oidc: the server becomes a relying party, and devices can carry an account

Echolot delegates identity to whatever IdP the operator already runs and stores no passwords - no hashing, no reset flow, no lockout policy, and no credential database to lose. For a tool people self-host next to other services, that is the difference between one more service and one more thing that can leak someone's password. Verification is stdlib-only, matching the server's no-dependency rule. Longer than jwt.Parse, and auditable in one sitting. The part that matters is the algorithm allow-list: taking `alg` from the token is the classic forgery, so it is fixed in code. Tests cover the real attacks against a genuine signer - a self-contained IdP with real keys, because a mock that returns success proves nothing about a verifier: alg=none, HS256/RS256 confusion, a payload swapped under a valid signature, a token addressed to another client, a token from another issuer, expired and future-dated tokens, and discovery that renames the issuer (which would otherwise have us fetch a stranger's keys believing they were the provider's). With no admin group configured nobody is an admin. An operator who has not said who may administer the server has not thereby said "anyone who can log in". Device and account stay separate concepts: enrollment admits a device (operator's token), signing in attributes it to a person (POST /v1/account/link, device credential plus ID token - both required, neither substitutes). uploads=account now means what it says instead of refusing everyone, and signing in does not override uploads=off. The profile advertises the sign-in configuration so the app can offer the button only when there is something behind it, and drive PKCE without anyone typing an issuer URL. A discovery failure is reported rather than hidden, so "configured but the provider is not answering" is distinguishable from "not configured". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-01 16:52:56 +02:00
parent 57a5ef8796
commit ce6d0c2f64
8 changed files with 1008 additions and 29 deletions
@@ -0,0 +1,288 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package oidc
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// A self-contained IdP: real keys, real signatures, real discovery and JWKS documents. Testing
+// token verification against anything less than a genuine signer proves nothing — the failure
+// modes that matter here (accepting `none`, accepting another client's token, accepting an
+// expired one) all look fine to a mock that just returns success.
+type testIdP struct {
+	*httptest.Server
+	rsaKey *rsa.PrivateKey
+	ecKey  *ecdsa.PrivateKey
+}
+
+func newIdP(t *testing.T) *testIdP {
+	t.Helper()
+	rk, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ek, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	idp := &testIdP{rsaKey: rk, ecKey: ek}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(Discovery{
+			Issuer:                idp.URL,
+			AuthorizationEndpoint: idp.URL + "/auth",
+			TokenEndpoint:         idp.URL + "/token",
+			JWKSURI:               idp.URL + "/jwks",
+		})
+	})
+	mux.HandleFunc("/jwks", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{"keys": []map[string]string{
+			{
+				"kty": "RSA", "kid": "rsa-1", "alg": "RS256", "use": "sig",
+				"n": raw(rk.N.Bytes()),
+				"e": raw(big.NewInt(int64(rk.E)).Bytes()),
+			},
+			{
+				"kty": "EC", "kid": "ec-1", "alg": "ES256", "use": "sig", "crv": "P-256",
+				"x": raw(ek.X.Bytes()), "y": raw(ek.Y.Bytes()),
+			},
+		}})
+	})
+	idp.Server = httptest.NewServer(mux)
+	t.Cleanup(idp.Close)
+	return idp
+}
+
+func raw(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+
+func (i *testIdP) sign(t *testing.T, alg, kid string, claims map[string]any) string {
+	t.Helper()
+	h, _ := json.Marshal(map[string]string{"alg": alg, "kid": kid, "typ": "JWT"})
+	p, _ := json.Marshal(claims)
+	signing := raw(h) + "." + raw(p)
+	digest := sha256.Sum256([]byte(signing))
+
+	var sig []byte
+	switch alg {
+	case "RS256":
+		s, err := rsa.SignPKCS1v15(rand.Reader, i.rsaKey, crypto.SHA256, digest[:])
+		if err != nil {
+			t.Fatal(err)
+		}
+		sig = s
+	case "ES256":
+		r, s, err := ecdsa.Sign(rand.Reader, i.ecKey, digest[:])
+		if err != nil {
+			t.Fatal(err)
+		}
+		// JWS wants fixed-width r||s, not ASN.1.
+		sig = make([]byte, 64)
+		r.FillBytes(sig[:32])
+		s.FillBytes(sig[32:])
+	default:
+		t.Fatalf("unsupported test alg %q", alg)
+	}
+	return signing + "." + raw(sig)
+}
+
+func (i *testIdP) claims(extra map[string]any) map[string]any {
+	c := map[string]any{
+		"iss": i.URL, "sub": "user-1", "aud": "echolot",
+		"exp": time.Now().Add(time.Hour).Unix(), "iat": time.Now().Unix(),
+		"email": "someone@example.net", "groups": []string{"users"},
+	}
+	for k, v := range extra {
+		c[k] = v
+	}
+	return c
+}
+
+func verifier(i *testIdP, adminGroup string) *Verifier {
+	return New(Config{Issuer: i.URL, ClientID: "echolot", AdminGroup: adminGroup}, i.Client())
+}
+
+func TestAcceptsAGenuineToken(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	for _, tc := range []struct{ alg, kid string }{{"RS256", "rsa-1"}, {"ES256", "ec-1"}} {
+		got, err := v.Verify(context.Background(), idp.sign(t, tc.alg, tc.kid, idp.claims(nil)))
+		if err != nil {
+			t.Fatalf("%s: %v", tc.alg, err)
+		}
+		if got.Subject != "user-1" || got.Email != "someone@example.net" {
+			t.Fatalf("%s: claims not parsed: %+v", tc.alg, got)
+		}
+		if want := idp.URL + "#user-1"; got.AccountID() != want {
+			t.Errorf("AccountID = %q, want %q", got.AccountID(), want)
+		}
+	}
+}
+
+// "alg": "none" is the oldest JWT forgery there is: strip the signature, declare no algorithm,
+// and a naive verifier accepts anything. It must not even reach the key lookup.
+func TestRejectsAlgNone(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	h, _ := json.Marshal(map[string]string{"alg": "none", "kid": "rsa-1", "typ": "JWT"})
+	p, _ := json.Marshal(idp.claims(nil))
+	token := raw(h) + "." + raw(p) + "."
+	if _, err := v.Verify(context.Background(), token); !errors.Is(err, ErrSignature) {
+		t.Fatalf("alg=none was not refused as a signature failure: %v", err)
+	}
+}
+
+// The other classic: declare HS256 so the verifier treats the RSA *public* key as an HMAC secret,
+// which the attacker also has. The allow-list has no symmetric algorithms at all.
+func TestRejectsSymmetricAlgorithmConfusion(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	h, _ := json.Marshal(map[string]string{"alg": "HS256", "kid": "rsa-1", "typ": "JWT"})
+	p, _ := json.Marshal(idp.claims(nil))
+	token := raw(h) + "." + raw(p) + "." + raw([]byte("whatever"))
+	if _, err := v.Verify(context.Background(), token); !errors.Is(err, ErrSignature) {
+		t.Fatalf("HS256 confusion was not refused: %v", err)
+	}
+}
+
+func TestRejectsATamperedPayload(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	good := idp.sign(t, "RS256", "rsa-1", idp.claims(nil))
+	// Swap the payload for one claiming to be somebody else, keeping the valid signature.
+	forged, _ := json.Marshal(idp.claims(map[string]any{"sub": "admin"}))
+	parts := []byte(good)
+	dot1, dot2 := 0, 0
+	for i, c := range parts {
+		if c == '.' {
+			if dot1 == 0 {
+				dot1 = i
+			} else {
+				dot2 = i
+			}
+		}
+	}
+	token := string(parts[:dot1+1]) + raw(forged) + string(parts[dot2:])
+	if _, err := v.Verify(context.Background(), token); !errors.Is(err, ErrSignature) {
+		t.Fatalf("a swapped payload was not refused: %v", err)
+	}
+}
+
+// A token from the same IdP but issued to a different client is perfectly valid — just not for
+// us. Accepting it would let any other client of the same provider authenticate here.
+func TestRejectsAnotherClientsToken(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	tok := idp.sign(t, "RS256", "rsa-1", idp.claims(map[string]any{"aud": "some-other-app"}))
+	if _, err := v.Verify(context.Background(), tok); !errors.Is(err, ErrClaims) {
+		t.Fatalf("another client's token was accepted: %v", err)
+	}
+}
+
+func TestAcceptsAudienceArrayContainingUs(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	tok := idp.sign(t, "RS256", "rsa-1", idp.claims(map[string]any{"aud": []string{"other", "echolot"}}))
+	if _, err := v.Verify(context.Background(), tok); err != nil {
+		t.Fatalf("an audience array including us was refused: %v", err)
+	}
+}
+
+func TestRejectsExpiredAndFutureTokens(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	expired := idp.sign(t, "RS256", "rsa-1", idp.claims(map[string]any{
+		"exp": time.Now().Add(-time.Hour).Unix(),
+	}))
+	if _, err := v.Verify(context.Background(), expired); !errors.Is(err, ErrClaims) {
+		t.Errorf("expired token accepted: %v", err)
+	}
+	future := idp.sign(t, "RS256", "rsa-1", idp.claims(map[string]any{
+		"iat": time.Now().Add(time.Hour).Unix(),
+	}))
+	if _, err := v.Verify(context.Background(), future); !errors.Is(err, ErrClaims) {
+		t.Errorf("token issued in the future accepted: %v", err)
+	}
+}
+
+// A token signed by a completely different provider, with its own keys and its own kid.
+func TestRejectsATokenFromAnotherIssuer(t *testing.T) {
+	ours, theirs := newIdP(t), newIdP(t)
+	v := verifier(ours, "")
+	tok := theirs.sign(t, "RS256", "rsa-1", theirs.claims(nil))
+	if _, err := v.Verify(context.Background(), tok); err == nil {
+		t.Fatal("a token from another issuer was accepted")
+	}
+}
+
+func TestRejectsMalformedTokens(t *testing.T) {
+	idp := newIdP(t)
+	v := verifier(idp, "")
+	for _, bad := range []string{"", "not-a-token", "a.b", "a.b.c.d", "...", "!!!.???.***"} {
+		if _, err := v.Verify(context.Background(), bad); err == nil {
+			t.Errorf("%q was accepted", bad)
+		}
+	}
+}
+
+// With no admin group configured, nobody is an admin. An operator who has not said who may
+// administer the server has not thereby said "anyone who can log in".
+func TestNobodyIsAdminUntilAGroupIsConfigured(t *testing.T) {
+	idp := newIdP(t)
+	claims := &Claims{Groups: []string{"users", "echolot-admins"}}
+
+	if verifier(idp, "").IsAdmin(claims) {
+		t.Error("someone was an admin with no admin group configured")
+	}
+	if !verifier(idp, "echolot-admins").IsAdmin(claims) {
+		t.Error("a member of the configured group was not an admin")
+	}
+	if verifier(idp, "other-group").IsAdmin(claims) {
+		t.Error("a non-member was an admin")
+	}
+	if verifier(idp, "echolot-admins").IsAdmin(nil) {
+		t.Error("an absent identity was an admin")
+	}
+}
+
+// A discovery document whose issuer disagrees with the configured one means we were redirected
+// somewhere — and would otherwise have fetched that somewhere's signing keys while believing
+// they belonged to the configured provider.
+func TestRefusesDiscoveryThatRenamesTheIssuer(t *testing.T) {
+	mux := http.NewServeMux()
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(Discovery{Issuer: "https://somewhere.else", JWKSURI: srv.URL + "/jwks"})
+	})
+	v := New(Config{Issuer: srv.URL, ClientID: "echolot"}, srv.Client())
+	if _, err := v.Discover(context.Background()); err == nil {
+		t.Fatal("discovery accepted a document for a different issuer")
+	}
+}
+
+func TestDisabledWithoutConfiguration(t *testing.T) {
+	v := New(Config{}, nil)
+	if v.Config().Enabled() {
+		t.Fatal("an unconfigured verifier reports itself enabled")
+	}
+	if _, err := v.Verify(context.Background(), "x.y.z"); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("want ErrDisabled, got %v", err)
+	}
+}