[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host by antonengelhardt · Pull Request #99 · antonengelhardt/wasm-oidc-plugin

antonengelhardt · 2024-09-05T21:41:44Z

Please describe your changes and why you made them

Multiple OpenID providers

the plugin can now be configured to use multiple providers for token issuing and validation
the discovery fetches all information from the configured providers, loads the jwks etc.
if there is more than one provider, then the user can select a provider to authenticate with on a dedicated page. this happens with a callback (_wasm-oidc-plugin/provider-selection?authorize_with_provider=wwu&return_to=lw), which then redirect to the authorization_endpoint, because otherwise we would not be able to know which server sent the code in the code callback.
if there is only one provider, the redirection will happen right away

Small features

configurable ticking interval (ticking_interval_in_ms)
logout path to clear cookies and end session (optional) as in feat(auth): logout route #96
get envoy request id and show it in the logs & error page when something fails Error IDs on Error Page & in Logs #101

Refactor & fixes

large refactor of the files and codebase (more to come)
fix if open id providers had the jwks_uri exposed at a different host than the openid-configuration host
get :scheme to parse url as in fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98
pretty print discovery and jwks responses when log level is debug

Does this PR introduce a breaking change?

Warning

This PR introduces a breaking change:
Please see envoy.yaml for the updated config structure

TODOs

Update k8s files
Write a script to migrate config
Readme
More comments, docs and logs
Error pages in html.rs
Include fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98
Include feat(auth): logout route #96

Other information and Screenshots (if appropriate)

🤫 It has darkmode

Linked

For #93

more to come

* plugin can now have more than one oidc provider * the discovery will load information from all providers * user selects the provider on an auth page if there is >1 provider * more logs * more comments TODO: * error handling * performance and linting * large refactoring to file structure This is just a POC! THIS IS A BREAKING CHANGE! Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

* add auth.rs for code flow * rename cookies.rs to session.rs * add pause.rs Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

https://github.com/antonengelhardt/wasm-oidc-plugin/security/dependabot/5 Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

antonengelhardt · 2025-01-13T17:01:01Z

+      - name: Install cargo audit
+        run: cargo install cargo-audit
+


Rust Version

Simplify discovery.rs a bit by removing some mutexes that are not strictly necessary. We do however need to work around proxy-wasm/proxy-wasm-rust-sdk#303 by using the hostcalls module (around which the HttpContext trait is just a trivial wrapper) directly

as defined by the OIDC spec: https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter This avoids the need to escape quotes in the "stringly typed" JSON object and allows the map-type of the value to be validated during config parsing

and use anyhow

because that makes sense intuitively and fixes a bug which could lead to duplicate providers being created

While it would be nice to share these with the Root context, that would require some refactoring, so we don't currently do that and the Arc is unnecessary

greptile-apps

PR Summary

This PR introduces significant changes to support multiple OpenID Connect providers, including a new provider selection UI with dark mode and improved error handling.

Added new open_id_configs array in configuration files to support multiple OIDC providers with separate endpoints and settings
Changed WASM target from wasm32-wasi to wasm32-wasip1 across all build configurations and documentation
Added configurable ticking_interval_in_ms and logout_path with optional end_session_endpoint support
Introduced request ID tracking in logs and error pages for better debugging
Upgraded Envoy from v1.29 to v1.31 in Docker configurations and fixed JWKS endpoint host issues

Note: The PR contains some potential issues with unwrap() calls in provider selection and artifact path mismatches between build target and upload paths that should be addressed.

_{💡 (1/5) You can manually trigger the bot by mentioning @greptileai in a comment!}

_{24 file(s) reviewed, 24 comment(s)}
_{Edit PR Review Bot Settings | Greptile}

greptile-apps · 2025-03-11T20:09:06Z

@@ -116,7 +185,7 @@ jobs:
          path: target/wasm32-wasi/release/wasm_oidc_plugin.wasm


logic: Path mismatch: Build uses wasm32-wasip1 target (line 179) but artifact upload looks for wasm32-wasi path. This will cause the artifact upload to fail.

Suggested change

path: target/wasm32-wasi/release/wasm_oidc_plugin.wasm

path: target/wasm32-wasip1/release/wasm_oidc_plugin.wasm

greptile-apps · 2025-03-11T20:09:06Z

+    needs: [verify-project]



style: Build job only depends on verify-project and not on test/clippy/fmt jobs. This could allow builds with failing tests or linting issues.

Suggested change

needs: [verify-project]

needs: [verify-project, test, clippy, fmt]

greptile-apps · 2025-03-11T20:09:30Z

+authors = [
+    "WWU Cloud Developer <cloud@uni-muenster.de>, Anton Engelhardt <antoncengelhardt@icloud.com>",
+]
+description = "A Wasm-Pplugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the autorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."


syntax: Typo in description: 'Wasm-Pplugin' should be 'Wasm plugin'

Suggested change

description = "A Wasm-Pplugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the autorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."

description = "A Wasm plugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the autorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."

greptile-apps · 2025-03-11T20:09:30Z

+authors = [
+    "WWU Cloud Developer <cloud@uni-muenster.de>, Anton Engelhardt <antoncengelhardt@icloud.com>",
+]
+description = "A Wasm-Pplugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the autorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."


syntax: Typo in description: 'autorization' should be 'authorization'

Suggested change

description = "A Wasm-Pplugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the autorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."

description = "A Wasm-Pplugin for the Envoy Proxy written in Rust acting as an HTTP-Filter, that implements the OpenID Authorization Code Flow. Requests sent to the filter are checked for the presence of a valid session cookie. If the cookie is not present, the user is redirected to OpenID Provider to authenticate. After successful authentication, the user is redirected back to the original path with the authorization code in the URL query. The plugin then exchanges the code for a token using the token_endpoint and stores the token in the session."

greptile-apps · 2025-03-11T20:11:42Z

+                            logo.style.visibility = 'hidden';
+                            setTimeout(() => {{
+                                logo.style.visibility = 'visible';
+                            }}, 0);
+                        }});


style: The visibility toggle hack could cause flickering. Consider using CSS transitions or opacity instead

greptile-apps · 2025-03-11T20:11:47Z


-        Ok(values)
-    }
+    proxy_wasm::set_log_level(LogLevel::Debug);


style: Setting log level to Debug in production could impact performance and expose sensitive information

greptile-apps · 2025-03-11T20:11:59Z

+            307,
+            vec![
+                // Redirect to the requested path
+                ("location", self.original_path.as_ref().unwrap()),


logic: unwrap on original_path could panic if None - should handle this case gracefully

Suggested change

("location", self.original_path.as_ref().unwrap()),

("location", self.original_path.as_ref().unwrap_or(&"/".to_string())),

greptile-apps · 2025-03-11T20:12:10Z

+        let num_parts = cookie_values.len();
+        let num_parts_cookie_value = format!("{cookie_name}-parts={num_parts}; Path=/; HttpOnly; Secure; Max-Age={cookie_duration}; ");
+        cookie_values.push(num_parts_cookie_value);


style: The trailing space in the cookie value format string could cause issues with some browsers or proxies

greptile-apps · 2025-03-11T20:12:11Z

        let nonce_cookie_value = format!(
            "{}-nonce={}; Path=/; HttpOnly; Secure; Max-Age={}; ",
            cookie_name, &encoded_nonce, cookie_duration
        );


style: The trailing space in the nonce cookie format string could cause issues with some browsers or proxies

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

…-open-id-providers Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

…iders Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

antonengelhardt added semver:minor Release in the next minor version feature New Feature or enhancement refactor Code refactoring docs Documentation labels Sep 5, 2024

antonengelhardt self-assigned this Sep 5, 2024

antonengelhardt requested a review from miwig as a code owner September 5, 2024 21:41

antonengelhardt force-pushed the mulitple-open-id-providers branch 2 times, most recently from e6806c9 to 0d882e9 Compare September 5, 2024 22:02

This was referenced Sep 6, 2024

Rebase logout path (#96) for multiple open id providers (#99) #100

Merged

Error IDs on Error Page & in Logs #101

Open

antonengelhardt linked an issue Sep 6, 2024 that may be closed by this pull request

Multiple OIDC providers #93

Open

antonengelhardt changed the title ~~[BREAKING] feat/refactor/docs: multiple providers, large refactor~~ [BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host Sep 9, 2024

antonengelhardt force-pushed the mulitple-open-id-providers branch 2 times, most recently from 80e497e to d94b6df Compare September 9, 2024 16:00

This was linked to issues Sep 10, 2024

Error IDs on Error Page & in Logs #101

Open

Logout Route to clear cookies #94

Open

antonengelhardt force-pushed the mulitple-open-id-providers branch from 36c5896 to 818a32c Compare October 2, 2024 08:41

antonengelhardt force-pushed the mulitple-open-id-providers branch 3 times, most recently from eb3e9de to 17ac0f4 Compare October 17, 2024 15:37

This was referenced Nov 4, 2024

chore(deps): Bump regex from 1.10.5 to 1.11.1 #108

Closed

fix(exclude): get scheme to parse url, more debug logs and yaml fmt #98

Closed

feat(auth): logout route #96

Closed

antonengelhardt added 7 commits November 4, 2024 18:28

refactor: split into separate files

6e9f61b

* add auth.rs for code flow * rename cookies.rs to session.rs * add pause.rs Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: pr template

301ba4c

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

refactor: error page is now generic

7866042

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

style: fmt

3315846

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

style: clippy lints fixed

f36a1ba

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

fix: add footer to auth page and layout fixes

74060f7

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

antonengelhardt added 2 commits January 8, 2025 15:13

style: clean up Cargo.toml, chore(deps): upgrade url to 2.5.4

8fa4a61

https://github.com/antonengelhardt/wasm-oidc-plugin/security/dependabot/5 Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: update cargo-deny action to v2

4d06f8d

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

antonengelhardt commented Jan 13, 2025

View reviewed changes

miwig added 8 commits February 12, 2025 16:26

Remove unnecessary mutexes

4d3cdb4

Simplify discovery.rs a bit by removing some mutexes that are not strictly necessary. We do however need to work around proxy-wasm/proxy-wasm-rust-sdk#303 by using the hostcalls module (around which the HttpContext trait is just a trivial wrapper) directly

refactor: move config parsing to separate function

197e4f6

and use anyhow

Use configured name instead of authority to match provider to resolver

45859a1

because that makes sense intuitively and fixes a bug which could lead to duplicate providers being created

Remove unnecessary Arc for ConfiguredOidc::open_id_providers

f902039

While it would be nice to share these with the Root context, that would require some refactoring, so we don't currently do that and the Arc is unnecessary

Update all properties of provider, not just keys

3231d58

Make Session::issuer not optional

3797409

Make ConfiguredOidc::request_id not optional

4200e5f

greptile-apps Bot reviewed Mar 11, 2025

View reviewed changes

antonengelhardt added 18 commits November 28, 2025 16:45

docs: enhance README with state and sequence diagrams for OpenID flow

c0e8b64

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

ci: update build target from wasm32-wasi to wasm32-wasip1

947946f

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: update Docker image references and fix ci

b2191d8

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

refactor: rename ConfiguredOidc and use inline strings

1205317

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

feat: add reset button and styling for cookie management

8c46b83

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

docs: update README to clarify OpenID flow steps and notes

cfb5c67

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

fix: update cookie attributes to include HttpOnly

645c5d5

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: update CHANGELOG formatting for consistency and clarity

f157454

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

fix: lints and format

6b3a257

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: upgrade Envoy image to v1.36

d86dfd0

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Merge remote-tracking branch 'origin/multi-oidc-review' into mulitple…

7daf71b

…-open-id-providers Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Merge remote-tracking branch 'origin/main' into mulitple-open-id-prov…

e6d90e8

…iders Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: update CI configuration for wasm32-wasip1 target and optimise ci

02e75dd

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: refactor CI workflow to use actions instead of image

2e5b9fe

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: add rust-toolchain and use fixed rust version

c924e24

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

docs: update README env vars

f079fd3

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

refactor(ci): use actions to speed up ci workflows

ae08efd

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

chore: update CI and deployment configurations for wasm32-wasip1 target

819a293

Signed-off-by: Anton Engelhardt <antoncengelhardt@icloud.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host#99

[BREAKING] feat/refactor/docs: multiple providers, large refactor, configurable ticking interval, fix for jwks endpoint has different host#99
antonengelhardt wants to merge 64 commits into
mainfrom
mulitple-open-id-providers

antonengelhardt commented Sep 5, 2024 •

edited

Loading

Uh oh!

antonengelhardt Jan 13, 2025

Uh oh!

greptile-apps Bot left a comment

Uh oh!

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

greptile-apps Bot Mar 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -116,7 +185,7 @@ jobs:
		path: target/wasm32-wasi/release/wasm_oidc_plugin.wasm

	path: target/wasm32-wasi/release/wasm_oidc_plugin.wasm
	path: target/wasm32-wasip1/release/wasm_oidc_plugin.wasm

	needs: [verify-project]
	needs: [verify-project, test, clippy, fmt]

	("location", self.original_path.as_ref().unwrap()),
	("location", self.original_path.as_ref().unwrap_or(&"/".to_string())),

Conversation

antonengelhardt commented Sep 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Please describe your changes and why you made them

Multiple OpenID providers

Small features

Refactor & fixes

Does this PR introduce a breaking change?

TODOs

Other information and Screenshots (if appropriate)

🤫 It has darkmode

Linked

Uh oh!

antonengelhardt Jan 13, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

PR Summary

Uh oh!

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Mar 11, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

antonengelhardt commented Sep 5, 2024 •

edited

Loading