示例#1
0
// Polls the Revocation Provider for new revocations and adds them to the revocation cache; handles the Force Refresh
// condition (e.g. refresh cache from a specific timestamp); expires revocations older than the
// REVOCATION_CACHE_TTL envionment variable.
func (crp *CachingRevokeProvider) RefreshRevocations() {
	ts := crp.cache.GetLastTS()
	if ts == 0 {
		ts = int(time.Now().Add(-1 * options.AppSettings.RevocationCacheTTL).Unix())
	}
	ts = ts - int(options.AppSettings.RevocationRefreshTolerance.Seconds())

	log.Printf("Checking for new revocations since %d...", ts)

	resp, err := breaker.Get("refreshRevocations", crp.url+"?from="+strconv.Itoa(ts))
	if err != nil {
		log.Println("Failed to get revocations. " + err.Error())
		return
	}

	if resp.StatusCode != http.StatusOK {
		log.Printf("Failed to get revocations. Server returned status %s.", resp.Status)
		return
	}

	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)

	jr := &jsonRevoke{}
	if err := json.Unmarshal(body, &jr); err != nil {
		log.Println("Failed to unmarshall revocation data. " + err.Error())
		return
	}

	if jr.Meta.RefreshTimestamp != 0 {
		r := crp.cache.Get(REVOCATION_TYPE_FORCEREFRESH)
		if r == nil || (r.(*Revocation).Data["revoked_at"] != jr.Meta.RefreshTimestamp) {
			log.Printf("Force refreshing cache from %d...", jr.Meta.RefreshFrom)
			crp.cache.ForceRefresh(jr.Meta.RefreshFrom)
			rev := &Revocation{}
			d := make(map[string]interface{})
			rev.Type = REVOCATION_TYPE_FORCEREFRESH
			d["refresh_from"] = jr.Meta.RefreshFrom
			d["revoked_at"] = jr.Meta.RefreshTimestamp
			rev.Data = d
			crp.cache.Add(rev)
		}

	}

	if len(jr.Revs) > 0 {
		log.Printf("Received %d new revocations", len(jr.Revs))
	}

	for _, j := range jr.Revs {
		r, err := j.toRevocation()
		if err == nil {
			crp.cache.Add(r)
		}
	}

	crp.cache.Expire()

}
示例#2
0
// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
func (kl *cachingOpenIDProviderLoader) loadConfiguration() (*configuration, error) {
	resp, err := breaker.Get("loadConfiguration", kl.url)
	if err != nil {
		return nil, err
	}

	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, errInvalidResponseStatusCode
	}

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}

	config := new(configuration)
	err = json.Unmarshal(body, config)
	return config, err
}
示例#3
0
// Example: https://www.googleapis.com/oauth2/v3/certs
func (kl *cachingOpenIDProviderLoader) refreshKeys() {
	log.Println("Refreshing keys..")

	log.Println("Loading configuration..")
	c, err := kl.loadConfiguration()
	if err != nil {
		log.Printf("Failed to get configuration from %q. %s\n", kl.url, err)
		return
	}

	log.Println("Configuration loaded successfully, loading JWKS..")
	resp, err := breaker.Get("loadKeys", c.JwksURI)
	if err != nil {
		log.Println("Failed to get JWKS from ", c.JwksURI)
		return
	}
	defer resp.Body.Close()

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		log.Printf("Failed to read JWKS response body from %q: %v\n", c.JwksURI, err)
		return
	}

	log.Println("JWKS loaded successfully, parsing JWKS..")
	jwks := new(jwk.JSONWebKeySet)
	if err = json.Unmarshal(body, jwks); err != nil {
		log.Println("Failed to parse JWKS: ", err)
		return
	}

	// safety first: only remove public keys if our newly
	// received list contains at least one public key!
	// (we don't want our tokeninfo to run out of public keys
	// just because somebody cleared the provider database)
	numKeys := len(jwks.Keys)
	if numKeys < 1 {
		log.Println("No JWKS currently in the OpenID provider")
		if c, ok := metrics.DefaultRegistry.GetOrRegister(metricsNoKeysError, metrics.NewCounter).(metrics.Counter); ok {
			c.Inc(1)
		}
		return
	}

	if g, ok := metrics.DefaultRegistry.GetOrRegister(metricsNumKeys, metrics.NewGauge).(metrics.Gauge); ok {
		g.Update(int64(numKeys))
	}

	newKeys := jwks.ToMap()
	for kid, k := range newKeys {
		key := k.(jwk.JSONWebKey)
		existing := kl.keyCache.Get(kid)
		if existing == nil {
			log.Printf("Received new public key %q (%s)\n", kid, key.Algorithm)
		} else if !reflect.DeepEqual(existing, key) {
			// this is potentially dangerous: the key contents changed..
			// (but maybe the key wasn't used for signing yet, so it might be ok)
			log.Printf("Received a replacement public key for existing key %q (%s)", kid, key.Algorithm)
		}
	}

	log.Printf("Resetting key cache with %d key(s)..", numKeys)
	kl.keyCache.Reset(newKeys)
	log.Println("Refresh done..")
}