lxc/incus
1
0
Fork 0
mirror of https://github.com/lxc/incus.git synced 2026-10-12 02:18:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

client: Send the ID token alongside opaque access tokens

Browse Source 
Signed-off-by: Stéphane Graber <[email protected]>
This commit is contained in:
Stéphane Graber
2026-10-08 14:01:02 -04:00
parent ad8a585e79
commit 5d406447e2
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/incus.go
+1 -1
View File
@@ -197,7 +197,7 @@ func (r *ProtocolIncus) addClientHeaders(req *http.Request) {
}
if r.oidcClient != nil {
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", r.oidcClient.getAccessToken()))
r.oidcClient.setAuthHeaders(req.Header)
}
}
client/incus_oidc.go
+19 -4
View File
@@ -157,6 +157,17 @@ func (o *oidcClient) getAccessToken() string {
return o.tokens.AccessToken
}
// setAuthHeaders sets the authentication headers, including the ID token when the access token is opaque.
func (o *oidcClient) setAuthHeaders(header http.Header) {
token := o.getAccessToken()
header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
// Opaque access tokens can't be verified by the server, so send the ID token alongside.
if o.tokens.IDToken != "" && strings.Count(token, ".") != 2 {
header.Set("X-Incus-OIDC-idtoken", o.tokens.IDToken)
}
}
// do function executes an HTTP request using the oidcClient's http client, and manages authorization by refreshing or authenticating as needed.
// If the request fails with an HTTP Unauthorized status, it attempts to refresh the access token, or perform an OIDC authentication if refresh fails.
func (o *oidcClient) do(req *http.Request) (*http.Response, error) {
@@ -200,8 +211,8 @@ func (o *oidcClient) do(req *http.Request) (*http.Response, error) {
return resp, ErrOIDCExpired
}
// Set the new access token in the header.
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", o.tokens.AccessToken))
// Set the new tokens in the header.
o.setAuthHeaders(req.Header)
// Reset the request body.
if req.GetBody != nil {
@@ -257,8 +268,8 @@ func (o *oidcClient) dial(dialer websocket.Dialer, uri string, req *http.Request
}
}
// Set the new access token in the header.
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", o.tokens.AccessToken))
// Set the new tokens in the header.
o.setAuthHeaders(req.Header)
return dialer.Dial(uri, req.Header)
}
@@ -318,6 +329,10 @@ func (o *oidcClient) refresh(issuer string, clientID string, scopes string) erro
o.tokens.TokenType = oauthTokens.TokenType
o.tokens.Expiry = oauthTokens.Expiry
if oauthTokens.IDToken != "" {
o.tokens.IDToken = oauthTokens.IDToken
}
if oauthTokens.RefreshToken != "" {
o.tokens.RefreshToken = oauthTokens.RefreshToken
}