3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-02 00:10:45 +02:00
Code Issues Projects Releases Packages Wiki Activity

oidc: fix token revocation (#3810)

Browse source
This commit is contained in:
Caleb Doxsey 2022-12-16 13:24:40 -07:00 • committed by github-actions[bot]
parent 0b3d4f3a6f
commit 73d8900c47
2 changed files with 79 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

24
internal/identity/oidc/oidc.go
View file

@ -176,6 +176,11 @@ func (p *Provider) UpdateUserInfo(ctx context.Context, t *oauth2.Token, v interf
// Group membership is also refreshed.
// https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens
func (p *Provider) Refresh(ctx context.Context, t *oauth2.Token, v identity.State) (*oauth2.Token, error) {
oa, err := p.GetOauthConfig()
if err != nil {
return nil, err
}
if t == nil {
return nil, ErrMissingAccessToken
}
@ -183,11 +188,6 @@ func (p *Provider) Refresh(ctx context.Context, t *oauth2.Token, v identity.Stat
return nil, ErrMissingRefreshToken
}
oa, err := p.GetOauthConfig()
if err != nil {
return nil, err
}
newToken, err := oa.TokenSource(ctx, t).Token()
if err != nil {
return nil, fmt.Errorf("identity/oidc: refresh failed: %w", err)
@ -230,6 +230,11 @@ func (p *Provider) getIDToken(ctx context.Context, t *oauth2.Token) (*go_oidc.ID
//
// https://tools.ietf.org/html/rfc7009#section-2.1
func (p *Provider) Revoke(ctx context.Context, t *oauth2.Token) error {
oa, err := p.GetOauthConfig()
if err != nil {
return err
}
if p.RevocationURL == "" {
return ErrRevokeNotImplemented
}
@ -237,11 +242,6 @@ func (p *Provider) Revoke(ctx context.Context, t *oauth2.Token) error {
return ErrMissingAccessToken
}
oa, err := p.GetOauthConfig()
if err != nil {
return err
}
params := url.Values{}
params.Add("token", t.AccessToken)
params.Add("token_type_hint", "access_token")
@ -263,6 +263,10 @@ func (p *Provider) Revoke(ctx context.Context, t *oauth2.Token) error {
// session to be initiated.
// https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPInitiated
func (p *Provider) LogOut() (*url.URL, error) {
_, err := p.GetProvider()
if err != nil {
return nil, err
}
if p.EndSessionURL == "" {
return nil, ErrSignoutNotImplemented
}