feat(sdk): Include auth token in grpc

go.mod

@@ -30,7 +30,6 @@ require (
 	github.com/valyala/fasthttp v1.52.0
 	github.com/virtru/access-pdp v1.11.0
 	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225
-	golang.org/x/oauth2 v0.18.0
 	google.golang.org/grpc v1.62.1
 	google.golang.org/protobuf v1.33.0
 	gopkg.in/go-jose/go-jose.v2 v2.6.3
@@ -140,6 +139,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/mod v0.15.0 // indirect
+	golang.org/x/oauth2 v0.18.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.18.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect

internal/server/server.go

@@ -19,7 +19,7 @@ import (
 	"github.com/go-chi/cors"
 	protovalidate_middleware "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/protovalidate"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
-	"github.com/opentdf/platform/internal/auth"
+	"github.com/opentdf/platform/sdk/auth"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"

pkg/server/start_test.go

@@ -8,10 +8,10 @@ import (
 	"time"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
-	"github.com/opentdf/platform/internal/auth"
 	"github.com/opentdf/platform/internal/config"
 	"github.com/opentdf/platform/internal/server"
 	"github.com/opentdf/platform/pkg/serviceregistry"
+	"github.com/opentdf/platform/sdk/auth"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/exp/slog"
 	"google.golang.org/grpc"

sdk/auth/access_token_source.go

@@ -0,0 +1,15 @@
+package auth
+
+import "github.com/lestrrat-go/jwx/v2/jwk"
+
+type AccessToken string
+
+type AccessTokenSource interface {
+	AccessToken() (AccessToken, error)
+	// probably better to use `crypto.AsymDecryption` here than roll our own since this should be
+	// more closely linked to what happens in KAS in terms of crypto params
+	DecryptWithDPoPKey(data []byte) ([]byte, error)
+	MakeToken(func(jwk.Key) ([]byte, error)) ([]byte, error)
+	DPOPPublicKeyPEM() string
+	RefreshAccessToken() error
+}

internal/auth/authn.go → sdk/auth/authn.go

@@ -2,14 +2,19 @@ package auth
 
 import (
 	"context"
+	"crypto"
+	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
 	"log/slog"
 	"net/http"
 	"slices"
 	"strings"
 	"time"
 
+	"github.com/lestrrat-go/jwx/v2/jwa"
 	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jws"
 	"github.com/lestrrat-go/jwx/v2/jwt"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -28,6 +33,18 @@ var (
 		"/healthz",
 		"/.well-known/opentdf-configuration",
 	}
+	// only asymmetric algorithms and no 'none'
+	allowedSignatureAlgorithms = map[jwa.SignatureAlgorithm]bool{
+		jwa.RS256: true,
+		jwa.RS384: true,
+		jwa.RS512: true,
+		jwa.ES256: true,
+		jwa.ES384: true,
+		jwa.ES512: true,
+		jwa.PS256: true,
+		jwa.PS384: true,
+		jwa.PS512: true,
+	}
 )
 
 // Authentication holds a jwks cache and information about the openid configuration
@@ -72,6 +89,12 @@ func NewAuthenticator(cfg AuthNConfig) (*authentication, error) {
 	return a, nil
 }
 
+type dpopInfo struct {
+	headers []string
+	path    string
+	method  string
+}
+
 // verifyTokenHandler is a http handler that verifies the token
 func (a authentication) VerifyTokenHandler(handler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -85,7 +108,12 @@ func (a authentication) VerifyTokenHandler(handler http.Handler) http.Handler {
 			http.Error(w, "missing authorization header", http.StatusUnauthorized)
 			return
 		}
-		err := checkToken(r.Context(), header, a)
+		dpopInfo := dpopInfo{
+			headers: r.Header["Dpop"],
+			path:    r.URL.Path,
+			method:  r.Method,
+		}
+		err := checkToken(r.Context(), header, dpopInfo, a)
 		if err != nil {
 			slog.WarnContext(r.Context(), "failed to validate token", slog.String("error", err.Error()))
 			http.Error(w, "unauthenticated", http.StatusUnauthorized)
@@ -117,7 +145,13 @@ func (a authentication) VerifyTokenInterceptor(ctx context.Context, req any, inf
 		return nil, status.Error(codes.Unauthenticated, "missing authorization header")
 	}
 
-	err := checkToken(ctx, header, a)
+	dpopInfo := dpopInfo{
+		headers: md["dpop"],
+		path:    info.FullMethod,
+		method:  "POST",
+	}
+
+	err := checkToken(ctx, header, dpopInfo, a)
 	if err != nil {
 		slog.Warn("failed to validate token", slog.String("error", err.Error()))
 		return nil, status.Errorf(codes.Unauthenticated, "unauthenticated")
@@ -127,7 +161,7 @@ func (a authentication) VerifyTokenInterceptor(ctx context.Context, req any, inf
 }
 
 // checkToken is a helper function to verify the token.
-func checkToken(ctx context.Context, authHeader []string, auth authentication) error {
+func checkToken(ctx context.Context, authHeader []string, dpopInfo dpopInfo, auth authentication) error {
 	var (
 		tokenRaw  string
 		tokenType string
@@ -145,32 +179,22 @@ func checkToken(ctx context.Context, authHeader []string, auth authentication) e
 		return fmt.Errorf("not of type bearer or dpop")
 	}
 
-	// Future work is to validate DPoP proof if token type is DPoP
-	//nolint:staticcheck
-	if tokenType == "DPoP" {
-		// Implement in the future here or as separate interceptor
-	}
-
 	// We have to get iss from the token first to verify the signature
 	unverifiedToken, err := jwt.Parse([]byte(tokenRaw), jwt.WithVerify(false))
 	if err != nil {
 		return err
 	}
 
 	// Get issuer from unverified token
-	issuer, exists := unverifiedToken.Get("iss")
-	if !exists {
+	issuer := unverifiedToken.Issuer()
+	if issuer == "" {
 		return fmt.Errorf("missing issuer")
 	}
 
 	// Get the openid configuration for the issuer
 	// Because we get an interface we need to cast it to a string
 	// and jwx expects it as a string so we should never hit this error if the token is valid
-	issuerStr, ok := issuer.(string)
-	if !ok {
-		return fmt.Errorf("invalid issuer")
-	}
-	oidc, exists := auth.oidcConfigurations[issuerStr]
+	oidc, exists := auth.oidcConfigurations[issuer]
 	if !exists {
 		return fmt.Errorf("invalid issuer")
 	}
@@ -182,17 +206,144 @@ func checkToken(ctx context.Context, authHeader []string, auth authentication) e
 	}
 
 	// Now we verify the token signature
-	_, err = jwt.Parse([]byte(tokenRaw),
+	accessToken, err := jwt.Parse([]byte(tokenRaw),
 		jwt.WithKeySet(keySet),
 		jwt.WithValidate(true),
-		jwt.WithIssuer(issuerStr),
+		jwt.WithIssuer(issuer),
 		jwt.WithAudience(oidc.Audience),
 		jwt.WithValidator(jwt.ValidatorFunc(auth.claimsValidator)),
 	)
+
 	if err != nil {
 		return err
 	}
 
+	if tokenType == "Bearer" {
+		if _, ok := accessToken.Get("cnf"); !ok {
+			return nil
+		}
+		slog.Warn("presented token with `cnf` claim as a bearer token. validating as DPoP")
+	}
+
+	return validateDPoP(accessToken, tokenRaw, dpopInfo)
+}
+
+func validateDPoP(accessToken jwt.Token, acessTokenRaw string, dpopInfo dpopInfo) error {
+	if len(dpopInfo.headers) != 1 {
+		return fmt.Errorf("got %d dpop headers, should have 1", len(dpopInfo.headers))
+	}
+	dpopHeader := dpopInfo.headers[0]
+
+	cnf, ok := accessToken.Get("cnf")
+	if !ok {
+		return fmt.Errorf("missing `cnf` claim in access token")
+	}
+
+	cnfDict, ok := cnf.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("got `cnf` in an invalid format")
+	}
+
+	jktI, ok := cnfDict["jkt"]
+	if !ok {
+		return fmt.Errorf("missing `jkt` field in `cnf` claim. only thumbprint JWK confirmation is supported")
+	}
+
+	jkt, ok := jktI.(string)
+	if !ok {
+		return fmt.Errorf("invalid `jkt` field in `cnf` claim: %v. the value must be a JWK thumbprint", jkt)
+	}
+
+	dpop, err := jws.Parse([]byte(dpopHeader))
+	if err != nil {
+		slog.Error("error parsing JWT: %w", err)
+		return fmt.Errorf("invalid DPoP JWT")
+	}
+	if len(dpop.Signatures()) != 1 {
+		return fmt.Errorf("expected one signature on DPoP JWT, got %d", len(dpop.Signatures()))
+	}
+	sig := dpop.Signatures()[0]
+	protectedHeaders := sig.ProtectedHeaders()
+	if protectedHeaders.Type() != "dpop+jwt" {
+		return fmt.Errorf("invalid typ on DPoP JWT: %v", protectedHeaders.Type())
+	}
+
+	if _, exists := allowedSignatureAlgorithms[protectedHeaders.Algorithm()]; !exists {
+		return fmt.Errorf("unsupported algorithm specified: %v", protectedHeaders.Algorithm())
+	}
+
+	dpopKey := protectedHeaders.JWK()
+	if dpopKey == nil {
+		return fmt.Errorf("JWK missing in DPoP JWT")
+	}
+
+	isPrivate, err := jwk.IsPrivateKey(dpopKey)
+	if err != nil {
+		slog.Error("error checking if key is private", err)
+		return fmt.Errorf("invalid DPoP key specified")
+	}
+
+	if isPrivate {
+		return fmt.Errorf("cannot use a private key for DPoP")
+	}
+
+	thumbprint, err := dpopKey.Thumbprint(crypto.SHA256)
+	if err != nil {
+		slog.Error("error computing thumbprint for key", err)
+		return fmt.Errorf("couldn't compute thumbprint for key in `jwk` in DPoP JWT")
+	}
+
+	if base64.URLEncoding.EncodeToString(thumbprint) != jkt {
+		return fmt.Errorf("the `jkt` from the DPoP JWT didn't match the thumbprint from the access token")
+	}
+
+	// at this point we have the right key because its thumbprint matches the `jkt` claim
+	// in the validated access token
+	dpopToken, err := jwt.Parse([]byte(dpopHeader), jwt.WithKey(protectedHeaders.Algorithm(), dpopKey))
+
+	if err != nil {
+		slog.Error("error validating DPoP JWT", err)
+		return fmt.Errorf("failed to verify signature on DPoP JWT")
+	}
+
+	issuedAt := dpopToken.IssuedAt()
+	if issuedAt.IsZero() {
+		return fmt.Errorf("missing `iat` claim in the DPoP JWT")
+	}
+
+	if issuedAt.Add(time.Minute * 60).Before(time.Now()) {
+		return fmt.Errorf("the DPoP JWT has expired")
+	}
+
+	htm, ok := dpopToken.Get("htm")
+	if !ok {
+		return fmt.Errorf("`htm` claim missing in DPoP JWT")
+	}
+
+	if htm != dpopInfo.method {
+		return fmt.Errorf("incorrect `htm` claim in DPoP JWT")
+	}
+
+	htu, ok := dpopToken.Get("htu")
+	if !ok {
+		return fmt.Errorf("`htu` claim missing in DPoP JWT")
+	}
+
+	if htu != dpopInfo.path {
+		return fmt.Errorf("incorrect `htu` claim in DPoP JWT")
+	}
+
+	ath, ok := dpopToken.Get("ath")
+	if !ok {
+		return fmt.Errorf("missing `ath` claim in DPoP JWT")
+	}
+
+	h := sha256.New()
+	h.Write([]byte(acessTokenRaw))
+	if ath != base64.URLEncoding.EncodeToString(h.Sum(nil)) {
+		return fmt.Errorf("incorrect `ath` claim in DPoP JWT")
+	}
+
 	return nil
 }