3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

authorize: add jti to JWT payload (#1328)

Browse source
This commit is contained in:
Caleb Doxsey 2020-08-24 15:35:16 -06:00 • committed by GitHub
parent fbd8c8f294
commit 51bdf9baae
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
authorize/evaluator/evaluator.go
View file

@ -206,6 +206,7 @@ func (e *Evaluator) JWTPayload(req *Request) map[string]interface{} {
payload["aud"] = u.Hostname() payload["aud"] = u.Hostname()
} }
if s, ok := req.DataBrokerData.Get("type.googleapis.com/session.Session", req.Session.ID).(*session.Session); ok { if s, ok := req.DataBrokerData.Get("type.googleapis.com/session.Session", req.Session.ID).(*session.Session); ok {
payload["jti"] = s.GetId()
if tm, err := ptypes.Timestamp(s.GetIdToken().GetExpiresAt()); err == nil { if tm, err := ptypes.Timestamp(s.GetIdToken().GetExpiresAt()); err == nil {
payload["exp"] = tm.Unix() payload["exp"] = tm.Unix()
} }

6
authorize/evaluator/evaluator_test.go
View file

@ -153,6 +153,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
DataBrokerData: DataBrokerData{ DataBrokerData: DataBrokerData{
"type.googleapis.com/session.Session": map[string]interface{}{ "type.googleapis.com/session.Session": map[string]interface{}{
"SESSION_ID": &session.Session{ "SESSION_ID": &session.Session{
Id: "SESSION_ID",
IdToken: &session.IDToken{ IdToken: &session.IDToken{
ExpiresAt: nowPb, ExpiresAt: nowPb,
IssuedAt: nowPb, IssuedAt: nowPb,
@ -167,6 +168,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
}, },
map[string]interface{}{ map[string]interface{}{
"iss": "authn.example.com", "iss": "authn.example.com",
"jti": "SESSION_ID",
"aud": "example.com", "aud": "example.com",
"exp": now.Unix(), "exp": now.Unix(),
"iat": now.Unix(), "iat": now.Unix(),
@ -178,6 +180,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
DataBrokerData: DataBrokerData{ DataBrokerData: DataBrokerData{
"type.googleapis.com/session.Session": map[string]interface{}{ "type.googleapis.com/session.Session": map[string]interface{}{
"SESSION_ID": &session.Session{ "SESSION_ID": &session.Session{
Id: "SESSION_ID",
UserId: "USER_ID", UserId: "USER_ID",
}, },
}, },
@ -196,6 +199,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
}, },
map[string]interface{}{ map[string]interface{}{
"iss": "authn.example.com", "iss": "authn.example.com",
"jti": "SESSION_ID",
"aud": "example.com", "aud": "example.com",
"sub": "USER_ID", "sub": "USER_ID",
"user": "USER_ID", "user": "USER_ID",
@ -208,6 +212,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
DataBrokerData: DataBrokerData{ DataBrokerData: DataBrokerData{
"type.googleapis.com/session.Session": map[string]interface{}{ "type.googleapis.com/session.Session": map[string]interface{}{
"SESSION_ID": &session.Session{ "SESSION_ID": &session.Session{
Id: "SESSION_ID",
UserId: "USER_ID", UserId: "USER_ID",
}, },
}, },
@ -237,6 +242,7 @@ func TestEvaluator_JWTPayload(t *testing.T) {
}, },
map[string]interface{}{ map[string]interface{}{
"iss": "authn.example.com", "iss": "authn.example.com",
"jti": "SESSION_ID",
"aud": "example.com", "aud": "example.com",
"groups": []string{"group1", "group2", "admin", "test"}, "groups": []string{"group1", "group2", "admin", "test"},
}, },