forked from okta/okta-oidc-js
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathlib.js
156 lines (135 loc) · 5.05 KB
/
lib.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
/*!
* Copyright (c) 2017-Present, Okta, Inc. and/or its affiliates. All rights reserved.
* The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.")
*
* You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
const jwksClient = require('jwks-rsa');
const nJwt = require('njwt');
const {
assertIssuer,
assertClientId
} = require('@okta/configuration-validation');
class AssertedClaimsVerifier {
constructor() {
this.errors = [];
}
extractOperator(claim) {
const idx = claim.indexOf('.');
if (idx >= 0) {
return claim.substring(idx + 1);
}
return undefined;
}
extractClaim(claim) {
const idx = claim.indexOf('.');
if (idx >= 0) {
return claim.substring(0, idx);
}
return claim;
}
isValidOperator(operator) {
// may support more operators in the future
return !operator || operator === 'includes'
}
checkAssertions(op, claim, expectedValue, actualValue) {
if (!op && actualValue !== expectedValue) {
this.errors.push(`claim '${claim}' value '${actualValue}' does not match expected value '${expectedValue}'`);
} else if (op === 'includes' && Array.isArray(expectedValue)) {
expectedValue.forEach(value => {
if (!actualValue || !actualValue.includes(value)) {
this.errors.push(`claim '${claim}' value '${actualValue}' does not include expected value '${value}'`);
}
})
} else if (op === 'includes' && (!actualValue || !actualValue.includes(expectedValue))) {
this.errors.push(`claim '${claim}' value '${actualValue}' does not include expected value '${expectedValue}'`);
}
}
}
function verifyAssertedClaims(verifier, claims) {
const assertedClaimsVerifier = new AssertedClaimsVerifier();
for (let [claimName, expectedValue] of Object.entries(verifier.claimsToAssert)) {
const operator = assertedClaimsVerifier.extractOperator(claimName);
if (!assertedClaimsVerifier.isValidOperator(operator)) {
throw new Error(`operator: '${operator}' invalid. Supported operators: 'includes'.`);
}
const claim = assertedClaimsVerifier.extractClaim(claimName);
const actualValue = claims[claim];
assertedClaimsVerifier.checkAssertions(operator, claim, expectedValue, actualValue)
}
if (assertedClaimsVerifier.errors.length) {
throw new Error(assertedClaimsVerifier.errors.join(', '));
}
}
function verifyAudience(expected, aud) {
if( !expected ) {
throw new Error('expected audience is required');
}
if ( Array.isArray(expected) && !expected.includes(aud) ) {
throw new Error(`audience claim ${aud} does not match one of the expected audiences: ${ expected.join(', ') }`);
}
if ( !Array.isArray(expected) && aud !== expected ) {
throw new Error(`audience claim ${aud} does not match expected audience: ${expected}`);
}
}
function verifyIssuer(expected, issuer) {
if( issuer !== expected ) {
throw new Error(`issuer ${issuer} does not match expected issuer: ${expected}`);
}
}
class OktaJwtVerifier {
constructor(options = {}) {
// Assert configuration options exist and are well-formed (not necessarily correct!)
assertIssuer(options.issuer, options.testing);
if( options.clientId ) {
assertClientId(options.clientId);
}
this.claimsToAssert = options.assertClaims || {};
this.issuer = options.issuer;
this.jwksClient = jwksClient({
jwksUri: options.issuer + '/v1/keys',
cache: true,
cacheMaxAge: options.cacheMaxAge || (60 * 60 * 1000),
cacheMaxEntries: 3,
jwksRequestsPerMinute: options.jwksRequestsPerMinute || 10,
rateLimit: true
});
this.verifier = nJwt.createVerifier().setSigningAlgorithm('RS256').withKeyResolver((kid, cb) => {
this.jwksClient.getSigningKey(kid, (err, key) => {
cb(err, key && (key.publicKey || key.rsaPublicKey));
});
});
}
async verifyAsPromise(accessTokenString) {
return new Promise((resolve, reject) => {
// Convert to a promise
this.verifier.verify(accessTokenString, (err, jwt) => {
if (err) {
return reject(err);
}
jwt.claims = jwt.body;
delete jwt.body;
resolve(jwt);
});
});
}
async verifyAccessToken(accessTokenString, expectedAudience) {
// njwt verifies expiration and signature.
// We require RS256 in the base verifier.
// Remaining to verify:
// - audience claim
// - issuer claim
// - any custom claims passed in
const jwt = await this.verifyAsPromise(accessTokenString);
verifyAudience(expectedAudience, jwt.claims.aud);
verifyIssuer(this.issuer, jwt.claims.iss);
verifyAssertedClaims(this, jwt.claims);
return jwt;
}
}
module.exports = OktaJwtVerifier;