Audience key versions

README.md

@@ -134,6 +134,22 @@ Create a new job:
 - URL: use the hubauth-int URL: `<URL>/cron`
 
 
+## Enabling Biscuit
+
+To use biscuit tokens instead of bearers, configure the following:
+
+### In Security > Secret manager
+
+Create new secret 
+- HUBAUTH_BISCUIT_ROOT_PRIVKEY: a base64 encoded p256 EC private key
+
+### In variables
+
+Add a new variable
+- TOKEN_TYPE: `Biscuit`
+- BISCUIT_ROOT_PRIVKEY:  set to the resource ID from `HUBAUTH_BISCUIT_ROOT_PRIVKEY`
+
+
 ## Hubauth CLI
 
 Configure gcloud auth application-default with the following command, and follow the browser instructions:

cloudbuild.yaml

@@ -17,6 +17,8 @@ steps:
     '--image', 'gcr.io/$PROJECT_ID/$_APP:$BUILD_ID',
     '--region', '$_DEPLOY_REGION_PRIMARY',
     '--update-env-vars', 'BUILD_REPO=$REPO_NAME,BUILD_REV=$COMMIT_SHA',
+    '--command', '/app/hubauth-ext',
+    '--allow-unauthenticated'
   ]
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
   waitFor: ['build']
@@ -27,6 +29,8 @@ steps:
     '--image', 'gcr.io/$PROJECT_ID/$_APP:$BUILD_ID',
     '--region', '$_DEPLOY_REGION_FALLBACK',
     '--update-env-vars', 'BUILD_REPO=$REPO_NAME,BUILD_REV=$COMMIT_SHA',
+    '--command', '/app/hubauth-ext',
+    '--allow-unauthenticated'
   ]
 - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
   waitFor: ['build']
@@ -37,6 +41,7 @@ steps:
     '--image', 'gcr.io/$PROJECT_ID/$_APP:$BUILD_ID',
     '--region', '$_DEPLOY_REGION_PRIMARY',
     '--update-env-vars', 'BUILD_REPO=$REPO_NAME,BUILD_REV=$COMMIT_SHA',
+    '--command', '/app/hubauth-int',
   ]
 substitutions:
     _APP: hubauth

cmd/hubauth-ext/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log"
 	"net/http"
@@ -15,6 +16,7 @@ import (
 	"github.com/flynn/hubauth/pkg/datastore"
 	"github.com/flynn/hubauth/pkg/httpapi"
 	"github.com/flynn/hubauth/pkg/idp"
+	"github.com/flynn/hubauth/pkg/idp/token"
 	"github.com/flynn/hubauth/pkg/kmssign"
 	"github.com/flynn/hubauth/pkg/rp/google"
 	"go.opencensus.io/plugin/ochttp"
@@ -65,27 +67,68 @@ func main() {
 		if err != nil {
 			log.Fatalf("failed to access secret version for %s: %s", name, err)
 		}
-		return result.Payload.String()
+
+		// Payload.String() would return a json encoded version of the secret: {"data": "..."}
+		// the actual secret is in Data.
+		return string(result.Payload.Data)
+	}
+
+	forcedAudienceKeyVersions := new(kmssign.ForcedAudiencesKeyVersion)
+	// AUDIENCE_KEYS is a env variable containing a serialized json object, holding tuples of audienceURL: keyVersion
+	// it allows to specify a different key to use for some audience.
+	// example:
+	// {
+	//   "https://audience.url": "projects/PROJECT/locations/KMS_LOCATION/keyRings/KMS_KEYRING/cryptoKeys/AUDIENCE_NAME/cryptoKeyVersions/VERSION",
+	//   "https://another.audience.url": "projects/PROJECT/locations/KMS_LOCATION/keyRings/KMS_KEYRING/cryptoKeys/AUDIENCE_NAME/cryptoKeyVersions/VERSION"
+	// }
+	if keys := os.Getenv("AUDIENCE_KEYS"); keys != "" {
+		if err := json.Unmarshal([]byte(keys), forcedAudienceKeyVersions); err != nil {
+			log.Fatalf("invalid audience keys: %v", err)
+		}
+	}
+
+	audienceKeyNamer := kmssign.AudienceKeyNameFunc(*forcedAudienceKeyVersions, os.Getenv("PROJECT_ID"), os.Getenv("KMS_LOCATION"), os.Getenv("KMS_KEYRING"))
+
+	var accessTokenBuilder token.AccessTokenBuilder
+	var rootPubKey []byte
+	tokenType, exists := os.LookupEnv("TOKEN_TYPE")
+	if !exists {
+		tokenType = "Bearer"
+	}
+	switch tokenType {
+	case "Bearer":
+		accessTokenBuilder = token.NewBearerBuilder(kmsClient, audienceKeyNamer)
+	case "Biscuit":
+		biscuitKey, err := token.DecodeB64PrivateKey(secret("BISCUIT_ROOT_PRIVKEY"))
+		if err != nil {
+			log.Fatalf("failed to initialize biscuit keypair: %v", err)
+		}
+
+		rootPubKey = biscuitKey.Public().Bytes()
+		accessTokenBuilder = token.NewBiscuitBuilder(kmsClient, audienceKeyNamer, biscuitKey)
+	default:
+		log.Fatalf("invalid TOKEN_TYPE, must be one of: Bearer, Biscuit")
 	}
 
 	log.Fatal(http.ListenAndServe(":"+httpPort, &ochttp.Handler{
 		Propagation: &propagation.HTTPFormat{},
 		Handler: httpapi.New(httpapi.Config{
-			IdP: idp.New(datastore.New(dsClient),
+			IdP: idp.New(
+				datastore.New(dsClient),
 				google.New(
 					os.Getenv("RP_GOOGLE_CLIENT_ID"),
 					os.Getenv("RP_GOOGLE_CLIENT_SECRET"),
 					os.Getenv("BASE_URL")+"/rp/google",
 				),
-				kmsClient,
 				[]byte(secret("CODE_KEY_SECRET")),
 				refreshKey,
-				idp.AudienceKeyNameFunc(os.Getenv("PROJECT_ID"), os.Getenv("KMS_LOCATION"), os.Getenv("KMS_KEYRING")),
+				accessTokenBuilder,
 			),
 			CookieKey:  []byte(secret("COOKIE_KEY_SECRET")),
 			ProjectID:  os.Getenv("PROJECT_ID"),
 			Repository: fmt.Sprintf("https://source.developers.google.com/p/%s/r/%s", os.Getenv("PROJECT_ID"), os.Getenv("BUILD_REPO")),
 			Revision:   os.Getenv("BUILD_REV"),
+			PublicKey:  rootPubKey,
 		}),
 	},
 	))

go.mod

@@ -9,13 +9,14 @@ require (
 	github.com/alecthomas/kong v0.2.12
 	github.com/aws/aws-sdk-go v1.34.6 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
+	github.com/flynn/biscuit-go v0.0.0-20201015081742-15d7d351f345
 	github.com/golang/protobuf v1.4.3
 	github.com/googleapis/gax-go/v2 v2.0.5
 	github.com/jedib0t/go-pretty/v6 v6.0.5
 	github.com/stretchr/testify v1.6.1
 	go.opencensus.io v0.22.5
 	go.uber.org/zap v1.16.0
-	golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de
+	golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0
 	golang.org/x/exp/errors v0.0.0-20200513190911-00229845015e
 	golang.org/x/net v0.0.0-20201209123823-ac852fbbde11
 	golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5