CadolesKube/hydra-maester
7
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: add 'UserinfoSignedResponseAlg' attribute to hydra.ory.sh_oauth2clients CRD
Some checks failed
Format / format (push) Failing after 6m3s
Details
CI / Prepare Dependencies (pull_request) Successful in 18m21s
Details
CI / Detected Repo Changes (pull_request) Successful in 8s
Details
Docker Image Scan / docker (pull_request) Failing after 21m14s
Details
Format / format (pull_request) Failing after 4m54s
Details
Licenses / License compliance (pull_request) Successful in 7m42s
Details
CI / Lint GithubAction files (pull_request) Has been skipped
Details
CI / Compile and test (pull_request) Failing after 9m23s
Details
CI / Run integration tests (pull_request) Failing after 15m8s
Details
CI / Build docker image (pull_request) Has been skipped
Details
Conventional commits / Validate PR title (pull_request_target) Failing after 9s
Details
CI / release (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
wpetit 2025-03-07 15:09:16 +01:00
parent e9be45f0b4
commit 1ed6229e78
5 changed files with 362 additions and 376 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
api/v1alpha1/oauth2client_types.go
View File

@ -225,6 +225,11 @@ type OAuth2ClientSpec struct {
// Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
// Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
DeletionPolicy OAuth2ClientDeletionPolicy `json:"deletionPolicy,omitempty"`
// +kubebuilder:validation:type=string
//
// UserInfoSignedResponseAlg value specifying the JWS alg algorithm for signing UserInfo Responses
UserInfoSignedResponseAlg string `json:"userInfoSignedResponseAlg,omitempty"`
}
// GrantType represents an OAuth 2.0 grant type

143
config/crd/bases/hydra.ory.sh_oauth2clients.yaml
View File

@ -37,75 +37,64 @@ spec:
metadata:
type: object
spec:
description:
OAuth2ClientSpec defines the desired state of OAuth2Client
description: OAuth2ClientSpec defines the desired state of OAuth2Client
properties:
allowedCorsOrigins:
description:
AllowedCorsOrigins is an array of allowed CORS origins
description: AllowedCorsOrigins is an array of allowed CORS origins
items:
description:
RedirectURI represents a redirect URI for the client
description: RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
audience:
description:
Audience is a whitelist defining the audiences this client
description: Audience is a whitelist defining the audiences this client
is allowed to request tokens for
items:
type: string
type: array
backChannelLogoutSessionRequired:
default: false
description:
BackChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that a sid (session ID) Claim be
included in the Logout Token to identify the RP session with
the OP when the backchannel_logout_uri is used. If omitted,
the default value is false.
description: BackChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that a sid (session ID) Claim be included
in the Logout Token to identify the RP session with the OP when
the backchannel_logout_uri is used. If omitted, the default value
is false.
type: boolean
backChannelLogoutURI:
description:
BackChannelLogoutURI RP URL that will cause the RP to log
itself out when sent a Logout Token by the OP
description: BackChannelLogoutURI RP URL that will cause the RP to
log itself out when sent a Logout Token by the OP
pattern: (^$|^https?://.*)
type: string
clientName:
description:
ClientName is the human-readable string name of the client
description: ClientName is the human-readable string name of the client
to be presented to the end-user during authorization.
type: string
deletionPolicy:
description: |-
Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
Value 0 means deletion of the OAuth2 client, value 1 means keep an orphan oauth2 client.
Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
enum:
- 0
- 1
- 2
type: integer
frontChannelLogoutSessionRequired:
default: false
description:
FrontChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that iss (issuer) and sid (session
ID) query parameters be included to identify the RP session
with the OP when the frontchannel_logout_uri is used
description: FrontChannelLogoutSessionRequired Boolean value specifying
whether the RP requires that iss (issuer) and sid (session ID) query
parameters be included to identify the RP session with the OP when
the frontchannel_logout_uri is used
type: boolean
frontChannelLogoutURI:
description:
FrontChannelLogoutURI RP URL that will cause the RP to log
itself out when rendered in an iframe by the OP. An iss
(issuer) query parameter and a sid (session ID) query
parameter MAY be included by the OP to enable the RP to
validate the request and to determine which of the
potentially multiple sessions is to be logged out; if either
is included, both MUST be
description: FrontChannelLogoutURI RP URL that will cause the RP to
log itself out when rendered in an iframe by the OP. An iss (issuer)
query parameter and a sid (session ID) query parameter MAY be included
by the OP to enable the RP to validate the request and to determine
which of the potentially multiple sessions is to be logged out;
if either is included, both MUST be
pattern: (^$|^https?://.*)
type: string
grantTypes:
description:
GrantTypes is an array of grant types the client is allowed
description: GrantTypes is an array of grant types the client is allowed
to use.
items:
description: GrantType represents an OAuth 2.0 grant type
@ -155,10 +144,9 @@ spec:
type: string
type: object
jwksUri:
description:
JwksUri Define the URL where the JSON Web Key Set should be
fetched from when performing the private_key_jwt client
authentication method.
description: JwksUri Define the URL where the JSON Web Key Set should
be fetched from when performing the private_key_jwt client authentication
method.
pattern: (^$|^https?://.*)
type: string
metadata:
@ -167,22 +155,18 @@ spec:
type: object
x-kubernetes-preserve-unknown-fields: true
postLogoutRedirectUris:
description:
PostLogoutRedirectURIs is an array of the post logout
description: PostLogoutRedirectURIs is an array of the post logout
redirect URIs allowed for the application
items:
description:
RedirectURI represents a redirect URI for the client
description: RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
redirectUris:
description:
RedirectURIs is an array of the redirect URIs allowed for
the application
description: RedirectURIs is an array of the redirect URIs allowed
for the application
items:
description:
RedirectURI represents a redirect URI for the client
description: RedirectURI represents a redirect URI for the client
pattern: \w+:/?/?[^\s]+
type: string
type: array
@ -191,8 +175,8 @@ spec:
ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
use at the authorization endpoint.
items:
description:
ResponseType represents an OAuth 2.0 response type strings
description: ResponseType represents an OAuth 2.0 response type
strings
enum:
- id_token
- code
@ -221,8 +205,7 @@ spec:
type: string
type: array
secretName:
description:
SecretName points to the K8s secret that contains this
description: SecretName points to the K8s secret that contains this
client's ID and password
maxLength: 253
minLength: 1
@ -230,8 +213,7 @@ spec:
type: string
skipConsent:
default: false
description:
SkipConsent skips the consent screen for this client.
description: SkipConsent skips the consent screen for this client.
type: boolean
tokenEndpointAuthMethod:
allOf:
@ -245,9 +227,8 @@ spec:
- client_secret_post
- private_key_jwt
- none
description:
Indication which authentication method should be used for
the token endpoint
description: Indication which authentication method should be used
for the token endpoint
type: string
tokenLifespans:
description: |-
@ -258,76 +239,78 @@ spec:
description: |-
AuthorizationCodeGrantAccessTokenLifespan is the access token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
authorization_code_grant_id_token_lifespan:
description: |-
AuthorizationCodeGrantIdTokenLifespan is the id token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
authorization_code_grant_refresh_token_lifespan:
description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the refresh token lifespan
issued on an authorization_code grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
client_credentials_grant_access_token_lifespan:
description: |-
AuthorizationCodeGrantRefreshTokenLifespan is the access token lifespan
issued on a client_credentials grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
implicit_grant_access_token_lifespan:
description: |-
ImplicitGrantAccessTokenLifespan is the access token lifespan
issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
implicit_grant_id_token_lifespan:
description: |-
ImplicitGrantIdTokenLifespan is the id token lifespan
issued on an implicit grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
jwt_bearer_grant_access_token_lifespan:
description: |-
JwtBearerGrantAccessTokenLifespan is the access token lifespan
issued on a jwt_bearer grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
refresh_token_grant_access_token_lifespan:
description: |-
RefreshTokenGrantAccessTokenLifespan is the access token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
refresh_token_grant_id_token_lifespan:
description: |-
RefreshTokenGrantIdTokenLifespan is the id token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
refresh_token_grant_refresh_token_lifespan:
description: |-
RefreshTokenGrantRefreshTokenLifespan is the refresh token lifespan
issued on a refresh_token grant.
pattern: "[0-9]+(ns|us|ms|s|m|h)"
pattern: '[0-9]+(ns|us|ms|s|m|h)'
type: string
type: object
userInfoSignedResponseAlg:
description: UserInfoSignedResponseAlg value specifying the JWS alg
algorithm for signing UserInfo Responses
type: string
required:
- grantTypes
- secretName
type: object
status:
description:
OAuth2ClientStatus defines the observed state of OAuth2Client
description: OAuth2ClientStatus defines the observed state of OAuth2Client
properties:
conditions:
items:
description:
OAuth2ClientCondition contains condition information for
an OAuth2Client
description: OAuth2ClientCondition contains condition information
for an OAuth2Client
properties:
status:
enum:
@ -343,24 +326,20 @@ spec:
type: object
type: array
observedGeneration:
description:
ObservedGeneration represents the most recent generation
description: ObservedGeneration represents the most recent generation
observed by the daemon set controller.
format: int64
type: integer
reconciliationError:
description:
ReconciliationError represents an error that occurred during
the reconciliation process
description: ReconciliationError represents an error that occurred
during the reconciliation process
properties:
description:
description:
Description is the description of the reconciliation
description: Description is the description of the reconciliation
error
type: string
statusCode:
description:
Code is the status code of the reconciliation error
description: Code is the status code of the reconciliation error
type: string
type: object
type: object

2
config/default/manager_image_patch.yaml
View File

@ -8,6 +8,6 @@ spec:
spec:
containers:
# Change the value of image field below to your controller image URL
- image: controller:latest
- image: reg.cadoles.com/wpetit/hydra-maester
name: manager
imagePullPolicy: IfNotPresent

2
hydra/types.go
View File

@ -44,6 +44,7 @@ type OAuth2ClientJSON struct {
RefreshTokenGrantAccessTokenLifespan string `json:"refresh_token_grant_access_token_lifespan,omitempty"`
RefreshTokenGrantIdTokenLifespan string `json:"refresh_token_grant_id_token_lifespan,omitempty"`
RefreshTokenGrantRefreshTokenLifespan string `json:"refresh_token_grant_refresh_token_lifespan,omitempty"`
UserInfoSignedResponseAlg string `json:"userinfo_signed_response_alg,omitempty"`
}
// Oauth2ClientCredentials represents client ID and password fetched from a
@ -104,6 +105,7 @@ func FromOAuth2Client(c *hydrav1alpha1.OAuth2Client) (*OAuth2ClientJSON, error)
RefreshTokenGrantAccessTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantAccessTokenLifespan,
RefreshTokenGrantIdTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantIdTokenLifespan,
RefreshTokenGrantRefreshTokenLifespan: c.Spec.TokenLifespans.RefreshTokenGrantRefreshTokenLifespan,
UserInfoSignedResponseAlg: c.Spec.UserInfoSignedResponseAlg,
}, nil
}