feat: add user / default scopes

Author: bevzzz

src/it/java/io/weaviate/integration/OIDCSupportITest.java

@@ -16,9 +16,13 @@
 /**
  * Test that the client can use one of the supported authorization flows to
  * obtain a token from the OIDC provider and use it in a request to Weaviate.
+ *
+ * Running this test suite successfully requires talking to external services,
+ * so tests will be skipped if the don't have internet. See
+ * {@link #hasInternetConnection}.
  */
 public class OIDCSupportITest extends ConcurrentTest {
-  private static final String WCS_DUMMY_CI_USER = "oidc-test-user@weaviate.io";
+  private static final String WCS_DUMMY_CI_USERNAME = "oidc-test-user@weaviate.io";
   private static final String WCS_DUMMY_CI_PW = System.getenv("WCS_DUMMY_CI_PW");
 
   /**
@@ -51,7 +55,7 @@ public void test_resourceOwnerPassword() throws IOException {
     Assume.assumeTrue("WCS_DUMMY_CI_PW is not set", WCS_DUMMY_CI_PW != null);
     Assume.assumeTrue("no internet connection", hasInternetConnection());
 
-    var authz = Authorization.resourceOwnerPassword(WCS_DUMMY_CI_USER, WCS_DUMMY_CI_PW, List.of("test_scope"));
+    var authz = Authorization.resourceOwnerPassword(WCS_DUMMY_CI_USERNAME, WCS_DUMMY_CI_PW, List.of());
     pingWeaviate(wcsContainer, authz);
   }
 
@@ -60,7 +64,7 @@ public void test_clientCredentials() throws IOException {
     Assume.assumeTrue("OKTA_CLIENT_SECRET is not set", OKTA_CLIENT_SECRET != null);
     Assume.assumeTrue("no internet connection", hasInternetConnection());
 
-    var authz = Authorization.clientCredentials(OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, List.of("test_scope"));
+    var authz = Authorization.clientCredentials(OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, List.of());
     pingWeaviate(oktaContainer, authz);
   }
 

src/main/java/io/weaviate/client6/v1/api/Authorization.java

@@ -51,7 +51,7 @@ public static Authorization bearerToken(String accessToken, String refreshToken,
    */
   public static Authorization resourceOwnerPassword(String username, String password, List<String> scopes) {
     return transport -> {
-      OidcConfig oidc = OidcUtils.getConfig(transport);
+      OidcConfig oidc = OidcUtils.getConfig(transport).withScopes(scopes).withScopes("offline_access");
       return TokenProvider.resourceOwnerPassword(oidc, username, password);
     };
   }
@@ -69,7 +69,10 @@ public static Authorization resourceOwnerPassword(String username, String passwo
    */
   public static Authorization clientCredentials(String clientId, String clientSecret, List<String> scopes) {
     return transport -> {
-      OidcConfig oidc = OidcUtils.getConfig(transport);
+      OidcConfig oidc = OidcUtils.getConfig(transport).withScopes(scopes);
+      if (oidc.scopes().isEmpty() && TokenProvider.isMicrosoft(oidc)) {
+        oidc = oidc.withScopes(clientId + "/.default");
+      }
       return TokenProvider.clientCredentials(oidc, clientId, clientSecret);
     };
   }

src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

@@ -1,5 +1,6 @@
 package io.weaviate.client6.v1.internal;
 
+import java.net.URI;
 import java.time.Instant;
 
 import io.weaviate.client6.v1.api.WeaviateOAuthException;
@@ -131,4 +132,21 @@ static TokenProvider exchange(OidcConfig oidc, TokenProvider tp) {
   static TokenProvider reuse(Token t, TokenProvider tp) {
     return ReuseTokenProvider.wrap(t, tp);
   }
+
+  public record ProviderMetadata(URI tokenEndpoint) {
+  }
+
+  /**
+   * Returns true if this OIDC provider's token endpoint is hosted at
+   * {@code login.microsoftonline.com}.
+   *
+   * @param oidc OIDC config.
+   *
+   * @throws WeaviateOAuthException if metadata could not be parsed.
+   */
+  public static boolean isMicrosoft(OidcConfig oidc) {
+    var metadata = NimbusTokenProvider.parseProviderMetadata(oidc.providerMetadata());
+    return metadata.tokenEndpoint().getHost().contains("login.microsoftonline.com");
+  }
+
 }

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

@@ -1,16 +1,36 @@
 package io.weaviate.client6.v1.internal.oidc;
 
+import java.util.Arrays;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 public record OidcConfig(
     String clientId,
     String providerMetadata,
-    List<String> scopes) {
+    Set<String> scopes) {
 
-  public OidcConfig(String clientId, String providerMetadata, List<String> scopes) {
+  public OidcConfig(String clientId, String providerMetadata, Set<String> scopes) {
     this.clientId = clientId;
     this.providerMetadata = providerMetadata;
-    this.scopes = scopes != null ? scopes : Collections.emptyList();
+    this.scopes = scopes != null ? Set.copyOf(scopes) : Collections.emptySet();
+  }
+
+  public OidcConfig(String clientId, String providerMetadata, List<String> scopes) {
+    this(clientId, providerMetadata, scopes == null ? null : new HashSet<>(scopes));
+  }
+
+  /** Create a new OIDC config with extended scopes. */
+  public OidcConfig withScopes(String... scopes) {
+    return withScopes(Arrays.asList(scopes));
+  }
+
+  /** Create a new OIDC config with extended scopes. */
+  public OidcConfig withScopes(List<String> scopes) {
+    var newScopes = Stream.concat(this.scopes.stream(), scopes.stream()).collect(Collectors.toSet());
+    return new OidcConfig(clientId, providerMetadata, newScopes);
   }
 }

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcUtils.java

@@ -53,6 +53,7 @@ public static final OidcConfig getConfig(RestTransport transport) {
     } catch (IOException e) {
       throw new WeaviateOAuthException("fetch provider metadata", e);
     }
+
     return new OidcConfig(openid.clientId(), providerMetadata, openid.scopes());
   }
 }

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

@@ -70,12 +70,7 @@ public static NimbusTokenProvider clientCredentials(OidcConfig oidc, String clie
   }
 
   private NimbusTokenProvider(OidcConfig oidc, Flow flow) {
-    try {
-      this.metadata = OIDCProviderMetadata.parse(oidc.providerMetadata());
-    } catch (ParseException ex) {
-      throw new WeaviateOAuthException("parse provider metadata: ", ex);
-    }
-
+    this.metadata = _parseProviderMetadata(oidc.providerMetadata());
     this.clientId = new ClientID(oidc.clientId());
     this.scope = new Scope(oidc.scopes().toArray(String[]::new));
     this.flow = flow;
@@ -114,6 +109,19 @@ public Token getToken() {
     return newToken;
   }
 
+  public static ProviderMetadata parseProviderMetadata(String providerMetadata) {
+    var metadata = _parseProviderMetadata(providerMetadata);
+    return new ProviderMetadata(metadata.getTokenEndpointURI());
+  }
+
+  private static OIDCProviderMetadata _parseProviderMetadata(String providerMetadata) {
+    try {
+      return OIDCProviderMetadata.parse(providerMetadata);
+    } catch (ParseException ex) {
+      throw new WeaviateOAuthException("parse provider metadata: ", ex);
+    }
+  }
+
   @NotThreadSafe
   final class BearerTokenFlow implements Flow {
     private Token t;