WIP

Author: tiagomlalves

common/pom.xml

@@ -154,6 +154,10 @@
       <artifactId>spotbugs-annotations</artifactId>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>oauth2-oidc-sdk</artifactId>
+    </dependency>
   </dependencies>
   <build>
     <plugins>

common/src/main/java/com/datastax/oss/common/sink/state/LifeCycleManager.java

@@ -31,6 +31,7 @@
 import static com.datastax.oss.driver.api.core.config.DefaultDriverOption.SSL_TRUSTSTORE_PATH;
 
 import com.codahale.metrics.MetricRegistry;
+import com.datastax.db.driver.api.plugin.auth.OIDCAuthProvider;
 import com.datastax.dse.driver.api.core.config.DseDriverOption;
 import com.datastax.dse.driver.internal.core.auth.DseGssApiAuthProvider;
 import com.datastax.oss.common.sink.AbstractSinkTask;
@@ -66,17 +67,36 @@
 import com.datastax.oss.driver.shaded.guava.common.annotations.VisibleForTesting;
 import com.datastax.oss.driver.shaded.guava.common.collect.ImmutableMap;
 import com.datastax.oss.dsbulk.codecs.api.ConvertingCodecFactory;
+import com.nimbusds.oauth2.sdk.AccessTokenResponse;
+import com.nimbusds.oauth2.sdk.ClientCredentialsGrant;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.TokenErrorResponse;
+import com.nimbusds.oauth2.sdk.TokenRequest;
+import com.nimbusds.oauth2.sdk.TokenResponse;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
+import com.nimbusds.oauth2.sdk.auth.ClientSecretBasic;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.token.AccessToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponseParser;
 import com.typesafe.config.Config;
 import com.typesafe.config.ConfigFactory;
 import edu.umd.cs.findbugs.annotations.NonNull;
 import edu.umd.cs.findbugs.annotations.Nullable;
+
+import java.io.IOException;
 import java.net.InetSocketAddress;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.file.Path;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionException;
 import java.util.concurrent.CompletionStage;
@@ -621,6 +641,42 @@ private static void processAuthenticatorConfig(
               AUTH_PROVIDER_SASL_PROPERTIES, ImmutableMap.of("javax.security.sasl.qop", "auth"))
           .withStringMap(DseDriverOption.AUTH_PROVIDER_LOGIN_CONFIGURATION, loginConfig);
     } else if (authConfig.getProvider() == AuthenticatorConfig.Provider.OIDC) {
+      ClientCredentialsGrant grant = new ClientCredentialsGrant();
+
+      ClientID clientID = new ClientID(config.getAuthenticatorConfig().getOIDCClientId());
+      Secret clientSecret = new Secret(config.getAuthenticatorConfig().getOIDCClientSecret());
+
+      ClientAuthentication clientAuth = new ClientSecretBasic(clientID, clientSecret);
+
+      URI tokenEndpoint = config.getAuthenticatorConfig().getOIDCIssuer();
+      TokenRequest request = new TokenRequest(tokenEndpoint, clientAuth, grant, null);
+
+      TokenResponse tokenResponse;
+      try
+      {
+        tokenResponse = OIDCTokenResponseParser.parse(request.toHTTPRequest().send());
+      }
+      catch (ParseException e) {
+        throw new RuntimeException("Failed OIDC request parsing: " + e.getMessage());
+      }
+      catch (IOException e) {
+        throw new RuntimeException("Failed OIDC request: " + e.getMessage());
+      }
+
+      if (!tokenResponse.indicatesSuccess()) {
+        // We got an error response...
+        TokenErrorResponse errorResponse = tokenResponse.toErrorResponse();
+        throw new RuntimeException("Failed OIDC token response:" + errorResponse.toString());
+      }
+
+      AccessTokenResponse successResponse = tokenResponse.toSuccessResponse();
+
+      AccessToken accessToken = successResponse.getTokens().getAccessToken();
+      // RefreshToken refreshToken = successResponse.getTokens().getRefreshToken();
+
+      OIDCAuthProvider authProvider = new OIDCAuthProvider(accessToken.getValue());
+
+      configLoaderBuilder.withClass(AUTH_PROVIDER_CLASS, OIDCAuthProvider.class);
       /*
       TODO: OidcApiAuthProvider.
         configLoaderBuilder

pom.xml

@@ -62,6 +62,7 @@
     <snappy.version>1.1.7.2</snappy.version>
     <jackson.version>2.10.0</jackson.version>
     <jackson-databind.version>2.10.0</jackson-databind.version>
+    <nimbus.oidc-sdk.version>11.26</nimbus.oidc-sdk.version>
   </properties>
   <dependencyManagement>
     <dependencies>
@@ -201,6 +202,11 @@
         <artifactId>spotbugs-annotations</artifactId>
         <version>3.1.12</version>
       </dependency>
+      <dependency>
+        <groupId>com.nimbusds</groupId>
+        <artifactId>oauth2-oidc-sdk</artifactId>
+        <version>${nimbus.oidc-sdk.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   <build>