Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OIDC: Sessions #15030

Draft
wants to merge 47 commits into
base: main
Choose a base branch
from
Draft

OIDC: Sessions #15030

wants to merge 47 commits into from

Conversation

markylaing
Copy link
Contributor

This is for discussion and would add direct support for Entra ID and ADFS (#14174 #14175). It:

  • Adds logic to set a JWT as a cookie after successfully logging in (both via CLI and UI).
  • The JWT is signed using a key derived from the cluster-wide key (added in OIDC: Cluster-wide key and salt for cookie encryption #15011) using the session ID as a salt.
  • The session ID is saved both in the token itself ("sub" claim) and also in the metadata for the identity.
  • The identity metadata for OIDC identities now contains fields for the refresh token, for identity provider groups, and for a boolean to indicate if the session has been revoked. These are updated whenever a session times out.
  • Sessions can be revoked by session the session_terminated field in the identity metadata to true. I haven't implemented an API endpoint for this but it should be easy to do.
  • Adds a new config key oidc.session.lifetime, which determines the expiry of the JWTs issued by LXD.
  • Updates the OIDC Verifier to return an *api.IdentityInfo or error. This is set in the request context so that authorization can account for effective groups (LXD and IdP groups). The OIDC Verifier performs DB queries only when the user has authenticated.
  • Removes reliance on the identity cache for authorization. It is now used only for mTLS authentication.
  • Updates the Authenticate function in daemon.go to add an *api.IdentityInfo and *api.Certificate to the request context when appropriate. (Again, DB calls are made only when the caller has authenticated).
  • Updates the client and lxc/config to handle session cookies (and saves cookies on disk on exit).

@markylaing
api: Add secret_lifetime API extension.
82b3b31 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/cluster/config: Add secret lifetime config keys.
bbbadd1 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
doc: Update metadata
1d5409a 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/db/cluster/secret: Add secret package.
1488f9a 
Adds utils for managing a cluster wide secret and salt.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/config: Ignore volatile.secret.* keys in config map.
190e1b1 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/cluster/config: Add method to get key and salt lifetimes.
4e1766f 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Add getClusterSecret function to Daemon.
ff45af4 
This function, in combination with `clusterSecretInternal`,
can be used to get a cluster-wide shared secret on demand.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Unset (*Daemon).clusterSecretInternal on cluster join.
ff5b87e 
We need to unset any previously configured value so that the joining
daemon will fetch the shared secret on the next call to
`(*Daemon).getClusterSecret`.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Invalidate the key/salt when their lifetime is changed.
6555775 
To do this, we need to delete the database entry first, then reset
the `(*Daemon).clusterSecretInternal` so that new ones are generated
when required. We only delete the database entries once, from the member
that received the request.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Update Verifier to use cluster-wide secret.
d970ddf 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Optionally pass host and context to NewVerifier.
79be02d 
This change allows the verifier to perform OIDC discovery when
it is created (on config change). Users will get faster feedback
if their OIDC configuration is incorrect.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Update calls to NewVerifier.
8d628ad 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Allow usage of older relying parties for /oidc/callback.
d632561 
This PR changes the `relyingParty` field to a slice of relying parties
associated with the time at which they became outdated.

In /oidc/callback, we use any available relying party that can decrypt
the state cookie (and therefore complete the flow).

Relying parties are only kept around for 5 minutes.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
test/suites: Test enforcement of issuer URL being compatible with dis…
5d72a2b 
…covery.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
api: Add oidc_sessions API extension.
4c7628a 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
gomod: Add dependencies.
1c5e998 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Add refresh token and session ID to authentication res…
d712351 
…ult.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Add SessionHandler type.
2071226 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/db/cluster: Add methods for getting identity info.
911c55e 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/db/oidc: Add SessionHandler implementation.
db85d2d 
Signed-off-by: Mark Laing <[email protected]>
@github-actions github-actions bot added Documentation Documentation needs updating API Changes to the REST API labels Feb 19, 2025
@markylaing
lxd/cluster/config: Add oidc.session.lifetime config key.
ab869a5 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
doc: Update metadata.
eea8b64 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Update NewVerifier with session lifetime/handler and c…
01e63aa 
…luster cert fingerprint.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Update OIDC config and NewVerifier calls.
ec0b4b6 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Move cookie and encryption handling to other files.
911b058 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Update authorization code flow to set session cookie.
bcdef2c 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Update IsRequest to check session cookie.
dfb6459 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/oidc: Update OIDC Verifier to use sessions.
3c5a422 
Note: I'll need to split this commit. I didn't because the
diff was horrible, but I'll get to it.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/identity: Strip the identity cache back to only contain certifica…
c7a1d15 
…tes.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Change updateIdentityCache to only add certificates.
6709ed1 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Update calls to identity cache.
abbd34e 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Update tests using the identity cache.
f79f3ff 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth/drivers: Remove identity cache from authorizers.
a6bd085 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/auth: Remove identity cache from auth utils.
078228a 
Expect an api.IdentityInfo and optional api.Certificate in request context.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/request: Remove IdP groups context key and add identity info and …
2339c22 
…certificate keys.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd/cluster: Don't send IdP groups header.
a4b37bc 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Only update identity cache when a certificate changes.
5f77555 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Updates from auth util changes.
357e9a3 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Don't add identity cache to authorizer instantiations.
6eb0f39 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Don't add IdP groups to request context.
1e66ec6 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxd: Update Authenticate method and remove handle OIDC result method.
ba0cc5a 
The authenticate method now contains a handler to be called on successful
authentication for identities that should be present in the database.

It must be called when the authentication method is "cluster" to get the
context of the true caller.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
client: Don't always sent the OIDC access token.
c15f09d 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
client: Update the do method for the OIDC client.
e478526 
This is in a few stages:
1. Check if there are any cookies for this URL.
  - If yes, do request.
  - If no, add Authorization: Bearer header. Preemptively
    add the token if present.
2. On failure, if we have an access token, try again with the
   access token using a *cloned* request. Not using a cloned
   request results in sending the invalid session cookie again.
   This is because the cookies aren't deleted from the request,
   they are only deleted from the cookie jar on the client.
3. If trying again fails or we don't have an access token, authenticate
   and try a third time.

Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxc/config: Add cookie handling to config.
21cbcb0 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxc: Save cookies on exit, delete cookies on remote remove.
9b9e9c8 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
lxc: Ignore lint error (staticcheck).
4864c5c 
Signed-off-by: Mark Laing <[email protected]>
@markylaing
test/godeps: Update deps for lxc config.
3c8deab 
Signed-off-by: Mark Laing <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
API Changes to the REST API Documentation Documentation needs updating
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@markylaing