oidc auth flow methods

rajanadar · Dec 9, 2022 · 8478677 · 8478677
1 parent 0a0dac3
commit 8478677
Show file tree

Hide file tree

Showing 6 changed files with 147 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,8 +1,9 @@
-## 1.12.2 (TBD)
+## 1.12.2 (December 09, 2022)
 
 **FEATURES:**
 
   * secret/kubernetes: Add kubernetes secrets engine.
+  * auth/jwt(oidc): Added OIDC methods to get auth url and generate vault token by exchanging auth code.
 
 ## 1.8.12 (December 09, 2022)
 

diff --git a/src/VaultSharp/V1/AuthMethods/AuthMethodProvider.cs b/src/VaultSharp/V1/AuthMethods/AuthMethodProvider.cs
@@ -8,6 +8,7 @@
 using VaultSharp.V1.AuthMethods.Cert;
 using VaultSharp.V1.AuthMethods.CloudFoundry;
 using VaultSharp.V1.AuthMethods.GitHub;
+using VaultSharp.V1.AuthMethods.JWT;
 using VaultSharp.V1.AuthMethods.Kerberos;
 using VaultSharp.V1.AuthMethods.Kubernetes;
 using VaultSharp.V1.AuthMethods.LDAP;
@@ -28,6 +29,7 @@ public AuthMethodProvider(Polymath polymath)
             _polymath = polymath;
 
             AppRole = new AppRoleAuthMethodProvider(_polymath);
+            JWT = new JWTAuthMethodProvider(_polymath);
             LDAP = new LDAPAuthMethodProvider(_polymath);
             Okta = new OktaAuthMethodProvider(_polymath);
             Token = new TokenAuthMethodProvider(_polymath);
@@ -47,6 +49,8 @@ public AuthMethodProvider(Polymath polymath)
 
         public IGitHubAuthMethod GoogleCloud => throw new NotImplementedException();
 
+        public IJWTAuthMethod JWT { get; }
+
         public IKubernetesAuthMethod Kubernetes => throw new NotImplementedException();
 
         public ILDAPAuthMethod LDAP { get; }

diff --git a/src/VaultSharp/V1/AuthMethods/IAuthMethod.cs b/src/VaultSharp/V1/AuthMethods/IAuthMethod.cs
@@ -6,6 +6,7 @@
 using VaultSharp.V1.AuthMethods.Cert;
 using VaultSharp.V1.AuthMethods.CloudFoundry;
 using VaultSharp.V1.AuthMethods.GitHub;
+using VaultSharp.V1.AuthMethods.JWT;
 using VaultSharp.V1.AuthMethods.Kerberos;
 using VaultSharp.V1.AuthMethods.Kubernetes;
 using VaultSharp.V1.AuthMethods.LDAP;
@@ -57,6 +58,8 @@ public interface IAuthMethod
         /// </summary>
         IGitHubAuthMethod GoogleCloud { get; }
 
+        IJWTAuthMethod JWT { get; }
+
         /// <summary>
         /// 
         /// </summary>

diff --git a/src/VaultSharp/V1/AuthMethods/JWT/IJWTAuthMethod.cs b/src/VaultSharp/V1/AuthMethods/JWT/IJWTAuthMethod.cs
@@ -1,9 +1,67 @@
-namespace VaultSharp.V1.AuthMethods.JWT
+using System.Threading.Tasks;
+using VaultSharp.V1.AuthMethods.JWT.Models;
+using VaultSharp.V1.Commons;
+
+namespace VaultSharp.V1.AuthMethods.JWT
 {
     /// <summary>
-    /// 
+    /// Non Login methods
     /// </summary>
     public interface IJWTAuthMethod
     {
+        /// <summary>
+        /// Obtain an authorization URL from Vault to start an OIDC login flow.
+        /// </summary>
+        /// <param name="redirectUri">
+        /// <para>[required]</para>
+        /// Path to the callback to complete the login. 
+        /// This will be of the form, "https://.../oidc/callback" where the leading portion is dependent on
+        /// your Vault server location, port, and the mount of the JWT plugin. 
+        /// This must be configured with Vault and the provider.
+        /// </param>
+        /// <param name="roleName">
+        /// <para>[optional]</para>
+        /// Name of the role against which the login is being attempted. 
+        /// Defaults to configured default_role if not provided.
+        /// </param>
+        /// <param name="clientNonce">
+        /// <para>[optional]</para>
+        /// Optional client-provided nonce that must match the client_nonce value provided 
+        /// during a subsequent request to the callback API.
+        /// </param>
+        /// <param name="mountPoint">
+        /// Mount point of the JWT Auth method
+        /// </param>
+        /// <returns>The OIDC Auth URL</returns>
+        Task<Secret<OIDCAuthURLInfo>> GetOIDCAuthURLAsync(string redirectUri, string roleName = null, string clientNonce = null, string mountPoint = AuthMethodDefaultPaths.JWT);
+
+        /// <summary>
+        /// Exchange an authorization code for an OIDC ID Token. 
+        /// The ID token will be further validated against any bound claims, and if valid a Vault token will be returned.
+        /// </summary>
+        /// <param name="state">
+        /// <para>[required]</para>
+        /// Opaque state ID that is part of the Authorization URL and will be included in 
+        /// the the redirect following successful authentication on the provider.
+        /// </param>
+        /// <param name="nonce">
+        /// <para>[required]</para>
+        /// Opaque nonce that is part of the Authorization URL and will be 
+        /// included in the the redirect following successful authentication on the provider.
+        /// </param>
+        /// <param name="code">
+        /// <para>[required]</para>
+        /// Provider-generated authorization code that Vault will exchange for an ID token.
+        /// </param>
+        /// <param name="clientNonce">
+        /// <para>[optional]</para>
+        /// Optional client-provided nonce that must match the client_nonce value 
+        /// provided during the prior request to the auth API.
+        /// </param>
+        /// <param name="mountPoint">
+        /// Mount point of the JWT Auth method
+        /// </param>
+        /// <returns>The OIDC Vault Token</returns>
+        Task<Secret<AuthInfo>> DoOIDCCallbackAsync(string state, string nonce, string code, string clientNonce = null, string mountPoint = AuthMethodDefaultPaths.JWT);
     }
 }
diff --git a/src/VaultSharp/V1/AuthMethods/JWT/JWTAuthMethodProvider.cs b/src/VaultSharp/V1/AuthMethods/JWT/JWTAuthMethodProvider.cs
@@ -0,0 +1,68 @@
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading.Tasks;
+using VaultSharp.Core;
+using VaultSharp.V1.AuthMethods.JWT.Models;
+using VaultSharp.V1.Commons;
+
+namespace VaultSharp.V1.AuthMethods.JWT
+{
+    internal class JWTAuthMethodProvider : IJWTAuthMethod
+    {
+        private readonly Polymath _polymath;
+
+        public JWTAuthMethodProvider(Polymath polymath)
+        {
+            Checker.NotNull(polymath, "polymath");
+            this._polymath = polymath;
+        }
+
+        public async Task<Secret<OIDCAuthURLInfo>> GetOIDCAuthURLAsync(string redirectUri, string roleName = null, string clientNonce = null, string mountPoint = AuthMethodDefaultPaths.JWT)
+        {
+            Checker.NotNull(mountPoint, "mountPoint");
+            Checker.NotNull(redirectUri, "redirectUri");
+
+            var requestData = new Dictionary<string, string>
+            {
+                { "redirect_uri", redirectUri }
+            };
+
+            if (!string.IsNullOrWhiteSpace(roleName))
+            {
+                requestData.Add("role", roleName);
+            }
+
+            if (!string.IsNullOrWhiteSpace(clientNonce))
+            {
+                requestData.Add("client_nonce", clientNonce);
+            }
+
+            return await _polymath.MakeVaultApiRequest<Secret<OIDCAuthURLInfo>>("v1/auth/" + mountPoint.Trim('/') + "/oidc/auth_url", HttpMethod.Post, requestData: requestData).ConfigureAwait(_polymath.VaultClientSettings.ContinueAsyncTasksOnCapturedContext);
+        }
+
+        public async Task<Secret<AuthInfo>> DoOIDCCallbackAsync(string state, string nonce, string code, string clientNonce = null, string mountPoint = AuthMethodDefaultPaths.JWT)
+        {
+            Checker.NotNull(state, "state");
+            Checker.NotNull(nonce, "nonce");
+            Checker.NotNull(code, "code");
+
+            Checker.NotNull(mountPoint, "mountPoint");
+
+            var queryStrings = new List<string>
+            {
+                "state=" + state,
+                "nonce=" + nonce,
+                "code=" + code
+            };
+
+            if (!string.IsNullOrWhiteSpace(clientNonce))
+            {
+                queryStrings.Add("client_nonce=" + clientNonce);
+            }
+
+            var queryString = "?" + string.Join("&", queryStrings);
+
+            return await _polymath.MakeVaultApiRequest<Secret<AuthInfo>>("v1/auth/" + mountPoint.Trim('/') + "/oidc/callback" + queryString, HttpMethod.Get).ConfigureAwait(_polymath.VaultClientSettings.ContinueAsyncTasksOnCapturedContext);
+        }
+    }
+}
diff --git a/src/VaultSharp/V1/AuthMethods/JWT/Models/OIDCAuthURLInfo.cs b/src/VaultSharp/V1/AuthMethods/JWT/Models/OIDCAuthURLInfo.cs
@@ -0,0 +1,10 @@
+using Newtonsoft.Json;
+
+namespace VaultSharp.V1.AuthMethods.JWT.Models
+{
+    public class OIDCAuthURLInfo
+    {
+        [JsonProperty("auth_url")]
+        public string AuthorizationURL { get; set; }
+    }
+}