[Security] Add security:oidc-token:generate command #60660
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <fabien@symfony.com> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Component\Security\Http\AccessToken\Oidc; | ||
|
|
||
| use Jose\Component\Core\Algorithm; | ||
| use Jose\Component\Core\AlgorithmManager; | ||
| use Jose\Component\Core\JWKSet; | ||
| use Jose\Component\Signature\JWSBuilder; | ||
| use Jose\Component\Signature\Serializer\CompactSerializer; | ||
| use Psr\Clock\ClockInterface; | ||
| use Symfony\Component\Clock\Clock; | ||
|
|
||
| class OidcTokenGenerator | ||
| { | ||
| public function __construct( | ||
| private readonly AlgorithmManager $algorithmManager, | ||
| private readonly JWKSet $jwkset, | ||
| private readonly string $audience, | ||
| private readonly array $issuers, | ||
| private readonly string $claim = 'sub', | ||
| private readonly ClockInterface $clock = new Clock(), | ||
| ) { | ||
| } | ||
|
|
||
| public function generate(string $userIdentifier, ?string $algorithmAlias = null, ?string $issuer = null, ?int $ttl = null, ?\DateTimeImmutable $notBefore = null): string | ||
| { | ||
| $algorithm = $this->getAlgorithm($algorithmAlias); | ||
|
|
||
| if (!$jwk = $this->jwkset->selectKey('sig', $algorithm)) { | ||
| throw new \InvalidArgumentException(\sprintf('No JWK found to sign with "%s" algorithm.', $algorithm->name())); | ||
| } | ||
|
|
||
| $jwsBuilder = new JWSBuilder($this->algorithmManager); | ||
|
|
||
| $now = $this->clock->now(); | ||
| $payload = [ | ||
| $this->claim => $userIdentifier, | ||
| 'iat' => $now->getTimestamp(), # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6 | ||
| 'aud' => $this->audience, # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3 | ||
| 'iss' => $this->getIssuer($issuer), # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1 | ||
| ]; | ||
| if ($ttl) { | ||
| if (0 > $ttl) { | ||
| throw new \InvalidArgumentException('Time to live must be a positive integer.'); | ||
| } | ||
|
|
||
| $payload['exp'] = $now->add(new \DateInterval("PT{$ttl}S"))->getTimestamp(); # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4 | ||
| } | ||
| if ($notBefore) { | ||
| $payload['nbf'] = $notBefore->getTimestamp(); # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5 | ||
| } | ||
|
|
||
| $jws = $jwsBuilder | ||
| ->create() | ||
| ->withPayload(json_encode($payload, flags: \JSON_THROW_ON_ERROR)) | ||
| ->addSignature($jwk, ['alg' => $algorithm->name()]) | ||
| ->build(); | ||
|
|
||
| $serializer = new CompactSerializer(); | ||
|
|
||
| return $serializer->serialize($jws, 0); | ||
| } | ||
|
|
||
| private function getAlgorithm(?string $alias): Algorithm | ||
| { | ||
| if ($alias) { | ||
| if (!$this->algorithmManager->has($alias)) { | ||
| throw new \InvalidArgumentException(sprintf('"%s" is not a valid algorithm. Available algorithms: "%s".', $alias, implode('", "', $this->algorithmManager->list()))); | ||
| } | ||
| return $this->algorithmManager->get($alias); | ||
| } | ||
|
|
||
| if (1 !== count($list = $this->algorithmManager->list())) { | ||
| throw new \InvalidArgumentException(sprintf('Please choose an algorithm. Available algorithms: "%s".', implode('", "', $list))); | ||
| } | ||
|
|
||
| return $this->algorithmManager->get($list[0]); | ||
| } | ||
|
|
||
| private function getIssuer(?string $issuer): string | ||
| { | ||
| if ($issuer) { | ||
| if (!in_array($issuer, $this->issuers, true)) { | ||
| throw new \InvalidArgumentException(sprintf('"%s" is not a valid issuer. Available issuers: "%s".', $issuer, implode('", "', $this->issuers))); | ||
| } | ||
|
|
||
| return $issuer; | ||
| } | ||
|
|
||
| if (1 !== count($this->issuers)) { | ||
| throw new \InvalidArgumentException(sprintf('Please choose an issuer. Available issuers: "%s".', implode('", "', $this->issuers))); | ||
| } | ||
|
|
||
| return $this->issuers[0]; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <fabien@symfony.com> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Component\Security\Http\Command; | ||
|
|
||
| use Symfony\Component\Console\Attribute\AsCommand; | ||
| use Symfony\Component\Console\Command\Command; | ||
| use Symfony\Component\Console\Completion\CompletionInput; | ||
| use Symfony\Component\Console\Completion\CompletionSuggestions; | ||
| use Symfony\Component\Console\Completion\Suggestion; | ||
| use Symfony\Component\Console\Input\InputArgument; | ||
| use Symfony\Component\Console\Input\InputInterface; | ||
| use Symfony\Component\Console\Input\InputOption; | ||
| use Symfony\Component\Console\Output\OutputInterface; | ||
| use Symfony\Component\Security\Http\AccessToken\Oidc\OidcTokenGenerator; | ||
|
|
||
| #[AsCommand(name: 'security:oidc:generate-token', description: 'Generate an OIDC token for a given user')] | ||
| final class OidcTokenGenerateCommand extends Command | ||
| { | ||
| /** @var array<string, OidcTokenGenerator> */ | ||
| private array $generators = []; | ||
| /** @var array<string, list<string>> */ | ||
| private array $algorithms; | ||
| /** @var array<string, list<string>> */ | ||
| private array $issuers; | ||
|
|
||
| protected function configure(): void | ||
| { | ||
| $this | ||
| ->addArgument('user-identifier', InputArgument::REQUIRED, 'User identifier') | ||
| ->addOption('firewall', null, InputOption::VALUE_REQUIRED, 'Firewall') | ||
fabpot marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| ->addOption('algorithm', null, InputOption::VALUE_REQUIRED, 'Algorithm name to use to sign') | ||
chalasr marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| ->addOption('issuer', null, InputOption::VALUE_REQUIRED, 'Set the Issuer claim (iss)') | ||
| ->addOption('ttl', null, InputOption::VALUE_REQUIRED, 'Set the Expiration Time claim (exp) (time to live in seconds)') | ||
| ->addOption('not-before', null, InputOption::VALUE_REQUIRED, 'Set the Not Before claim (nbf)') | ||
| ; | ||
| } | ||
|
|
||
|
|
||
|
|
||
| /** | ||
| * @params array<string, list<string>> $algorithms | ||
| * @params array<string, list<string>> $issuers | ||
| */ | ||
| public function addGenerator(string $firewall, OidcTokenGenerator $oidcTokenGenerator, array $algorithms, array $issuers): void | ||
| { | ||
| $this->generators[$firewall] = $oidcTokenGenerator; | ||
| foreach ($algorithms as $algorithm) { | ||
| $this->algorithms[$algorithm] ??= []; | ||
| $this->algorithms[$algorithm][] = $firewall; | ||
| } | ||
| foreach ($issuers as $issuer) { | ||
| $this->issuers[$issuer] ??= []; | ||
| $this->issuers[$issuer][] = $firewall; | ||
| } | ||
| } | ||
|
|
||
| protected function execute(InputInterface $input, OutputInterface $output): int | ||
| { | ||
| $generator = $this->getGenerator($input->getOption('firewall')); | ||
| $token = $generator->generate( | ||
| $input->getArgument('user-identifier'), | ||
| $input->getOption('algorithm'), | ||
| $input->getOption('issuer'), | ||
| $input->getOption('ttl'), | ||
| ($nbf = $input->getOption('not-before')) ? new \DateTimeImmutable($nbf) : null, | ||
| ); | ||
|
|
||
| $output->writeln($token); | ||
|
|
||
| return self::SUCCESS; | ||
| } | ||
|
|
||
| private function getGenerator(?string $firewall): OidcTokenGenerator | ||
| { | ||
| if (0 === count($this->generators)) { | ||
| throw new \InvalidArgumentException('No OIDC token generator configured.'); | ||
| } | ||
|
|
||
| if ($firewall) { | ||
| return $this->generators[$firewall] ?? throw new \InvalidArgumentException(sprintf('Invalid firewall. Available firewalls: "%s".', implode('", "', array_keys($this->generators)))); | ||
| } | ||
|
|
||
| if (1 === count($this->generators)) { | ||
| return end($this->generators); | ||
| } | ||
|
|
||
| throw new \InvalidArgumentException(sprintf('Please choose an firewall. Available firewalls: "%s".', implode('", "', array_keys($this->generators)))); | ||
| } | ||
|
|
||
| public function complete(CompletionInput $input, CompletionSuggestions $suggestions): void | ||
| { | ||
| if ($input->mustSuggestOptionValuesFor('firewall')) { | ||
| $suggestions->suggestValues(array_keys($this->generators)); | ||
| } | ||
|
|
||
| if ($input->mustSuggestOptionValuesFor('algorithm')) { | ||
| foreach ($this->algorithms as $algorithm => $firewalls) { | ||
| $suggestions->suggestValue(new Suggestion($algorithm, sprintf('Available firewalls: "%s".', implode('", "', $firewalls)))); | ||
| } | ||
| } | ||
|
|
||
| if ($input->mustSuggestOptionValuesFor('issuer')) { | ||
| foreach ($this->issuers as $issuer => $firewalls) { | ||
| $suggestions->suggestValue(new Suggestion($issuer, sprintf('Available firewalls: "%s".', implode('", "', $firewalls)))); | ||
| } | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.