[Security] Add security:oidc-token:generate command #60660
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <[email protected]> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Component\Security\Http\AccessToken\Oidc; | ||
|
|
||
| use Jose\Component\Core\Algorithm; | ||
| use Jose\Component\Core\AlgorithmManager; | ||
| use Jose\Component\Core\JWKSet; | ||
| use Jose\Component\Signature\JWSBuilder; | ||
| use Jose\Component\Signature\Serializer\CompactSerializer; | ||
| use Psr\Clock\ClockInterface; | ||
| use Symfony\Component\Clock\Clock; | ||
|
|
||
| class OidcTokenGenerator | ||
| { | ||
| public function __construct( | ||
| private readonly AlgorithmManager $algorithmManager, | ||
| private readonly JWKSet $jwkset, | ||
| private readonly string $audience, | ||
| private readonly array $issuers, | ||
| private readonly string $claim = 'sub', | ||
| private readonly ClockInterface $clock = new Clock(), | ||
| ) { | ||
| } | ||
|
|
||
| public function generate(string $userIdentifier, ?string $algorithmAlias = null, ?string $issuer = null, ?int $ttl = null, ?\DateTimeImmutable $notBefore = null): string | ||
| { | ||
| $algorithm = $this->getAlgorithm($algorithmAlias); | ||
|
|
||
| if (!$jwk = $this->jwkset->selectKey('sig', $algorithm)) { | ||
| throw new \InvalidArgumentException(\sprintf('No JWK found to sign with "%s" algorithm.', $algorithm->name())); | ||
| } | ||
|
|
||
| $jwsBuilder = new JWSBuilder($this->algorithmManager); | ||
|
|
||
| $now = $this->clock->now(); | ||
| $payload = [ | ||
| $this->claim => $userIdentifier, | ||
| 'iat' => $now->getTimestamp(), # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6 | ||
| 'aud' => $this->audience, # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3 | ||
| 'iss' => $this->getIssuer($issuer), # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1 | ||
| ]; | ||
| if ($ttl) { | ||
| if (0 > $ttl) { | ||
| throw new \InvalidArgumentException('Time to live must be a positive integer.'); | ||
| } | ||
|
|
||
| $payload['exp'] = $now->add(new \DateInterval("PT{$ttl}S"))->getTimestamp(); # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4 | ||
| } | ||
| if ($notBefore) { | ||
| $payload['nbf'] = $notBefore->getTimestamp(); # https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5 | ||
| } | ||
|
|
||
| $jws = $jwsBuilder | ||
| ->create() | ||
| ->withPayload(json_encode($payload, flags: \JSON_THROW_ON_ERROR)) | ||
| ->addSignature($jwk, ['alg' => $algorithm->name()]) | ||
| ->build(); | ||
|
|
||
| $serializer = new CompactSerializer(); | ||
|
|
||
| return $serializer->serialize($jws, 0); | ||
| } | ||
|
|
||
| private function getAlgorithm(?string $alias): Algorithm | ||
| { | ||
| if ($alias) { | ||
| if (!$this->algorithmManager->has($alias)) { | ||
| throw new \InvalidArgumentException(sprintf('"%s" is not a valid algorithm. Available algorithms: "%s".', $alias, implode('", "', $this->algorithmManager->list()))); | ||
| } | ||
| return $this->algorithmManager->get($alias); | ||
| } | ||
|
|
||
| if (1 !== count($list = $this->algorithmManager->list())) { | ||
| throw new \InvalidArgumentException(sprintf('Please choose an algorithm. Available algorithms: "%s".', implode('", "', $list))); | ||
| } | ||
|
|
||
| return $this->algorithmManager->get($list[0]); | ||
| } | ||
|
|
||
| private function getIssuer(?string $issuer): string | ||
| { | ||
| if ($issuer) { | ||
| if (!in_array($issuer, $this->issuers, true)) { | ||
| throw new \InvalidArgumentException(sprintf('"%s" is not a valid issuer. Available issuers: "%s".', $issuer, implode('", "', $this->issuers))); | ||
| } | ||
|
|
||
| return $issuer; | ||
| } | ||
|
|
||
| if (1 !== count($this->issuers)) { | ||
| throw new \InvalidArgumentException(sprintf('Please choose an issuer. Available issuers: "%s".', implode('", "', $this->issuers))); | ||
| } | ||
|
|
||
| return $this->issuers[0]; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * This file is part of the Symfony package. | ||
| * | ||
| * (c) Fabien Potencier <[email protected]> | ||
| * | ||
| * For the full copyright and license information, please view the LICENSE | ||
| * file that was distributed with this source code. | ||
| */ | ||
|
|
||
| namespace Symfony\Component\Security\Http\Command; | ||
|
|
||
| use Symfony\Component\Console\Attribute\AsCommand; | ||
| use Symfony\Component\Console\Command\Command; | ||
| use Symfony\Component\Console\Completion\CompletionInput; | ||
| use Symfony\Component\Console\Completion\CompletionSuggestions; | ||
| use Symfony\Component\Console\Completion\Suggestion; | ||
| use Symfony\Component\Console\Input\InputArgument; | ||
| use Symfony\Component\Console\Input\InputInterface; | ||
| use Symfony\Component\Console\Input\InputOption; | ||
| use Symfony\Component\Console\Output\OutputInterface; | ||
| use Symfony\Component\Security\Http\AccessToken\Oidc\OidcTokenGenerator; | ||
|
|
||
| /** | ||
| * Generates an OIDC token. | ||
| * | ||
| * @final | ||
| */ | ||
| #[AsCommand(name: 'security:oidc:generate-token', description: 'Generate an OIDC token for a given user')] | ||
| final class OidcTokenGenerateCommand extends Command | ||
| { | ||
| /** @var array<string, OidcTokenGenerator> */ | ||
| private array $generators = []; | ||
| /** @var array<string, list<string>> */ | ||
| private array $algorithms; | ||
| /** @var array<string, list<string>> */ | ||
| private array $issuers; | ||
|
|
||
| protected function configure(): void | ||
| { | ||
| $this | ||
| ->addArgument('user-identifier', InputArgument::REQUIRED, 'User identifier') | ||
| ->addOption('firewall', null, InputOption::VALUE_REQUIRED, 'Firewall') | ||
|
There was a problem hiding this comment. this should provide completion for the list of firewall names |
||
| ->addOption('algorithm', null, InputOption::VALUE_REQUIRED, 'Algorithm name to use to sign') | ||
|
There was a problem hiding this comment. this should provide completion for the list of supported algorithms There was a problem hiding this comment. Done. BTW, Example: |
||
| ->addOption('issuer', null, InputOption::VALUE_REQUIRED, 'Set the Issuer claim (iss)') | ||
| ->addOption('ttl', null, InputOption::VALUE_REQUIRED, 'Set the Expiration Time claim (exp) (time to live in seconds)') | ||
| ->addOption('not-before', null, InputOption::VALUE_REQUIRED, 'Set the Not Before claim (nbf)') | ||
| ; | ||
| } | ||
|
|
||
|
|
||
| /** | ||
| * @params array<string, list<string>> $algorithms | ||
| * @params array<string, list<string>> $issuers | ||
| */ | ||
| public function addGenerator(string $firewall, OidcTokenGenerator $oidcTokenGenerator, array $algorithms, array $issuers): void | ||
| { | ||
| $this->generators[$firewall] = $oidcTokenGenerator; | ||
| foreach ($algorithms as $algorithm) { | ||
| $this->algorithms[$algorithm] ??= []; | ||
| $this->algorithms[$algorithm][] = $firewall; | ||
| } | ||
| foreach ($issuers as $issuer) { | ||
| $this->issuers[$issuer] ??= []; | ||
| $this->issuers[$issuer][] = $firewall; | ||
| } | ||
| } | ||
|
|
||
| protected function execute(InputInterface $input, OutputInterface $output): int | ||
| { | ||
| $generator = $this->getGenerator($input->getOption('firewall')); | ||
| $token = $generator->generate( | ||
| $input->getArgument('user-identifier'), | ||
| $input->getOption('algorithm'), | ||
| $input->getOption('issuer'), | ||
| $input->getOption('ttl'), | ||
| ($nbf = $input->getOption('not-before')) ? new \DateTimeImmutable($nbf) : null, | ||
| ); | ||
|
|
||
| $output->writeln($token); | ||
|
|
||
| return self::SUCCESS; | ||
| } | ||
|
|
||
| private function getGenerator(?string $firewall): OidcTokenGenerator | ||
| { | ||
| if (0 === count($this->generators)) { | ||
| throw new \InvalidArgumentException('No OIDC token generator configured.'); | ||
| } | ||
|
|
||
| if ($firewall) { | ||
| return $this->generators[$firewall] ?? throw new \InvalidArgumentException(sprintf('Invalid firewall. Available firewalls: "%s".', implode('", "', array_keys($this->generators)))); | ||
| } | ||
|
|
||
| if (1 === count($this->generators)) { | ||
| return end($this->generators); | ||
| } | ||
|
|
||
| throw new \InvalidArgumentException(sprintf('Please choose an firewall. Available firewalls: "%s".', implode('", "', array_keys($this->generators)))); | ||
| } | ||
|
|
||
| public function complete(CompletionInput $input, CompletionSuggestions $suggestions): void | ||
| { | ||
| if ($input->mustSuggestOptionValuesFor('firewall')) { | ||
| $suggestions->suggestValues(array_keys($this->generators)); | ||
| } | ||
|
|
||
| if ($input->mustSuggestOptionValuesFor('algorithm')) { | ||
| foreach ($this->algorithms as $algorithm => $firewalls) { | ||
| $suggestions->suggestValue(new Suggestion($algorithm, sprintf('Available firewalls: "%s".', implode('", "', $firewalls)))); | ||
| } | ||
| } | ||
|
|
||
| if ($input->mustSuggestOptionValuesFor('issuer')) { | ||
| foreach ($this->issuers as $issuer => $firewalls) { | ||
| $suggestions->suggestValue(new Suggestion($issuer, sprintf('Available firewalls: "%s".', implode('", "', $firewalls)))); | ||
| } | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this needs to check whether the command exists, as SecurityBundle 7.4 could be installed with security-http version 7.3
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch!