Skip to content

Commit 60c4511

Browse files
MarcialRosalesMarcialRosales
committed
Improve configuration of introspection
1 parent 2f80ce9 commit 60c4511

File tree

4 files changed

+80
-48
lines changed

4 files changed

+80
-48
lines changed

‎deps/oauth2_client/include/types.hrl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@
2626
issuer :: option(uri_string:uri_string()),
2727
discovery_endpoint :: option(uri_string:uri_string()),
2828
token_endpoint :: option(uri_string:uri_string()),
29-
tokeninfo_endpoint :: option(uri_string:uri_string()),
3029
authorization_endpoint :: option(uri_string:uri_string()),
3130
end_session_endpoint :: option(uri_string:uri_string()),
3231
jwks_uri :: option(uri_string:uri_string()),
3332
introspection_endpoint :: option(uri_string:uri_string()),
33+
introspection_client_id :: binary() | undefined,
34+
introspection_client_secret :: binary() | undefined,
35+
introspection_client_auth_method :: basic | request_param | undefined,
3436
ssl_options :: option(list())
3537
}).
3638

‎deps/rabbitmq_auth_backend_oauth2/priv/schema/rabbitmq_auth_backend_oauth2.schema‎

Lines changed: 32 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -153,32 +153,36 @@
153153
rabbit_oauth2_schema:translate_signing_keys(Conf)
154154
end}.
155155

156-
%% When RabbitMQ sends a request to the authorization server, such as to validate a token,
157-
%% it must authenticate with the authorization server
158-
159156
{mapping,
160157
"auth_oauth2.access_token_format",
161158
"rabbitmq_auth_backend_oauth2.access_token_format",
162159
[{datatype, {enum, [jwt, opaque]}}]}.
163160

161+
%% basic_authorization -> Authorization: Basic base64(client_id, client_secret)
162+
%% post_request_param -> &client_id=<client_id>&client_secret=<client_secret>
163+
{mapping,
164+
"auth_oauth2.introspection_client_auth_method",
165+
"rabbitmq_auth_backend_oauth2.introspection_client_auth_method",
166+
[{datatype, {enum, [basic, request_param]}}]}.
167+
164168
{mapping,
165-
"auth_oauth2.oauth_client_id",
166-
"rabbitmq_auth_backend_oauth2.oauth_client_id",
169+
"auth_oauth2.introspection_client_id",
170+
"rabbitmq_auth_backend_oauth2.introspection_client_id",
167171
[{datatype, string}]}.
168172

169173
{translation,
170-
"rabbitmq_auth_backend_oauth2.oauth_client_id",
171-
fun(Conf) -> list_to_binary(cuttlefish:conf_get("auth_oauth2.oauth_client_id", Conf))
174+
"rabbitmq_auth_backend_oauth2.introspection_client_id",
175+
fun(Conf) -> list_to_binary(cuttlefish:conf_get("auth_oauth2.introspection_client_id", Conf))
172176
end}.
173177

174178
{mapping,
175-
"auth_oauth2.oauth_client_secret",
176-
"rabbitmq_auth_backend_oauth2.oauth_client_secret",
179+
"auth_oauth2.introspection_client_secret",
180+
"rabbitmq_auth_backend_oauth2.introspection_client_secret",
177181
[{datatype, string}]}.
178182

179183
{translation,
180-
"rabbitmq_auth_backend_oauth2.oauth_client_secret",
181-
fun(Conf) -> list_to_binary(cuttlefish:conf_get("auth_oauth2.oauth_client_secret", Conf))
184+
"rabbitmq_auth_backend_oauth2.introspection_client_secret",
185+
fun(Conf) -> list_to_binary(cuttlefish:conf_get("auth_oauth2.introspection_client_secret", Conf))
182186
end}.
183187

184188
{mapping,
@@ -346,6 +350,23 @@
346350
"rabbitmq_auth_backend_oauth2.oauth_providers",
347351
[{datatype, string}, {validators, ["uri", "https_uri"]}]}.
348352

353+
%% basic_authorization -> Authorization: Basic base64(client_id, client_secret)
354+
%% post_request_param -> &client_id=<client_id>&client_secret=<client_secret>
355+
{mapping,
356+
"auth_oauth2.oauth_providers.$name.introspection_client_auth_method",
357+
"rabbitmq_auth_backend_oauth2.oauth_providers",
358+
[{datatype, {enum, [basic, request_param]}}]}.
359+
360+
{mapping,
361+
"auth_oauth2.oauth_providers.$name.introspection_client_id",
362+
"rabbitmq_auth_backend_oauth2.oauth_providers",
363+
[{datatype, string}]}.
364+
365+
{mapping,
366+
"auth_oauth2.oauth_providers.$name.introspection_client_secret",
367+
"rabbitmq_auth_backend_oauth2.oauth_providers",
368+
[{datatype, string}]}.
369+
349370
{mapping,
350371
"auth_oauth2.oauth_providers.$name.https.verify",
351372
"rabbitmq_auth_backend_oauth2.oauth_providers",
@@ -447,18 +468,6 @@
447468
"rabbitmq_auth_backend_oauth2.resource_servers",
448469
[{datatype, string}]}.
449470

450-
%% When RabbitMQ sends a request to the authorization server, such as to validate a token,
451-
%% it must authenticate with the authorization server
452-
{mapping,
453-
"auth_oauth2.resource_servers.$name.oauth_client_id",
454-
"rabbitmq_auth_backend_oauth2.resource_servers",
455-
[{datatype, string}]}.
456-
457-
{mapping,
458-
"auth_oauth2.resource_servers.$name.oauth_client_secret",
459-
"rabbitmq_auth_backend_oauth2.resource_servers",
460-
[{datatype, string}]}.
461-
462471
{mapping,
463472
"auth_oauth2.resource_servers.$name.access_token_format",
464473
"rabbitmq_auth_backend_oauth2.resource_servers",

‎deps/rabbitmq_auth_backend_oauth2/test/config_schema_SUITE_data/rabbitmq_auth_backend_oauth2.snippets‎

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -331,33 +331,40 @@
331331
"auth_oauth2.resource_server_id = new_resource_server_id
332332
auth_oauth2.introspection_endpoint = https://introspect
333333
auth_oauth2.access_token_format = jwt
334-
auth_oauth2.oauth_client_id = rabbit
335-
auth_oauth2.oauth_client_secret = rabbit_secret
336-
auth_oauth2.oauth_providers.p.introspection_endpoint = https://introspect_p
337-
auth_oauth2.resource_servers.b.access_token_format = opaque
338-
auth_oauth2.resource_servers.b.oauth_client_id = rabbit_b
339-
auth_oauth2.resource_servers.b.oauth_client_secret = rabbit_secret_b",
334+
auth_oauth2.introspection_client_auth_method = basic
335+
auth_oauth2.introspection_client_id = rabbit
336+
auth_oauth2.introspection_client_secret = rabbit_secret",
340337
[
341338
{rabbitmq_auth_backend_oauth2, [
339+
{access_token_format, jwt},
340+
{introspection_client_auth_method, basic },
341+
{introspection_client_id, <<"rabbit">> },
342+
{introspection_client_secret, <<"rabbit_secret">> },
342343
{introspection_endpoint, "https://introspect"},
343-
{oauth_client_secret, <<"rabbit_secret">> },
344-
{oauth_client_id, <<"rabbit">> },
345-
{access_token_format, jwt},
346-
{resource_server_id,<<"new_resource_server_id">>},
344+
{resource_server_id, <<"new_resource_server_id">>}
345+
]
346+
}
347+
], []
348+
},
349+
{token_introspection_via_oauth_providers,
350+
"auth_oauth2.resource_server_id = new_resource_server_id
351+
auth_oauth2.access_token_format = jwt
352+
auth_oauth2.oauth_providers.p.introspection_endpoint = https://introspect
353+
auth_oauth2.oauth_providers.p.introspection_client_auth_method = basic
354+
auth_oauth2.oauth_providers.p.introspection_client_id = rabbit
355+
auth_oauth2.oauth_providers.p.introspection_client_secret = rabbit_secret",
356+
[
357+
{rabbitmq_auth_backend_oauth2, [
358+
{access_token_format, jwt},
359+
{resource_server_id, <<"new_resource_server_id">>},
347360
{oauth_providers, #{
348-
<<"p">> => [
349-
{introspection_endpoint, "https://introspect_p"}
350-
]
351-
}},
352-
{resource_servers, #{
353-
<<"b">> => [
354-
{oauth_client_secret, <<"rabbit_secret_b">>},
355-
{oauth_client_id, <<"rabbit_b">>},
356-
{access_token_format, opaque},
357-
{id, <<"b">>}
358-
]
359-
}}
360-
361+
<<"p">> => [
362+
{introspection_client_auth_method, basic},
363+
{introspection_client_id, <<"rabbit">>},
364+
{introspection_client_secret, <<"rabbit_secret">>},
365+
{introspection_endpoint, <<"https://introspect">>}
366+
]
367+
}}
361368
]}
362369
], []
363370
}

‎deps/rabbitmq_auth_backend_oauth2/test/rabbit_oauth2_resource_server_SUITE.erl‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ groups() -> [
4848
verify_get_rabbitmq_server_configuration()}
4949
]},
5050
{without_resource_server_id, [], [
51-
resolve_resource_server_id_for_any_audience_returns_no_matching_aud_found
51+
resolve_resource_server_id_for_any_audience_returns_no_matching_aud_found,
52+
cannot_resolve_resource_server_for_opaque_access_token
5253
]},
5354

5455
{with_two_resource_servers, [], [
@@ -57,13 +58,17 @@ groups() -> [
5758
resolve_resource_server_id_for_both_resources_returns_error,
5859
resolve_resource_server_for_none_audience_returns_no_aud_found,
5960
resolve_resource_server_for_unknown_audience_returns_no_matching_aud_found,
61+
cannot_resolve_resource_server_for_opaque_access_token,
6062
{with_verify_aud_false, [], [
6163
resolve_resource_server_for_none_audience_returns_rabbitmq2,
6264
resolve_resource_server_for_unknown_audience_returns_rabbitmq2,
6365
{with_rabbitmq1_verify_aud_false, [], [
6466
resolve_resource_server_for_none_audience_returns_error
6567
]}
6668
]},
69+
{with_opaque_access_token_format_for_rabbitmq1_and_rabbitmq2, [], [
70+
resolve_resource_server_for_opaque_access_token
71+
]},
6772
verify_rabbitmq1_server_configuration,
6873
{verify_configuration_inheritance_with_rabbitmq2, [],
6974
verify_configuration_inheritance_with_rabbitmq2()},
@@ -215,6 +220,15 @@ init_per_group(with_opaque_access_token_format, Config) ->
215220
set_env(access_token_format, opaque),
216221
Config;
217222

223+
init_per_group(with_opaque_access_token_format_for_rabbitmq1_and_rabbitmq2, Config) ->
224+
RabbitMQServers = get_env(resource_servers, #{}),
225+
Resource0 = maps:get(?RABBITMQ_RESOURCE_ONE, RabbitMQServers, []),
226+
Resource = [{access_token_format, opaque} | Resource0],
227+
Maps0 = maps:put(?RABBITMQ_RESOURCE_ONE, Resource, RabbitMQServers),
228+
Maps1 = maps:put(?RABBITMQ_RESOURCE_TWO, Resource, Maps0),
229+
set_env(resource_servers, Maps1),
230+
Config;
231+
218232
init_per_group(_any, Config) ->
219233
Config.
220234

0 commit comments

Comments
 (0)