4 local sasl = require "util.sasl"; |
4 local sasl = require "util.sasl"; |
5 |
5 |
6 -- TODO -- local issuer_identity = module:get_option_string("oauth_external_issuer"); |
6 -- TODO -- local issuer_identity = module:get_option_string("oauth_external_issuer"); |
7 local oidc_discovery_url = module:get_option_string("oauth_external_discovery_url") |
7 local oidc_discovery_url = module:get_option_string("oauth_external_discovery_url") |
8 local validation_endpoint = module:get_option_string("oauth_external_validation_endpoint"); |
8 local validation_endpoint = module:get_option_string("oauth_external_validation_endpoint"); |
|
9 local token_endpoint = module:get_option_string("oauth_external_token_endpoint"); |
9 |
10 |
10 local username_field = module:get_option_string("oauth_external_username_field", "preferred_username"); |
11 local username_field = module:get_option_string("oauth_external_username_field", "preferred_username"); |
|
12 local allow_plain = module:get_option_boolean("oauth_external_resource_owner_password", true); |
11 |
13 |
12 -- XXX Hold up, does whatever done here even need any of these things? Are we |
14 -- XXX Hold up, does whatever done here even need any of these things? Are we |
13 -- the OAuth client? Is the XMPP client the OAuth client? What are we??? |
15 -- the OAuth client? Is the XMPP client the OAuth client? What are we??? |
14 -- TODO -- local client_id = module:get_option_string("oauth_external_client_id"); |
16 local client_id = module:get_option_string("oauth_external_client_id"); |
15 -- TODO -- local client_secret = module:get_option_string("oauth_external_client_secret"); |
17 -- TODO -- local client_secret = module:get_option_string("oauth_external_client_secret"); |
16 |
18 |
17 --[[ More or less required endpoints |
19 --[[ More or less required endpoints |
18 digraph "oauth endpoints" { |
20 digraph "oauth endpoints" { |
19 issuer -> discovery -> { registration validation } |
21 issuer -> discovery -> { registration validation } |
27 |
29 |
28 function provider.get_sasl_handler() |
30 function provider.get_sasl_handler() |
29 local profile = {}; |
31 local profile = {}; |
30 profile.http_client = http.default; -- TODO configurable |
32 profile.http_client = http.default; -- TODO configurable |
31 local extra = { oidc_discovery_url = oidc_discovery_url }; |
33 local extra = { oidc_discovery_url = oidc_discovery_url }; |
|
34 if token_endpoint and allow_plain then |
|
35 local map_username = function (username, _realm) return username; end; --jid.join; -- TODO configurable |
|
36 function profile:plain_test(username, password, realm) |
|
37 local tok, err = async.wait_for(self.profile.http_client:request(token_endpoint, { |
|
38 headers = { ["Content-Type"] = "application/x-www-form-urlencoded; charset=utf-8"; ["Accept"] = "application/json" }; |
|
39 body = http.formencode({ |
|
40 grant_type = "password"; |
|
41 client_id = client_id; |
|
42 username = map_username(username, realm); |
|
43 password = password; |
|
44 scope = "openid"; |
|
45 }); |
|
46 })) |
|
47 if err or not (tok.code >= 200 and tok.code < 300) then |
|
48 return false, nil; |
|
49 end |
|
50 local token_resp = json.decode(tok.body); |
|
51 if not token_resp or string.lower(token_resp.token_type or "") ~= "bearer" then |
|
52 return false, nil; |
|
53 end |
|
54 local ret, err = async.wait_for(self.profile.http_client:request(validation_endpoint, |
|
55 { headers = { ["Authorization"] = "Bearer " .. token_resp.access_token; ["Accept"] = "application/json" } })); |
|
56 if err then |
|
57 return false, nil; |
|
58 end |
|
59 if not (ret.code >= 200 and ret.code < 300) then |
|
60 return false, nil; |
|
61 end |
|
62 local response = json.decode(ret.body); |
|
63 if type(response) ~= "table" or (response[username_field]) ~= username then |
|
64 return false, nil, nil; |
|
65 end |
|
66 if response.jid then |
|
67 self.username, self.realm, self.resource = jid.prepped_split(response.jid, true); |
|
68 end |
|
69 self.role = response.role; |
|
70 self.token_info = response; |
|
71 return true, true; |
|
72 end |
|
73 end |
32 function profile:oauthbearer(token) |
74 function profile:oauthbearer(token) |
33 if token == "" then |
75 if token == "" then |
34 return false, nil, extra; |
76 return false, nil, extra; |
35 end |
77 end |
36 |
78 |