rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Browse Source 
Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-19 16:35:15 +02:00
parent b2e9b8b4f1
commit e424563794
18 changed files with 305 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/server/api/connect/v1/oauth2_handler.go
View File

@@ -77,7 +77,7 @@ func (h *OAuth2Handler) BearerTokenMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
tokenValue, err := bearertoken.Parse(r.Header.Get("Authorization"))
if err != nil {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
@@ -85,7 +85,7 @@ func (h *OAuth2Handler) BearerTokenMiddleware(next http.Handler) http.Handler {
accessToken, err := h.iam.OAuth2ServerService.LoadAccessToken(r.Context(), tokenValue)
if err != nil {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
@@ -402,7 +402,7 @@ func (h *OAuth2Handler) RegisterHandler(w http.ResponseWriter, r *http.Request)
func (h *OAuth2Handler) UserInfoHandler(w http.ResponseWriter, r *http.Request) {
accessToken, ok := oauth2.AccessTokenFromContext(r.Context())
if !ok {
w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
bearertoken.SetBearerInvalidToken(w, h.baseURL)
http.Error(w, "unauthorized", http.StatusUnauthorized)
return

9
pkg/server/api/connect/v1/resolver.go
View File

@@ -76,11 +76,16 @@ func NewMux(
sessionMiddleware := authn.NewSessionMiddleware(svc, cookieConfig)
apiKeyMiddleware := authn.NewAPIKeyMiddleware(svc, tokenSecret)
oauth2Middleware := authn.NewOAuth2AccessTokenMiddleware(svc)
identityPresenceMiddleware := authn.NewIdentityPresenceMiddleware(baseURL)
graphqlHandler := NewGraphQLHandler(svc, logger, fileManagerSvc, baseURL, cookieConfig)
samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL, logger)
scimHandler := NewSCIMHandler(svc, logger.Named("scim"))
router := r.With(sessionMiddleware, apiKeyMiddleware, oauth2Middleware)
router := r.With(
sessionMiddleware,
apiKeyMiddleware,
oauth2Middleware,
)
oidcHandler := NewOIDCHandler(svc, cookieConfig, logger, allowedRedirectHost, isTrustCenterDomain)
@@ -115,7 +120,7 @@ func NewMux(
// Session-authenticated endpoints.
router.Get("/oauth2/authorize", oauth2Handler.AuthorizeHandler)
requireIdentity := router.With(authn.NewIdentityPresenceMiddleware())
requireIdentity := router.With(identityPresenceMiddleware)
requireIdentity.Post("/oauth2/register", oauth2Handler.RegisterHandler)
return r