Add GCP token validation

lib/gcp/gcp.go

@@ -0,0 +1,69 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gcp
+
+import (
+	"github.com/gravitational/trace"
+	"github.com/mitchellh/mapstructure"
+)
+
+// defaultIssuerHost is the issuer for GCP ID tokens.
+const defaultIssuerHost = "accounts.google.com"
+
+// ComputeEngine contains VM-specific token claims.
+type computeEngine struct {
+	// The ID of the instance's project.
+	ProjectID string `json:"project_id"`
+	// The instance's zone.
+	Zone string `json:"zone"`
+	// The instance's ID.
+	InstanceID string `json:"instance_id"`
+	// The instance's name.
+	InstanceName string `json:"instance_name"`
+}
+
+// Google contains Google-specific token claims.
+type google struct {
+	ComputeEngine computeEngine `json:"compute_engine"`
+}
+
+// IDTokenClaims is the set of claims in a GCP ID token. GCP documentation for
+// claims can be found at
+// https://cloud.google.com/compute/docs/instances/verifying-instance-identity#payload
+type IDTokenClaims struct {
+	// The email of the service account that this token was issued for.
+	Email  string `json:"email"`
+	Google google `json:"google"`
+}
+
+// JoinAuditAttributes returns a series of attributes that can be inserted into
+// audit events related to a specific join.
+func (c *IDTokenClaims) JoinAuditAttributes() (map[string]interface{}, error) {
+	res := map[string]interface{}{}
+	d, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		TagName: "json",
+		Result:  &res,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	if err := d.Decode(c); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return res, nil
+}

lib/gcp/token_validator.go

@@ -0,0 +1,96 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gcp
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/coreos/go-oidc"
+	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/gravitational/teleport/lib/jwt"
+)
+
+// IDTokenValidatorConfig is the config for IDTokenValidator.
+type IDTokenValidatorConfig struct {
+	// Clock is used by the validator when checking expiry and issuer times of
+	// tokens. If omitted, a real clock will be used.
+	Clock clockwork.Clock
+	// issuerHost is the host of the Issuer for tokens issued by Google, to be
+	// overridden in tests. Defaults to "accounts.google.com".
+	issuerHost string
+	// insecure configures the validator to use HTTP rather than HTTPS, to be
+	// overridden in tests.
+	insecure bool
+}
+
+// IDTokenValidator validates ID tokens from GCP.
+type IDTokenValidator struct {
+	IDTokenValidatorConfig
+}
+
+func NewIDTokenValidator(cfg IDTokenValidatorConfig) *IDTokenValidator {
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewRealClock()
+	}
+	if cfg.issuerHost == "" {
+		cfg.issuerHost = defaultIssuerHost
+	}
+	return &IDTokenValidator{
+		IDTokenValidatorConfig: cfg,
+	}
+}
+
+func (id *IDTokenValidator) issuerURL() string {
+	scheme := "https"
+	if id.insecure {
+		scheme = "http"
+	}
+	return fmt.Sprintf("%s://%s", scheme, id.issuerHost)
+}
+
+// Validate validates an ID token.
+func (id *IDTokenValidator) Validate(ctx context.Context, token string) (*IDTokenClaims, error) {
+	p, err := oidc.NewProvider(ctx, id.issuerURL())
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	verifier := p.Verifier(&oidc.Config{
+		ClientID: "teleport.cluster.local",
+		Now:      id.Clock.Now,
+	})
+
+	idToken, err := verifier.Verify(ctx, token)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	// `go-oidc` does not implement not before check, so we need to manually
+	// perform this
+	if err := jwt.CheckNotBefore(id.Clock.Now(), time.Minute*2, idToken); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	claims := IDTokenClaims{}
+	if err := idToken.Claims(&claims); err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return &claims, nil
+}