Repository: clouditor/clouditor
Pull request #708 (2022-05-24 09:58:32)

Added some basic claims for OpenID connect

codecov[bot]: # [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) Report
> Merging [#708](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (1467fd6) into [main](https://codecov.io/gh/clouditor/clouditor/commit/bada1e1533c8e50352018b8685b35a69f88e73de?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (bada1e1) will **not change** coverage.
> The diff coverage is `100.00%`.

```diff
@@           Coverage Diff           @@
##             main     #708   +/-   ##
=======================================
  Coverage   81.20%   81.20%           
=======================================
  Files          66       66           
  Lines        6102     6102           
=======================================
  Hits         4955     4955           
  Misses        888      888           
  Partials      259      259           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `81.20% <100.00%> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) | Coverage Δ | |
|---|---|---|
| [service/auth\_middleware.go](https://codecov.io/gh/clouditor/clouditor/pull/708/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9hdXRoX21pZGRsZXdhcmUuZ28=) | `93.54% <100.00%> (ø)` | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Last update [bada1e1...1467fd6](https://codecov.io/gh/clouditor/clouditor/pull/708?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor).


Patch:
diff --git a/service/auth_middleware.go b/service/auth_middleware.go
index 0ae25b07..419bc8b6 100644
--- a/service/auth_middleware.go
+++ b/service/auth_middleware.go
@@ -45,6 +45,22 @@ func init() {
 	log = logrus.WithField("component", "auth-middleware")
 }
 
+// ProfileClaim represents claims that are contained in the profile scope of OpenID Connect.
+type ProfileClaim struct {
+	PreferredUsername string `json:"preferred_username"`
+	Name              string `json:"name"`
+	GivenName         string `json:"given_name"`
+	FamilyName        string `json:"family_name"`
+}
+
+// OpenIDConnectClaim represents a claim that supports some aspects of a token issued by an OpenID Connect provider. It
+// contains the regular registered JWT claims as well as some specific optional claims, which are empty if Open ID
+// Connect is not used.
+type OpenIDConnectClaim struct {
+	*jwt.RegisteredClaims
+	*ProfileClaim
+}
+
 type AuthConfig struct {
 	jwksURL string
 	useJWKS bool
@@ -141,10 +157,10 @@ func parseToken(token string, authConfig *AuthConfig) (jwt.Claims, error) {
 
 	// Use JWKS, if enabled
 	if authConfig.useJWKS {
-		parsedToken, err = jwt.ParseWithClaims(token, &jwt.RegisteredClaims{}, authConfig.Jwks.Keyfunc)
+		parsedToken, err = jwt.ParseWithClaims(token, &OpenIDConnectClaim{}, authConfig.Jwks.Keyfunc)
 	} else {
 		// Otherwise, we will use the supplied public key
-		parsedToken, err = jwt.ParseWithClaims(token, &jwt.RegisteredClaims{}, func(t *jwt.Token) (interface{}, error) {
+		parsedToken, err = jwt.ParseWithClaims(token, &OpenIDConnectClaim{}, func(t *jwt.Token) (interface{}, error) {
 			return authConfig.publicKey, nil
 		})
 	}


Test patch:
diff --git a/service/auth_middleware_test.go b/service/auth_middleware_test.go
index 90f2e6df..271d0f31 100644
--- a/service/auth_middleware_test.go
+++ b/service/auth_middleware_test.go
@@ -32,7 +32,6 @@ import (
 
 	"clouditor.io/clouditor/internal/testutil"
 
-	"github.com/golang-jwt/jwt/v4"
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/grpc/codes"
@@ -47,7 +46,7 @@ func ValidClaimAssertion(tt assert.TestingT, i1 interface{}, _ ...interface{}) b
 		return false
 	}
 
-	claims, ok := ctx.Value(AuthContextKey).(*jwt.RegisteredClaims)
+	claims, ok := ctx.Value(AuthContextKey).(*OpenIDConnectClaim)
 	if !ok {
 		tt.Errorf("Token value in context not a JWT claims object")
 		return false