Struct wasm_oidc_plugin::ConfiguredOidc

pub(crate) struct ConfiguredOidc {
    pub open_id_config: Arc<OpenIdConfig>,
    pub plugin_config: Arc<PluginConfiguration>,
    pub token_id: Option<u32>,
}

The ConfiguredOidc is the main filter struct and responsible for the OIDC authentication flow. Requests arriving are checked for a valid cookie. If the cookie is valid, the request is forwarded. If the cookie is not valid, the request is redirected to the authorization endpoint.

Fields

open_id_config: Arc<OpenIdConfig>

The configuration of the filter which mainly contains the open id configuration and the keys to validate the JWT

plugin_config: Arc<PluginConfiguration>

Plugin configuration parsed from the envoy configuration

token_id: Option<u32>

Token id of the current request

Implementations

impl ConfiguredOidc

Helper functions for the ConfiguredOidc struct.

pub(crate) fn get_cookie(&self, name: &str) -> Option<String>

Get the cookie of the HTTP request by name The cookie is searched in the request headers. If the cookie is found, the value is returned. If the cookie is not found, None is returned.

pub(crate) fn get_host(&self) -> Option<String>

Get the host of the HTTP request The host is searched in the request headers. If the host is found, the value is returned.

pub(crate) fn filter_proxy_cookies(&self)

Filter non proxy cookies by checking the cookie name. This function removes all cookies from the request that do not match the cookie name to prevent the cookie from being forwarded to the upstream service.

pub(crate) fn validate_cookie(&self) -> Result<AuthorizationState, PluginError>

Parse the cookie and validate the token. The cookie is parsed into the AuthorizationState struct. The token is validated using the validate_token function. If the token is valid, this function returns Ok(()). If the token is invalid, this function returns Err(String) and redirects the requester to the authorization endpoint.

pub(crate) fn validate_token(&self, token: &str) -> Result<(), PluginError>

Validate the token using the JWT library. This function checks for the correct issuer and audience and verifies the signature with the public keys loaded from the JWKs endpoint.

pub(crate) fn exchange_code_for_token( &mut self, path: String, ) -> Result<(), PluginError>

Exchange the code for a token using the token endpoint. This function is called when the user is redirected back to the callback URL. The code is extracted from the URL and exchanged for a token using the token endpoint.

• path - The path of the request

pub(crate) fn store_token_in_cookie( &mut self, token_id: u32, body_size: usize, ) -> Result<(), PluginError>

Store the token from the token response in a cookie. Parse the token with the AuthorizationState struct and store it in an encoded and encrypted cookie. Then, redirect the requester to the original URL.

pub(crate) fn redirect_to_authorization_endpoint(&self) -> Action

Redirect to the authorization endpoint by sending a HTTP response with a 307 status code. The original path is encoded and stored in a cookie as well as the PKCE code verifier.

pub fn get_session_cookie_as_string(&self) -> Result<String, PluginError>

Helper function to get the session cookie as a string by getting the cookie from the request headers and concatenating all cookie parts.

pub fn get_nonce(&self) -> Result<String, PluginError>

pub fn get_number_of_cookies(&self) -> usize

Helper function to get the number of cookies from the request headers.

Trait Implementations

impl Context for ConfiguredOidc

This context is used to process HTTP responses from the token endpoint.

fn on_http_call_response( &mut self, token_id: u32, _: usize, body_size: usize, _: usize, )

This function catches the response from the token endpoint.

fn get_current_time(&self) -> SystemTime

fn get_property(&self, path: Vec<&str>) -> Option<Vec<u8>>

fn set_property(&self, path: Vec<&str>, value: Option<&[u8]>)

fn get_shared_data(&self, key: &str) -> (Option<Vec<u8>>, Option<u32>)

fn set_shared_data( &self, key: &str, value: Option<&[u8]>, cas: Option<u32>, ) -> Result<(), Status>

fn register_shared_queue(&self, name: &str) -> u32

fn resolve_shared_queue(&self, vm_id: &str, name: &str) -> Option<u32>

fn dequeue_shared_queue(&self, queue_id: u32) -> Result<Option<Vec<u8>>, Status>

fn enqueue_shared_queue( &self, queue_id: u32, value: Option<&[u8]>, ) -> Result<(), Status>

fn dispatch_http_call( &self, upstream: &str, headers: Vec<(&str, &str)>, body: Option<&[u8]>, trailers: Vec<(&str, &str)>, timeout: Duration, ) -> Result<u32, Status>

fn get_http_call_response_headers(&self) -> Vec<(String, String)>

fn get_http_call_response_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn get_http_call_response_header(&self, name: &str) -> Option<String>

fn get_http_call_response_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn get_http_call_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn get_http_call_response_trailers(&self) -> Vec<(String, String)>

fn get_http_call_response_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn get_http_call_response_trailer(&self, name: &str) -> Option<String>

fn get_http_call_response_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn dispatch_grpc_call( &self, upstream_name: &str, service_name: &str, method_name: &str, initial_metadata: Vec<(&str, &[u8])>, message: Option<&[u8]>, timeout: Duration, ) -> Result<u32, Status>

fn on_grpc_call_response( &mut self, _token_id: u32, _status_code: u32, _response_size: usize, )

fn get_grpc_call_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn cancel_grpc_call(&self, token_id: u32)

fn open_grpc_stream( &self, cluster_name: &str, service_name: &str, method_name: &str, initial_metadata: Vec<(&str, &[u8])>, ) -> Result<u32, Status>

fn on_grpc_stream_initial_metadata( &mut self, _token_id: u32, _num_elements: u32, )

fn get_grpc_stream_initial_metadata(&self) -> Vec<(String, Vec<u8>)>

fn get_grpc_stream_initial_metadata_value(&self, name: &str) -> Option<Vec<u8>>

fn send_grpc_stream_message( &self, token_id: u32, message: Option<&[u8]>, end_stream: bool, )

fn on_grpc_stream_message(&mut self, _token_id: u32, _message_size: usize)

fn get_grpc_stream_message( &mut self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn on_grpc_stream_trailing_metadata( &mut self, _token_id: u32, _num_elements: u32, )

fn get_grpc_stream_trailing_metadata(&self) -> Vec<(String, Vec<u8>)>

fn get_grpc_stream_trailing_metadata_value(&self, name: &str) -> Option<Vec<u8>>

fn cancel_grpc_stream(&self, token_id: u32)

fn close_grpc_stream(&self, token_id: u32)

fn on_grpc_stream_close(&mut self, _token_id: u32, _status_code: u32)

fn get_grpc_status(&self) -> (u32, Option<String>)

fn call_foreign_function( &self, function_name: &str, arguments: Option<&[u8]>, ) -> Result<Option<Vec<u8>>, Status>

fn on_done(&mut self) -> bool

fn done(&self)

impl HttpContext for ConfiguredOidc

The context is used to process incoming HTTP requests when the filter is configured.

1. Check if the request matches any of the exclude hosts, paths, urls. If so, forward the request.
2. If the request is for the OIDC callback, dispatch the request to the token endpoint.
3. If the request contains a cookie, validate the cookie and forward the request.
4. Else, redirect the request to the authorization endpoint.

fn on_http_request_headers(&mut self, _: usize, _: bool) -> Action

This function is called when the request headers are received.

fn get_http_request_headers(&self) -> Vec<(String, String)>

fn get_http_request_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_request_headers(&self, headers: Vec<(&str, &str)>)

fn set_http_request_headers_bytes(&self, headers: Vec<(&str, &[u8])>)

fn get_http_request_header(&self, name: &str) -> Option<String>

fn get_http_request_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_request_header(&self, name: &str, value: Option<&str>)

fn set_http_request_header_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_request_header(&self, name: &str, value: &str)

fn add_http_request_header_bytes(&self, name: &str, value: &[u8])

fn on_http_request_body( &mut self, _body_size: usize, _end_of_stream: bool, ) -> Action

fn get_http_request_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn set_http_request_body(&self, start: usize, size: usize, value: &[u8])

fn on_http_request_trailers(&mut self, _num_trailers: usize) -> Action

fn get_http_request_trailers(&self) -> Vec<(String, String)>

fn get_http_request_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_request_trailers(&self, trailers: Vec<(&str, &str)>)

fn set_http_request_trailers_bytes(&self, trailers: Vec<(&str, &[u8])>)

fn get_http_request_trailer(&self, name: &str) -> Option<String>

fn get_http_request_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_request_trailer(&self, name: &str, value: Option<&str>)

fn set_http_request_trailer_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_request_trailer(&self, name: &str, value: &str)

fn add_http_request_trailer_bytes(&self, name: &str, value: &[u8])

fn resume_http_request(&self)

fn reset_http_request(&self)

fn on_http_response_headers( &mut self, _num_headers: usize, _end_of_stream: bool, ) -> Action

fn get_http_response_headers(&self) -> Vec<(String, String)>

fn get_http_response_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_response_headers(&self, headers: Vec<(&str, &str)>)

fn set_http_response_headers_bytes(&self, headers: Vec<(&str, &[u8])>)

fn get_http_response_header(&self, name: &str) -> Option<String>

fn get_http_response_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_response_header(&self, name: &str, value: Option<&str>)

fn set_http_response_header_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_response_header(&self, name: &str, value: &str)

fn add_http_response_header_bytes(&self, name: &str, value: &[u8])

fn on_http_response_body( &mut self, _body_size: usize, _end_of_stream: bool, ) -> Action

fn get_http_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn set_http_response_body(&self, start: usize, size: usize, value: &[u8])

fn on_http_response_trailers(&mut self, _num_trailers: usize) -> Action

fn get_http_response_trailers(&self) -> Vec<(String, String)>

fn get_http_response_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_response_trailers(&self, trailers: Vec<(&str, &str)>)

fn set_http_response_trailers_bytes(&self, trailers: Vec<(&str, &[u8])>)

fn get_http_response_trailer(&self, name: &str) -> Option<String>

fn get_http_response_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_response_trailer(&self, name: &str, value: Option<&str>)

fn set_http_response_trailer_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_response_trailer(&self, name: &str, value: &str)

fn add_http_response_trailer_bytes(&self, name: &str, value: &[u8])

fn resume_http_response(&self)

fn reset_http_response(&self)

fn send_http_response( &self, status_code: u32, headers: Vec<(&str, &str)>, body: Option<&[u8]>, )

fn send_grpc_response( &self, grpc_status: GrpcStatusCode, grpc_status_message: Option<&str>, custom_metadata: Vec<(&str, &[u8])>, )

fn on_log(&mut self)