Skip to content
This repository was archived by the owner on Sep 17, 2022. It is now read-only.

Commit 16e723e

Browse files
f-marinof-marino
authored
Merge pull request #130 from ldsec/go1.15
Getting ready for v3.0.0 release
2 parents 9cabcdd + f97ce16 commit 16e723e

File tree

7 files changed

+189
-112
lines changed

7 files changed

+189
-112
lines changed

‎.github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
- name: Set up Go
1414
uses: actions/setup-go@v2
1515
with:
16-
go-version: '1.14'
16+
go-version: '1.15'
1717
- run: go version
1818

1919
- name: Checkout code

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
MEDCO_VERSION := $(shell scripts/version.sh)
2-
GB_VERSION := v2.0.1
2+
GB_VERSION := v3.0.0
33

44
# test commands
55
.PHONY: test test_go_fmt test_go_lint test_codecov_unit test_codecov_e2e

‎build/package/medco/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.14 as build
1+
FROM golang:1.15 as build
22
ARG MEDCO_VERSION=dev
33

44
COPY ./ /src

‎connector/util/server/oidc_provider.go

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package utilserver
22

33
import (
4+
"context"
45
"errors"
56
"github.com/lestrrat-go/jwx/jwk"
67
"github.com/lestrrat-go/jwx/jws"
@@ -33,19 +34,20 @@ type oidcProvider struct {
3334

3435
// cachedJWKSet is the cached set of keys used to establish the trust with the identity provider,
3536
// valid until cachedJWKSetExpiration
36-
cachedJWKSet *jwk.Set
37+
cachedJWKSet jwk.Set
3738

3839
// cachedJWKSetExpiration is the expiration time of cachedJWKSet
3940
cachedJWKSetExpiration time.Time
4041
}
4142

4243
// retrieveJWKSets retrieves the JWK set (live or from cache if TTL not expired) and cache it
43-
func (oidcProvider *oidcProvider) retrieveJWKSet() (keySet *jwk.Set, err error) {
44+
func (oidcProvider *oidcProvider) retrieveJWKSet() (keySet jwk.Set, err error) {
4445

4546
if oidcProvider.cachedJWKSet == nil || oidcProvider.cachedJWKSetExpiration.Before(time.Now()) {
4647

4748
// fetch jwks with custom client to enforce timeout
4849
oidcProvider.cachedJWKSet, err = jwk.Fetch(
50+
context.Background(),
4951
oidcProvider.JwksURL,
5052
jwk.WithHTTPClient(&http.Client{
5153
Timeout: JwksTimeout,
@@ -82,7 +84,7 @@ func verifyTokenWithJWKSets(token string) (tokenPayload []byte, matchingProvider
8284
}
8385

8486
// signature verification attempt
85-
if attemptedTokenPayload, err := jws.VerifyWithJWKSet([]byte(token), keySet, nil); err == nil {
87+
if attemptedTokenPayload, err := jws.VerifySet([]byte(token), keySet); err == nil {
8688
logrus.Info("Token validation successful with provider: ", provider.JwksURL)
8789
if tokenPayload != nil || matchingProvider != nil {
8890
logrus.Warn("More than one OIDC provider matches")

‎connector/util/server/security.go

+5-11
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package utilserver
22

33
import (
4-
"encoding/json"
54
"errors"
65
"github.com/ldsec/medco/connector/restapi/models"
76
"github.com/lestrrat-go/jwx/jwt"
@@ -31,19 +30,14 @@ func AuthenticateUser(token string) (user *models.User, err error) {
3130
}
3231

3332
// parse and validate claims
34-
var parsedToken jwt.Token
35-
if err = json.Unmarshal(tokenPayload, &parsedToken); err != nil {
36-
logrus.Warn("authentication failed (token parsing error): ", err)
37-
return
38-
}
39-
40-
err = parsedToken.Verify(
33+
parsedToken, err := jwt.Parse(
34+
tokenPayload,
4135
jwt.WithIssuer(matchingProvider.JwtIssuer),
4236
jwt.WithAudience(matchingProvider.ClientID),
4337
jwt.WithAcceptableSkew(matchingProvider.JwtAcceptableSkew),
4438
)
4539
if err != nil {
46-
logrus.Warn("authentication failed (invalid claim): ", err)
40+
logrus.Warn("authentication failed): ", err)
4741
return
4842
}
4943

@@ -59,12 +53,12 @@ func AuthenticateUser(token string) (user *models.User, err error) {
5953
}
6054

6155
// extract user authorizations
62-
user.Authorizations, err = extractAuthorizationsFromToken(&parsedToken, matchingProvider)
56+
user.Authorizations, err = extractAuthorizationsFromToken(parsedToken, matchingProvider)
6357
return
6458
}
6559

6660
// extractAuthorizationsFromToken parsed the token to extract the user's authorizations
67-
func extractAuthorizationsFromToken(token *jwt.Token, provider *oidcProvider) (ua *models.UserAuthorizations, err error) {
61+
func extractAuthorizationsFromToken(token jwt.Token, provider *oidcProvider) (ua *models.UserAuthorizations, err error) {
6862

6963
// retrieve roles, within the keycloak pre-determined structure (this is ugly)
7064
var extractedRoles []string

‎go.mod

+29-30
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,38 @@
11
module github.com/ldsec/medco
22

33
require (
4-
github.com/BurntSushi/toml v0.3.1
5-
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect
6-
github.com/daviddengcn/go-colortext v1.0.0 // indirect
4+
github.com/BurntSushi/toml v0.4.1
5+
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
6+
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 // indirect
77
github.com/fanliao/go-concurrentMap v0.0.0-20141114143905-7d2d7a5ea67b
8-
github.com/go-openapi/errors v0.19.7
9-
github.com/go-openapi/loads v0.19.5
10-
github.com/go-openapi/runtime v0.19.22
11-
github.com/go-openapi/spec v0.19.9
12-
github.com/go-openapi/strfmt v0.19.5
13-
github.com/go-openapi/swag v0.19.9
14-
github.com/go-openapi/validate v0.19.11
15-
github.com/gorilla/websocket v1.4.2 // indirect
16-
github.com/jessevdk/go-flags v1.4.0
17-
github.com/ldsec/unlynx v1.4.1
18-
github.com/lestrrat-go/jwx v0.9.0
19-
github.com/lib/pq v1.8.0
20-
github.com/mailru/easyjson v0.7.6 // indirect
21-
github.com/mitchellh/mapstructure v1.3.3 // indirect
8+
github.com/go-openapi/analysis v0.21.1 // indirect
9+
github.com/go-openapi/errors v0.20.1
10+
github.com/go-openapi/loads v0.21.0
11+
github.com/go-openapi/runtime v0.21.0
12+
github.com/go-openapi/spec v0.20.4
13+
github.com/go-openapi/strfmt v0.21.1
14+
github.com/go-openapi/swag v0.19.15
15+
github.com/go-openapi/validate v0.20.3
16+
github.com/go-stack/stack v1.8.1 // indirect
17+
github.com/jessevdk/go-flags v1.5.0
18+
github.com/ldsec/unlynx v1.4.3
19+
github.com/lestrrat-go/jwx v1.2.13
20+
github.com/lib/pq v1.10.4
21+
github.com/mailru/easyjson v0.7.7 // indirect
22+
github.com/mitchellh/mapstructure v1.4.3 // indirect
2223
github.com/pkg/errors v0.9.1
2324
github.com/r0fls/gostats v0.0.0-20180711082619-e793b1fda35c
24-
github.com/sirupsen/logrus v1.6.0
25-
github.com/smartystreets/goconvey v1.6.4 // indirect
26-
github.com/stretchr/testify v1.6.1
27-
github.com/urfave/cli v1.22.4
28-
go.dedis.ch/kyber/v3 v3.0.12
29-
go.dedis.ch/onet/v3 v3.2.0
30-
go.etcd.io/bbolt v1.3.5 // indirect
31-
go.mongodb.org/mongo-driver v1.5.1 // indirect
32-
golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a // indirect
33-
golang.org/x/net v0.0.0-20211201190559-0a0e4e1bb54c
34-
golang.org/x/text v0.3.7 // indirect
25+
github.com/sirupsen/logrus v1.8.1
26+
github.com/stretchr/testify v1.7.0
27+
github.com/urfave/cli v1.22.5
28+
go.dedis.ch/kyber/v3 v3.0.13
29+
go.dedis.ch/onet/v3 v3.2.10
30+
go.mongodb.org/mongo-driver v1.8.1 // indirect
31+
golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b // indirect
32+
golang.org/x/net v0.0.0-20211209124913-491a49abca63
33+
golang.org/x/sys v0.0.0-20211214170744-3b038e5940ed // indirect
3534
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
36-
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
35+
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
3736
)
3837

39-
go 1.14
38+
go 1.15

0 commit comments

Comments
 (0)