Allow cozypass to login with OIDC

Author: nono

docs/delegated-auth.md

@@ -177,6 +177,68 @@ Set-Cookie: ...
 Location: https://name00001-home.mycozy.cloud/
 ```
 
+#### GET /oidc/bitwarden/:context
+
+This route can be used by a bitwarden client to get a token from the OpenID
+Connect Identity Provider, and the fqdn of the associated cozy instance. This
+token can then be exchanged for credentials for the cozy instance.
+
+```http
+GET /oidc/bitwarden/examplecontext?redirect_uri=cozypass://login HTTP/1.1
+Host: oauthcallback.mycozy.cloud
+```
+
+```http
+HTTP/1.1 303 See Other
+Location: https://identity-provider/path/to/authorize?response_type=code&state=9f6873dfce7d&scope=openid+profile+email&client_id=aClientID&nonce=94246498&redirect_uri=https://oauthcallback.mycozy.cloud/oidc/redirect
+```
+
+[...]
+
+```http
+HTTP/1.1 303 See Other
+Location: cozypass://login?code=xxx&instance=alice.example.com
+```
+
+#### POST /oidc/bitwarden/:context
+
+This route can be used by a bitwarden client to exchange the token from the
+previous route for credentials.
+
+```http
+POST /oidc/bitwarden/examplecontext HTTP/1.1
+Host: alice.example.com
+Content-Type: application/x-www-form-urlencoded
+```
+
+```
+code=xxx&
+client_id=mobile&
+deviceType=0&
+deviceIdentifier=aac2e34a-44db-42ab-a733-5322dd582c3d&
+deviceName=android&
+clientName=CozyPass&
+devicePushToken=
+```
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+```
+
+```json
+{
+  "client_id": "f05671e159450b44d5c78cebbd0260b5",
+  "registration_access_token": "J9l-ZhwP[...omitted for brevity...]",
+  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkJDMz[...](JWT string)",
+  "expires_in": 3600,
+  "token_type": "Bearer",
+  "refresh_token": "28fb1911ef6db24025ce1bae5aa940e117eb09dfe609b425b69bff73d73c03bf",
+  "Key": "0.uRcMe+Mc2nmOet4yWx9BwA==|PGQhpYUlTUq/vBEDj1KOHVMlTIH1eecMl0j80+Zu0VRVfFa7X/MWKdVM6OM/NfSZicFEwaLWqpyBlOrBXhR+trkX/dPRnfwJD2B93hnLNGQ=",
+  "PrivateKey": null
+}
+```
+
 #### POST /oidc/:context/logout
 
 This route implements the OpenID Connect Back-Channel Logout. It means that the

web/bitwarden/bitwarden.go

@@ -270,7 +270,6 @@ type AccessTokenReponse struct {
 
 func getInitialCredentials(c echo.Context) error {
 	inst := middlewares.GetInstance(c)
-	log := inst.Logger().WithNamespace("bitwarden")
 	pass := []byte(c.FormValue("password"))
 
 	// Authentication
@@ -286,6 +285,12 @@ func getInitialCredentials(c echo.Context) error {
 		}
 	}
 
+	return RegisterClientAndReturnTokens(c, inst)
+}
+
+func RegisterClientAndReturnTokens(c echo.Context, inst *instance.Instance) error {
+	log := inst.Logger().WithNamespace("bitwarden")
+
 	// Register the client
 	kind := bitwarden.ParseBitwardenDeviceType(c.FormValue("deviceType"))
 	clientName := c.FormValue("clientName")

web/oidc/oidc.go

@@ -28,6 +28,7 @@ import (
 	"github.com/cozy/cozy-stack/pkg/logger"
 	"github.com/cozy/cozy-stack/pkg/prefixer"
 	"github.com/cozy/cozy-stack/web/auth"
+	"github.com/cozy/cozy-stack/web/bitwarden"
 	"github.com/cozy/cozy-stack/web/middlewares"
 	"github.com/cozy/cozy-stack/web/statik"
 	jwt "github.com/golang-jwt/jwt/v5"
@@ -50,7 +51,7 @@ func Start(c echo.Context) error {
 		inst.Logger().WithNamespace("oidc").Infof("Start error: %s", err)
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the context was not found.")
 	}
-	u, err := makeStartURL(inst.Domain, c.QueryParam("redirect"), c.QueryParam("confirm_state"), conf)
+	u, err := makeStartURL(inst.Domain, c.QueryParam("redirect"), c.QueryParam("confirm_state"), "", conf)
 	if err != nil {
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the server is not configured for OpenID Connect.")
 	}
@@ -65,13 +66,78 @@ func StartFranceConnect(c echo.Context) error {
 		inst.Logger().WithNamespace("oidc").Infof("StartFranceConnect error: %s", err)
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the context was not found.")
 	}
-	u, err := makeStartURL(inst.Domain, c.QueryParam("redirect"), c.QueryParam("confirm_state"), conf)
+	u, err := makeStartURL(inst.Domain, c.QueryParam("redirect"), c.QueryParam("confirm_state"), "", conf)
 	if err != nil {
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the server is not configured for OpenID Connect.")
 	}
 	return c.Redirect(http.StatusSeeOther, u)
 }
 
+func checkRedirectURIForBitwarden(redirectURI string) error {
+	if redirectURI == "" {
+		return errors.New("redirect URI is required")
+	}
+	u, err := url.Parse(redirectURI)
+	if err != nil {
+		return errors.New("invalid redirect URI")
+	}
+	if u.Scheme == "cozypass" || u.Scheme == "moz-extension" || u.Scheme == "chrome-extension" {
+		return nil
+	}
+	if u.Scheme == "https" && u.Host == "links.mycozy.cloud" {
+		return nil
+	}
+	return errors.New("invalid redirect URI")
+}
+
+// BitwardenStart starts the OIDC flow for Bitwarden clients
+func BitwardenStart(c echo.Context) error {
+	contextName := c.Param("context")
+	redirectURI := c.QueryParam("redirect_uri")
+
+	if err := checkRedirectURIForBitwarden(redirectURI); err != nil {
+		return renderError(c, nil, http.StatusNotFound, "Sorry, the redirect URI is not valid.")
+	}
+
+	conf, err := getGenericConfig(contextName)
+	if err != nil {
+		return renderError(c, nil, http.StatusNotFound, "Sorry, the context was not found.")
+	}
+	u, err := makeStartURL("", redirectURI, "", contextName, conf)
+	if err != nil {
+		return renderError(c, nil, http.StatusNotFound, "Sorry, the server is not configured for OpenID Connect.")
+	}
+	return c.Redirect(http.StatusSeeOther, u)
+}
+
+// BitwardenExchange handles the POST /oidc/bitwarden/:context route for exchanging
+// a delegated code for bitwarden credentials
+func BitwardenExchange(c echo.Context) error {
+	inst := middlewares.GetInstance(c)
+
+	code := c.FormValue("code")
+	if code == "" {
+		return c.JSON(http.StatusBadRequest, echo.Map{
+			"error": "code parameter is required",
+		})
+	}
+
+	sub := getStorage().GetSub(code)
+	invalidCode := sub == ""
+	if sub != inst.OIDCID && sub != inst.Domain {
+		invalidCode = true
+	}
+	if invalidCode {
+		inst.Logger().WithNamespace("oidc").Infof("BitwardenExchange invalid code: %s (%s - %s)",
+			sub, inst.OIDCID, inst.Domain)
+		return c.JSON(http.StatusBadRequest, echo.Map{
+			"error": "invalid code",
+		})
+	}
+
+	return bitwarden.RegisterClientAndReturnTokens(c, inst)
+}
+
 // Redirect is the route after the Identity Provider has redirected the user to
 // the stack. The redirection is made to a generic domain, like
 // oauthcallback.cozy.localhost and the association with an instance is made via a
@@ -85,6 +151,42 @@ func Redirect(c echo.Context) error {
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the session has expired.")
 	}
 
+	if state.BitwardenContext != "" {
+		conf, err := getGenericConfig(state.BitwardenContext)
+		if err != nil {
+			return renderError(c, nil, http.StatusBadRequest, "No OpenID Connect is configured.")
+		}
+		accessToken, err := getToken(conf, c.QueryParam("code"))
+		if err != nil {
+			logger.WithNamespace("oidc").Errorf("Error on getToken: %s", err)
+			return renderError(c, nil, http.StatusBadGateway, "Error from the identity provider.")
+		}
+		params, err := getUserInfo(conf, accessToken)
+		if err != nil {
+			return err
+		}
+		sub, ok := params["sub"].(string)
+		if !ok {
+			logger.WithNamespace("oidc").Errorf("Missing sub")
+			return ErrAuthenticationFailed
+		}
+		domain, err := extractDomain(conf, params)
+		if err != nil {
+			return renderError(c, nil, http.StatusNotFound, "Sorry, the cozy was not found.")
+		}
+
+		code := getStorage().CreateCode(sub)
+		u, err := url.Parse(state.Redirect)
+		if err != nil {
+			return renderError(c, nil, http.StatusNotFound, "Sorry, an error occurred.")
+		}
+		q := u.Query()
+		q.Add("code", code)
+		q.Add("instance", domain)
+		u.RawQuery = q.Encode()
+		return c.Redirect(http.StatusSeeOther, u.String())
+	}
+
 	domain := state.Instance
 	if contextName, ok := FindLoginDomain(domain); ok {
 		conf, err := getGenericConfig(contextName)
@@ -625,12 +727,12 @@ func getFranceConnectConfig(context string) (*Config, error) {
 	return config, nil
 }
 
-func makeStartURL(domain, redirect, confirm string, conf *Config) (string, error) {
+func makeStartURL(domain, redirect, confirm, bitwardenContext string, conf *Config) (string, error) {
 	u, err := url.Parse(conf.AuthorizeURL)
 	if err != nil {
 		return "", err
 	}
-	state := newStateHolder(domain, redirect, confirm, conf.Provider)
+	state := newStateHolder(domain, redirect, confirm, bitwardenContext, conf.Provider)
 	if err = getStorage().Add(state); err != nil {
 		return "", err
 	}
@@ -948,6 +1050,8 @@ func renderError(c echo.Context, inst *instance.Instance, code int, msg string)
 func Routes(router *echo.Group) {
 	router.GET("/start", Start, middlewares.NeedInstance, middlewares.CheckOnboardingNotFinished)
 	router.GET("/franceconnect", StartFranceConnect, middlewares.NeedInstance, middlewares.CheckOnboardingNotFinished)
+	router.GET("/bitwarden/:context", BitwardenStart)
+	router.POST("/bitwarden/:context", BitwardenExchange, middlewares.NeedInstance)
 	router.GET("/redirect", Redirect)
 	router.GET("/login", Login, middlewares.NeedInstance)
 	router.POST("/twofactor", TwoFactor, middlewares.NeedInstance)
@@ -1043,7 +1147,7 @@ func LoginDomainHandler(c echo.Context, contextName string) error {
 	if err != nil {
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the context was not found.")
 	}
-	u, err := makeStartURL(r.Host, "", "", conf)
+	u, err := makeStartURL(r.Host, "", "", "", conf)
 	if err != nil {
 		return renderError(c, nil, http.StatusNotFound, "Sorry, the server is not configured for OpenID Connect.")
 	}

web/oidc/statestore.go

@@ -19,13 +19,14 @@ const (
 )
 
 type stateHolder struct {
-	id        string
-	expiresAt int64
-	Provider  ProviderOIDC
-	Instance  string
-	Redirect  string
-	Nonce     string
-	Confirm   string
+	id               string
+	expiresAt        int64
+	Provider         ProviderOIDC
+	Instance         string
+	Redirect         string
+	Nonce            string
+	Confirm          string
+	BitwardenContext string
 }
 
 type ProviderOIDC int
@@ -35,16 +36,17 @@ const (
 	FranceConnectProvider
 )
 
-func newStateHolder(domain, redirect, confirm string, provider ProviderOIDC) *stateHolder {
+func newStateHolder(domain, redirect, confirm, bitwardenContext string, provider ProviderOIDC) *stateHolder {
 	id := hex.EncodeToString(crypto.GenerateRandomBytes(24))
 	nonce := hex.EncodeToString(crypto.GenerateRandomBytes(24))
 	return &stateHolder{
-		id:       id,
-		Provider: provider,
-		Instance: domain,
-		Redirect: redirect,
-		Confirm:  confirm,
-		Nonce:    nonce,
+		id:               id,
+		Provider:         provider,
+		Instance:         domain,
+		Redirect:         redirect,
+		Confirm:          confirm,
+		Nonce:            nonce,
+		BitwardenContext: bitwardenContext,
 	}
 }