feat(op): dynamic issuer depending on request / host

[livio-a]

BREAKING CHANGE: The OpenID Provider package is now able to handle multiple issuers with a single storage implementation. The issuer will be selected from the host of the request and passed into the context, where every function can read it from if necessary. This results in some fundamental changes:

• Configuration interface:
  • Issuer() string has been changed to IssuerFromRequest(r *http.Request) string
  • Insecure() bool has been added
• OpenIDProvider interface and dependants:
  • Issuer has been removed from Config struct
  • NewOpenIDProvider now takes an additional parameter issuer and returns a pointer to the public/default implementation and not an OpenIDProvider interface:
    NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opOpts ...Option) (OpenIDProvider, error) changed to NewOpenIDProvider(ctx context.Context, issuer string, config *Config, storage Storage, opOpts ...Option) (*Provider, error)
  • therefore the parameter type Option changed to the public type as well: Option func(o *Provider) error
  • AuthCallbackURL(o OpenIDProvider) func(string) string has been changed to AuthCallbackURL(o OpenIDProvider) func(context.Context, string) string
  • IDTokenHintVerifier() IDTokenHintVerifier (Authorizer, OpenIDProvider, SessionEnder interfaces), AccessTokenVerifier() AccessTokenVerifier (Introspector, OpenIDProvider, Revoker, UserinfoProvider interfaces) and JWTProfileVerifier() JWTProfileVerifier (IntrospectorJWTProfile, JWTAuthorizationGrantExchanger, OpenIDProvider, RevokerJWTProfile interfaces) now take a context.Context parameter IDTokenHintVerifier(context.Context) IDTokenHintVerifier, AccessTokenVerifier(context.Context) AccessTokenVerifier and JWTProfileVerifier(context.Context) JWTProfileVerifier
  • OidcDevMode (CAOS_OIDC_DEV) environment variable check has been removed, use WithAllowInsecure() Option
• Signing: the signer is not kept in memory anymore, but created on request from the loaded key:
  • Signer interface and func NewSigner have been removed
  • ReadySigner(s Signer) ProbesFn has been removed
  • CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfiguration has been changed to CreateDiscoveryConfig(r *http.Request, config Configuration, storage DiscoverStorage) *oidc.DiscoveryConfiguration
  • Storage interface:
    • GetSigningKey(context.Context, chan<- jose.SigningKey) has been changed to SigningKey(context.Context) (SigningKey, error)
    • KeySet(context.Context) ([]Key, error) has been added
    • GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
  • SigAlgorithms(s Signer) []string has been changed to SigAlgorithms(ctx context.Context, storage DiscoverStorage) []string
  • KeyProvider interface: GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
  • CreateIDToken: the Signer parameter has been removed

[codecov]

Codecov Report

Merging #173 (3e6ea03) into main (885fe0d) will increase coverage by 4.69%.
The diff coverage is 29.69%.

@@            Coverage Diff             @@
##             main     #173      +/-   ##
==========================================
+ Coverage   12.77%   17.47%   +4.69%     
==========================================
  Files          39       41       +2     
  Lines        2927     3119     +192     
==========================================
+ Hits          374      545     +171     
- Misses       2543     2561      +18     
- Partials       10       13       +3     

Impacted Files	Coverage Δ
pkg/http/http.go	0.00% <0.00%> (ø)
pkg/oidc/code_challenge.go	0.00% <ø> (ø)
pkg/oidc/introspection.go	0.00% <0.00%> (ø)
pkg/oidc/token.go	0.00% <ø> (ø)
pkg/oidc/token_request.go	0.00% <ø> (ø)
pkg/oidc/verifier.go	0.00% <ø> (ø)
pkg/op/client.go	100.00% <ø> (ø)
pkg/op/crypto.go	0.00% <ø> (ø)
pkg/op/error.go	0.00% <ø> (ø)
pkg/op/op.go	0.00% <0.00%> (ø)
... and 25 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[muhlemmer]

Closing in favor of #278