Add JWT-validation for idporten/maskinporten

api/v1alpha1/application_types.go

@@ -3,9 +3,9 @@ package v1alpha1
 import (
 	"encoding/json"
 	"errors"
+	"github.com/kartverket/skiperator/api/v1alpha1/digdirator"
 	"time"
 
-	"github.com/kartverket/skiperator/api/v1alpha1/digdirator"
 	"github.com/kartverket/skiperator/api/v1alpha1/istiotypes"
 	"github.com/kartverket/skiperator/api/v1alpha1/podtypes"
 	corev1 "k8s.io/api/core/v1"

api/v1alpha1/digdirator/digdirator.go

@@ -0,0 +1,32 @@
+package digdirator
+
+import (
+	"github.com/kartverket/skiperator/api/v1alpha1/istiotypes"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type DigdiratorName string
+
+type DigdiratorURIs struct {
+	Name      DigdiratorName
+	IssuerURI string
+	JwksURI   string
+	ClientID  string
+}
+
+type DigdiratorClient interface {
+	GetOwnerReferences() []v1.OwnerReference
+	GetSecretName() string
+}
+
+type DigdiratorProvider interface {
+	IsEnabled() bool
+	GetAuthSpec() istiotypes.Authentication
+	GetDigdiratorName() DigdiratorName
+	GetProvidedSecretName() *string
+	GetPaths() []string
+	GetIgnoredPaths() []string
+	GetIssuerKey() string
+	GetJwksKey() string
+	GetClientIDKey() string
+}

api/v1alpha1/digdirator/idporten.go

@@ -1,6 +1,11 @@
 package digdirator
 
-import nais_io_v1 "github.com/nais/liberator/pkg/apis/nais.io/v1"
+import (
+	"github.com/kartverket/skiperator/api/v1alpha1/istiotypes"
+	"github.com/nais/digdirator/pkg/secrets"
+	nais_io_v1 "github.com/nais/liberator/pkg/apis/nais.io/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
 
 // Based off NAIS' IDPorten specification as seen here:
 // https://github.com/nais/liberator/blob/c9da4cf48a52c9594afc8a4325ff49bbd359d9d2/pkg/apis/nais.io/v1/naiserator_types.go#L93C10-L93C10
@@ -75,4 +80,69 @@ type IDPorten struct {
 	// +kubebuilder:validation:Minimum=3600
 	// +kubebuilder:validation:Maximum=7200
 	SessionLifetime *int `json:"sessionLifetime,omitempty"`
+
+	// Authentication specifies how incoming JWT's should be validated.
+	Authentication *istiotypes.Authentication `json:"authentication,omitempty"`
+}
+
+type IDPortenClient struct {
+	Client nais_io_v1.IDPortenClient
+}
+
+func (i *IDPortenClient) GetSecretName() string {
+	return i.Client.Spec.SecretName
+}
+
+func (i *IDPortenClient) GetOwnerReferences() []v1.OwnerReference {
+	return i.Client.GetOwnerReferences()
+}
+
+const IDPortenName DigdiratorName = "idporten"
+
+func (i *IDPorten) IsEnabled() bool {
+	return i != nil && i.Enabled && i.Authentication != nil && i.Authentication.Enabled
+}
+
+func (i *IDPorten) GetAuthSpec() istiotypes.Authentication {
+	return *i.Authentication
+}
+
+func (i *IDPorten) GetDigdiratorName() DigdiratorName {
+	return IDPortenName
+}
+
+func (i *IDPorten) GetProvidedSecretName() *string {
+	return i.Authentication.SecretName
+}
+
+func (i *IDPorten) GetPaths() []string {
+	var paths []string
+	if i.IsEnabled() {
+		if i.Authentication.Paths != nil {
+			paths = append(paths, *i.Authentication.Paths...)
+		}
+	}
+	return paths
+}
+
+func (i *IDPorten) GetIgnoredPaths() []string {
+	var ignoredPaths []string
+	if i.IsEnabled() {
+		if i.Authentication.IgnorePaths != nil {
+			ignoredPaths = append(ignoredPaths, *i.Authentication.IgnorePaths...)
+		}
+	}
+	return ignoredPaths
+}
+
+func (i *IDPorten) GetIssuerKey() string {
+	return secrets.IDPortenIssuerKey
+}
+
+func (i *IDPorten) GetJwksKey() string {
+	return secrets.IDPortenJwksUriKey
+}
+
+func (i *IDPorten) GetClientIDKey() string {
+	return secrets.IDPortenClientIDKey
 }

api/v1alpha1/digdirator/maskinporten.go

@@ -1,6 +1,11 @@
 package digdirator
 
-import nais_io_v1 "github.com/nais/liberator/pkg/apis/nais.io/v1"
+import (
+	"github.com/kartverket/skiperator/api/v1alpha1/istiotypes"
+	"github.com/nais/digdirator/pkg/secrets"
+	nais_io_v1 "github.com/nais/liberator/pkg/apis/nais.io/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
 
 // https://github.com/nais/liberator/blob/c9da4cf48a52c9594afc8a4325ff49bbd359d9d2/pkg/apis/nais.io/v1/naiserator_types.go#L376
 //
@@ -15,4 +20,69 @@ type Maskinporten struct {
 
 	// Schema to configure Maskinporten clients with consumed scopes and/or exposed scopes.
 	Scopes *nais_io_v1.MaskinportenScope `json:"scopes,omitempty"`
+
+	// Authentication specifies how incoming JWT's should be validated.
+	Authentication *istiotypes.Authentication `json:"authentication,omitempty"`
+}
+
+type MaskinportenClient struct {
+	Client nais_io_v1.MaskinportenClient
+}
+
+func (m *MaskinportenClient) GetOwnerReferences() []v1.OwnerReference {
+	return m.Client.GetOwnerReferences()
+}
+
+func (m *MaskinportenClient) GetSecretName() string {
+	return m.Client.Spec.SecretName
+}
+
+const MaskinPortenName = "maskinporten"
+
+func (i *Maskinporten) IsEnabled() bool {
+	return i != nil && i.Enabled && i.Authentication != nil && i.Authentication.Enabled
+}
+
+func (i *Maskinporten) GetAuthSpec() istiotypes.Authentication {
+	return *i.Authentication
+}
+
+func (i *Maskinporten) GetDigdiratorName() DigdiratorName {
+	return MaskinPortenName
+}
+
+func (i *Maskinporten) GetProvidedSecretName() *string {
+	return i.Authentication.SecretName
+}
+
+func (i *Maskinporten) GetPaths() []string {
+	var paths []string
+	if i.IsEnabled() {
+		if i.Authentication.Paths != nil {
+			paths = append(paths, *i.Authentication.Paths...)
+		}
+	}
+	return paths
+}
+
+func (i *Maskinporten) GetIgnoredPaths() []string {
+	var ignoredPaths []string
+	if i.IsEnabled() {
+		if i.Authentication.IgnorePaths != nil {
+			ignoredPaths = append(ignoredPaths, *i.Authentication.IgnorePaths...)
+		}
+	}
+	return ignoredPaths
+}
+
+func (i *Maskinporten) GetIssuerKey() string {
+	return secrets.MaskinportenIssuerKey
+}
+
+func (i *Maskinporten) GetJwksKey() string {
+	return secrets.MaskinportenJwksUriKey
+}
+
+func (i *Maskinporten) GetClientIDKey() string {
+	return secrets.MaskinportenClientIDKey
 }

api/v1alpha1/istiotypes/jwt_authentication.go

@@ -0,0 +1,67 @@
+package istiotypes
+
+// Authentication specifies how incoming JWT's should be validated.
+//
+// +kubebuilder:object:generate=true
+type Authentication struct {
+	// Whether to enable JWT validation.
+	// If enabled, incoming JWT's will be validated against the issuer specified in the app registration and the generated audience.
+	Enabled bool `json:"enabled"`
+
+	// The name of the kubernetes Secret containing OAuth2-credentials.
+	//
+	// If omitted, the associated client registration in the application manifest is used for JWT validation.
+	SecretName *string `json:"secretName,omitempty"`
+
+	// If set to `true`, the original token will be kept for the upstream request. Defaults to `true`.
+	// +kubebuilder:default=true
+	ForwardOriginalToken bool `json:"forwardOriginalToken,omitempty"`
+
+	// Where to find the JWT in the incoming request
+	//
+	// An enum value of `header` means that the JWT is present in the `Authorization`-header as a Bearer Token.
+	// An enum value of `cookie` means that the JWT is present as a cookie called `BearerToken`.
+	//
+	// +kubebuilder:validation:Enum=header;cookie
+	// +kubebuilder:default=header
+	TokenLocation string `json:"tokenLocation,omitempty"`
+
+	// This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.
+	// The header specified in each operation in the list must be unique. Nested claims of type string/int/bool is supported as well.
+	// ```
+	//
+	//	outputClaimToHeaders:
+	//	- header: x-my-company-jwt-group
+	//	  claim: my-group
+	//	- header: x-test-environment-flag
+	//	  claim: test-flag
+	//	- header: x-jwt-claim-group
+	//	  claim: nested.key.group
+	//
+	// ```
+	OutputClaimToHeaders *[]ClaimToHeader `json:"outputClaimToHeaders,omitempty"`
+
+	// Paths specifies paths that require an authenticated JWT.
+	//
+	// The specified paths must start with '/'.
+	// +listType=set
+	// +kubebuilder:validation:Items.Pattern="^/"
+	// +kubebuilder:validation:MaxItems=50
+	Paths *[]string `json:"paths,omitempty"`
+
+	// IgnorePaths specifies paths that do not require an authenticated JWT.
+	//
+	// The specified paths must start with '/'.
+	// +listType=set
+	// +kubebuilder:validation:Items.Pattern="^/"
+	// +kubebuilder:validation:MaxItems=50
+	IgnorePaths *[]string `json:"ignorePaths,omitempty"`
+}
+
+type ClaimToHeader struct {
+	// The name of the HTTP-header for which the specified claim will be copied to.
+	Header string `json:"header"`
+
+	// The claim to be copied.
+	Claim string `json:"claim"`
+}