Merge pull request #35 from LF-Engineering/test-auth0-manager

Fix auth0 manager key validation

Author: enkhalifapro

auth0/token.go

@@ -39,7 +39,6 @@ type ClientProvider struct {
 	AuthClientSecret string
 	AuthAudience     string
 	AuthURL          string
-	AuthSecret       string
 	Environment      string
 	httpClient       HTTPClientProvider
 	esClient         ESClientProvider
@@ -56,7 +55,6 @@ func NewAuth0Client(esCacheURL,
 	authClientSecret,
 	authAudience,
 	authURL string,
-	authSecret string,
 	httpClient HTTPClientProvider,
 	esClient ESClientProvider,
 	slackClient SlackProvider) (*ClientProvider, error) {
@@ -69,7 +67,6 @@ func NewAuth0Client(esCacheURL,
 		AuthClientSecret: authClientSecret,
 		AuthAudience:     authAudience,
 		AuthURL:          authURL,
-		AuthSecret:       authSecret,
 		Environment:      env,
 		httpClient:       httpClient,
 		esClient:         esClient,
@@ -235,13 +232,72 @@ var searchCacheQuery = map[string]interface{}{
 }
 
 func (a *ClientProvider) isValid(token string) bool {
-	t, err := jwt.Parse(token, func(_ *jwt.Token) (interface{}, error) { return []byte(a.AuthSecret), nil })
-	if err != nil || !t.Valid {
+	p, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodRSA); !ok {
+			return nil, errors.New("unexpected signing method")
+		}
+
+		cert, err := a.getPemCert(t)
+		if err != nil {
+			return nil, err
+		}
+
+		key, err := jwt.ParseRSAPublicKeyFromPEM([]byte(cert))
+		if err != nil {
+			return nil, err
+		}
+
+		return key, nil
+	})
+	if err != nil || !p.Valid {
 		log.Println(err)
 		return false
 	}
 
-	return t.Valid
+	return p.Valid
+}
+
+// Jwks result from auth0 well know keys
+type Jwks struct {
+	Keys []JSONWebKeys `json:"keys"`
+}
+
+// JSONWebKeys auth0 token key
+type JSONWebKeys struct {
+	Kty string   `json:"kty"`
+	Kid string   `json:"kid"`
+	Use string   `json:"use"`
+	N   string   `json:"n"`
+	E   string   `json:"e"`
+	X5c []string `json:"x5c"`
+}
+
+func (a *ClientProvider) getPemCert(token *jwt.Token) (string, error) {
+	cert := ""
+	//resp, err := http.Get(a.AuthURL + "/.well-known/jwks.json")
+	fmt.Println(fmt.Sprintf("%s/.well-known/jwks.json", a.AuthURL))
+	_, resp, err := a.httpClient.Request(fmt.Sprintf("%s/.well-known/jwks.json", a.AuthURL), "GET", nil, nil, nil)
+	if err != nil {
+		return cert, err
+	}
+
+	var jwks = Jwks{}
+	if err := json.Unmarshal(resp, &jwks); err != nil {
+		return cert, err
+	}
+
+	for _, k := range jwks.Keys {
+		if token.Header["kid"] == k.Kid {
+			cert = "-----BEGIN CERTIFICATE-----\n" + k.X5c[0] + "\n-----END CERTIFICATE-----"
+		}
+	}
+
+	if cert == "" {
+		err := errors.New("unable to find appropriate key")
+		return cert, err
+	}
+
+	return cert, nil
 }
 
 func (a *ClientProvider) createLastActionDate() error {

auth0/token_test.go

@@ -166,7 +166,7 @@ func buildServices(o *Org) (*http.ClientProvider, *auth0.ClientProvider, *elasti
 	}
 
 	httpClientProvider := http.NewClientProvider(time.Minute)
-	auth0ClientProvider, err := auth0.NewAuth0Client(o.ESCacheURL, o.ESCacheUsername, o.ESCachePassword, o.Environment, o.AuthGrantType, o.AuthClientID, o.AuthClientSecret, o.AuthAudience, o.AuthURL, o.AuthSecret, o.httpClient, o.esClient, o.slackProvider)
+	auth0ClientProvider, err := auth0.NewAuth0Client(o.ESCacheURL, o.ESCacheUsername, o.ESCachePassword, o.Environment, o.AuthGrantType, o.AuthClientID, o.AuthClientSecret, o.AuthAudience, o.AuthURL, o.httpClient, o.esClient, o.slackProvider)
 	if err != nil {
 		return nil, nil, nil, err
 	}