/*
* use OpenID Connect Discovery to get metadata for the specified issuer
*/
apr_byte_t oidc_metadata_provider_retrieve(request_rec *r, oidc_cfg *cfg,
const char *issuer, const char *url, json_t **j_metadata,
const char **response) {
/* get a handle to the directory config */
oidc_dir_cfg *dir_cfg = ap_get_module_config(r->per_dir_config,
&auth_openidc_module);
/* get provider metadata from the specified URL with the specified parameters */
if (oidc_util_http_get(r, url, NULL, NULL, NULL,
cfg->provider.ssl_validate_server, response,
cfg->http_timeout_short, cfg->outgoing_proxy,
dir_cfg->pass_cookies) == FALSE)
return FALSE;
/* decode and see if it is not an error response somehow */
if (oidc_util_decode_json_and_check_error(r, *response, j_metadata) == FALSE)
return FALSE;
/* check to see if it is valid metadata */
if (oidc_metadata_provider_is_valid(r, *j_metadata, issuer) == FALSE)
return FALSE;
/* all OK */
return TRUE;
}
/*
* see if we have provider metadata and check its validity
* if not, use OpenID Connect Discovery to get it, check it and store it
*/
static apr_byte_t oidc_metadata_provider_get(request_rec *r, oidc_cfg *cfg,
const char *issuer, json_t **j_provider, apr_byte_t allow_discovery) {
/* holds the response data/string/JSON from the OP */
const char *response = NULL;
/* get the full file path to the provider metadata for this issuer */
const char *provider_path = oidc_metadata_provider_file_path(r, issuer);
/* see if we have valid metadata already, if so, return it */
if (oidc_metadata_file_read_json(r, provider_path, j_provider) == TRUE) {
/* return the validation result */
return oidc_metadata_provider_is_valid(r, *j_provider, issuer);
}
if (!allow_discovery) {
oidc_warn(r,
"no metadata found for the requested issuer (%s), and Discovery is not allowed",
issuer);
return FALSE;
}
// TODO: how to do validity/expiry checks on provider metadata
/* assemble the URL to the .well-known OpenID metadata */
const char *url = apr_psprintf(r->pool, "%s",
((strstr(issuer, "http://") == issuer)
|| (strstr(issuer, "https://") == issuer)) ?
issuer : apr_psprintf(r->pool, "https://%s", issuer));
url = apr_psprintf(r->pool, "%s%s.well-known/openid-configuration", url,
url[strlen(url) - 1] != '/' ? "/" : "");
/* get the metadata for the issuer using OpenID Connect Discovery and validate it */
if (oidc_metadata_provider_retrieve(r, cfg, issuer, url, j_provider,
&response) == FALSE)
return FALSE;
/* since it is valid, write the obtained provider metadata file */
if (oidc_metadata_file_write(r, provider_path, response) == FALSE)
return FALSE;
return TRUE;
}
