func (i *IDTokenHandleHelper) IssueImplicitIDToken(ctx context.Context, req *http.Request, ar fosite.Requester, resp fosite.AuthorizeResponder) error { token, err := i.generateIDToken(ctx, req, ar) if err != nil { return err } resp.AddFragment("id_token", token) return nil }
func (c *OpenIDConnectImplicitHandler) HandleAuthorizeEndpointRequest(ctx context.Context, req *http.Request, ar fosite.AuthorizeRequester, resp fosite.AuthorizeResponder) error { if !(ar.GetGrantedScopes().Has("openid") && (ar.GetResponseTypes().Has("token", "id_token") || ar.GetResponseTypes().Exact("id_token"))) { return nil } else if ar.GetResponseTypes().Has("code") { // hybrid flow return nil } if !ar.GetClient().GetGrantTypes().Has("implicit") { return errors.Wrap(fosite.ErrInvalidGrant, "The client is not allowed to use implicit grant type") } if ar.GetResponseTypes().Exact("id_token") && !ar.GetClient().GetResponseTypes().Has("id_token") { return errors.Wrap(fosite.ErrInvalidGrant, "The client is not allowed to use response type id_token") } else if ar.GetResponseTypes().Matches("token", "id_token") && !ar.GetClient().GetResponseTypes().Has("token", "id_token") { return errors.Wrap(fosite.ErrInvalidGrant, "The client is not allowed to use response type token and id_token") } client := ar.GetClient() for _, scope := range ar.GetRequestedScopes() { if !c.ScopeStrategy(client.GetScopes(), scope) { return errors.Wrap(fosite.ErrInvalidScope, fmt.Sprintf("The client is not allowed to request scope %s", scope)) } } sess, ok := ar.GetSession().(Session) if !ok { return errors.Wrap(ErrInvalidSession, "") } claims := sess.IDTokenClaims() if ar.GetResponseTypes().Has("token") { if err := c.AuthorizeImplicitGrantTypeHandler.IssueImplicitAccessToken(ctx, req, ar, resp); err != nil { return errors.Wrap(err, err.Error()) } ar.SetResponseTypeHandled("token") hash, err := c.RS256JWTStrategy.Hash([]byte(resp.GetFragment().Get("access_token"))) if err != nil { return err } claims.AccessTokenHash = []byte(base64.URLEncoding.EncodeToString([]byte(hash[:c.RS256JWTStrategy.GetSigningMethodLength()/2]))) } else { resp.AddFragment("state", ar.GetState()) } if err := c.IssueImplicitIDToken(ctx, req, ar, resp); err != nil { return errors.Wrap(err, err.Error()) } // there is no need to check for https, because implicit flow does not require https // https://tools.ietf.org/html/rfc6819#section-4.4.2 ar.SetResponseTypeHandled("id_token") return nil }
func (c *AuthorizeImplicitGrantTypeHandler) IssueImplicitAccessToken(ctx context.Context, req *http.Request, ar fosite.AuthorizeRequester, resp fosite.AuthorizeResponder) error { // Generate the code token, signature, err := c.AccessTokenStrategy.GenerateAccessToken(ctx, ar) if err != nil { return errors.Wrap(fosite.ErrServerError, err.Error()) } else if err := c.AccessTokenStorage.CreateAccessTokenSession(ctx, signature, ar); err != nil { return errors.Wrap(fosite.ErrServerError, err.Error()) } ar.GetSession().SetExpiresAt(fosite.AccessToken, time.Now().Add(c.AccessTokenLifespan)) resp.AddFragment("access_token", token) resp.AddFragment("expires_in", strconv.FormatInt(int64(getExpiresIn(ar, fosite.AccessToken, c.AccessTokenLifespan, time.Now())/time.Second), 10)) resp.AddFragment("token_type", "bearer") resp.AddFragment("state", ar.GetState()) resp.AddFragment("scope", strings.Join(ar.GetGrantedScopes(), " ")) ar.SetResponseTypeHandled("token") return nil }