rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Browse Source 
Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-19 16:35:15 +02:00
parent b2e9b8b4f1
commit e424563794
18 changed files with 305 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/server/api/api.go
View File

@@ -221,6 +221,7 @@ func NewServer(cfg Config) (*Server, error) {
cfg.IAM,
cfg.Cookie,
cfg.TokenSecret,
cfg.BaseURL,
),
mcpHandler: mcp_v1.NewMux(
cfg.Logger.Named("mcp.v1"),

2
pkg/server/api/authn/context.go
View File

@@ -28,7 +28,7 @@ var (
identityContextKey = &ctxKey{name: "identity"}
sessionContextKey = &ctxKey{name: "session"}
apiKeyContextKey = &ctxKey{name: "api_key"}
TrustCenterKey = &ctxKey{name: "trust_center"}
trustCenterKey = &ctxKey{name: "trust_center"}
)
func SessionFromContext(ctx context.Context) *coredata.Session {

13
pkg/server/api/authn/identity_presence_middleware.go
View File

@@ -20,16 +20,25 @@ import (
"github.com/99designs/gqlgen/graphql"
"github.com/vektah/gqlparser/v2/gqlerror"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/bearertoken"
"go.probo.inc/probo/pkg/server/gqlutils"
)
func NewIdentityPresenceMiddleware() func(next http.Handler) http.Handler {
func NewIdentityPresenceMiddleware(baseURL *baseurl.BaseURL) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
identity := IdentityFromContext(r.Context())
ctx := r.Context()
identity := IdentityFromContext(ctx)
if identity == nil {
if bearertoken.IsAttempt(r.Header.Get("Authorization")) {
bearertoken.SetBearerInvalidToken(w, baseURL)
} else {
bearertoken.SetBearerUnauthenticated(w, baseURL)
}
httpserver.RenderJSON(
w,
http.StatusUnauthorized,

6
pkg/server/api/authn/oauth2_access_token_middleware.go
View File

@@ -36,15 +36,19 @@ func NewOAuth2AccessTokenMiddleware(svc *iam.Service) func(next http.Handler) ht
return
}
tokenValue, err := bearertoken.Parse(r.Header.Get("Authorization"))
authorization := r.Header.Get("Authorization")
tokenValue, err := bearertoken.Parse(authorization)
if err != nil {
next.ServeHTTP(w, r)
return
}
accessToken, err := svc.OAuth2ServerService.LoadAccessToken(ctx, tokenValue)
if err != nil {
next.ServeHTTP(w, r)
return
}

6
pkg/server/api/connect/v1/oauth2_handler.go
View File

@@ -77,7 +77,7 @@ func (h *OAuth2Handler) BearerTokenMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
tokenValue, err := bearertoken.Parse(r.Header.Get("Authorization"))
if err != nil {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
@@ -85,7 +85,7 @@ func (h *OAuth2Handler) BearerTokenMiddleware(next http.Handler) http.Handler {
accessToken, err := h.iam.OAuth2ServerService.LoadAccessToken(r.Context(), tokenValue)
if err != nil {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
@@ -402,7 +402,7 @@ func (h *OAuth2Handler) RegisterHandler(w http.ResponseWriter, r *http.Request)
func (h *OAuth2Handler) UserInfoHandler(w http.ResponseWriter, r *http.Request) {
accessToken, ok := oauth2.AccessTokenFromContext(r.Context())
if !ok {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return

9
pkg/server/api/connect/v1/resolver.go
View File

@@ -76,11 +76,16 @@ func NewMux(
sessionMiddleware := authn.NewSessionMiddleware(svc, cookieConfig)
apiKeyMiddleware := authn.NewAPIKeyMiddleware(svc, tokenSecret)
oauth2Middleware := authn.NewOAuth2AccessTokenMiddleware(svc)
identityPresenceMiddleware := authn.NewIdentityPresenceMiddleware(baseURL)
graphqlHandler := NewGraphQLHandler(svc, logger, fileManagerSvc, baseURL, cookieConfig)
samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL, logger)
scimHandler := NewSCIMHandler(svc, logger.Named("scim"))
router := r.With(sessionMiddleware, apiKeyMiddleware, oauth2Middleware)
router := r.With(
sessionMiddleware,
apiKeyMiddleware,
oauth2Middleware,
)
oidcHandler := NewOIDCHandler(svc, cookieConfig, logger, allowedRedirectHost, isTrustCenterDomain)
@@ -115,7 +120,7 @@ func NewMux(
// Session-authenticated endpoints.
router.Get("/oauth2/authorize", oauth2Handler.AuthorizeHandler)
requireIdentity := router.With(authn.NewIdentityPresenceMiddleware())
requireIdentity := router.With(identityPresenceMiddleware)
requireIdentity.Post("/oauth2/register", oauth2Handler.RegisterHandler)
return r

2
pkg/server/api/console/v1/resolver.go
View File

@@ -120,7 +120,7 @@ func NewMux(
r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
r.Use(authn.NewIdentityPresenceMiddleware())
r.Use(authn.NewIdentityPresenceMiddleware(baseURL))
r.Use(dataloader.NewMiddleware(proboSvc, iamSvc, cookieBannerSvc, thirdPartySvc))
r.Handle("/graphql", graphqlHandler)

11
pkg/server/api/files/v1/handler.go
View File

@@ -22,6 +22,8 @@ import (
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/bearertoken"
"go.probo.inc/probo/pkg/brand"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/filemanager"
@@ -41,6 +43,7 @@ type Handler struct {
probo *probo.Service
iamSvc *iam.Service
assets *brand.Assets
baseURL *baseurl.BaseURL
}
func NewMux(
@@ -50,6 +53,7 @@ func NewMux(
iamSvc *iam.Service,
cookieConfig securecookie.Config,
tokenSecret string,
baseURL *baseurl.BaseURL,
) *chi.Mux {
h := &Handler{
logger: logger,
@@ -57,6 +61,7 @@ func NewMux(
probo: proboSvc,
iamSvc: iamSvc,
assets: brand.NewAssets(),
baseURL: baseURL,
}
r := chi.NewRouter()
@@ -68,7 +73,7 @@ func NewMux(
r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
r.Use(authn.NewIdentityPresenceMiddleware())
r.Use(authn.NewIdentityPresenceMiddleware(baseURL))
r.Get("/{fileID}", h.handleGetFile)
})
@@ -157,8 +162,10 @@ func (h *Handler) handleGetFile(w http.ResponseWriter, r *http.Request) {
scope, err := h.iamSvc.Authorizer.Authorize(ctx, params)
if err != nil {
if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
if scopeErr, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
bearertoken.SetBearerInsufficientScope(w, h.baseURL, scopeErr.Scopes...)
jsonx.RenderForbidden(w)
return
}

3
pkg/server/api/files/v1/handler_test.go
View File

@@ -26,6 +26,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/securecookie"
)
@@ -79,6 +80,7 @@ func TestHandleGetStaticFile(t *testing.T) {
nil,
securecookie.Config{},
"test-secret",
baseurl.MustParse("https://example.com"),
)
rec := httptest.NewRecorder()
@@ -118,6 +120,7 @@ func TestHandleGetFile_UnauthenticatedReturns401(t *testing.T) {
nil, // iamSvc — not reached when no token/cookie present
securecookie.Config{},
"test-secret",
baseurl.MustParse("https://example.com"),
)
rec := httptest.NewRecorder()

2
pkg/server/api/mcp/v1/v1_handler.go
View File

@@ -86,7 +86,7 @@ func NewMux(
r := chi.NewMux()
r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
r.Use(authn.NewIdentityPresenceMiddleware())
r.Use(authn.NewIdentityPresenceMiddleware(baseURL))
r.Handle("/", protectedHandler)
logger.Info("MCP server initialized successfully")