some cleanup and fix group validation

Author: Jusshersmith

internal/auth/providers/okta.go

@@ -24,9 +24,14 @@ import (
 type OktaProvider struct {
 	*ProviderData
 	StatsdClient *statsd.Client
-	// AdminService AdminService
-	cb          *circuit.Breaker
-	GroupsCache groups.MemberSetCache
+	cb           *circuit.Breaker
+	GroupsCache  groups.MemberSetCache
+}
+
+type UserInfoResponse struct {
+	EmailAddress  string   `json:"email"`
+	EmailVerified bool     `json:"email_verified"`
+	Groups        []string `json:"groups"`
 }
 
 // NewOktaProvider returns a new OktaProvider and sets the provider url endpoints.
@@ -80,7 +85,7 @@ func NewOktaProvider(p *ProviderData, orgName string) (*OktaProvider, error) {
 	}
 	if p.Scope == "" {
 		// https://developer.okta.com/docs/api/resources/oidc/#authorize
-		p.Scope = "openid profile email email_verified"
+		p.Scope = "openid profile email groups"
 	}
 
 	oktaProvider := &OktaProvider{
@@ -100,27 +105,6 @@ func NewOktaProvider(p *ProviderData, orgName string) (*OktaProvider, error) {
 	return oktaProvider, nil
 }
 
-// SetStatsdClient sets the okta provider and admin service statsd client
-//func (p *OktaProvider) SetStatsdClient(statsdClient *statsd.Client) {
-//	logger := log.NewLogEntry()
-//
-//	p.StatsdClient = statsdClient
-//
-//	switch s := p.AdminService.(type) {
-//	case *OktaAdminService:
-//		s.StatsdClient = statsdClient
-//	default:
-//		logger.Info("admin service does not have statsd client")
-//	}
-
-//	switch g := p.GroupsCache.(type) {
-//	case *groups.FillCache:
-//		g.StatsdClient = statsdClient
-//	default:
-//		logger.Info("groups cache does not have statsd client")
-//	}
-//}
-
 // ValidateSessionState attempts to validate the session state's access token.
 func (p *OktaProvider) ValidateSessionState(s *sessions.SessionState) bool {
 	return validateToken(p, s.AccessToken, p.ClientID, p.ClientSecret, nil)
@@ -132,9 +116,6 @@ func (p *OktaProvider) GetSignInURL(redirectURI, state string) string {
 	a = *p.SignInURL
 	params, _ := url.ParseQuery(a.RawQuery)
 	params.Set("redirect_uri", redirectURI)
-	// https://developer.okta.com/docs/api/resources/oidc/#parameter-details
-	//params.Set("prompt", p.ApprovalPrompt)
-	// params.Add("nonce", nonce)
 	params.Add("scope", p.Scope)
 	params.Set("client_id", p.ClientID)
 	params.Add("response_mode", "query")
@@ -226,36 +207,6 @@ func (p *OktaProvider) oktaRequest(method, endpoint string, params url.Values, t
 	return nil
 }
 
-func emailFromIDTokenOkta(idToken []string) (string, error) {
-
-	// id_token is a base64 encode ID token payload
-	// https://developers.okta.com/accounts/docs/OAuth2Login#obtainuserinfo
-	//jwt := strings.Split(idToken, ".")
-	//b, err := jwtDecodeSegmentOkta(jwt[1])
-	//if err != nil {
-	//	return "", err
-	//}
-
-	//var email struct {
-	//		Email         string `json:"email"`
-	//	EmailVerified bool   `json:"email_verified"`
-	//}
-	//err = json.Unmarshal(b, &email)
-	//if err != nil {
-	//	return "", err
-	//}
-	//if email.Email == "" {
-	//	return "", errors.New("missing email")
-	//}
-	// TESTING: added for test purposes
-	//added 'b' output as well for debugging
-	//if !email.EmailVerified {
-	//	return email.Email, nil
-	//	return "", fmt.Errorf("email %s not listed as verified: %s", email.Email, b)
-	//}
-	return "test", nil
-}
-
 func jwtDecodeSegmentOkta(seg string) ([]byte, error) {
 	if l := len(seg) % 4; l > 0 {
 		seg += strings.Repeat("=", 4-l)
@@ -313,7 +264,7 @@ func (p *OktaProvider) Redeem(redirectURL, code string) (*sessions.SessionState,
 		return nil, err
 	}
 	var email string
-	email, err = p.UserInfo(response.AccessToken)
+	email, err = p.verifyEmailWithAccessToken(response.AccessToken)
 	if err != nil {
 		return nil, err
 	}
@@ -327,83 +278,68 @@ func (p *OktaProvider) Redeem(redirectURL, code string) (*sessions.SessionState,
 	}, nil
 }
 
-func (p *OktaProvider) UserInfo(access_token string) (string, error) {
-	if access_token == "" {
+func (p *OktaProvider) verifyEmailWithAccessToken(AccessToken string) (string, error) {
+	if AccessToken == "" {
 		return "", ErrBadRequest
 	}
-	var bearer = "Bearer " + access_token
-	header := http.Header{}
-	header.Set("Authorization", bearer)
 
-	var response struct {
-		EmailAddress  string `json:"email"`
-		EmailVerified bool   `json:"email_verified"`
-	}
-	err := p.oktaRequest("GET", p.UserInfoURL.String(), nil, []string{"tags", "test"}, header, &response)
+	userinfo, err := p.UserInfo(AccessToken)
 	if err != nil {
 		return "", err
 	}
-	if response.EmailAddress == "" {
+	if userinfo.EmailAddress == "" {
 		return "", errors.New("missing email")
 	}
-	if !response.EmailVerified {
-		return "", fmt.Errorf("email %s not listed as verified", response.EmailAddress)
+	if !userinfo.EmailVerified {
+		return "", fmt.Errorf("email %s not listed as verified", userinfo.EmailAddress)
 	}
 
-	return response.EmailAddress, nil
+	return userinfo.EmailAddress, nil
 }
 
-// PopulateMembers is the fill function for the groups cache
-//func (p *OktaProvider) PopulateMembers(group string) (groups.MemberSet, error) {
-//	members, err := p.AdminService.ListMemberships(group, 4)
-//	if err != nil {
-//		return nil, err
-//	}
-//	memberSet := map[string]struct{}{}
-//	for _, member := range members {
-//		memberSet[member] = struct{}{}
-//	}
-//	return memberSet, nil
-//}
-
-// ValidateGroupMembership takes in an email and the allowed groups and returns the groups that the email is part of in that list.
-// If `allGroups` is an empty list, returns an empty list.
-//
-
-func (p *OktaProvider) ValidateGroupMembership(email string, allGroups []string) ([]string, error) {
-	logger := log.NewLogEntry()
-
-	groups := []string{}
-
-	//var useGroupsResource bool
+func (p *OktaProvider) ValidateGroupMembership(email string, allowedGroups []string, accessToken string) ([]string, error) {
+	if accessToken == "" {
+		return nil, ErrBadRequest
+	}
 
-	// if `allGroups` is empty, we return an empty list
-	if len(allGroups) == 0 {
+	if len(allowedGroups) == 0 {
 		return []string{}, nil
 	}
 
-	// iterate over the groups, if a set isn't populated only call the GroupsResource once and check all groups
-	for _, group := range allGroups {
-		memberSet, ok := p.GroupsCache.Get(group)
-		if !ok {
-			//useGroupsResource = true
-			if started := p.GroupsCache.RefreshLoop(group); started {
-				logger.WithUserGroup(group).Info(
-					"no member set cached for group; refresh loops started")
-				p.StatsdClient.Incr("cache_refresh_loop", []string{"action:profile", fmt.Sprintf("group:%s", group)}, 1.0)
+	userinfo, err := p.UserInfo(accessToken)
+	if err != nil {
+		return nil, err
+	}
+	if len(userinfo.Groups) == 0 {
+		return nil, fmt.Errorf("no groups found")
+	}
+
+	matchingGroups := []string{}
+	for _, x := range allowedGroups {
+		for _, y := range userinfo.Groups {
+			if x == y {
+				matchingGroups = append(matchingGroups, x)
 			}
 		}
-		if _, exists := memberSet[email]; exists {
-			groups = append(groups, group)
-		}
 	}
+	return matchingGroups, nil
+}
 
-	//	// if a cached member set was not populated, use the groups resource to get all the groups and filter out the ones that are in `allGroups`
-	//	if useGroupsResource {
-	//		return p.AdminService.CheckMemberships(allGroups, email)
-	//	}
-	return groups, nil
+func (p *OktaProvider) UserInfo(AccessToken string) (*UserInfoResponse, error) {
+	response := &UserInfoResponse{}
+	if AccessToken == "" {
+		return nil, ErrBadRequest
+	}
+	var bearer = "Bearer " + AccessToken
+	header := http.Header{}
+	header.Set("Authorization", bearer)
+
+	err := p.oktaRequest("GET", p.UserInfoURL.String(), nil, []string{"tags", "test"}, header, &response)
+	if err != nil {
+		return nil, err
+	}
 
+	return response, nil
 }
 
 // RefreshSessionIfNeeded takes in a SessionState and