feat: Complete Azure SSO implementation (v0.1.3)
- Add SSO session cleanup task (10-min expiry, 60s purge interval) - Change callback to redirect to frontend with tokens as query params - Add sso_callback_url to SecurityConfig with serde default - Add SsoCallbackPage.tsx for handling SSO callback redirects - Add /auth/sso/callback public route to App.tsx - Add Sign in with Microsoft Azure button to LoginPage - Replace insecure decode_jwt_payload with verify_id_token - Implement JWKS caching (1-hour TTL) and RSA signature verification - Validate iss, aud, exp claims on id_token - Add jsonwebtoken dependency to pm-web crate - Update config.example.toml with sso_callback_url setting - Add sso_callback_url to settings response (read-only from TOML)
This commit is contained in:
@ -80,6 +80,9 @@ pub struct SecurityConfig {
|
||||
pub web_tls_cert_path: String,
|
||||
/// Web UI TLS key path
|
||||
pub web_tls_key_path: String,
|
||||
/// Frontend URL to redirect to after SSO callback (default: http://localhost:5173/auth/sso/callback)
|
||||
#[serde(default = "default_sso_callback_url")]
|
||||
pub sso_callback_url: String,
|
||||
}
|
||||
|
||||
impl AppConfig {
|
||||
@ -105,6 +108,10 @@ fn default_health_check_poll_interval() -> u64 {
|
||||
300
|
||||
}
|
||||
|
||||
fn default_sso_callback_url() -> String {
|
||||
"http://localhost:5173/auth/sso/callback".to_string()
|
||||
}
|
||||
|
||||
impl Default for AppConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
@ -142,6 +149,7 @@ impl Default for AppConfig {
|
||||
ca_key_path: "/etc/patch-manager/ca/ca.key".to_string(),
|
||||
web_tls_cert_path: "/etc/patch-manager/tls/web.crt".to_string(),
|
||||
web_tls_key_path: "/etc/patch-manager/tls/web.key".to_string(),
|
||||
sso_callback_url: default_sso_callback_url(),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
@ -38,5 +38,6 @@ lettre = { version = "0.11", default-features = false, features = ["tokio1-rustl
|
||||
rand = { workspace = true }
|
||||
base64 = { workspace = true }
|
||||
sha2 = { workspace = true }
|
||||
jsonwebtoken = { workspace = true }
|
||||
url = { workspace = true }
|
||||
urlencoding = "2"
|
||||
|
||||
@ -10,10 +10,11 @@ use pm_auth::{
|
||||
rbac::{require_auth, AuthConfig},
|
||||
};
|
||||
use pm_core::{config::AppConfig, db, logging, request_id::request_id_middleware};
|
||||
use routes::azure_sso::SsoSession;
|
||||
use routes::azure_sso::{JwksCache, SsoSession};
|
||||
use routes::ws::WsTicket;
|
||||
use serde_json::{json, Value};
|
||||
use std::{net::SocketAddr, sync::Arc, time::Duration};
|
||||
use tokio::sync::Mutex;
|
||||
use tower_http::{
|
||||
services::{ServeDir, ServeFile},
|
||||
trace::TraceLayer,
|
||||
@ -30,6 +31,8 @@ pub struct AppState {
|
||||
pub ws_tickets: Arc<DashMap<String, WsTicket>>,
|
||||
/// In-memory store for SSO PKCE sessions (state → code_verifier).
|
||||
pub sso_sessions: Arc<DashMap<String, SsoSession>>,
|
||||
/// Cached Azure AD JWKS for id_token signature verification.
|
||||
pub jwks_cache: Arc<Mutex<JwksCache>>,
|
||||
/// Internal certificate authority for mTLS client cert issuance.
|
||||
pub ca: Arc<pm_ca::CertAuthority>,
|
||||
}
|
||||
@ -87,6 +90,7 @@ async fn main() -> anyhow::Result<()> {
|
||||
|
||||
let ws_tickets: Arc<DashMap<String, WsTicket>> = Arc::new(DashMap::new());
|
||||
let sso_sessions: Arc<DashMap<String, SsoSession>> = Arc::new(DashMap::new());
|
||||
let jwks_cache: Arc<Mutex<JwksCache>> = Arc::new(Mutex::new(JwksCache::default()));
|
||||
|
||||
// Background task: purge expired WS tickets every 30 seconds.
|
||||
{
|
||||
@ -106,6 +110,25 @@ async fn main() -> anyhow::Result<()> {
|
||||
});
|
||||
}
|
||||
|
||||
// Background task: purge expired SSO sessions every 60 seconds (sessions older than 10 minutes).
|
||||
{
|
||||
let sessions = sso_sessions.clone();
|
||||
tokio::spawn(async move {
|
||||
let mut interval = tokio::time::interval(Duration::from_secs(60));
|
||||
loop {
|
||||
interval.tick().await;
|
||||
let now = chrono::Utc::now();
|
||||
let cutoff = now - chrono::Duration::minutes(10);
|
||||
let before = sessions.len();
|
||||
sessions.retain(|_, v| v.created_at > cutoff);
|
||||
let removed = before.saturating_sub(sessions.len());
|
||||
if removed > 0 {
|
||||
tracing::debug!(removed, "Purged expired SSO sessions");
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
let state = AppState {
|
||||
db: pool,
|
||||
config: Arc::new(config.clone()),
|
||||
@ -114,6 +137,7 @@ async fn main() -> anyhow::Result<()> {
|
||||
ws_tickets,
|
||||
sso_sessions,
|
||||
ca: Arc::new(ca),
|
||||
jwks_cache,
|
||||
};
|
||||
|
||||
let app = build_router(state);
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
//!
|
||||
//! Public routes (no auth required):
|
||||
//! GET /api/v1/auth/azure/login — redirect to Azure AD authorization URL
|
||||
//! GET /api/v1/auth/azure/callback — handle Azure AD callback
|
||||
//! GET /api/v1/auth/azure/callback — handle Azure AD callback, redirect to frontend SPA
|
||||
|
||||
use axum::{
|
||||
extract::State,
|
||||
@ -13,11 +13,15 @@ use axum::{
|
||||
};
|
||||
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
|
||||
use chrono::Utc;
|
||||
use jsonwebtoken::{decode, decode_header, Algorithm, DecodingKey, Validation};
|
||||
use pm_auth::{jwt::issue_access_token, refresh};
|
||||
use pm_core::audit::{log_event, AuditAction};
|
||||
use serde::Deserialize;
|
||||
use serde_json::{json, Value};
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::collections::HashSet;
|
||||
use std::sync::Arc;
|
||||
use tokio::sync::Mutex;
|
||||
use uuid::Uuid;
|
||||
|
||||
use crate::AppState;
|
||||
@ -61,6 +65,24 @@ struct DbUserForSso {
|
||||
mfa_enabled: bool,
|
||||
}
|
||||
|
||||
/// Cache for Azure AD JWKS (JSON Web Key Set) with TTL-based refresh.
|
||||
pub struct JwksCache {
|
||||
pub keys: Option<serde_json::Value>,
|
||||
pub fetched_at: Option<chrono::DateTime<Utc>>,
|
||||
}
|
||||
|
||||
impl Default for JwksCache {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
keys: None,
|
||||
fetched_at: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// JWKS cache TTL in seconds (1 hour).
|
||||
const JWKS_CACHE_TTL_SECS: i64 = 3600;
|
||||
|
||||
// ============================================================
|
||||
// Router
|
||||
// ============================================================
|
||||
@ -160,69 +182,61 @@ struct CallbackParams {
|
||||
async fn azure_callback(
|
||||
State(state): State<AppState>,
|
||||
axum::extract::Query(params): axum::extract::Query<CallbackParams>,
|
||||
) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
|
||||
) -> Result<Redirect, Redirect> {
|
||||
let callback_url = &state.config.security.sso_callback_url;
|
||||
|
||||
// Helper to build error redirect
|
||||
let error_redirect = |code: &str, message: &str| -> Redirect {
|
||||
let url = format!(
|
||||
"{}?error={}&error_description={}",
|
||||
callback_url,
|
||||
urlencoding::encode(code),
|
||||
urlencoding::encode(message)
|
||||
);
|
||||
Redirect::to(&url)
|
||||
};
|
||||
|
||||
// Check for error from Azure AD
|
||||
if let Some(error) = params.error {
|
||||
let desc = params.error_description.unwrap_or_default();
|
||||
return Err((
|
||||
StatusCode::BAD_REQUEST,
|
||||
Json(
|
||||
json!({ "error": { "code": "sso_error", "message": format!("Azure AD error: {} - {}", error, desc) } }),
|
||||
),
|
||||
));
|
||||
let message = format!("Azure AD error: {} - {}", error, desc);
|
||||
return Err(error_redirect("sso_error", &message));
|
||||
}
|
||||
|
||||
let code = params.code.ok_or_else(|| {
|
||||
(
|
||||
StatusCode::BAD_REQUEST,
|
||||
Json(json!({ "error": { "code": "bad_request", "message": "Missing authorization code" } })),
|
||||
)
|
||||
})?;
|
||||
let code = match params.code {
|
||||
Some(c) => c,
|
||||
None => return Err(error_redirect("bad_request", "Missing authorization code")),
|
||||
};
|
||||
|
||||
let state_token = params.state.ok_or_else(|| {
|
||||
(
|
||||
StatusCode::BAD_REQUEST,
|
||||
Json(
|
||||
json!({ "error": { "code": "bad_request", "message": "Missing state parameter" } }),
|
||||
),
|
||||
)
|
||||
})?;
|
||||
let state_token = match params.state {
|
||||
Some(s) => s,
|
||||
None => return Err(error_redirect("bad_request", "Missing state parameter")),
|
||||
};
|
||||
|
||||
// Look up code_verifier from sso_sessions
|
||||
let sso_session = state
|
||||
.sso_sessions
|
||||
.remove(&state_token)
|
||||
.map(|(_, v)| v)
|
||||
.ok_or_else(|| {
|
||||
(
|
||||
StatusCode::BAD_REQUEST,
|
||||
Json(json!({ "error": { "code": "bad_request", "message": "Invalid or expired state token" } })),
|
||||
)
|
||||
})?;
|
||||
let sso_session = match state.sso_sessions.remove(&state_token).map(|(_, v)| v) {
|
||||
Some(s) => s,
|
||||
None => return Err(error_redirect("bad_request", "Invalid or expired state token")),
|
||||
};
|
||||
|
||||
// Read Azure SSO config (including client_secret for token exchange)
|
||||
let row: Option<(bool, String, String, String, String)> = sqlx::query_as(
|
||||
let row: Option<(bool, String, String, String, String)> = match sqlx::query_as(
|
||||
"SELECT enabled, tenant_id, client_id, client_secret, redirect_uri FROM azure_sso_config WHERE id = 1",
|
||||
)
|
||||
.fetch_optional(&state.db)
|
||||
.await
|
||||
.map_err(|e| {
|
||||
tracing::error!(error = %e, "Failed to load azure_sso_config");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Database error" } })),
|
||||
)
|
||||
})?;
|
||||
{
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to load azure_sso_config");
|
||||
return Err(error_redirect("internal_error", "Database error"));
|
||||
}
|
||||
};
|
||||
|
||||
let (_enabled, tenant_id, client_id, client_secret, redirect_uri) = match row {
|
||||
Some(r) => r,
|
||||
None => {
|
||||
return Err((
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(
|
||||
json!({ "error": { "code": "internal_error", "message": "Azure SSO not configured" } }),
|
||||
),
|
||||
));
|
||||
return Err(error_redirect("internal_error", "Azure SSO not configured"));
|
||||
},
|
||||
};
|
||||
|
||||
@ -232,16 +246,16 @@ async fn azure_callback(
|
||||
tenant_id
|
||||
);
|
||||
|
||||
let client = reqwest::Client::builder()
|
||||
let client = match reqwest::Client::builder()
|
||||
.timeout(std::time::Duration::from_secs(10))
|
||||
.build()
|
||||
.map_err(|e| {
|
||||
{
|
||||
Ok(c) => c,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to build HTTP client");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "HTTP client error" } })),
|
||||
)
|
||||
})?;
|
||||
return Err(error_redirect("internal_error", "HTTP client error"));
|
||||
}
|
||||
};
|
||||
|
||||
let params = [
|
||||
("grant_type", "authorization_code".to_string()),
|
||||
@ -254,57 +268,47 @@ async fn azure_callback(
|
||||
|
||||
let form_params: Vec<(&str, String)> = params.to_vec();
|
||||
|
||||
let token_resp = client
|
||||
let token_resp = match client
|
||||
.post(&token_url)
|
||||
.form(&form_params)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| {
|
||||
{
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Token exchange request failed");
|
||||
(
|
||||
StatusCode::BAD_GATEWAY,
|
||||
Json(json!({ "error": { "code": "sso_error", "message": format!("Token exchange failed: {}", e) } })),
|
||||
)
|
||||
})?;
|
||||
return Err(error_redirect("sso_error", &format!("Token exchange failed: {}", e)));
|
||||
}
|
||||
};
|
||||
|
||||
if !token_resp.status().is_success() {
|
||||
let status = token_resp.status();
|
||||
let body = token_resp.text().await.unwrap_or_default();
|
||||
tracing::error!(status = %status, body = %body, "Token exchange failed");
|
||||
return Err((
|
||||
StatusCode::BAD_GATEWAY,
|
||||
Json(
|
||||
json!({ "error": { "code": "sso_error", "message": format!("Token exchange failed: HTTP {}", status) } }),
|
||||
),
|
||||
));
|
||||
return Err(error_redirect("sso_error", &format!("Token exchange failed: HTTP {}", status)));
|
||||
}
|
||||
|
||||
let token_data: TokenResponse = token_resp
|
||||
.json()
|
||||
.await
|
||||
.map_err(|e| {
|
||||
let token_data: TokenResponse = match token_resp.json().await {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to parse token response");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Failed to parse token response" } })),
|
||||
)
|
||||
})?;
|
||||
return Err(error_redirect("internal_error", "Failed to parse token response"));
|
||||
}
|
||||
};
|
||||
|
||||
// Decode id_token JWT (without verification — trust HTTPS channel)
|
||||
let id_token = token_data.id_token.ok_or_else(|| {
|
||||
(
|
||||
StatusCode::BAD_GATEWAY,
|
||||
Json(json!({ "error": { "code": "sso_error", "message": "No id_token in response" } })),
|
||||
)
|
||||
})?;
|
||||
// Verify id_token JWT signature using Azure AD JWKS and validate claims
|
||||
let id_token = match token_data.id_token {
|
||||
Some(t) => t,
|
||||
None => return Err(error_redirect("sso_error", "No id_token in response")),
|
||||
};
|
||||
|
||||
let claims = decode_jwt_payload(&id_token).map_err(|e| {
|
||||
tracing::error!(error = %e, "Failed to decode id_token");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Failed to decode id_token" } })),
|
||||
)
|
||||
})?;
|
||||
let claims = match verify_id_token(&id_token, &tenant_id, &client_id, &state.jwks_cache).await {
|
||||
Ok(c) => c,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to verify id_token");
|
||||
return Err(error_redirect("internal_error", "Failed to verify id_token"));
|
||||
}
|
||||
};
|
||||
|
||||
let email = claims.email.unwrap_or_default();
|
||||
let name = claims.name.unwrap_or_default();
|
||||
@ -312,43 +316,33 @@ async fn azure_callback(
|
||||
let preferred_username = claims.preferred_username.unwrap_or_else(|| email.clone());
|
||||
|
||||
if email.is_empty() || oid.is_empty() {
|
||||
return Err((
|
||||
StatusCode::BAD_GATEWAY,
|
||||
Json(
|
||||
json!({ "error": { "code": "sso_error", "message": "Missing email or oid in id_token" } }),
|
||||
),
|
||||
));
|
||||
return Err(error_redirect("sso_error", "Missing email or oid in id_token"));
|
||||
}
|
||||
|
||||
// Look up or create user
|
||||
let user_opt: Option<DbUserForSso> = sqlx::query_as(
|
||||
let user_opt: Option<DbUserForSso> = match sqlx::query_as(
|
||||
r#"SELECT id, username, display_name, role, is_active, mfa_enabled
|
||||
FROM users WHERE email = $1 AND auth_provider = 'azure_sso'"#,
|
||||
)
|
||||
.bind(&email)
|
||||
.fetch_optional(&state.db)
|
||||
.await
|
||||
.map_err(|e| {
|
||||
tracing::error!(error = %e, "Failed to look up SSO user");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Database error" } })),
|
||||
)
|
||||
})?;
|
||||
{
|
||||
Ok(o) => o,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to look up SSO user");
|
||||
return Err(error_redirect("internal_error", "Database error"));
|
||||
}
|
||||
};
|
||||
|
||||
let user = match user_opt {
|
||||
Some(u) if !u.is_active => {
|
||||
return Err((
|
||||
StatusCode::FORBIDDEN,
|
||||
Json(
|
||||
json!({ "error": { "code": "account_disabled", "message": "Account is disabled" } }),
|
||||
),
|
||||
));
|
||||
return Err(error_redirect("account_disabled", "Account is disabled"));
|
||||
},
|
||||
Some(u) => u,
|
||||
None => {
|
||||
// Auto-create user with role=operator, auth_provider=azure_sso
|
||||
let id: Uuid = sqlx::query_scalar(
|
||||
let id: Uuid = match sqlx::query_scalar(
|
||||
r#"INSERT INTO users (username, display_name, email, role, auth_provider, azure_oid)
|
||||
VALUES ($1, $2, $3, 'operator', 'azure_sso', $4)
|
||||
RETURNING id"#,
|
||||
@ -359,13 +353,13 @@ async fn azure_callback(
|
||||
.bind(&oid)
|
||||
.fetch_one(&state.db)
|
||||
.await
|
||||
.map_err(|e| {
|
||||
tracing::error!(error = %e, "Failed to create SSO user");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Failed to create user" } })),
|
||||
)
|
||||
})?;
|
||||
{
|
||||
Ok(id) => id,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to create SSO user");
|
||||
return Err(error_redirect("internal_error", "Failed to create user"));
|
||||
}
|
||||
};
|
||||
|
||||
log_event(
|
||||
&state.db,
|
||||
@ -392,47 +386,41 @@ async fn azure_callback(
|
||||
};
|
||||
|
||||
// Update last_login_at and azure_oid
|
||||
sqlx::query(
|
||||
if let Err(e) = sqlx::query(
|
||||
"UPDATE users SET last_login_at = NOW(), azure_oid = COALESCE(azure_oid, $1) WHERE id = $2",
|
||||
)
|
||||
.bind(&oid)
|
||||
.bind(user.id)
|
||||
.execute(&state.db)
|
||||
.await
|
||||
.map_err(|e| {
|
||||
{
|
||||
tracing::error!(error = %e, "Failed to update last_login_at");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Database error" } })),
|
||||
)
|
||||
})?;
|
||||
return Err(error_redirect("internal_error", "Database error"));
|
||||
}
|
||||
|
||||
// Issue JWT access token + refresh token
|
||||
let access_ttl = state.config.security.jwt_access_ttl_secs as i64;
|
||||
let access_token = issue_access_token(
|
||||
let access_token = match issue_access_token(
|
||||
user.id,
|
||||
&user.username,
|
||||
&user.role,
|
||||
access_ttl,
|
||||
&state.signing_key_pem,
|
||||
)
|
||||
.map_err(|e| {
|
||||
tracing::error!(error = %e, "Failed to issue access token");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Token issuance failed" } })),
|
||||
)
|
||||
})?;
|
||||
) {
|
||||
Ok(t) => t,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to issue access token");
|
||||
return Err(error_redirect("internal_error", "Token issuance failed"));
|
||||
}
|
||||
};
|
||||
|
||||
let raw_refresh = refresh::issue(&state.db, user.id, None, None)
|
||||
.await
|
||||
.map_err(|e| {
|
||||
let raw_refresh = match refresh::issue(&state.db, user.id, None, None).await {
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "Failed to issue refresh token");
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": { "code": "internal_error", "message": "Refresh token issuance failed" } })),
|
||||
)
|
||||
})?;
|
||||
return Err(error_redirect("internal_error", "Refresh token issuance failed"));
|
||||
}
|
||||
};
|
||||
|
||||
log_event(
|
||||
&state.db,
|
||||
@ -447,42 +435,145 @@ async fn azure_callback(
|
||||
)
|
||||
.await;
|
||||
|
||||
Ok(Json(json!({
|
||||
"access_token": access_token,
|
||||
"refresh_token": raw_refresh.0,
|
||||
"token_type": "Bearer",
|
||||
"expires_in": access_ttl,
|
||||
"user": {
|
||||
"id": user.id.to_string(),
|
||||
"username": user.username,
|
||||
"display_name": user.display_name,
|
||||
"role": user.role,
|
||||
"mfa_enabled": user.mfa_enabled,
|
||||
// Build user JSON for query parameter
|
||||
let user_json = json!({
|
||||
"id": user.id.to_string(),
|
||||
"username": user.username,
|
||||
"display_name": user.display_name,
|
||||
"role": user.role,
|
||||
"mfa_enabled": user.mfa_enabled,
|
||||
});
|
||||
|
||||
// Redirect to frontend SPA with tokens as query parameters
|
||||
let redirect_url = format!(
|
||||
"{}?access_token={}&refresh_token={}&token_type=Bearer&expires_in={}&user={}",
|
||||
callback_url,
|
||||
urlencoding::encode(&access_token),
|
||||
urlencoding::encode(&raw_refresh.0),
|
||||
access_ttl,
|
||||
urlencoding::encode(&user_json.to_string()),
|
||||
);
|
||||
|
||||
Ok(Redirect::to(&redirect_url))
|
||||
}
|
||||
|
||||
// ============================================================
|
||||
// JWT Verification Helpers
|
||||
// ============================================================
|
||||
|
||||
/// Verify the id_token JWT signature using Azure AD JWKS and validate standard claims.
|
||||
///
|
||||
/// Steps:
|
||||
/// 1. Decode JWT header to extract `kid` (key ID)
|
||||
/// 2. Fetch JWKS from Azure AD if cache is empty or expired (1-hour TTL)
|
||||
/// 3. Find the matching JWK by `kid`
|
||||
/// 4. Construct RSA public key from JWK modulus (`n`) and exponent (`e`)
|
||||
/// 5. Validate issuer, audience, and expiry via `jsonwebtoken::decode`
|
||||
async fn verify_id_token(
|
||||
token: &str,
|
||||
tenant_id: &str,
|
||||
client_id: &str,
|
||||
jwks_cache: &Arc<Mutex<JwksCache>>,
|
||||
) -> Result<IdTokenClaims, String> {
|
||||
// 1. Decode JWT header to get the kid
|
||||
let header = decode_header(token)
|
||||
.map_err(|e| format!("Failed to decode JWT header: {}", e))?;
|
||||
|
||||
let kid = header.kid.ok_or("JWT header missing 'kid' field")?;
|
||||
|
||||
// 2. Check JWKS cache — fetch if expired or missing
|
||||
let jwks = {
|
||||
let cache = jwks_cache.lock().await;
|
||||
let needs_fetch = match (&cache.keys, &cache.fetched_at) {
|
||||
(None, _) => true,
|
||||
(Some(_), None) => true,
|
||||
(Some(_), Some(fetched)) => {
|
||||
let elapsed = Utc::now().signed_duration_since(*fetched);
|
||||
elapsed.num_seconds() > JWKS_CACHE_TTL_SECS
|
||||
}
|
||||
};
|
||||
|
||||
if needs_fetch {
|
||||
// Drop lock before making async HTTP request
|
||||
drop(cache);
|
||||
|
||||
let jwks_value = fetch_jwks(tenant_id).await?;
|
||||
|
||||
let mut cache = jwks_cache.lock().await;
|
||||
cache.keys = Some(jwks_value);
|
||||
cache.fetched_at = Some(Utc::now());
|
||||
cache.keys.clone().unwrap()
|
||||
} else {
|
||||
cache.keys.clone().unwrap()
|
||||
}
|
||||
})))
|
||||
};
|
||||
|
||||
// 3. Find the matching JWK by kid
|
||||
let keys_array = jwks
|
||||
.get("keys")
|
||||
.ok_or("JWKS response missing 'keys' array")?
|
||||
.as_array()
|
||||
.ok_or("JWKS 'keys' is not an array")?;
|
||||
|
||||
let jwk = keys_array
|
||||
.iter()
|
||||
.find(|k| k.get("kid").and_then(|v| v.as_str()) == Some(kid.as_str()))
|
||||
.ok_or_else(|| format!("No matching JWK found for kid: {}", kid))?;
|
||||
|
||||
// 4. Construct RSA public key from JWK modulus (n) and exponent (e)
|
||||
let n = jwk
|
||||
.get("n")
|
||||
.and_then(|v| v.as_str())
|
||||
.ok_or("JWK missing 'n' (modulus) field")?;
|
||||
let e = jwk
|
||||
.get("e")
|
||||
.and_then(|v| v.as_str())
|
||||
.ok_or("JWK missing 'e' (exponent) field")?;
|
||||
|
||||
let decoding_key = DecodingKey::from_rsa_components(n, e)
|
||||
.map_err(|e| format!("Failed to construct RSA decoding key: {}", e))?;
|
||||
|
||||
// 5. Configure validation rules
|
||||
let mut validation = Validation::new(Algorithm::RS256);
|
||||
validation.iss = Some(HashSet::from([format!(
|
||||
"https://login.microsoftonline.com/{}/v2.0",
|
||||
tenant_id
|
||||
)]));
|
||||
validation.aud = Some(HashSet::from([client_id.to_string()]));
|
||||
validation.leeway = 60; // 60 seconds clock skew tolerance
|
||||
|
||||
// 6. Decode and verify the JWT
|
||||
let token_data = decode::<IdTokenClaims>(token, &decoding_key, &validation)
|
||||
.map_err(|e| format!("JWT signature verification failed: {}", e))?;
|
||||
|
||||
Ok(token_data.claims)
|
||||
}
|
||||
|
||||
// ============================================================
|
||||
// Helpers
|
||||
// ============================================================
|
||||
/// Fetch the JWKS from the Azure AD discovery endpoint.
|
||||
async fn fetch_jwks(tenant_id: &str) -> Result<serde_json::Value, String> {
|
||||
let jwks_url = format!(
|
||||
"https://login.microsoftonline.com/{}/discovery/v2.0/keys",
|
||||
tenant_id
|
||||
);
|
||||
|
||||
/// Decode JWT payload without verification (trust HTTPS channel from Azure AD).
|
||||
fn decode_jwt_payload(token: &str) -> Result<IdTokenClaims, String> {
|
||||
let parts: Vec<&str> = token.split('.').collect();
|
||||
if parts.len() != 3 {
|
||||
return Err("Invalid JWT format".to_string());
|
||||
let client = reqwest::Client::builder()
|
||||
.timeout(std::time::Duration::from_secs(10))
|
||||
.build()
|
||||
.map_err(|e| format!("Failed to build HTTP client for JWKS fetch: {}", e))?;
|
||||
|
||||
let resp = client
|
||||
.get(&jwks_url)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| format!("JWKS fetch request failed: {}", e))?;
|
||||
|
||||
if !resp.status().is_success() {
|
||||
let status = resp.status();
|
||||
let body = resp.text().await.unwrap_or_default();
|
||||
return Err(format!("JWKS fetch failed: HTTP {} — {}", status, body));
|
||||
}
|
||||
|
||||
let payload_b64 = parts[1];
|
||||
// Add padding if needed
|
||||
let mut payload_b64_padded = payload_b64.to_string();
|
||||
while payload_b64_padded.len() % 4 != 0 {
|
||||
payload_b64_padded.push('=');
|
||||
}
|
||||
|
||||
let payload_bytes = base64::engine::general_purpose::STANDARD
|
||||
.decode(&payload_b64_padded)
|
||||
.map_err(|e| format!("Base64 decode error: {}", e))?;
|
||||
|
||||
serde_json::from_slice(&payload_bytes).map_err(|e| format!("JSON parse error: {}", e))
|
||||
resp.json::<serde_json::Value>()
|
||||
.await
|
||||
.map_err(|e| format!("Failed to parse JWKS response: {}", e))
|
||||
}
|
||||
|
||||
@ -40,6 +40,7 @@ pub struct SettingsResponse {
|
||||
pub ip_whitelist: Vec<String>,
|
||||
pub web_tls_strategy: String,
|
||||
pub notification: NotificationConfig,
|
||||
pub sso_callback_url: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
@ -202,6 +203,7 @@ fn build_settings_response(
|
||||
email_from: get("notification_email_from"),
|
||||
recipients,
|
||||
},
|
||||
sso_callback_url: get("sso_callback_url"),
|
||||
}
|
||||
}
|
||||
|
||||
@ -269,6 +271,9 @@ async fn get_settings(
|
||||
) -> Result<Json<SettingsResponse>, (StatusCode, Json<Value>)> {
|
||||
admin_only(&auth)?;
|
||||
let cfg = load_system_config(&state.db).await?;
|
||||
// Inject read-only config values from TOML file (not stored in DB)
|
||||
let mut cfg = cfg;
|
||||
cfg.insert("sso_callback_url".to_string(), state.config.security.sso_callback_url.clone());
|
||||
let azure = fetch_azure_sso_config(&state.db).await?;
|
||||
Ok(Json(build_settings_response(&cfg, azure)))
|
||||
}
|
||||
@ -488,6 +493,9 @@ async fn update_settings(
|
||||
|
||||
// Return updated settings
|
||||
let cfg = load_system_config(&state.db).await?;
|
||||
// Inject read-only config values from TOML file (not stored in DB)
|
||||
let mut cfg = cfg;
|
||||
cfg.insert("sso_callback_url".to_string(), state.config.security.sso_callback_url.clone());
|
||||
let azure = fetch_azure_sso_config(&state.db).await?;
|
||||
Ok(Json(build_settings_response(&cfg, azure)))
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user