3+BWDwqor78DcJkJCIwnkviFi+rrOANki9BUFw=
 github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo=
+github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b h1:NGgE5ELokSf2tZ/bydyDUKrvd/jP8lrAoPNeBuMOTOk=
+github.com/grantae/certinfo v0.0.0-20170412194111-59d56a35515b/go.mod h1:zT/uzhdQGTqlwTq7Lpbj3JoJQWfPfIJ1tE0OidAmih8=
 github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
 github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=

internal/oauth2/oauth2.go

@@ -3,6 +3,7 @@ package oauth2
 import (
 	"context"
 	"crypto/sha256"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -38,9 +39,8 @@ const (
 	ClientSecretPostAuthMethod  string = "client_secret_post"
 	ClientSecretJwtAuthMethod   string = "client_secret_jwt"
 	PrivateKeyJwtAuthMethod     string = "private_key_jwt"
-	// SelfSignedTLSAuthMethod     string = "self_signed_tls_client_auth"
-	// TLSClientAuthMethod         string = "tls_client_auth"
-	// NoneAuthMethod              string = "none"
+	SelfSignedTLSAuthMethod     string = "self_signed_tls_client_auth"
+	TLSClientAuthMethod         string = "tls_client_auth"
 )
 
 // client assertion types
@@ -69,6 +69,9 @@ type ClientConfig struct {
 	RefreshToken string
 	Assertion    string
 	SigningKey   string
+	TLSCert      string
+	TLSKey       string
+	TLSRootCA    string
 }
 
 func RequestAuthorization(addr string, cconfig ClientConfig, sconfig ServerConfig) (r Request, codeVerifier string, err error) {
@@ -233,10 +236,11 @@ func RequestToken(
 	opts ...RequestTokenOption,
 ) (request Request, response TokenResponse, err error) {
 	var (
-		req    *http.Request
-		resp   *http.Response
-		params RequestTokenParams
-		body   []byte
+		req      *http.Request
+		resp     *http.Response
+		params   RequestTokenParams
+		endpoint = sconfig.TokenEndpoint
+		body     []byte
 	)
 
 	for _, opt := range opts {
@@ -299,6 +303,15 @@ func RequestToken(
 
 		request.Form.Set("client_assertion_type", JwtBearerClientAssertion)
 		request.Form.Set("client_assertion", clientAssertion)
+	case TLSClientAuthMethod, SelfSignedTLSAuthMethod:
+		endpoint = sconfig.MTLsEndpointAliases.TokenEndpoint
+		request.Form.Set("client_id", cconfig.ClientID)
+
+		if tr, ok := hc.Transport.(*http.Transport); ok {
+			if len(tr.TLSClientConfig.Certificates) > 0 {
+				request.Cert, _ = x509.ParseCertificate(tr.TLSClientConfig.Certificates[0].Certificate[0])
+			}
+		}
 	}
 
 	if params.RedirectURL != "" {
@@ -316,7 +329,7 @@ func RequestToken(
 	if req, err = http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		sconfig.TokenEndpoint,
+		endpoint,
 		strings.NewReader(request.Form.Encode()),
 	); err != nil {
 		return request, response, err

internal/oauth2/signing_test.go

@@ -12,14 +12,14 @@ import (
 )
 
 func TestReadKey(t *testing.T) {
-	key, err := oauth2.ReadKey("./testdata/jwks-private.json", http.DefaultClient)
+	key, err := oauth2.ReadKey("../../data/key.json", http.DefaultClient)
 	require.NoError(t, err)
 
 	require.NotNil(t, key)
 }
 
 func TestSignJWT(t *testing.T) {
-	key, err := oauth2.ReadKey("./testdata/jwks-private.json", http.DefaultClient)
+	key, err := oauth2.ReadKey("../../data/key.json", http.DefaultClient)
 	require.NoError(t, err)
 
 	claims := oauth2.AssertionClaims(
@@ -33,7 +33,7 @@ func TestSignJWT(t *testing.T) {
 	)
 
 	jwt, _, err := oauth2.SignJWT(claims, oauth2.JWKSigner(oauth2.ClientConfig{
-		SigningKey: "./testdata/jwks-private.json",
+		SigningKey: "../../data/key.json",
 	}, http.DefaultClient))
 	require.NoError(t, err)
 

internal/oauth2/testdata/jwks-private.json

@@ -0,0 +1,73 @@
+package oauth2
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+)
+
+func ReadURL(location string, hc *http.Client) (data []byte, err error) {
+	var resp *http.Response
+
+	if resp, err = hc.Get(location); err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if data, err = io.ReadAll(resp.Body); err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to read data from url %d: %s", resp.StatusCode, string(data))
+	}
+
+	return data, nil
+}
+
+func ReadKeyPair(cert string, key string, hc *http.Client) (keyPair tls.Certificate, err error) {
+	if strings.HasPrefix(cert, "http") && strings.HasPrefix(key, "http") {
+		var (
+			certPEM []byte
+			keyPEM  []byte
+		)
+
+		if certPEM, err = ReadURL(cert, hc); err != nil {
+			return tls.Certificate{}, err
+		}
+
+		if keyPEM, err = ReadURL(key, hc); err != nil {
+			return tls.Certificate{}, err
+		}
+
+		return tls.X509KeyPair(certPEM, keyPEM)
+	}
+
+	return tls.LoadX509KeyPair(cert, key)
+}
+
+func ReadRootCA(location string, hc *http.Client) (pool *x509.CertPool, err error) {
+	var rootCA []byte
+
+	if pool, err = x509.SystemCertPool(); err != nil {
+		return nil, err
+	}
+
+	if strings.HasPrefix(location, "http") {
+		if rootCA, err = ReadURL(location, hc); err != nil {
+			return nil, err
+		}
+	} else {
+		if rootCA, err = os.ReadFile(location); err != nil {
+			return nil, err
+		}
+	}
+
+	pool.AppendCertsFromPEM(rootCA)
+
+	return pool, nil
+}

internal/oauth2/tls.go

@@ -1,13 +1,17 @@
 package oauth2
 
-import "net/url"
+import (
+	"crypto/x509"
+	"net/url"
+)
 
 type Request struct {
 	Method  string
 	URL     *url.URL
 	Headers map[string][]string
 	Form    url.Values
 	Key     interface{}
+	Cert    *x509.Certificate
 }
 
 func (r *Request) Get(key string) string {