Handle configuration and swapping between different token types

Author: jaxoncreed

src/AccessToken.js

@@ -68,6 +68,7 @@ class AccessToken extends JWT {
     const key = keys.token.signing[alg].privateKey
     const kid = keys.token.signing[alg].publicJwk.kid
 
+    
     const header = { alg, kid }
     const payload = { iss, aud, sub, exp, iat, jti, scope }
 
@@ -108,7 +109,9 @@ class AccessToken extends JWT {
       scope = code.scope
     }
 
-    const options = { aud, sub, scope, alg, jti, iat, max }
+    const tokenType = request.tokenType;
+
+    const options = { aud, sub, scope, alg, jti, iat, max, tokenType }
 
     let header, payload
 

src/Provider.js

@@ -17,6 +17,7 @@ const DEFAULT_RESPONSE_TYPES_SUPPORTED = [
   'code',
   'code token',
   'code id_token',
+  'id_token code',
   'id_token',
   'id_token token',
   'code id_token token',
@@ -34,6 +35,8 @@ const DEFAULT_GRANT_TYPES_SUPPORTED = [
 ]
 const DEFAULT_SUBJECT_TYPES_SUPPORTED = ['public']
 
+const DEFAULT_TOKEN_TYPES_SUPPORTED = ['legacyPop', 'dpop']
+
 /**
  * OpenID Connect Provider
  */
@@ -53,6 +56,8 @@ class Provider {
     this.scopes_supported = data.scopes_supported
     this.response_types_supported = data.response_types_supported ||
       DEFAULT_RESPONSE_TYPES_SUPPORTED
+    this.token_types_supported = data.token_types_supported ||
+      DEFAULT_TOKEN_TYPES_SUPPORTED
     this.response_modes_supported = data.response_modes_supported ||
       DEFAULT_RESPONSE_MODES_SUPPORTED
     this.grant_types_supported = data.grant_types_supported ||

src/handlers/AuthenticationRequest.js

@@ -12,6 +12,9 @@ const { JWT, JWK, JWKSet } = require('@solid/jose')
 const { random } = require('../crypto')
 const { URL } = require('whatwg-url')
 
+const LEGACY_POP = "legacyPop"
+const DPOP = "dpop"
+
 /**
  * AuthenticationRequest
  */
@@ -25,14 +28,54 @@ class AuthenticationRequest extends BaseRequest {
    * @param {Provider} provider
    */
   static handle (req, res, provider) {
-    let {host} = provider
+    let {host, token_types_supported} = provider
     let request = new AuthenticationRequest(req, res, provider)
 
+    return Promise
+      .resolve(request)
+      .then(request.getTokenType)
+      .then((request) => {
+        if (
+          request.tokenType === LEGACY_POP &&
+          token_types_supported.includes(LEGACY_POP)
+        ) {
+          return request.handleLegacyPop(request, host)
+        } else if (
+          request.tokenType === DPOP &&
+          token_types_supported.includes(DPOP)
+        ) {
+          return request.handleDpop(request, host)
+        } else {
+          return request.badRequest({
+            error: 'invalid_request',
+            error_description: `This server does not allow a token of type ${request.tokenType}`,
+          })
+        }
+      })
+  }
+
+  handleLegacyPop (request, host) {
+    console.log("Handling legacy Pop")
     return Promise
       .resolve(request)
       .then(request.loadClient)
       .then(request.decodeRequestParam)
-      .then(request.validate)
+      .then(request.validateCommon)
+      .then(request.validateLegacyPop)
+      .then(host.authenticate)
+      .then(host.obtainConsent)
+      .then(request.authorize)
+      .catch(err => request.error(err))
+  }
+
+  handleDpop (request, host) {
+    console.log("Handling dpop")
+    request.responseMode = '?'
+    return Promise
+      .resolve(request)
+      .then(request.loadClient)
+      .then(request.validateCommon)
+      .then(request.validateDpop)
       .then(host.authenticate)
       .then(host.obtainConsent)
       .then(request.authorize)
@@ -53,6 +96,15 @@ class AuthenticationRequest extends BaseRequest {
     this.responseMode = AuthenticationRequest.getResponseMode(this)
   }
 
+  getTokenType (request) {
+    if (request.params.request) {
+      request.tokenType = LEGACY_POP
+    } else {
+      request.tokenType = DPOP
+    }
+    return request;
+  }
+
   /**
    * loadClient
    *
@@ -353,7 +405,7 @@ class AuthenticationRequest extends BaseRequest {
    *
    * @returns {AuthenticationRequest}
    */
-  validate (request) {
+  validateCommon (request) {
     const { params, client } = request
 
     // CLIENT ID IS REQUIRED
@@ -412,14 +464,6 @@ class AuthenticationRequest extends BaseRequest {
       })
     }
 
-    // NONCE MAY BE REQUIRED
-    if (!request.requiredNonceProvided()) {
-      return request.redirect({
-        error: 'invalid_request',
-        error_description: 'Missing nonce'
-      })
-    }
-
     // RESPONSE TYPE MUST BE SUPPORTED
     // TODO is this something the client can configure too?
     if (!request.supportedResponseType()) {
@@ -442,6 +486,22 @@ class AuthenticationRequest extends BaseRequest {
     return request
   }
 
+  validateLegacyPop (request) {
+    // NONCE MAY BE REQUIRED
+    if (!request.requiredNonceProvided()) {
+      return request.redirect({
+        error: 'invalid_request',
+        error_description: 'Missing nonce'
+      })
+    }
+
+    return request
+  }
+
+  validateDpop (request) {
+    return request
+  }
+
   static validateRedirectUri (registeredUris, redirectUri) {
     // Drop hash fragment when validating against pre-registered uris
     let uriNoHash = (uri) => {

src/handlers/TokenRequest.js

@@ -9,6 +9,9 @@ const AccessToken = require('../AccessToken')
 const AuthorizationCode = require('../AuthorizationCode')
 const IDToken = require('../IDToken')
 
+const LEGACY_POP = "legacyPop"
+const DPOP = "dpop"
+
 /**
  * TokenRequest
  */
@@ -27,6 +30,7 @@ class TokenRequest extends BaseRequest {
     Promise
       .resolve(request)
       .then(request.validate)
+      .then(request.extractDpopHeader)
       .then(request.authenticateClient)
       .then(request.verifyAuthorizationCode)
       .then(request.grant)
@@ -40,6 +44,7 @@ class TokenRequest extends BaseRequest {
     super(req, res, provider)
     this.params = TokenRequest.getParams(this)
     this.grantType = TokenRequest.getGrantType(this)
+    this.tokenType = TokenRequest.getTokenType(this)
   }
 
   /**
@@ -53,6 +58,15 @@ class TokenRequest extends BaseRequest {
     return params.grant_type
   }
 
+  static getTokenType (request) {
+    const { req } = request;
+    if (req.headers && req.headers.dpop) {
+      return DPOP;
+    } else {
+      return LEGACY_POP;
+    }
+  }
+
   /**
    * Validate Request
    *
@@ -176,6 +190,10 @@ class TokenRequest extends BaseRequest {
       method = 'clientSecretJWT'
     }
 
+    if (req.body && req.body.client_id) {
+      method = 'clientId'
+    }
+
     // Missing authentication parameters
     if (!method) {
       return request.badRequest({
@@ -349,6 +367,22 @@ class TokenRequest extends BaseRequest {
       })
   }
 
+  clientId (request) {
+    const { req: { body: { client_id: clientId } }, provider} = request
+    return provider.backend.get('clients', clientId)
+      .then(client => {
+        if (!client) {
+          return request.badRequest({
+            error: 'unauthorized_client',
+            error_description: 'Unknown client'
+          })
+        }
+        request.client = client
+
+        return request
+      })
+  }
+
   /**
    * Private Key JWT Authentication
    */
@@ -359,6 +393,14 @@ class TokenRequest extends BaseRequest {
    */
   // none () {}
 
+  extractDpopHeader (request) {
+    if (request.tokenType === DPOP) {
+      const decodedDpop = JWT.decode(req.headers.dpop);
+      return request;
+    }
+    return request;
+  }
+
   /**
    * Grant
    *