Archives/smallstep-certificates
2
0
Fork 0
mirror of https://github.com/smallstep/certificates.git synced 2024-11-15 18:12:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:smallstep/certificates into ssh-ca

Browse Source
This commit is contained in:
Mariano Cano 2019-07-26 15:38:46 -07:00
commit 082ebda85b
1 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
authority/provisioner/oidc.go
View File

@ -33,12 +33,13 @@ func (c openIDConfiguration) Validate() error {
// openIDPayload represents the fields on the id_token JWT payload.
type openIDPayload struct {
jose.Claims
AtHash string `json:"at_hash"`
AuthorizedParty string `json:"azp"`
Email string `json:"email"`
EmailVerified bool `json:"email_verified"`
Hd string `json:"hd"`
Nonce string `json:"nonce"`
AtHash string `json:"at_hash"`
AuthorizedParty string `json:"azp"`
Email string `json:"email"`
EmailVerified bool `json:"email_verified"`
Hd string `json:"hd"`
Nonce string `json:"nonce"`
Groups []string `json:"groups"`
}
// OIDC represents an OAuth 2.0 OpenID Connect provider.
@ -52,6 +53,7 @@ type OIDC struct {
ConfigurationEndpoint string `json:"configurationEndpoint"`
Admins []string `json:"admins,omitempty"`
Domains []string `json:"domains,omitempty"`
Groups []string `json:"groups,omitempty"`
Claims *Claims `json:"claims,omitempty"`
configuration openIDConfiguration
keyStore *keyStore
@ -187,6 +189,22 @@ func (o *OIDC) ValidatePayload(p openIDPayload) error {
}
}
// Filter by oidc group claim
if len(o.Groups) > 0 {
var found bool
for _, group := range o.Groups {
for _, g := range p.Groups {
if g == group {
found = true
break
}
}
}
if !found {
return errors.New("validation failed: invalid group")
}
}
return nil
}