diff --git a/controllers/auth.go b/controllers/auth.go index 9ad53d01..739dd04a 100644 --- a/controllers/auth.go +++ b/controllers/auth.go @@ -157,7 +157,7 @@ func (c *ApiController) HandleLoggedIn(application *object.Application, user *ob c.ResponseError(c.T("auth:Challenge method should be S256")) return } - code, err := object.GetOAuthCode(userId, clientId, form.Provider, responseType, redirectUri, scope, state, nonce, codeChallenge, c.Ctx.Request.Host, c.GetAcceptLanguage()) + code, err := object.GetOAuthCode(userId, clientId, form.Provider, form.SigninMethod, responseType, redirectUri, scope, state, nonce, codeChallenge, c.Ctx.Request.Host, c.GetAcceptLanguage()) if err != nil { c.ResponseError(err.Error(), nil) return diff --git a/object/token_jwt.go b/object/token_jwt.go index 724c078e..5fd8a916 100644 --- a/object/token_jwt.go +++ b/object/token_jwt.go @@ -34,6 +34,8 @@ type Claims struct { // the `azp` (Authorized Party) claim. Optional. See https://openid.net/specs/openid-connect-core-1_0.html#IDToken Azp string `json:"azp,omitempty"` Provider string `json:"provider,omitempty"` + + SigninMethod string `json:"signinMethod,omitempty"` jwt.RegisteredClaims } @@ -154,6 +156,8 @@ type ClaimsShort struct { Scope string `json:"scope,omitempty"` Azp string `json:"azp,omitempty"` Provider string `json:"provider,omitempty"` + + SigninMethod string `json:"signinMethod,omitempty"` jwt.RegisteredClaims } @@ -174,6 +178,8 @@ type ClaimsWithoutThirdIdp struct { Scope string `json:"scope,omitempty"` Azp string `json:"azp,omitempty"` Provider string `json:"provider,omitempty"` + + SigninMethod string `json:"signinMethod,omitempty"` jwt.RegisteredClaims } @@ -303,6 +309,7 @@ func getShortClaims(claims Claims) ClaimsShort { Scope: claims.Scope, RegisteredClaims: claims.RegisteredClaims, Azp: claims.Azp, + SigninMethod: claims.SigninMethod, Provider: claims.Provider, } return res @@ -317,6 +324,7 @@ func getClaimsWithoutThirdIdp(claims Claims) ClaimsWithoutThirdIdp { Scope: claims.Scope, RegisteredClaims: claims.RegisteredClaims, Azp: claims.Azp, + SigninMethod: claims.SigninMethod, Provider: claims.Provider, } return res @@ -339,6 +347,7 @@ func getClaimsCustom(claims Claims, tokenField []string) jwt.MapClaims { res["tag"] = claims.Tag res["scope"] = claims.Scope res["azp"] = claims.Azp + res["signinMethod"] = claims.SigninMethod res["provider"] = claims.Provider for _, field := range tokenField { @@ -395,7 +404,7 @@ func refineUser(user *User) *User { return user } -func generateJwtToken(application *Application, user *User, provider string, nonce string, scope string, host string) (string, string, string, error) { +func generateJwtToken(application *Application, user *User, provider string, signinMethod string, nonce string, scope string, host string) (string, string, string, error) { nowTime := time.Now() expireTime := nowTime.Add(time.Duration(application.ExpireInHours) * time.Hour) refreshExpireTime := nowTime.Add(time.Duration(application.RefreshExpireInHours) * time.Hour) @@ -423,10 +432,11 @@ func generateJwtToken(application *Application, user *User, provider string, non TokenType: "access-token", Nonce: nonce, // FIXME: A workaround for custom claim by reusing `tag` in user info - Tag: user.Tag, - Scope: scope, - Azp: application.ClientId, - Provider: provider, + Tag: user.Tag, + Scope: scope, + Azp: application.ClientId, + Provider: provider, + SigninMethod: signinMethod, RegisteredClaims: jwt.RegisteredClaims{ Issuer: originBackend, Subject: user.Id, diff --git a/object/token_oauth.go b/object/token_oauth.go index b17788b0..7a61f779 100644 --- a/object/token_oauth.go +++ b/object/token_oauth.go @@ -136,7 +136,7 @@ func CheckOAuthLogin(clientId string, responseType string, redirectUri string, s return "", application, nil } -func GetOAuthCode(userId string, clientId string, provider string, responseType string, redirectUri string, scope string, state string, nonce string, challenge string, host string, lang string) (*Code, error) { +func GetOAuthCode(userId string, clientId string, provider string, signinMethod string, responseType string, redirectUri string, scope string, state string, nonce string, challenge string, host string, lang string) (*Code, error) { user, err := GetUser(userId) if err != nil { return nil, err @@ -171,7 +171,7 @@ func GetOAuthCode(userId string, clientId string, provider string, responseType if err != nil { return nil, err } - accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, provider, nonce, scope, host) + accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, provider, signinMethod, nonce, scope, host) if err != nil { return nil, err } @@ -379,7 +379,7 @@ func RefreshToken(grantType string, refreshToken string, scope string, clientId return nil, err } - newAccessToken, newRefreshToken, tokenName, err := generateJwtToken(application, user, "", "", scope, host) + newAccessToken, newRefreshToken, tokenName, err := generateJwtToken(application, user, "", "", "", scope, host) if err != nil { return &TokenError{ Error: EndpointError, @@ -558,7 +558,7 @@ func GetPasswordToken(application *Application, username string, password string return nil, nil, err } - accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", "", scope, host) + accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", "", "", scope, host) if err != nil { return nil, &TokenError{ Error: EndpointError, @@ -604,7 +604,7 @@ func GetClientCredentialsToken(application *Application, clientSecret string, sc Type: "application", } - accessToken, _, tokenName, err := generateJwtToken(application, nullUser, "", "", scope, host) + accessToken, _, tokenName, err := generateJwtToken(application, nullUser, "", "", "", scope, host) if err != nil { return nil, &TokenError{ Error: EndpointError, @@ -668,7 +668,7 @@ func GetTokenByUser(application *Application, user *User, scope string, nonce st return nil, err } - accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", nonce, scope, host) + accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", "", nonce, scope, host) if err != nil { return nil, err } @@ -775,7 +775,7 @@ func GetWechatMiniProgramToken(application *Application, code string, host strin return nil, nil, err } - accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", "", "", host) + accessToken, refreshToken, tokenName, err := generateJwtToken(application, user, "", "", "", "", host) if err != nil { return nil, &TokenError{ Error: EndpointError, diff --git a/routers/static_filter.go b/routers/static_filter.go index d8e978e4..5b812371 100644 --- a/routers/static_filter.go +++ b/routers/static_filter.go @@ -89,7 +89,7 @@ func fastAutoSignin(ctx *context.Context) (string, error) { return "", nil } - code, err := object.GetOAuthCode(userId, clientId, "", responseType, redirectUri, scope, state, nonce, codeChallenge, ctx.Request.Host, getAcceptLanguage(ctx)) + code, err := object.GetOAuthCode(userId, clientId, "", "autoSignin", responseType, redirectUri, scope, state, nonce, codeChallenge, ctx.Request.Host, getAcceptLanguage(ctx)) if err != nil { return "", err } else if code.Message != "" {