From 206f308b3d561be4e212786f644b2c4ec0bb4609 Mon Sep 17 00:00:00 2001 From: Koen van Hove Date: Mon, 24 Nov 2025 12:01:16 +0100 Subject: [PATCH] Update openidconnect to v4 (#1333) --- Cargo.lock | 220 ++++++++---------- Cargo.toml | 2 +- .../providers/openid_connect/httpclient.rs | 34 +-- .../auth/providers/openid_connect/provider.rs | 69 +++--- .../auth/providers/openid_connect/util.rs | 38 +-- 5 files changed, 174 insertions(+), 189 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 150f419a..03034ea1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -64,22 +64,22 @@ dependencies = [ [[package]] name = "anstyle-query" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2" +checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] name = "anstyle-wincon" -version = "3.0.10" +version = "3.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a" +checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -128,9 +128,9 @@ checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" [[package]] name = "base64" -version = "0.13.1" +version = "0.21.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" +checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" [[package]] name = "base64" @@ -209,15 +209,15 @@ checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" [[package]] name = "bytes" -version = "1.10.1" +version = "1.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a" +checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] name = "cc" -version = "1.2.44" +version = "1.2.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "37521ac7aabe3d13122dc382493e20c9416f299d2ccd5b3a5340a2570cdeb0f3" +checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36" dependencies = [ "find-msvc-tools", "shlex", @@ -255,9 +255,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.5.51" +version = "4.5.52" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5" +checksum = "aa8120877db0e5c011242f96806ce3c94e0737ab8108532a76a3300a01db2ab8" dependencies = [ "clap_builder", "clap_derive", @@ -265,9 +265,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.5.51" +version = "4.5.52" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a" +checksum = "02576b399397b659c26064fbc92a75fede9d18ffd5f80ca1cd74ddab167016e1" dependencies = [ "anstream", "anstyle", @@ -285,7 +285,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -369,9 +369,9 @@ dependencies = [ [[package]] name = "crypto-common" -version = "0.1.6" +version = "0.1.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3" +checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" dependencies = [ "generic-array", "typenum", @@ -424,7 +424,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -448,7 +448,7 @@ dependencies = [ "proc-macro2", "quote", "strsim", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -459,7 +459,7 @@ checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81" dependencies = [ "darling_core", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -530,7 +530,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -717,9 +717,9 @@ dependencies = [ [[package]] name = "find-msvc-tools" -version = "0.1.4" +version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127" +checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844" [[package]] name = "fixedbitset" @@ -786,7 +786,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -817,9 +817,9 @@ dependencies = [ [[package]] name = "generic-array" -version = "0.14.9" +version = "0.14.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2" +checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", @@ -873,7 +873,7 @@ dependencies = [ "fnv", "futures-core", "futures-sink", - "http 1.3.1", + "http", "indexmap 2.12.0", "slab", "tokio", @@ -945,17 +945,6 @@ dependencies = [ "windows-link 0.1.3", ] -[[package]] -name = "http" -version = "0.2.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1" -dependencies = [ - "bytes", - "fnv", - "itoa", -] - [[package]] name = "http" version = "1.3.1" @@ -974,7 +963,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184" dependencies = [ "bytes", - "http 1.3.1", + "http", ] [[package]] @@ -985,7 +974,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a" dependencies = [ "bytes", "futures-core", - "http 1.3.1", + "http", "http-body", "pin-project-lite", ] @@ -1004,16 +993,16 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9" [[package]] name = "hyper" -version = "1.7.0" +version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e" +checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11" dependencies = [ "atomic-waker", "bytes", "futures-channel", "futures-core", "h2", - "http 1.3.1", + "http", "http-body", "httparse", "httpdate", @@ -1031,7 +1020,7 @@ version = "0.27.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58" dependencies = [ - "http 1.3.1", + "http", "hyper", "hyper-util", "rustls", @@ -1059,16 +1048,16 @@ dependencies = [ [[package]] name = "hyper-util" -version = "0.1.17" +version = "0.1.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8" +checksum = "52e9a2a24dc5c6821e71a7030e1e14b7b632acac55c40e9d2e082c621261bb56" dependencies = [ "base64 0.22.1", "bytes", "futures-channel", "futures-core", "futures-util", - "http 1.3.1", + "http", "http-body", "hyper", "ipnet", @@ -1273,9 +1262,9 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130" [[package]] name = "iri-string" -version = "0.7.8" +version = "0.7.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2" +checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397" dependencies = [ "memchr", "serde", @@ -1466,9 +1455,9 @@ checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" [[package]] name = "libflate" -version = "2.2.0" +version = "2.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "249fa21ba2b59e8cbd69e722f5b31e1b466db96c937ae3de23e8b99ead0d1383" +checksum = "e3248b8d211bd23a104a42d81b4fa8bb8ac4a3b75e7a43d85d2c9ccb6179cd74" dependencies = [ "adler32", "core2", @@ -1550,7 +1539,7 @@ checksum = "5cf92c10c7e361d6b99666ec1c6f9805b0bea2c3bd8c78dc6fe98ac5bd78db11" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -1601,9 +1590,9 @@ checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" [[package]] name = "num-bigint-dig" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "82c79c15c05d4bf82b6f5ef163104cc81a760d8e874d38ac50ab67c8877b647b" +checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7" dependencies = [ "lazy_static", "libm", @@ -1662,14 +1651,14 @@ dependencies = [ [[package]] name = "oauth2" -version = "4.4.2" +version = "5.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c38841cdd844847e3e7c8d29cef9dcfed8877f8f56f9071f77843ecf3baf937f" +checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d" dependencies = [ - "base64 0.13.1", + "base64 0.22.1", "chrono", "getrandom 0.2.16", - "http 0.2.12", + "http", "rand 0.8.5", "serde", "serde_json", @@ -1693,16 +1682,16 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" [[package]] name = "openidconnect" -version = "3.5.0" +version = "4.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f47e80a9cfae4462dd29c41e987edd228971d6565553fbc14b8a11e666d91590" +checksum = "0d8c6709ba2ea764bbed26bce1adf3c10517113ddea6f2d4196e4851757ef2b2" dependencies = [ - "base64 0.13.1", + "base64 0.21.7", "chrono", "dyn-clone", "ed25519-dalek", "hmac", - "http 0.2.12", + "http", "itertools 0.10.5", "log", "oauth2", @@ -1712,7 +1701,6 @@ dependencies = [ "rsa", "serde", "serde-value", - "serde_derive", "serde_json", "serde_path_to_error", "serde_plain", @@ -1725,9 +1713,9 @@ dependencies = [ [[package]] name = "openssl" -version = "0.10.74" +version = "0.10.75" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24ad14dd45412269e1a30f52ad8f0664f0f4f4a89ee8fe28c3b3527021ebb654" +checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328" dependencies = [ "bitflags 2.10.0", "cfg-if", @@ -1746,7 +1734,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -1757,9 +1745,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e" [[package]] name = "openssl-sys" -version = "0.9.110" +version = "0.9.111" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a9f0075ba3c21b09f8e8b2026584b1d18d49388648f2fbbf3c97ea8deced8e2" +checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321" dependencies = [ "cc", "libc", @@ -1977,9 +1965,9 @@ dependencies = [ [[package]] name = "quote" -version = "1.0.41" +version = "1.0.42" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1" +checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f" dependencies = [ "proc-macro2", ] @@ -2097,7 +2085,7 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -2140,7 +2128,7 @@ dependencies = [ "encoding_rs", "futures-core", "h2", - "http 1.3.1", + "http", "http-body", "http-body-util", "hyper", @@ -2230,9 +2218,9 @@ dependencies = [ [[package]] name = "rsa" -version = "0.9.8" +version = "0.9.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78928ac1ed176a5ca1d17e578a1825f3d81ca54cf41053a592584b020cfd691b" +checksum = "40a0376c50d0358279d9d643e4bf7b7be212f1f4ff1da9070a7b54d22ef75c88" dependencies = [ "const-oid", "digest", @@ -2282,9 +2270,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.34" +version = "0.23.35" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6a9586e9ee2b4f8fab52a0048ca7334d7024eef48e2cb9407e3497bb7cab7fa7" +checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f" dependencies = [ "log", "once_cell", @@ -2386,9 +2374,9 @@ dependencies = [ [[package]] name = "schemars" -version = "1.0.5" +version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1317c3bf3e7df961da95b0a56a172a02abead31276215a0497241a7624b487ce" +checksum = "9558e172d4e8533736ba97870c4b2cd63f84b382a3d6eb063da41b91cce17289" dependencies = [ "dyn-clone", "ref-cast", @@ -2513,7 +2501,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -2572,9 +2560,9 @@ dependencies = [ [[package]] name = "serde_with" -version = "3.15.1" +version = "3.16.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aa66c845eee442168b2c8134fec70ac50dc20e760769c8ba0ad1319ca1959b04" +checksum = "10574371d41b0d9b2cff89418eda27da52bcaff2cc8741db26382a77c29131f1" dependencies = [ "base64 0.22.1", "chrono", @@ -2582,7 +2570,7 @@ dependencies = [ "indexmap 1.9.3", "indexmap 2.12.0", "schemars 0.9.0", - "schemars 1.0.5", + "schemars 1.1.0", "serde_core", "serde_json", "serde_with_macros", @@ -2591,14 +2579,14 @@ dependencies = [ [[package]] name = "serde_with_macros" -version = "3.15.1" +version = "3.16.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b91a903660542fced4e99881aa481bdbaec1634568ee02e0b8bd57c64cb38955" +checksum = "08a72d8216842fdd57820dc78d840bef99248e35fb2554ff923319e60f2d686b" dependencies = [ "darling", "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -2737,9 +2725,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.108" +version = "2.0.110" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917" +checksum = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea" dependencies = [ "proc-macro2", "quote", @@ -2763,7 +2751,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -2870,7 +2858,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -2973,7 +2961,7 @@ checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -3072,7 +3060,7 @@ dependencies = [ "bitflags 2.10.0", "bytes", "futures-util", - "http 1.3.1", + "http", "http-body", "iri-string", "pin-project-lite", @@ -3295,7 +3283,7 @@ dependencies = [ "bumpalo", "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", "wasm-bindgen-shared", ] @@ -3358,8 +3346,8 @@ dependencies = [ "windows-implement", "windows-interface", "windows-link 0.2.1", - "windows-result 0.4.1", - "windows-strings 0.5.1", + "windows-result", + "windows-strings", ] [[package]] @@ -3370,7 +3358,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -3381,7 +3369,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -3398,22 +3386,13 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" [[package]] name = "windows-registry" -version = "0.5.3" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e" +checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720" dependencies = [ - "windows-link 0.1.3", - "windows-result 0.3.4", - "windows-strings 0.4.2", -] - -[[package]] -name = "windows-result" -version = "0.3.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6" -dependencies = [ - "windows-link 0.1.3", + "windows-link 0.2.1", + "windows-result", + "windows-strings", ] [[package]] @@ -3425,15 +3404,6 @@ dependencies = [ "windows-link 0.2.1", ] -[[package]] -name = "windows-strings" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57" -dependencies = [ - "windows-link 0.1.3", -] - [[package]] name = "windows-strings" version = "0.5.1" @@ -3655,7 +3625,7 @@ checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", "synstructure", ] @@ -3676,7 +3646,7 @@ checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] [[package]] @@ -3696,7 +3666,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", "synstructure", ] @@ -3736,5 +3706,5 @@ checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3" dependencies = [ "proc-macro2", "quote", - "syn 2.0.108", + "syn 2.0.110", ] diff --git a/Cargo.toml b/Cargo.toml index 74cb3fdd..70c8e4e2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -62,7 +62,7 @@ secrecy = { version = "0.8", features = ["serde"], optional = true } # Dependencies used by the "multi-user" feature basic-cookies = { version = "0.1", optional = true } -openidconnect = { version = "3.5.0", optional = true, default-features = false } +openidconnect = { version = "4.0.0", optional = true, default-features = false } regex = { version = "1.11.1", optional = true, default-features = false, features = [ "std" ] } rpassword = { version = "7.4.0", optional = true } scrypt = { version = "0.11", optional = true, default-features = false } diff --git a/src/daemon/http/auth/providers/openid_connect/httpclient.rs b/src/daemon/http/auth/providers/openid_connect/httpclient.rs index 11c3bc5f..a1df15b8 100644 --- a/src/daemon/http/auth/providers/openid_connect/httpclient.rs +++ b/src/daemon/http/auth/providers/openid_connect/httpclient.rs @@ -18,13 +18,13 @@ pub async fn logging_http_client( // Don't {:?} log the openidconnect::HTTPRequest req object // because that renders the body as an unreadable integer byte // array, instead try and decode it as UTF-8. - let body = match std::str::from_utf8(&req.body) { + let body = match std::str::from_utf8(req.body()) { Ok(text) => text.to_string(), - Err(_) => format!("{:?}", &req.body), + Err(_) => format!("{:?}", req.body()), }; debug!( "OpenID Connect request: url: {:?}, method: {:?}, headers: {:?}, body: {}", - req.url, req.method, req.headers, body + req.uri(), req.method(), req.headers(), body ); } @@ -37,13 +37,13 @@ pub async fn logging_http_client( // object because that renders the body as an unreadable // integer byte array, instead try and decode it as // UTF-8. - let body = match std::str::from_utf8(&res.body) { + let body = match std::str::from_utf8(res.body()) { Ok(text) => text.to_string(), - Err(_) => format!("{:?}", &res.body), + Err(_) => format!("{:?}", res.body()), }; debug!( "OpenID Connect response: status_code: {:?}, headers: {:?}, body: {}", - res.status_code, res.headers, body + res.status(), res.headers(), body ); } Err(err) => { @@ -58,7 +58,7 @@ pub async fn logging_http_client( async fn dispatch_openid_request( request: openidconnect::HttpRequest, ) -> Result { - let request_uri = request.url.to_string(); + let request_uri = request.uri().to_string(); let client = { let timeout = openid_connect_provider_timeout(); @@ -82,22 +82,22 @@ fn convert_openid_request( request: openidconnect::HttpRequest, client: &reqwest::Client, ) -> Result { - let request_uri = request.url.to_string(); + let request_uri = request.uri().to_string(); - let request_method = reqwest::Method::from_str(request.method.as_str()) + let request_method = reqwest::Method::from_str(request.method().as_str()) .map_err(|_| { httpclient::Error::request_build( &request_uri, - format!("invalid method: {}", request.method), + format!("invalid method: {}", request.method()), ) })?; let mut request_builder = client .request(request_method, &request_uri) - .body(request.body); + .body(request.body().to_vec()); // map openid connect headers to the request builder - for (name, value) in &request.headers { + for (name, value) in request.headers() { request_builder = request_builder.header(name.as_str(), value.as_bytes()); } @@ -159,11 +159,11 @@ async fn convert_to_openid_response( ) })?; - Ok(openidconnect::HttpResponse { - status_code: response_status, - headers: response_headers, - body: response_body.to_vec(), - }) + let mut response = + openidconnect::HttpResponse::new(response_body.to_vec()); + *response.status_mut() = response_status; + *response.headers_mut() = response_headers; + Ok(response) } fn openid_connect_provider_timeout() -> Duration { diff --git a/src/daemon/http/auth/providers/openid_connect/provider.rs b/src/daemon/http/auth/providers/openid_connect/provider.rs index 54558305..e4d84df9 100644 --- a/src/daemon/http/auth/providers/openid_connect/provider.rs +++ b/src/daemon/http/auth/providers/openid_connect/provider.rs @@ -28,9 +28,7 @@ //! [openid-connect-rpinitiated-1_0]: https://openid.net/specs/openid-connect-rpinitiated-1_0.html use std::{ - ops::Deref, - sync::Arc, - time::Instant, + ops::Deref, sync::Arc, time::Instant }; use tokio::sync::{RwLock, RwLockReadGuard}; @@ -41,15 +39,15 @@ use basic_cookies::Cookie; use hyper::header::{HeaderValue, SET_COOKIE}; use log::{debug, error, info, log_enabled, trace, warn}; use openidconnect::{ + AccessToken, AuthenticationFlow, AuthorizationCode, ClientId, ClientSecret, + CsrfToken, IssuerUrl, Nonce, OAuth2TokenResponse, RedirectUrl, + RefreshToken, RequestTokenError, RevocationErrorResponseType, + RevocationUrl, Scope, UserInfoError, core::{ CoreAuthPrompt, CoreErrorResponseType, CoreIdTokenVerifier, CoreJwsSigningAlgorithm, CoreResponseMode, CoreResponseType, CoreRevocableToken, - }, - AccessToken, AuthenticationFlow, AuthorizationCode, ClientId, - ClientSecret, CsrfToken, IssuerUrl, Nonce, OAuth2TokenResponse, - RedirectUrl, RefreshToken, RequestTokenError, - RevocationErrorResponseType, RevocationUrl, Scope, UserInfoError, + } }; use serde::{Deserialize, Serialize}; use tokio::runtime; @@ -216,7 +214,7 @@ impl AuthProvider { let meta = self.discover().await?; let (email_scope_supported, userinfo_endpoint_supported, logout_mode) = self.check_provider_capabilities(&meta)?; - let client = self.build_client(meta, &logout_mode)?; + let client = self.build_client(meta)?; let time_established = Instant::now(); let conn = ProviderConnectionProperties { client, @@ -253,7 +251,7 @@ impl AuthProvider { // Contact the OpenID Connect: identity provider discovery endpoint to // learn about and configure ourselves to talk to it. let meta = - WantedMeta::discover_async(issuer.clone(), logging_http_client) + WantedMeta::discover_async(issuer.clone(), &logging_http_client) .await .map_err(|e| { Error::custom(format!( @@ -468,7 +466,6 @@ impl AuthProvider { fn build_client( &self, meta: WantedMeta, - logout_mode: &LogoutMode, ) -> KrillResult { // Read from config the credentials we should use to authenticate // ourselves with the identity provider. These details should have @@ -515,15 +512,7 @@ impl AuthProvider { redirect_uri.as_str() ); - let mut client = client.set_redirect_uri(redirect_uri); - - if let LogoutMode::OAuth2TokenRevocation { revocation_url, .. } = - logout_mode - { - client = client.set_revocation_uri(RevocationUrl::new( - revocation_url.to_owned(), - )?); - } + let client = client.set_redirect_uri(redirect_uri); Ok(client) } @@ -557,6 +546,7 @@ impl AuthProvider { async fn try_revoke_token( &self, session: &Session, + revocation_url: String ) -> Result<(), RevocationErrorResponseType> { // Connect to the OpenID Connect provider OAuth 2.0 token revocation // endpoint to terminate the provider session @@ -586,16 +576,25 @@ impl AuthProvider { ) })?; let conn = lock_guard.deref().as_ref().unwrap(); // safe to unwrap as was tested in get_connection() - - match conn - .client + let client: FlexibleClient = conn.client.clone(); + let client = client.set_revocation_url( + RevocationUrl::new( + revocation_url, + ).map_err(|err| RevocationErrorResponseType::Basic( + CoreErrorResponseType::Extension( + format!("URL parsing failure while revoking token: {err}") + ) + ) + )? + ); + match client .revoke_token(token_to_revoke) .map_err(|err| { RevocationErrorResponseType::Basic(CoreErrorResponseType::Extension(format!( "Unexpected error while preparing to revoke token: {err}" ))) })? - .request_async(logging_http_client) + .request_async(&logging_http_client) .await { Ok(_) => Ok(()), @@ -666,8 +665,10 @@ impl AuthProvider { .client .exchange_refresh_token(&RefreshToken::new( refresh_token.to_string(), - )) - .request_async(logging_http_client) + )).map_err(|_err| { + CoreErrorResponseType::InvalidClient + })? + .request_async(&logging_http_client) .await; match token_response { @@ -937,7 +938,13 @@ impl AuthProvider { let token_response: FlexibleTokenResponse = conn .client .exchange_code(AuthorizationCode::new(code.to_string())) - .request_async(logging_http_client) + .map_err(|err| { + Self::internal_error( + "OpenID Connect: Configuration Error".to_string(), + Some(format!("{:?}", err)) + ) + })? + .request_async(&logging_http_client) .await .map_err(|e| { let (msg, additional_info) = match e { @@ -1060,7 +1067,7 @@ impl AuthProvider { // don't require the response to be signed as the spec says // signing it is optional: See: https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse .require_signed_response(false) - .request_async(logging_http_client) + .request_async(&logging_http_client) .await .map_err(|e| { let msg = match e { @@ -1813,10 +1820,12 @@ impl AuthProvider { let go_to_url = match &conn.logout_mode { LogoutMode::OAuth2TokenRevocation { + revocation_url, post_revocation_redirect_url, - .. } => { - if let Err(err) = self.try_revoke_token(&session).await { + if let Err(err) = self.try_revoke_token( + &session, revocation_url.clone() + ).await { Self::internal_error( format!( "Error while revoking token for user '{}'", diff --git a/src/daemon/http/auth/providers/openid_connect/util.rs b/src/daemon/http/auth/providers/openid_connect/util.rs index 74e3930a..8d747611 100644 --- a/src/daemon/http/auth/providers/openid_connect/util.rs +++ b/src/daemon/http/auth/providers/openid_connect/util.rs @@ -1,18 +1,19 @@ use log::{debug, error}; use openidconnect::{ + AdditionalClaims, AdditionalProviderMetadata, Client, EndpointMaybeSet, + EndpointNotSet, EndpointSet, ExtraTokenFields, IdTokenClaims, + IdTokenFields, ProviderMetadata, StandardErrorResponse, + StandardTokenResponse, UserInfoClaims, core::{ CoreAuthDisplay, CoreAuthPrompt, CoreClaimName, CoreClaimType, CoreClientAuthMethod, CoreErrorResponseType, CoreGenderClaim, - CoreGrantType, CoreJsonWebKey, CoreJsonWebKeyType, CoreJsonWebKeyUse, + CoreGrantType, CoreJsonWebKey, CoreJweContentEncryptionAlgorithm, CoreJweKeyManagementAlgorithm, CoreJwsSigningAlgorithm, CoreResponseMode, CoreResponseType, CoreRevocableToken, CoreRevocationErrorResponse, CoreSubjectIdentifierType, CoreTokenIntrospectionResponse, CoreTokenType, - }, - AdditionalClaims, AdditionalProviderMetadata, Client, ExtraTokenFields, - IdTokenClaims, IdTokenFields, ProviderMetadata, StandardErrorResponse, - StandardTokenResponse, UserInfoClaims, + } }; use serde::{Deserialize, Serialize}; @@ -37,11 +38,11 @@ use crate::commons::{error::Error, KrillResult}; // additional claims struct, serde_json would fail to deserialize it if the // the field is not present or not structured as expected. Using this approach // we can inspect the structure when we receive it from the provider. -#[derive(Serialize, Deserialize, Debug)] +#[derive(Serialize, Deserialize, Debug, Clone)] pub struct CustomerDefinedAdditionalClaims(serde_json::Value); impl AdditionalClaims for CustomerDefinedAdditionalClaims {} -#[derive(Serialize, Deserialize, Debug)] +#[derive(Serialize, Deserialize, Debug, Clone)] pub struct CustomerDefinedExtraTokenFields(serde_json::Value); impl ExtraTokenFields for CustomerDefinedExtraTokenFields {} @@ -52,26 +53,34 @@ pub type FlexibleTokenResponse = StandardTokenResponse< CoreGenderClaim, CoreJweContentEncryptionAlgorithm, CoreJwsSigningAlgorithm, - CoreJsonWebKeyType, >, CoreTokenType, >; -pub type FlexibleClient = Client< +pub type FlexibleClient< + HasAuthUrl = EndpointSet, + HasDeviceAuthUrl = EndpointNotSet, + HasIntrospectionUrl = EndpointNotSet, + HasRevocationUrl = EndpointNotSet, + HasTokenUrl = EndpointMaybeSet, + HasUserInfoUrl = EndpointMaybeSet, +> = Client< CustomerDefinedAdditionalClaims, CoreAuthDisplay, CoreGenderClaim, CoreJweContentEncryptionAlgorithm, - CoreJwsSigningAlgorithm, - CoreJsonWebKeyType, - CoreJsonWebKeyUse, CoreJsonWebKey, CoreAuthPrompt, StandardErrorResponse, FlexibleTokenResponse, - CoreTokenType, CoreTokenIntrospectionResponse, CoreRevocableToken, CoreRevocationErrorResponse, + HasAuthUrl, + HasDeviceAuthUrl, + HasIntrospectionUrl, + HasRevocationUrl, + HasTokenUrl, + HasUserInfoUrl, >; pub type FlexibleIdTokenClaims = IdTokenClaims; @@ -102,9 +111,6 @@ pub type WantedMeta = ProviderMetadata< CoreGrantType, CoreJweContentEncryptionAlgorithm, CoreJweKeyManagementAlgorithm, - CoreJwsSigningAlgorithm, - CoreJsonWebKeyType, - CoreJsonWebKeyUse, CoreJsonWebKey, CoreResponseMode, CoreResponseType,