onBehalfOfFlow

README

onBehalfOfFlow

Overview

This code is curently NOT TESTED

The OAuth 2.0 On-Behalf-Of flow (OBO) serves the use case where an application invokes a service/web API, which in turn needs to call another service/web API. The idea is to propagate the delegated user identity and permissions through the request chain. For the middle-tier service to make authenticated requests to the downstream service, it needs to secure an access token from the Microsoft identity platform, on behalf of the user.

Flow

(Microsoft's view)https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow

Note we are using active directory in our example but the code works with any openid compliant identity manager

1. The client application makes a request to API A with token A (with an aud claim of API A)

(see auth code grant flow)

2. API A authenticates to the Microsoft identity platform token issuance endpoint and requests a token to access API B

2a. First case: Access token request with a shared secret

POST /oauth2/v2.0/token HTTP/1.1
Host: login.microsoftonline.com/<tenant>
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
client_id=535fb089-9ff3-47b6-9bfb-4f1264799865
&client_secret=The client secret that you generated for your app in the Azure portal - App registrations page.
&assertion=The access token that was sent to the middle-tier API with an audience (aud) claim of the app denoted by the client-id field
&scope=https://graph.microsoft.com/user.read+offline_access
&requested_token_use=on_behalf_of

2b. Second case: Access token request with a certificate (NOT IMPLEMENTED)

3. The Microsoft identity platform token issuance endpoint validates API A's credentials along with token A and issues the access token for API B (token B) to API A

4. Token B is set by API A in the authorization header of the request to API B

GET /v1.0/me HTTP/1.1 Host: graph.microsoft.com Authorization: Bearer eyJ0eXAiO ... 0X2tnSQLEANnSPHY0gKcgw

5. Data from the secured resource is returned by API B to API A, then to the client

6. A success response is a JSON OAuth 2.0 response with the following parameters

{ "token_type": "Bearer", "scope": "https://graph.microsoft.com/user.read", "expires_in": 3269, "ext_expires_in": 0, "access_token": "eyJ0...a lot of characters...Jg", "refresh_token": "OAQABAAAAAABnfiG-mA6NTae7CdWW7QfdAALzDWjw6qSn4GUDfxWzJDZ6lk9qRw4An{a lot of characters here}" }

How to use the onBehalfOfFlow client

// logger must implement logger.LoggerInterface
type LoggerInterface interface {
Debugf(context.Context, string, ...interface{})
Infof(context.Context, string, ...interface{})
Errorf(context.Context, string, ...interface{})
}

// refer to the sample configuration section
cc, err := onBehalfOfFlow.NewClient(ctx, logger, clientId, clientSecret, userToken, scope, openidConfigurationurl)

// get the token
tokentype, token, err = cc.Token(ctx)

// add the authorisation header to your http requests
req.Header.Add("authorization", fmt.Sprintf("%s %s", tokenType, accessToken))

// if required refresh the token, e.g. on expiry
token, err = cc.Refresh(ctx)

Securing your middleware

Secure the remote third party service using the oauthMiddleware package

Sample configuration

See auth/openId package readme

Documentation

Index

• func NewClient(ctx context.Context, logger logger.LoggerInterface, ...) (c *client, err error)
• type ClientTokenResponse

Functions

func NewClient

func NewClient(ctx context.Context, logger logger.LoggerInterface, clientId, clientSecret, userToken, scope, openidConfigurationurl string) (c *client, err error)

Types

type ClientTokenResponse

type ClientTokenResponse struct {
	TokenType    string `json:"token_type"`
	Scope        string `json:"scope"`
	Expires_in   int    `json:"expires_in"`
	ExtExpiresIn int    `json:"ext_expires_in"`
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
}

"token_type": "Bearer", "scope": "https://graph.microsoft.com/user.read", "expires_in": 3269, "ext_expires_in": 0, "access_token": "eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFCbmZpRy1tQTZOVGFlN0NkV1c3UWZkQ0NDYy0tY0hGa18wZE50MVEtc2loVzRMd2RwQVZISGpnTVdQZ0tQeVJIaGlDbUN2NkdyMEpmYmRfY1RmMUFxU21TcFJkVXVydVJqX3Nqd0JoN211eHlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiejAzOXpkc0Z1aXpwQmZCVksxVG4yNVFIWU8wIiwia2lkIjoiejAzOXpkc0Z1aXpwQmZCVksxVG4yNVFIWU8wIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC83MmY5ODhiZi04NmYxLTQxYWYtOTFhYi0yZDdjZDAxMWRiNDcvIiwiaWF0IjoxNDkzOTMwMzA1LCJuYmYiOjE0OTM5MzAzMDUsImV4cCI6MTQ5MzkzMzg3NSwiYWNyIjoiMCIsImFpbyI6IkFTUUEyLzhEQUFBQU9KYnFFWlRNTnEyZFcxYXpKN1RZMDlYeDdOT29EMkJEUlRWMXJ3b2ZRc1k9IiwiYW1yIjpbInB3ZCJdLCJhcHBfZGlzcGxheW5hbWUiOiJUb2RvRG90bmV0T2JvIiwiYXBwaWQiOiIyODQ2ZjcxYi1hN2E0LTQ5ODctYmFiMy03NjAwMzViMmYzODkiLCJhcHBpZGFjciI6IjEiLCJmYW1pbHlfbmFtZSI6IkNhbnVtYWxsYSIsImdpdmVuX25hbWUiOiJOYXZ5YSIsImlwYWRkciI6IjE2Ny4yMjAuMC4xOTkiLCJuYW1lIjoiTmF2eWEgQ2FudW1hbGxhIiwib2lkIjoiZDVlOTc5YzctM2QyZC00MmFmLThmMzAtNzI3ZGQ0YzJkMzgzIiwib25wcmVtX3NpZCI6IlMtMS01LTIxLTIxMjc1MjExODQtMTYwNDAxMjkyMC0xODg3OTI3NTI3LTI2MTE4NDg0IiwicGxhdGYiOiIxNCIsInB1aWQiOiIxMDAzM0ZGRkEwNkQxN0M5Iiwic2NwIjoiVXNlci5SZWFkIiwic3ViIjoibWtMMHBiLXlpMXQ1ckRGd2JTZ1JvTWxrZE52b3UzSjNWNm84UFE3alVCRSIsInRpZCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsInVuaXF1ZV9uYW1lIjoibmFjYW51bWFAbWljcm9zb2Z0LmNvbSIsInVwbiI6Im5hY2FudW1hQG1pY3Jvc29mdC5jb20iLCJ1dGkiOiJWR1ItdmtEZlBFQ2M1dWFDaENRSkFBIiwidmVyIjoiMS4wIn0.cubh1L2VtruiiwF8ut1m9uNBmnUJeYx4x0G30F7CqSpzHj1Sv5DCgNZXyUz3pEiz77G8IfOF0_U5A_02k-xzwdYvtJUYGH3bFISzdqymiEGmdfCIRKl9KMeoo2llGv0ScCniIhr2U1yxTIkIpp092xcdaDt-2_2q_ql1Ha_HtjvTV1f9XR3t7_Id9bR5BqwVX5zPO7JMYDVhUZRx08eqZcC-F3wi0xd_5ND_mavMuxe2wrpF-EZviO3yg0QVRr59tE3AoWl8lSGpVc97vvRCnp4WVRk26jJhYXFPsdk4yWqOKZqzr3IFGyD08WizD_vPSrXcCPbZP3XWaoTUKZSNJg", "refresh_token": "OAQABAAAAAABnfiG-mA6NTae7CdWW7QfdAALzDWjw6qSn4GUDfxWzJDZ6lk9qRw4An{a lot of characters here}"