3 Commits

Author	SHA1	Message	Date
shankar0123	fefeccfa59	harden(oidc): relax alg-downgrade IdP-bind check to intersection-empty (Keycloak compat) ... Phase-10 live-IdP smoke (Keycloak 26.x via testcontainers-go) revealed the IdP-bind alg-downgrade check was too strict for real-world IdPs. 6 of the integration tests in internal/auth/oidc/integration_keycloak*_test.go were failing with: oidc: IdP advertises weak signing algorithms (HS*/none); refusing to use as defense against downgrade attacks: HS256 Keycloak 26.x (and several other real-world IdPs — Auth0 when HS-mode is enabled, some Authentik configs) advertise EVERY alg they're capable of in the discovery doc's id_token_signing_alg_values_supported field, even when the realm only signs with RS256 in practice. Pre-fix the IdP-bind check refused on ANY HS* or 'none' advertisement → no real Keycloak deploy could ever bind a provider row, hence the integration-test failures. The strict-deny check was defense-in-depth on top of the load-bearing per-token alg-pin at sig-verify time (isDisallowedAlg, service.go L1177): that check rejects every ID token whose JWS header carries an alg outside DefaultAllowedAlgs, regardless of what the discovery doc advertises. A forged HS256 token signed with the IdP's RS256 pubkey as HMAC secret is rejected at sig-verify time → the actual algorithm-confusion attack is closed by the per-token pin, NOT by the discovery-doc check. Fix: relax the IdP-bind check to refuse only when the intersection of advertised vs DefaultAllowedAlgs is EMPTY (the pathological all-weak-alg IdP case). Keycloak (RS256 + HS256 advertised) now binds successfully; an HS-only IdP still fails closed. Changes: - internal/auth/oidc/service.go: rewrite the alg-check loop at L1067 in getOrLoad / RefreshKeys to compute the intersection set; refuse only when no acceptable alg is advertised. ErrIdPDowngradeAdvertised docstring updated to reflect new contract. DefaultAllowedAlgs docstring + the package-level design-comment block at L40-72 updated with v2.1.0-relaxed semantics callouts. - internal/auth/oidc/test_discovery.go: TestDiscovery dry-run validator rewritten to surface HS*/none alongside RS* as an informational note ('note: IdP advertises weak algorithms %v alongside acceptable ones') rather than a hard-fail error. HS-only / none-only still hard-fails. - internal/auth/oidc/service_test.go: TestService_IdPDowngradeDefense_* tests updated. Renamed: - RejectsHSAdvertised → RS256PlusHS256_BindsSuccessfully (positive) - RejectsNoneAdvertised → RejectsHSOnlyAdvertised (intersection-empty) - RefreshKeys_CatchesPostLoadDowngrade rotated to HS-only post-load - internal/auth/oidc/coverage_fill_test.go: TestTestDiscovery_AlgDowngradeDetected split into _HS256AlongsideRS256_BindsWithNote (positive, asserts note but no hard-fail) + _HSOnly_StillTrips_HardFail (intersection-empty). - docs/operator/auth-threat-model.md: OIDC token-validation alg-allow-list section rewritten to call out the load-bearing-defense hierarchy (per-token pin first, IdP-bind check defense-in-depth) and document the v2.1.0 relaxation rationale. - CHANGELOG.md: ### Security entry under Unreleased. Verify: go test ./internal/auth/oidc/ -short PASS; gofmt clean; go vet clean. The Keycloak integration tests should now pass when the operator re-runs 'make keycloak-integration-test'.	2026-05-11 15:34:59 +00:00
shankar0123	09bea664d5	chore(fmt): gofmt cleanup on three pre-bundle drift files surfaced by v2.1.0 release-gate Phase 1 ... Phase 1 (make verify) of cowork/v2.1.0-release-gate.md surfaced three files with pre-existing gofmt drift that pre-dated the 2026-05-11 fix bundle work: internal/auth/oidc/domain/types.go internal/auth/oidc/integration_keycloak_rotate_test.go internal/auth/oidc/test_discovery.go The 2026-05-11 Fix 08 fmt-cleanup commit (b8fac59) fixed four files that the merge introduced; these three were noted as pre-existing master drift and intentionally left untouched at the time. The v2.1.0 release-gate spec's Phase 1 requires zero gofmt output from 'go fmt ./...' (Makefile::verify form), so the drift must close before tagging. Pure whitespace alignment, no semantic change.	2026-05-11 13:18:25 +00:00
shankar0123	b4b98799d5	feat(oidc): POST /api/v1/auth/oidc/test dry-run endpoint (MED-5) ... Audit 2026-05-10 MED-5 closure (backend half). WHAT. New POST /api/v1/auth/oidc/test endpoint that validates an OIDC provider configuration without persisting anything. Mirrors the read-only legs of the production getOrLoad path so operators can catch typos / network reachability problems / IdP-advertises-weak- alg conditions BEFORE creating the provider row. Request body: {issuer_url, client_id, client_secret, scopes} — client_secret is accepted but unused (discovery + JWKS reachability do not require it). Response body: TestDiscoveryResult{ discovery_succeeded — gooidc.NewProvider returned without error jwks_reachable — explicit GET against jwks_uri succeeded supported_alg_values — verbatim id_token_signing_alg_values_supported iss_param_supported — RFC 9207 advertisement parsed off the disco doc issuer_echo — the iss URL we were called with authorization_url, token_url, jwks_uri, userinfo_endpoint — discovery doc fields for the GUI to preview errors[] — per-leg failure messages } HTTP status: - 200 even when individual checks fail (the per-leg errors[] carries detail so the GUI renders per-check status rows) - 400 only when the request body is malformed or issuer_url empty - 500 only when the service-layer call itself errors WHY. Pre-fix, operators configuring OIDC had to create a provider, then hit /refresh, then read the audit log to figure out whether the discovery doc was reachable / whether the IdP advertises HS256 (the alg-downgrade trap). The GUI rendered no per-check feedback. MED-5 closes the dry-run gap for the same reason every Issuer + Target connector has a 'Test connection' button — operator experience parity. HOW. internal/auth/oidc/test_discovery.go (NEW): - TestDiscoveryResult struct with the per-leg projection. - Service.TestDiscovery(ctx, issuerURL) drives the read-only subset of getOrLoad: gooidc.NewProvider, claims parse for alg-supported + iss-param-supported + jwks_uri + userinfo, alg-downgrade defense, jwksReachable HTTP GET. - jwksReachable is a package-level closure so tests can swap. internal/api/handler/auth_session_oidc.go: - TestProvider HTTP handler. Uses an inline discoveryTester interface to type-assert against the OIDCAuthHandshaker stub (the production Service satisfies; test stubs supply via explicit method). Audit row 'auth.oidc_provider_tested' carries the summary fields. internal/api/router/router.go: - Wired as POST /api/v1/auth/oidc/test under rbacGate('auth.oidc.create'). internal/api/handler/auth_session_oidc_test.go: - stubOIDCSvc gains testResult + testErr fields + TestDiscovery method so it satisfies the inline interface. - 3 regression tests: happy path, missing issuer_url -> 400, discovery-failure -> 200 with errors[] populated. VERIFY. - go vet ./internal/auth/oidc/... ./internal/api/handler/... ./internal/api/router/... PASS - go test -short -count=1 -run TestProvider ./internal/api/handler/... PASS (3/3) - go test -short -count=1 ./internal/auth/oidc/... PASS (3.7s) - go test -short -count=1 ./internal/api/handler/... PASS (4.7s) Out of scope for this commit: the GUI 'Test connection' button on OIDCProviderDetailPage — queued with the GUI batch (items 10-19 of HANDOFF.md). Refs: cowork/auth-bundles-audit-2026-05-10.md MED-5 cowork/auth-bundles-fixes-2026-05-10/HANDOFF.md item 2	2026-05-10 23:25:54 +00:00