CadolesKube/hydra-maester
7
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: add 'UserinfoSignedResponseAlg' attribute to hydra.ory.sh_oauth2clients CRD
Some checks failed
Format / format (push) Failing after 6m3s
Details
CI / Prepare Dependencies (pull_request) Successful in 18m21s
Details
CI / Detected Repo Changes (pull_request) Successful in 8s
Details
Docker Image Scan / docker (pull_request) Failing after 21m14s
Details
Format / format (pull_request) Failing after 4m54s
Details
Licenses / License compliance (pull_request) Successful in 7m42s
Details
CI / Lint GithubAction files (pull_request) Has been skipped
Details
CI / Compile and test (pull_request) Failing after 9m23s
Details
CI / Run integration tests (pull_request) Failing after 15m8s
Details
CI / Build docker image (pull_request) Has been skipped
Details
Conventional commits / Validate PR title (pull_request_target) Failing after 9s
Details
CI / release (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
wpetit 2025-03-07 15:09:16 +01:00
parent e9be45f0b4
commit 1ed6229e78
5 changed files with 362 additions and 376 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
api/v1alpha1/oauth2client_types.go
View File

@ -225,6 +225,11 @@ type OAuth2ClientSpec struct {
// Indicates if a deleted OAuth2Client custom resource should delete the database row or not. // Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
// Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client. // Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
DeletionPolicy OAuth2ClientDeletionPolicy `json:"deletionPolicy,omitempty"` DeletionPolicy OAuth2ClientDeletionPolicy `json:"deletionPolicy,omitempty"`
// +kubebuilder:validation:type=string
//
// UserInfoSignedResponseAlg value specifying the JWS alg algorithm for signing UserInfo Responses
UserInfoSignedResponseAlg string `json:"userInfoSignedResponseAlg,omitempty"`
} }
// GrantType represents an OAuth 2.0 grant type // GrantType represents an OAuth 2.0 grant type

143
config/crd/bases/hydra.ory.sh_oauth2clients.yaml
View File

@ -37,75 +37,64 @@ spec:
metadata: metadata:
type: object type: object
spec: spec:
description: description: OAuth2ClientSpec defines the desired state of OAuth2Client
OAuth2ClientSpec defines the desired state of OAuth2Client
properties: properties:
allowedCorsOrigins: allowedCorsOrigins:
description: description: AllowedCorsOrigins is an array of allowed CORS origins
AllowedCorsOrigins is an array of allowed CORS origins
items: items:
description: description: RedirectURI represents a redirect URI for the client
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+ pattern: \w+:/?/?[^\s]+
type: string type: string
type: array type: array
audience: audience:
description: description: Audience is a whitelist defining the audiences this client
Audience is a whitelist defining the audiences this client
is allowed to request tokens for is allowed to request tokens for
items: items:
type: string type: string
type: array type: array
backChannelLogoutSessionRequired: backChannelLogoutSessionRequired:
default: false default: false
description: description: BackChannelLogoutSessionRequired Boolean value specifying
BackChannelLogoutSessionRequired Boolean value specifying whether the RP requires that a sid (session ID) Claim be included
whether the RP requires that a sid (session ID) Claim be in the Logout Token to identify the RP session with the OP when
included in the Logout Token to identify the RP session with the backchannel_logout_uri is used. If omitted, the default value
the OP when the backchannel_logout_uri is used. If omitted, is false.
the default value is false.
type: boolean type: boolean
backChannelLogoutURI: backChannelLogoutURI:
description: description: BackChannelLogoutURI RP URL that will cause the RP to
BackChannelLogoutURI RP URL that will cause the RP to log log itself out when sent a Logout Token by the OP
itself out when sent a Logout Token by the OP
pattern: (^$|^https?://.*) pattern: (^$|^https?://.*)
type: string type: string
clientName: clientName:
description: description: ClientName is the human-readable string name of the client
ClientName is the human-readable string name of the client
to be presented to the end-user during authorization. to be presented to the end-user during authorization.
type: string type: string
deletionPolicy: deletionPolicy:
description: |- description: |-
Indicates if a deleted OAuth2Client custom resource should delete the database row or not. Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
Value 0 means deletion of the OAuth2 client, value 1 means keep an orphan oauth2 client. Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
enum: enum:
- 0
- 1 - 1
- 2
type: integer type: integer
frontChannelLogoutSessionRequired: frontChannelLogoutSessionRequired:
default: false default: false
description: description: FrontChannelLogoutSessionRequired Boolean value specifying
FrontChannelLogoutSessionRequired Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query
whether the RP requires that iss (issuer) and sid (session parameters be included to identify the RP session with the OP when
ID) query parameters be included to identify the RP session the frontchannel_logout_uri is used
with the OP when the frontchannel_logout_uri is used
type: boolean type: boolean
frontChannelLogoutURI: frontChannelLogoutURI:
description: description: FrontChannelLogoutURI RP URL that will cause the RP to
FrontChannelLogoutURI RP URL that will cause the RP to log log itself out when rendered in an iframe by the OP. An iss (issuer)
itself out when rendered in an iframe by the OP. An iss query parameter and a sid (session ID) query parameter MAY be included
(issuer) query parameter and a sid (session ID) query by the OP to enable the RP to validate the request and to determine
parameter MAY be included by the OP to enable the RP to which of the potentially multiple sessions is to be logged out;
validate the request and to determine which of the if either is included, both MUST be
potentially multiple sessions is to be logged out; if either
is included, both MUST be
pattern: (^$|^https?://.*) pattern: (^$|^https?://.*)
type: string type: string
grantTypes: grantTypes:
description: description: GrantTypes is an array of grant types the client is allowed
GrantTypes is an array of grant types the client is allowed
to use. to use.
items: items:
description: GrantType represents an OAuth 2.0 grant type description: GrantType represents an OAuth 2.0 grant type
@ -155,10 +144,9 @@ spec:
type: string type: string
type: object type: object
jwksUri: jwksUri:
description: description: JwksUri Define the URL where the JSON Web Key Set should
JwksUri Define the URL where the JSON Web Key Set should be be fetched from when performing the private_key_jwt client authentication
fetched from when performing the private_key_jwt client method.
authentication method.
pattern: (^$|^https?://.*) pattern: (^$|^https?://.*)
type: string type: string
metadata: metadata:
@ -167,22 +155,18 @@ spec:
type: object type: object
x-kubernetes-preserve-unknown-fields: true x-kubernetes-preserve-unknown-fields: true
postLogoutRedirectUris: postLogoutRedirectUris:
description: description: PostLogoutRedirectURIs is an array of the post logout
PostLogoutRedirectURIs is an array of the post logout
redirect URIs allowed for the application redirect URIs allowed for the application
items: items:
description: description: RedirectURI represents a redirect URI for the client
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+ pattern: \w+:/?/?[^\s]+
type: string type: string
type: array type: array
redirectUris: redirectUris:
description: description: RedirectURIs is an array of the redirect URIs allowed
RedirectURIs is an array of the redirect URIs allowed for for the application
the application
items: items:
description: description: RedirectURI represents a redirect URI for the client
RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+ pattern: \w+:/?/?[^\s]+
type: string type: string
type: array type: array
@ -191,8 +175,8 @@ spec:
ResponseTypes is an array of the OAuth 2.0 response type strings that the client can ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
use at the authorization endpoint. use at the authorization endpoint.
items: items:
description: description: ResponseType represents an OAuth 2.0 response type
ResponseType represents an OAuth 2.0 response type strings strings
enum: enum:
- id_token - id_token
- code - code
@ -221,8 +205,7 @@ spec:
type: string type: string
type: array type: array
secretName: secretName:
description: description: SecretName points to the K8s secret that contains this
SecretName points to the K8s secret that contains this
client's ID and password client's ID and password
maxLength: 253 maxLength: 253
minLength: 1 minLength: 1
@ -230,8 +213,7 @@ spec:
type: string type: string
skipConsent: skipConsent:
default: false default: false
description: description: SkipConsent skips the consent screen for this client.
SkipConsent skips the consent screen for this client.
type: boolean type: boolean
tokenEndpointAuthMethod: tokenEndpointAuthMethod:
allOf: allOf:
@ -245,9 +227,8 @@ spec:
- client_secret_post - client_secret_post
- private_key_jwt - private_key_jwt
- none - none
description: description: Indication which authentication method should be used
Indication which authentication method should be used for for the token endpoint
the token endpoint
type: string type: string
tokenLifespans: tokenLifespans:
description: |- description: |-
@ -258,76 +239,78 @@ spec:
description: |- description: |-
AuthorizationCodeGrantAccessTokenLifespan is the access token lifespan AuthorizationCodeGrantAccessTokenLifespan is the access token lifespan
issued on an authorization_code grant. issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
authorization_code_grant_id_token_lifespan: authorization_code_grant_id_token_lifespan:
description: |- description: |-
AuthorizationCodeGrantIdTokenLifespan is the id token lifespan AuthorizationCodeGrantIdTokenLifespan is the id token lifespan
issued on an authorization_code grant. issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
authorization_code_grant_refresh_token_lifespan: authorization_code_grant_refresh_token_lifespan:
description: |- description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the refresh token lifespan AuthorizationCodeGrantRefreshTokenLifespan is the refresh token lifespan
issued on an authorization_code grant. issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
client_credentials_grant_access_token_lifespan: client_credentials_grant_access_token_lifespan:
description: |- description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the access token lifespan AuthorizationCodeGrantRefreshTokenLifespan is the access token lifespan
issued on a client_credentials grant. issued on a client_credentials grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
implicit_grant_access_token_lifespan: implicit_grant_access_token_lifespan:
description: |- description: |-
ImplicitGrantAccessTokenLifespan is the access token lifespan ImplicitGrantAccessTokenLifespan is the access token lifespan
issued on an implicit grant. issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
implicit_grant_id_token_lifespan: implicit_grant_id_token_lifespan:
description: |- description: |-
ImplicitGrantIdTokenLifespan is the id token lifespan ImplicitGrantIdTokenLifespan is the id token lifespan
issued on an implicit grant. issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
jwt_bearer_grant_access_token_lifespan: jwt_bearer_grant_access_token_lifespan:
description: |- description: |-
JwtBearerGrantAccessTokenLifespan is the access token lifespan JwtBearerGrantAccessTokenLifespan is the access token lifespan
issued on a jwt_bearer grant. issued on a jwt_bearer grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
refresh_token_grant_access_token_lifespan: refresh_token_grant_access_token_lifespan:
description: |- description: |-
RefreshTokenGrantAccessTokenLifespan is the access token lifespan RefreshTokenGrantAccessTokenLifespan is the access token lifespan
issued on a refresh_token grant. issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
refresh_token_grant_id_token_lifespan: refresh_token_grant_id_token_lifespan:
description: |- description: |-
RefreshTokenGrantIdTokenLifespan is the id token lifespan RefreshTokenGrantIdTokenLifespan is the id token lifespan
issued on a refresh_token grant. issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
refresh_token_grant_refresh_token_lifespan: refresh_token_grant_refresh_token_lifespan:
description: |- description: |-
RefreshTokenGrantRefreshTokenLifespan is the refresh token lifespan RefreshTokenGrantRefreshTokenLifespan is the refresh token lifespan
issued on a refresh_token grant. issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)" pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string type: string
type: object type: object
userInfoSignedResponseAlg:
description: UserInfoSignedResponseAlg value specifying the JWS alg
algorithm for signing UserInfo Responses
type: string
required: required:
- grantTypes - grantTypes
- secretName - secretName
type: object type: object
status: status:
description: description: OAuth2ClientStatus defines the observed state of OAuth2Client
OAuth2ClientStatus defines the observed state of OAuth2Client
properties: properties:
conditions: conditions:
items: items:
description: description: OAuth2ClientCondition contains condition information
OAuth2ClientCondition contains condition information for for an OAuth2Client
an OAuth2Client
properties: properties:
status: status:
enum: enum:
@ -343,24 +326,20 @@ spec:
type: object type: object
type: array type: array
observedGeneration: observedGeneration:
description: description: ObservedGeneration represents the most recent generation
ObservedGeneration represents the most recent generation
observed by the daemon set controller. observed by the daemon set controller.
format: int64 format: int64
type: integer type: integer
reconciliationError: reconciliationError:
description: description: ReconciliationError represents an error that occurred
ReconciliationError represents an error that occurred during during the reconciliation process
the reconciliation process
properties: properties:
description: description:
description: description: Description is the description of the reconciliation
Description is the description of the reconciliation
error error
type: string type: string
statusCode: statusCode:
description: description: Code is the status code of the reconciliation error
Code is the status code of the reconciliation error
type: string type: string
type: object type: object
type: object type: object

2
config/default/manager_image_patch.yaml
View File

@ -8,6 +8,6 @@ spec:
spec: spec:
containers: containers:
# Change the value of image field below to your controller image URL # Change the value of image field below to your controller image URL
- image: controller:latest - image: reg.cadoles.com/wpetit/hydra-maester
name: manager name: manager
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent

2
hydra/types.go
View File

@ -44,6 +44,7 @@ type OAuth2ClientJSON struct {
RefreshTokenGrantAccessTokenLifespan string `json:"refresh_token_grant_access_token_lifespan,omitempty"` RefreshTokenGrantAccessTokenLifespan string `json:"refresh_token_grant_access_token_lifespan,omitempty"`
RefreshTokenGrantIdTokenLifespan string `json:"refresh_token_grant_id_token_lifespan,omitempty"` RefreshTokenGrantIdTokenLifespan string `json:"refresh_token_grant_id_token_lifespan,omitempty"`
RefreshTokenGrantRefreshTokenLifespan string `json:"refresh_token_grant_refresh_token_lifespan,omitempty"` RefreshTokenGrantRefreshTokenLifespan string `json:"refresh_token_grant_refresh_token_lifespan,omitempty"`
UserInfoSignedResponseAlg string `json:"userinfo_signed_response_alg,omitempty"`
} }
// Oauth2ClientCredentials represents client ID and password fetched from a // Oauth2ClientCredentials represents client ID and password fetched from a
@ -104,6 +105,7 @@ func FromOAuth2Client(c *hydrav1alpha1.OAuth2Client) (*OAuth2ClientJSON, error)
RefreshTokenGrantAccessTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantAccessTokenLifespan, RefreshTokenGrantAccessTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantAccessTokenLifespan,
RefreshTokenGrantIdTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantIdTokenLifespan, RefreshTokenGrantIdTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantIdTokenLifespan,
RefreshTokenGrantRefreshTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantRefreshTokenLifespan, RefreshTokenGrantRefreshTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantRefreshTokenLifespan,
UserInfoSignedResponseAlg: c.Spec.UserInfoSignedResponseAlg,
}, nil }, nil
} }