mirror of
https://github.com/coder/coder.git
synced 2025-07-03 16:13:58 +00:00
f0c9c4dbcd
This pull request implements RFC 8707, Resource Indicators for OAuth 2.0 (https://datatracker.ietf.org/doc/html/rfc8707), to enhance the security of our OAuth 2.0 provider. This change enables proper audience validation and binds access tokens to their intended resource, which is crucial for preventing token misuse in multi-tenant environments or deployments with multiple resource servers. ## Key Changes: * Resource Parameter Support: Adds support for the resource parameter in both the authorization (`/oauth2/authorize`) and token (`/oauth2/token`) endpoints, allowing clients to specify the intended resource server. * Audience Validation: Implements server-side validation to ensure that the resource parameter provided during the token exchange matches the one from the authorization request. * API Middleware Enforcement: Introduces a new validation step in the API authentication middleware (`coderd/httpmw/apikey.go`) to verify that the audience of the access token matches the resource server being accessed. * Database Schema Updates: * Adds a `resource_uri` column to the `oauth2_provider_app_codes` table to store the resource requested during authorization. * Adds an `audience` column to the `oauth2_provider_app_tokens` table to bind the issued token to a specific audience. * Enhanced PKCE: Includes a minor enhancement to the PKCE implementation to protect against timing attacks. * Comprehensive Testing: Adds extensive new tests to `coderd/oauth2_test.go` to cover various RFC 8707 scenarios, including valid flows, mismatched resources, and refresh token validation. ## How it Works: 1. An OAuth2 client specifies the target resource (e.g., https://coder.example.com) using the resource parameter in the authorization request. 2. The authorization server stores this resource URI with the authorization code. 3. During the token exchange, the server validates that the client provides the same resource parameter. 4. The server issues an access token with an audience claim set to the validated resource URI. 5. When the client uses the access token to call an API endpoint, the middleware verifies that the token's audience matches the URL of the Coder deployment, rejecting any tokens intended for a different resource. This ensures that a token issued for one Coder deployment cannot be used to access another, significantly strengthening our authentication security. --- Change-Id: I3924cb2139e837e3ac0b0bd40a5aeb59637ebc1b Signed-off-by: Thomas Kosiewski <tk@coder.com>
167 lines
3.8 KiB
SQL
167 lines
3.8 KiB
SQL
-- name: GetOAuth2ProviderApps :many
|
|
SELECT * FROM oauth2_provider_apps ORDER BY (name, id) ASC;
|
|
|
|
-- name: GetOAuth2ProviderAppByID :one
|
|
SELECT * FROM oauth2_provider_apps WHERE id = $1;
|
|
|
|
-- name: InsertOAuth2ProviderApp :one
|
|
INSERT INTO oauth2_provider_apps (
|
|
id,
|
|
created_at,
|
|
updated_at,
|
|
name,
|
|
icon,
|
|
callback_url,
|
|
redirect_uris,
|
|
client_type,
|
|
dynamically_registered
|
|
) VALUES(
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateOAuth2ProviderAppByID :one
|
|
UPDATE oauth2_provider_apps SET
|
|
updated_at = $2,
|
|
name = $3,
|
|
icon = $4,
|
|
callback_url = $5,
|
|
redirect_uris = $6,
|
|
client_type = $7,
|
|
dynamically_registered = $8
|
|
WHERE id = $1 RETURNING *;
|
|
|
|
-- name: DeleteOAuth2ProviderAppByID :exec
|
|
DELETE FROM oauth2_provider_apps WHERE id = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppSecretByID :one
|
|
SELECT * FROM oauth2_provider_app_secrets WHERE id = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppSecretsByAppID :many
|
|
SELECT * FROM oauth2_provider_app_secrets WHERE app_id = $1 ORDER BY (created_at, id) ASC;
|
|
|
|
-- name: GetOAuth2ProviderAppSecretByPrefix :one
|
|
SELECT * FROM oauth2_provider_app_secrets WHERE secret_prefix = $1;
|
|
|
|
-- name: InsertOAuth2ProviderAppSecret :one
|
|
INSERT INTO oauth2_provider_app_secrets (
|
|
id,
|
|
created_at,
|
|
secret_prefix,
|
|
hashed_secret,
|
|
display_secret,
|
|
app_id
|
|
) VALUES(
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateOAuth2ProviderAppSecretByID :one
|
|
UPDATE oauth2_provider_app_secrets SET
|
|
last_used_at = $2
|
|
WHERE id = $1 RETURNING *;
|
|
|
|
-- name: DeleteOAuth2ProviderAppSecretByID :exec
|
|
DELETE FROM oauth2_provider_app_secrets WHERE id = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppCodeByID :one
|
|
SELECT * FROM oauth2_provider_app_codes WHERE id = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppCodeByPrefix :one
|
|
SELECT * FROM oauth2_provider_app_codes WHERE secret_prefix = $1;
|
|
|
|
-- name: InsertOAuth2ProviderAppCode :one
|
|
INSERT INTO oauth2_provider_app_codes (
|
|
id,
|
|
created_at,
|
|
expires_at,
|
|
secret_prefix,
|
|
hashed_secret,
|
|
app_id,
|
|
user_id,
|
|
resource_uri,
|
|
code_challenge,
|
|
code_challenge_method
|
|
) VALUES(
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9,
|
|
$10
|
|
) RETURNING *;
|
|
|
|
-- name: DeleteOAuth2ProviderAppCodeByID :exec
|
|
DELETE FROM oauth2_provider_app_codes WHERE id = $1;
|
|
|
|
-- name: DeleteOAuth2ProviderAppCodesByAppAndUserID :exec
|
|
DELETE FROM oauth2_provider_app_codes WHERE app_id = $1 AND user_id = $2;
|
|
|
|
-- name: InsertOAuth2ProviderAppToken :one
|
|
INSERT INTO oauth2_provider_app_tokens (
|
|
id,
|
|
created_at,
|
|
expires_at,
|
|
hash_prefix,
|
|
refresh_hash,
|
|
app_secret_id,
|
|
api_key_id,
|
|
user_id,
|
|
audience
|
|
) VALUES(
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9
|
|
) RETURNING *;
|
|
|
|
-- name: GetOAuth2ProviderAppTokenByPrefix :one
|
|
SELECT * FROM oauth2_provider_app_tokens WHERE hash_prefix = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppTokenByAPIKeyID :one
|
|
SELECT * FROM oauth2_provider_app_tokens WHERE api_key_id = $1;
|
|
|
|
-- name: GetOAuth2ProviderAppsByUserID :many
|
|
SELECT
|
|
COUNT(DISTINCT oauth2_provider_app_tokens.id) as token_count,
|
|
sqlc.embed(oauth2_provider_apps)
|
|
FROM oauth2_provider_app_tokens
|
|
INNER JOIN oauth2_provider_app_secrets
|
|
ON oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id
|
|
INNER JOIN oauth2_provider_apps
|
|
ON oauth2_provider_apps.id = oauth2_provider_app_secrets.app_id
|
|
WHERE
|
|
oauth2_provider_app_tokens.user_id = $1
|
|
GROUP BY
|
|
oauth2_provider_apps.id;
|
|
|
|
-- name: DeleteOAuth2ProviderAppTokensByAppAndUserID :exec
|
|
DELETE FROM
|
|
oauth2_provider_app_tokens
|
|
USING
|
|
oauth2_provider_app_secrets
|
|
WHERE
|
|
oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id
|
|
AND oauth2_provider_app_secrets.app_id = $1
|
|
AND oauth2_provider_app_tokens.user_id = $2;
|