Add access token request call for the OpenID4VP user flow #2619

woutslakhorst · 2023-11-24T11:03:53Z

it extends the access token request with a user ID. If a user ID is given, the user flow is started. The API then returns a 302 with the location for the user. The user is redirected to baseURL/iam/did/user. If an active redirect token is present, the rest of the flow is started by creating a redirectURL to the remote authorization server.

There are 3 different error states;

unauthenticated, the flow can forward to a login page
technical error (inc missing token), forward to ???
functional error return from verifier, invalid_request, display reason?

The last two would require i18n. #2621 is created for the user facing design which includes error codes.

some untested code
user facing error returns

reinkrul · 2023-12-04T12:09:06Z

auth/api/iam/api.go

+	if err != nil {
+		return nil, core.NotFoundError("did not found: %w", err)
+	}
+	isWallet, err := r.vdr.IsOwner(ctx, *requestHolder)


use idToOwnedDID (or something)

This API does not use the id from the path but a DID from the request body.

auth/api/iam/openid4vp.go

auth/api/iam/session.go

reinkrul

first part

auth/api/iam/session.go

auth/api/iam/user.go

reinkrul · 2023-12-04T12:14:31Z

auth/api/iam/user.go

+	}, nil
+}
+
+// handleUserLanding is the handler for the landing page of the user.


which protocols, all of them?

yes it should switch when more different types are added (overview, addDevice, listDevices, whatever). But currently that's not needed yet.

reinkrul · 2023-12-04T12:15:48Z

auth/api/iam/user.go

+	err := store.Get(token, &redirectSession)
+	if err != nil {
+		log.Logger().Debug("token not found in store")
+		return echoCtx.String(http.StatusForbidden, "")


shouldn't we render a user-friendly HTML page here?

See PR description: #2621

auth/api/iam/user.go

auth/services/oauth/interface.go

docs/_static/auth/iam.yaml

reinkrul · 2023-12-05T05:27:12Z

auth/services/oauth/relying_party.go

@@ -110,6 +111,31 @@ func (s *relyingParty) CreateJwtGrant(ctx context.Context, request services.Crea
 	return &services.JwtBearerTokenResult{BearerToken: signingString, AuthorizationServerEndpoint: endpointURL}, nil
 }

+func (s *relyingParty) AuthorizationRequest(ctx context.Context, requestHolder did.DID, verifier did.DID, scopes string, clientState string) (*url.URL, error) {


no state/session needed?

clientState is passed, tokens are (currently) stored on API layer

reinkrul

Let's see in it action

reinkrul · 2023-12-11T12:31:46Z

auth/api/iam/user.go

+	oAuthFlowTimeout    = time.Minute
+	userRedirectTimeout = time.Second * 5
+	userSessionTimeout  = time.Hour


can you document these here? At least for my understanding how they differ

additional tests additional test PR feedback PR feedback test fix remove failing test (#2618) added e2e test for OpenID4VP s2s flow (#2617) PEX: Provide ParseEnvelope to correctly parse PEX VP envelopes (#2620) Bump schneider.vip/problem from 1.8.1 to 1.9.0 (#2622) Bumps [schneider.vip/problem](https://github.com/mschneider82/problem) from 1.8.1 to 1.9.0. - [Commits](mschneider82/problem@v1.8.1...v1.9.0) --- updated-dependencies: - dependency-name: schneider.vip/problem dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Bump golang.org/x/crypto from 0.15.0 to 0.16.0 (#2628) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.16.0. - [Commits](golang/crypto@v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Bump golang.org/x/time from 0.4.0 to 0.5.0 (#2627) Bumps [golang.org/x/time](https://github.com/golang/time) from 0.4.0 to 0.5.0. - [Commits](golang/time@v0.4.0...v0.5.0) --- updated-dependencies: - dependency-name: golang.org/x/time dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Missing rfc021 e2e tests changes (#2623) Discovery: SQLite-based server implementation (#2589) Bump github.com/nuts-foundation/go-leia/v4 from 4.0.0 to 4.0.1 (#2632) Bumps [github.com/nuts-foundation/go-leia/v4](https://github.com/nuts-foundation/go-leia) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/nuts-foundation/go-leia/releases) - [Commits](nuts-foundation/go-leia@v4.0.0...v4.0.1) --- updated-dependencies: - dependency-name: github.com/nuts-foundation/go-leia/v4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Root URL server config property to replace auth.publicurl (#2633) change idToDID to use did:web in iam API (#2635) Bump github.com/lestrrat-go/jwx/v2 from 2.0.17 to 2.0.18 (#2645) Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.17 to 2.0.18. - [Release notes](https://github.com/lestrrat-go/jwx/releases) - [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes) - [Commits](lestrrat-go/jwx@v2.0.17...v2.0.18) --- updated-dependencies: - dependency-name: github.com/lestrrat-go/jwx/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Bump github.com/nats-io/nats-server/v2 from 2.10.5 to 2.10.6 (#2644) Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.10.5 to 2.10.6. - [Release notes](https://github.com/nats-io/nats-server/releases) - [Changelog](https://github.com/nats-io/nats-server/blob/main/.goreleaser.yml) - [Commits](nats-io/nats-server@v2.10.5...v2.10.6) --- updated-dependencies: - dependency-name: github.com/nats-io/nats-server/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Bump alpine from 3.18.4 to 3.18.5 (#2636) Bumps alpine from 3.18.4 to 3.18.5. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> more NO_CONTENT timeout godoc

woutslakhorst requested review from reinkrul and gerardsn November 27, 2023 09:53

reinkrul reviewed Dec 4, 2023

View reviewed changes

auth/api/iam/openid4vp.go Outdated Show resolved Hide resolved

reinkrul reviewed Dec 4, 2023

View reviewed changes

auth/api/iam/session.go Show resolved Hide resolved

reinkrul reviewed Dec 4, 2023

View reviewed changes

auth/api/iam/session.go Show resolved Hide resolved

reinkrul requested changes Dec 4, 2023

View reviewed changes

woutslakhorst requested a review from reinkrul December 4, 2023 13:47

reinkrul requested changes Dec 5, 2023

View reviewed changes

woutslakhorst requested a review from reinkrul December 5, 2023 08:26

reinkrul approved these changes Dec 11, 2023

View reviewed changes

woutslakhorst force-pushed the feature/2604/access_token_request branch from 8d0cbf5 to 5a5f4e7 Compare December 12, 2023 08:15

woutslakhorst added 3 commits December 12, 2023 09:20

rebase fixes

704d57a

rebase fixes

1132790

test fix

1cf04aa

woutslakhorst merged commit 993bca8 into master Dec 12, 2023
6 checks passed

woutslakhorst deleted the feature/2604/access_token_request branch December 12, 2023 08:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add access token request call for the OpenID4VP user flow #2619

Add access token request call for the OpenID4VP user flow #2619

woutslakhorst commented Nov 24, 2023 •

edited

Loading

reinkrul Dec 4, 2023

woutslakhorst Dec 4, 2023

reinkrul left a comment

reinkrul Dec 4, 2023

woutslakhorst Dec 4, 2023

reinkrul Dec 4, 2023

woutslakhorst Dec 4, 2023

reinkrul Dec 5, 2023

woutslakhorst Dec 5, 2023

reinkrul left a comment

reinkrul Dec 11, 2023

Add access token request call for the OpenID4VP user flow #2619

Add access token request call for the OpenID4VP user flow #2619

Conversation

woutslakhorst commented Nov 24, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

reinkrul left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

reinkrul left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

woutslakhorst commented Nov 24, 2023 •

edited

Loading