First commit to support opaque tokens for idp scenarios

Author: MarcialRosales

deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl

@@ -9,6 +9,7 @@
 
 -export([init/2]).
 -include("rabbit_mgmt.hrl").
+-include_lib("kernel/include/logger.hrl").
 
 %%--------------------------------------------------------------------
 
@@ -37,10 +38,28 @@ set_token_auth(AuthSettings, Req0) ->
         true ->
             case cowboy_req:parse_header(<<"authorization">>, Req0) of
                 {bearer, Token} -> 
-                    {
-                        Req0, 
-                        ["set_token_auth('", Token, "');"]
-                    };
+                    case oauth2_client:is_jwt_token(Token) of 
+                        true -> 
+                            {
+                                Req0, 
+                                ["set_token_auth('", Token, "');"]
+                            };
+                        false -> 
+                            case oauth2_client:introspect_token(Token) of
+                                {ok, Tk1} -> 
+                                    ?LOG_DEBUG("Successfully introspected token : ~p", [Tk1]),
+                                    {
+                                        Req0, 
+                                        ["set_token_auth('", Tk1, "');"]
+                                    };
+                                {error, Err1} -> 
+                                    ?LOG_ERROR("Failed to introspected token due to ~p", [Err1]),
+                                    {
+                                        Req0, 
+                                        []
+                                    }
+                            end      
+                    end;
                 _ -> 
                     Cookies = cowboy_req:parse_cookies(Req0),
                     case lists:keyfind(?OAUTH2_ACCESS_TOKEN_COOKIE_NAME, 1, Cookies) of 

deps/rabbitmq_management/test/rabbit_mgmt_wm_auth_SUITE.erl

@@ -54,7 +54,8 @@ groups() ->
         {verify_introspection_endpoint, [], [
           introspect_opaque_token_returns_active_jwt_token,
           introspect_opaque_token_returns_inactive_jwt_token,
-          introspect_opaque_token_returns_401_from_auth_server
+          introspect_opaque_token_returns_401_from_auth_server,
+          idp_introspect_opaque_token
         ]}        
       ]},
       {verify_multi_resource_and_provider, [], [
@@ -697,7 +698,9 @@ end_per_group(_, Config) ->
 
 init_per_testcase(Testcase, Config) when Testcase =:= introspect_opaque_token_returns_active_jwt_token orelse
                                          Testcase =:= introspect_opaque_token_returns_inactive_jwt_token orelse 
-                                         Testcase =:= introspect_opaque_token_returns_401_from_auth_server ->
+                                         Testcase =:= introspect_opaque_token_returns_401_from_auth_server orelse 
+                                         Testcase =:= idp_introspect_opaque_token ->
+
   ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, set_env,
     [rabbitmq_auth_backend_oauth2, introspection_endpoint,
       ?config(authorization_server_url, Config)]),
@@ -721,7 +724,8 @@ init_per_testcase(Testcase, Config) ->
 
 end_per_testcase(Testcase, Config) when Testcase =:= introspect_opaque_token_returns_active_jwt_token orelse
                                         Testcase =:= introspect_opaque_token_returns_inactive_jwt_token orelse 
-                                        Testcase =:= introspect_opaque_token_returns_401_from_auth_server ->
+                                        Testcase =:= introspect_opaque_token_returns_401_from_auth_server orelse
+                                        Testcase =:= idp_introspect_opaque_token ->
   ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, unset_env,
     [rabbitmq_auth_backend_oauth2, introspection_endpoint]),
   ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, unset_env,
@@ -958,22 +962,24 @@ should_return_mgt_oauth_resource_a_with_token_endpoint_params_1(Config) ->
 
 introspect_opaque_token_returns_active_jwt_token(Config) -> 
   {ok, {{_HTTP, 200, _}, _Headers, ResBody}} = req(Config, 0, post, "/auth/introspect", [
-    {"authorization", "bearer active"}], []),
-  
-  Split = binary:split(rabbit_data_coercion:to_binary(ResBody), <<".">>),
-  ct:log("split: ~p", [Split]).
+    {"authorization", "bearer active"}], []).
 
 introspect_opaque_token_returns_inactive_jwt_token(Config) -> 
   {ok, {{_HTTP, 401, _}, _Headers, ResBody}} = req(Config, 0, post, "/auth/introspect", [
     {"authorization", "bearer inactive"}], []),
-   JSON = rabbit_json:decode(rabbit_data_coercion:to_binary(ResBody)),
+  JSON = rabbit_json:decode(rabbit_data_coercion:to_binary(ResBody)),
   ?assertEqual(<<"not_authorised">>, maps:get(<<"error">>, JSON)),
   ?assertEqual(<<"Introspected token is not active">>, maps:get(<<"reason">>, JSON)).
 
 introspect_opaque_token_returns_401_from_auth_server(Config) -> 
   {ok, {{_HTTP, 401, _}, _Headers, _ResBody}} = req(Config, 0, post, "/auth/introspect", [
     {"authorization", "bearer 401"}], []).
 
+idp_introspect_opaque_token(Config) ->
+  URI = rabbit_mgmt_test_util:uri_base_from(Config, 0, "") ++ "js/oidc-oauth/bootstrap.js",
+  Result = httpc:request(get, {URI, [{"Authorization", "bearer active"}]}, [], []), 
+  ct:log("response idp:  ~p ~p", [URI, Result]).
+
 
 %% -------------------------------------------------------------------
 %% Utility/helper functions