Let a JWT policy require the token type it accepts (#1161)

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

Author: jviotti

docs/configuration.md

@@ -474,6 +474,7 @@ same response as any other unauthenticated request.
 | `/issuer`       | String  | :red_circle: **Yes** | N/A | The token issuer to trust, matched against the `iss` claim |
 | `/audience`     | String  | :red_circle: **Yes** | N/A | The audience this instance identifies as. A token is accepted when its `aud` claim includes this value, so a token minted for several audiences at once is accepted as long as this one is among them |
 | `/algorithms`   | Array   | :red_circle: **Yes** | N/A | The JSON Web Signature algorithms the policy accepts. One or more of `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, and `EdDSA` |
+| `/tokenType`    | String  | No | Any type is accepted | The `typ` header a presented token must carry, such as `at+jwt` for the [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068) JSON Web Token access token profile. Set it whenever the issuer stamps one. An identity token is signed by the same issuer under the same key, and where this policy's `audience` matches the `clientId` of an `oidc` policy on that issuer, the type is the only thing distinguishing the two, so without it an identity token is accepted as an API credential |
 | `/jwksUri`      | String  | No | Discovered from the issuer | The URL of the issuer's JSON Web Key Set. When omitted, it is discovered from the issuer's OpenID Connect metadata at `{issuer}/.well-known/openid-configuration`, which requires the issuer to be an `https` URL that publishes a valid OpenID Provider metadata document. Set it explicitly for an issuer that does not meet that bar |
 
 For example, the following instance keeps `/docs` public, gates `/partners`

enterprise/authentication/authentication.cc

@@ -310,6 +310,7 @@ struct JWTPolicy {
   std::string_view issuer;
   std::string_view audience;
   std::string_view jwks_uri;
+  std::string_view token_type;
   std::vector<sourcemeta::core::JWSAlgorithm> algorithms;
 };
 
@@ -318,7 +319,8 @@ auto decode_jwt_metadata(const std::span<const std::byte> metadata,
   std::size_t cursor{0};
   if (!read_string(metadata, cursor, result.issuer) ||
       !read_string(metadata, cursor, result.audience) ||
-      !read_string(metadata, cursor, result.jwks_uri)) {
+      !read_string(metadata, cursor, result.jwks_uri) ||
+      !read_string(metadata, cursor, result.token_type)) {
     return false;
   }
 
@@ -359,15 +361,25 @@ auto collect_jwt_identifiers(const std::span<const std::byte> metadata,
   std::string_view issuer;
   std::string_view audience;
   std::string_view jwks_uri;
+  std::string_view token_type;
   if (!read_string(metadata, cursor, issuer) ||
       !read_string(metadata, cursor, audience) ||
-      !read_string(metadata, cursor, jwks_uri)) {
+      !read_string(metadata, cursor, jwks_uri) ||
+      !read_string(metadata, cursor, token_type)) {
     return;
   }
 
   keys.emplace(issuer);
   keys.emplace(audience);
   keys.emplace(jwks_uri);
+  // A policy that requires a token type admits a narrower set than one that
+  // does not, so two policies alike but for it are not the same audience.
+  // This refuses a reference from the stricter of the two to the looser one,
+  // which every holder of the stricter credential could have followed anyway.
+  // That is deliberate: the comparison is by equality, and the cost of
+  // refusing is a build that has to say so, against disclosing a referent to
+  // somebody the referrer never admitted
+  keys.emplace(token_type);
 
   std::uint32_t count{0};
   if (!read_u32(metadata, cursor, count) || count > metadata.size() - cursor) {
@@ -599,14 +611,18 @@ struct Authentication::Impl {
       return false;
     }
 
-    // The token type is not pinned, so a policy whose audience coincides with
-    // an interactive policy's client identifier on the same issuer admits an
-    // identity token as an API credential. Pinning it is a configuration
-    // question rather than a default, since a provider that does not stamp the
-    // type would otherwise stop working on upgrade
+    // RFC 9068 Section 4 has a resource server refuse a token whose `typ` is
+    // not the access token profile's, which is what keeps an identity token
+    // from being spent as an API credential. A provider that does not stamp
+    // the header at all cannot be told apart that way, so the policy says
+    // which type it requires rather than one being assumed
+    const auto expected_type{
+        policy.token_type.empty()
+            ? std::optional<std::string_view>{std::nullopt}
+            : std::optional<std::string_view>{policy.token_type}};
     const auto error{provider->verify(token, policy.algorithms, policy.issuer,
                                       policy.audience, std::nullopt,
-                                      std::nullopt)};
+                                      expected_type)};
     return !error.has_value();
   }
 

enterprise/authentication/authentication_format.h

@@ -8,7 +8,7 @@
 namespace sourcemeta::one {
 
 constexpr std::uint32_t AUTHENTICATION_MAGIC{0x48545541};
-constexpr std::uint32_t AUTHENTICATION_VERSION{9};
+constexpr std::uint32_t AUTHENTICATION_VERSION{10};
 
 // The artifact begins with this header. Every variable-length section is
 // located through an absolute byte offset so the matcher can address it

enterprise/authentication/authentication_save.cc

@@ -98,12 +98,13 @@ auto encode_oidc_metadata(const std::string_view issuer,
 auto encode_jwt_metadata(
     const std::string_view issuer, const std::string_view audience,
     const std::string_view jwks_uri,
-    const std::span<const sourcemeta::core::JWSAlgorithm> algorithms)
-    -> std::vector<std::byte> {
+    const std::span<const sourcemeta::core::JWSAlgorithm> algorithms,
+    const std::string_view token_type) -> std::vector<std::byte> {
   std::vector<std::byte> result;
   append_string(result, issuer);
   append_string(result, audience);
   append_string(result, jwks_uri);
+  append_string(result, token_type);
   append_u32(result, static_cast<std::uint32_t>(algorithms.size()));
   for (const auto algorithm : algorithms) {
     result.push_back(
@@ -224,8 +225,9 @@ auto Authentication::save(std::span<const Authentication::Policy> policies,
   for (const auto &policy : policies) {
     std::vector<std::byte> policy_metadata;
     if (policy.type == Authentication::Type::JWT) {
-      policy_metadata = encode_jwt_metadata(policy.issuer, policy.audience,
-                                            policy.jwks_uri, policy.algorithms);
+      policy_metadata =
+          encode_jwt_metadata(policy.issuer, policy.audience, policy.jwks_uri,
+                              policy.algorithms, policy.token_type);
     } else if (policy.type == Authentication::Type::OIDC) {
       // A nameless interactive policy could never match a session cookie, and
       // one without a session secret could never mint or verify one, so both

enterprise/e2e/auth/hurl/directory.all.hurl

@@ -16,9 +16,9 @@ header "ETag" exists
 jsonpath "$.path" == "/"
 jsonpath "$.url" == "{{base}}"
 jsonpath "$.breadcrumb" count == 0
-jsonpath "$.schemas" == 72
+jsonpath "$.schemas" == 73
 jsonpath "$.policies" count == 0
-jsonpath "$.entries" count == 11
+jsonpath "$.entries" count == 12
 jsonpath "$.entries[0].name" == "console"
 jsonpath "$.entries[0].type" == "directory"
 jsonpath "$.entries[0].path" == "/console/"
@@ -97,6 +97,13 @@ jsonpath "$.entries[10].policies" count == 1
 jsonpath "$.entries[10].policies[0].name" == "telemetry"
 jsonpath "$.entries[10].policies[0].title" == "telemetry"
 jsonpath "$.entries[10].policies[0].type" == "jwt"
+jsonpath "$.entries[11].name" == "typed"
+jsonpath "$.entries[11].type" == "directory"
+jsonpath "$.entries[11].path" == "/typed/"
+jsonpath "$.entries[11].policies" count == 1
+jsonpath "$.entries[11].policies[0].name" == "typed"
+jsonpath "$.entries[11].policies[0].title" == "typed"
+jsonpath "$.entries[11].policies[0].type" == "jwt"
 
 POST {{base}}/self/v1/api/schemas/evaluate{{root_listing_schema}}
 ```
@@ -300,11 +307,12 @@ Cache-Control: public, max-age=0, must-revalidate
 [Asserts]
 header "Content-Type" contains "text/html"
 xpath "string(//title)" != "Unauthorized"
-xpath "count(//i[contains(@class, 'bi-lock-fill')])" == 8
+xpath "count(//i[contains(@class, 'bi-lock-fill')])" == 9
 xpath "count(//i[contains(@class, 'bi-folder-fill')])" == 3
 xpath "count(//tr[.//a[normalize-space(.) = 'console']]//i[contains(@class, 'bi-lock-fill')])" == 1
 xpath "count(//tr[.//a[normalize-space(.) = 'private']]//i[contains(@class, 'bi-lock-fill')])" == 1
 xpath "count(//tr[.//a[normalize-space(.) = 'internal']]//i[contains(@class, 'bi-lock-fill')])" == 1
+xpath "count(//tr[.//a[normalize-space(.) = 'typed']]//i[contains(@class, 'bi-lock-fill')])" == 1
 xpath "count(//tr[.//a[normalize-space(.) = 'reports']]//i[contains(@class, 'bi-lock-fill')])" == 1
 xpath "count(//tr[.//a[normalize-space(.) = 'mixed']]//i[contains(@class, 'bi-lock-fill')])" == 1
 xpath "count(//tr[.//a[normalize-space(.) = 'machine']]//i[contains(@class, 'bi-lock-fill')])" == 1

enterprise/e2e/auth/hurl/token-type.all.hurl

@@ -0,0 +1,158 @@
+# A machine token and a person's identity token are both signed by the same
+# provider under the same key, and where a policy names an audience that
+# matches an interactive client's identifier, everything else about them agrees
+# too. RFC 9068 Section 4 has a resource server refuse a token whose `typ` is
+# not the access token profile's, which Section 5 says is what keeps the two
+# apart. A provider that stamps no type cannot be told apart that way, so a
+# policy says which type it requires rather than one being assumed.
+#
+# These two clients differ in exactly that: same realm, same key, same
+# algorithm, same audience, and one stamps the profile's type while the other
+# does not. So a refusal here is attributable to the type alone.
+
+# The client that stamps the type gets a token carrying it
+POST https://keycloak:8443/realms/main/protocol/openid-connect/token
+[FormParams]
+grant_type: client_credentials
+client_id: ci-typed
+client_secret: ci-typed-secret
+HTTP 200
+[Captures]
+typed_token: jsonpath "$.access_token"
+[Asserts]
+jsonpath "$.token_type" == "Bearer"
+jsonpath "$.access_token" matches /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/
+
+# The client that does not stamp it gets one that is otherwise the same
+POST https://keycloak:8443/realms/main/protocol/openid-connect/token
+[FormParams]
+grant_type: client_credentials
+client_id: ci-untyped
+client_secret: ci-untyped-secret
+HTTP 200
+[Captures]
+untyped_token: jsonpath "$.access_token"
+[Asserts]
+jsonpath "$.token_type" == "Bearer"
+
+# The policy requires the profile's type, so the token carrying it is admitted
+GET {{base}}/typed/thing.json
+Authorization: Bearer {{typed_token}}
+HTTP 200
+Cache-Control: private, max-age=0, must-revalidate
+Content-Type: application/schema+json
+Link: <https://json-schema.org/draft/2020-12/schema>; rel="describedby"
+Access-Control-Allow-Origin: *
+Access-Control-Expose-Headers: Link, ETag
+[Asserts]
+header "ETag" exists
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "{{base}}/typed/thing",
+  "type": "boolean"
+}
+
+# And the one without it is refused, though it is valid in every other respect
+GET {{base}}/typed/thing.json
+Authorization: Bearer {{untyped_token}}
+HTTP 401
+Cache-Control: no-store
+Content-Type: application/problem+json
+WWW-Authenticate: Bearer realm="registry"
+Link: </self/v1/schemas/api/error>; rel="describedby"
+Access-Control-Allow-Origin: *
+Access-Control-Expose-Headers: Link, ETag
+[Captures]
+denied_body: body
+denied_schema: header "Link" regex "<([^>]+)>"
+[Asserts]
+header "ETag" not exists
+{
+  "type": "urn:sourcemeta:one:authentication-required",
+  "title": "Unauthorized",
+  "status": 401,
+  "detail": "This resource requires authentication"
+}
+
+POST {{base}}/self/v1/api/schemas/evaluate{{denied_schema}}
+```
+{{denied_body}}
+```
+HTTP 200
+[Asserts]
+jsonpath "$.valid" == true
+
+# Carrying nothing is refused identically, so the untyped token discloses
+# nothing by being refused differently
+GET {{base}}/typed/thing.json
+HTTP 401
+Cache-Control: no-store
+Content-Type: application/problem+json
+WWW-Authenticate: Bearer realm="registry"
+Link: </self/v1/schemas/api/error>; rel="describedby"
+[Asserts]
+body == {{denied_body}}
+
+# The gated listing is not enumerable without the right token either
+GET {{base}}/self/v1/api/list/typed
+Authorization: Bearer {{untyped_token}}
+HTTP 401
+Cache-Control: no-store
+Content-Type: application/problem+json
+WWW-Authenticate: Bearer realm="registry"
+Link: </self/v1/schemas/api/error>; rel="describedby"
+[Asserts]
+body == {{denied_body}}
+
+# The token that carries the type enumerates it, and the listing names the
+# policy that governs
+GET {{base}}/self/v1/api/list/typed
+Authorization: Bearer {{typed_token}}
+HTTP 200
+Cache-Control: private, max-age=0, must-revalidate
+Content-Type: application/json
+Link: </self/v1/schemas/api/list/response>; rel="describedby"
+Access-Control-Allow-Origin: *
+Access-Control-Expose-Headers: Link, ETag
+[Captures]
+listing_body: body
+listing_schema: header "Link" regex "<([^>]+)>"
+[Asserts]
+jsonpath "$.path" == "/typed"
+jsonpath "$.url" == "{{base}}/typed"
+jsonpath "$.schemas" == 1
+jsonpath "$.breadcrumb" count == 1
+jsonpath "$.breadcrumb[0].name" == "typed"
+jsonpath "$.breadcrumb[0].path" == "/typed/"
+jsonpath "$.policies" count == 1
+jsonpath "$.policies[0].name" == "typed"
+jsonpath "$.policies[0].title" == "typed"
+jsonpath "$.policies[0].type" == "jwt"
+jsonpath "$.entries" count == 1
+jsonpath "$.entries[0].name" == "thing"
+jsonpath "$.entries[0].type" == "schema"
+jsonpath "$.entries[0].path" == "/typed/thing"
+jsonpath "$.entries[0].identifier" == "{{base}}/typed/thing"
+jsonpath "$.entries[0].policies" count == 1
+jsonpath "$.entries[0].policies[0].name" == "typed"
+jsonpath "$.entries[0].policies[0].title" == "typed"
+jsonpath "$.entries[0].policies[0].type" == "jwt"
+
+POST {{base}}/self/v1/api/schemas/evaluate{{listing_schema}}
+```
+{{listing_body}}
+```
+HTTP 200
+[Asserts]
+jsonpath "$.valid" == true
+
+# A policy that requires no type is unaffected, so a provider that stamps none
+# keeps working
+GET {{base}}/machine/config.json
+Authorization: Bearer {{untyped_token}}
+HTTP 401
+Cache-Control: no-store
+Content-Type: application/problem+json
+WWW-Authenticate: Bearer realm="registry"
+[Asserts]
+body == {{denied_body}}

enterprise/e2e/auth/one.json

@@ -67,6 +67,15 @@
       "jwksUri": "https://keycloak:8443/realms/main/protocol/openid-connect/certs",
       "algorithms": [ "RS256" ]
     },
+    {
+      "type": "jwt",
+      "name": "typed",
+      "paths": [ "/typed" ],
+      "issuer": "https://keycloak:8443/realms/main",
+      "audience": "https://typed.example.com",
+      "tokenType": "at+jwt",
+      "algorithms": [ "RS256" ]
+    },
     {
       "type": "jwt",
       "name": "strict",
@@ -106,6 +115,7 @@
     "machine": { "path": "./schemas/machine" },
     "telemetry": { "path": "./schemas/telemetry" },
     "strict": { "path": "./schemas/strict" },
+    "typed": { "path": "./schemas/typed" },
     "console": { "path": "./schemas/console" }
   }
 }