2 Commits

Author	SHA1	Message	Date
shankar0123	2a1a0b347c	harden(oidc): pre-login UA/IP binding (MED-16) — RFC 9700 §4.7.1 ... Audit 2026-05-10 MED-16 closure. WHAT. Binds the OIDC pre-login row to the (clientIP, userAgent) tuple of the /auth/oidc/login request, and enforces a constant-time compare against the /auth/oidc/callback request at consume time. Defeats replay of a stolen pre-login cookie by a different browser / source — the secondary defense layer recommended by RFC 9700 §4.7.1 when the primary layer (HMAC integrity + Path=/ + SameSite=Lax on the cookie) is bypassed via CSRF / XSS / TLS-termination leak. WHY. Pre-fix, the pre-login cookie's HMAC verified only that 'some' caller of /auth/oidc/login was talking to /auth/oidc/callback; it did not verify that the SAME browser / source was on both sides. An attacker who exfiltrated the cookie value via any vector could replay the bytes through their own user-agent and ride the victim's authorization. RFC 9700 §4.7.1 calls out the gap explicitly and recommends binding state to a user-agent fingerprint + source IP. HOW. Migration: migrations/000044_prelogin_uaip.up.sql ALTER TABLE oidc_pre_login_sessions ADD COLUMN IF NOT EXISTS client_ip TEXT, ADD COLUMN IF NOT EXISTS user_agent TEXT; Both nullable for in-flight rolling-deploy compat — the consume- side check only enforces when both row AND request carry non-empty values for the leg in question. Domain: internal/repository/oidc.go (PreLoginSession) — adds ClientIP + UserAgent fields. Repository: internal/repository/postgres/oidc_prelogin.go — Create persists via sql.NullString (empty → NULL); LookupAndConsume reads back. Re-uses package-local nullableString from discovery.go. Service: internal/auth/oidc/service.go - PreLoginStore.CreatePreLogin signature takes (clientIP, userAgent) as positions 5–6. - PreLoginStore.LookupAndConsume returns (clientIP, userAgent) as positions 5–6. - HandleAuthRequest signature gains (clientIP, userAgent), threaded to the store. - HandleCallback adds Step 1.5 — UA / IP constant-time compare between stored row and incoming request. Per-leg toggles via preLoginRequireUA / preLoginRequireIP service fields. Empty values on either side pass through (rolling-deploy + headless- proxy compat). - New sentinels ErrPreLoginUAMismatch, ErrPreLoginIPMismatch. - SetPreLoginBindingRequirements(requireUA, requireIP) helper for main.go config wiring. Adapter: internal/auth/oidc/prelogin.go — PreLoginAdapter passes the new fields through to the repo row. Handler: internal/api/handler/auth_session_oidc.go - OIDCAuthHandshaker.HandleAuthRequest signature updated. - LoginInitiate captures clientIPFromRequest + r.UserAgent() and passes to the service. - classifyOIDCFailure adds errors.Is dispatch for the two new sentinels → prelogin_ua_mismatch / prelogin_ip_mismatch audit categories. Config: internal/config/config.go + AuthConfig.OIDCPreLoginRequireUA (default true) env CERTCTL_OIDC_PRELOGIN_REQUIRE_UA + AuthConfig.OIDCPreLoginRequireIP (default true) env CERTCTL_OIDC_PRELOGIN_REQUIRE_IP cmd/server/main.go calls oidcService.SetPreLoginBindingRequirements from cfg.Auth.OIDCPreLoginRequire{UA,IP}. Tests (internal/auth/oidc/service_test.go): - TestService_HandleCallback_MED16_UAMismatchRejected - TestService_HandleCallback_MED16_IPMismatchRejected - TestService_HandleCallback_MED16_BothMatch_Succeeds - TestService_HandleCallback_MED16_LegacyRowEmptyValues (rolling- deploy compat — empty stored values pass through) - TestService_HandleCallback_MED16_RequireUAFalse_AllowsMismatch (operator escape-hatch — UA mismatch silently allowed) Mechanical fan-out: - stubPreLogin / stubPreLoginRepo signatures updated. - All existing call sites in service_test.go (~40), prelogin_test.go, bench_test.go, logging_test.go, provider_enabled_test.go, integration_keycloak_test.go, integration_okta_smoke_test.go, auth_session_oidc_test.go updated to pass empty strings for the new params — pre-existing tests do not exercise UA/IP binding semantics. VERIFY. - go vet ./internal/auth/oidc/... ./internal/api/handler/... ./internal/config/... PASS - go test -short -count=1 -run MED16 ./internal/auth/oidc/... PASS (5/5) - go test -short -count=1 ./internal/auth/oidc/... PASS (4.6s) - go test -short -count=1 ./internal/api/handler/... PASS (4.3s) - go test -short -count=1 ./internal/config/... PASS Refs: cowork/auth-bundles-audit-2026-05-10.md MED-16 cowork/auth-bundles-fixes-2026-05-10/HANDOFF.md item 6 RFC 9700 §4.7.1 — OAuth 2.0 Security Best Current Practice	2026-05-10 23:18:23 +00:00
shankar0123	925523e06e	feat(oidc): Enabled toggle on OIDCProvider (MED-9) ... Audit 2026-05-10 Fix 13 Phase B — close MED-9. MED-4/5/6/7 deferred to v3. MED-9: ship the OIDCProvider.Enabled boolean. Pre-fix, the only way to take a provider offline during an incident was DELETE, which breaks active user_oidc_provider FK references and orphans any session that minted under the provider. Post-fix: - Migration 000042 adds enabled BOOLEAN NOT NULL DEFAULT TRUE. Default-true means existing pre-migration rows are all enabled post-deploy; no breaking-change window. - internal/auth/oidc/domain/types.go::OIDCProvider.Enabled ships the domain field with JSON tag 'enabled'. - Repository read/write paths (List, Get, GetByName, Create, Update) all carry the column. - internal/auth/oidc/service.go::HandleAuthRequest rejects with the new ErrProviderDisabled sentinel when cfgRow.Enabled=false. - cmd/server/main.go::oidcProvidersListAdapter.List filters disabled providers before constructing OIDCProviderInfo so the LoginPage's 'Sign in with X' buttons never render for offline IdPs. - Defense-in-depth: the ErrProviderDisabled service-layer check is the guard for direct API / MCP / CLI callers that bypass the GUI. Regression test: internal/auth/oidc/provider_enabled_test.go warms the entry cache via a successful HandleAuthRequest, flips cfgRow.Enabled=false on the cached entry, then asserts the next call returns ErrProviderDisabled (errors.Is). Test fixtures (newValidProvider, makeProvider) updated to set Enabled: true so existing tests stay green. Operators can toggle Enabled today via the existing PUT /api/v1/auth/oidc/providers/{id} body field. A dedicated GUI toggle on OIDCProviderDetailPage and a single-purpose PUT-just-enabled endpoint are deferred to the v3 GUI-polish bundle — the load-bearing wire is in place now. MED-4 (GUI advanced fields on edit), MED-5 (POST .../test endpoint + button), MED-6 (JWKS auto-refresh on cache-miss), MED-7 (JWKS health endpoint + GUI panel): DEFERRED to v3 with explicit annotations in the audit doc. Workarounds: MED-4 fields are PUT-editable via curl/MCP; MED-5 → call refresh post-create; MED-6 → call refresh manually on key rotation. Refs: cowork/auth-bundles-audit-2026-05-10.md MED-4, MED-5, MED-6, MED-7, MED-9 Spec: cowork/auth-bundles-fixes-2026-05-10/13-med-bundle.md Phase B	2026-05-10 21:59:17 +00:00