mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-03-25 23:23:04 -04:00
c84cbd56a1
Add support for OIDC workload identity federation.
Add ID_TOKEN_SIGNING_ALGORITHM, ID_TOKEN_SIGNING_PRIVATE_KEY_FILE, and
ID_TOKEN_EXPIRATION_TIME settings to settings.actions to allow for admin
configuration of this functionality.
Add OIDC endpoints (/.well-known/openid-configuration and /.well-known/keys)
underneath the "/api/actions" route.
Add a token generation endpoint (/_apis/pipelines/workflows/{run_id}/idtoken)
underneath the "/api/actions" route.
Depends on: https://code.forgejo.org/forgejo/runner/pulls/1232
Docs PR: https://codeberg.org/forgejo/docs/pulls/1667
Signed-off-by: Mario Minardi <mminardi@shaw.ca>
## Checklist
The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).
### Tests
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10481
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Mario Minardi <mminardi@shaw.ca>
Co-committed-by: Mario Minardi <mminardi@shaw.ca>
71 lines
2.5 KiB
Go
71 lines
2.5 KiB
Go
// Copyright 2025 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package integration
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"forgejo.org/modules/setting"
|
|
"forgejo.org/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type jwksResponse map[string][]map[string]string
|
|
|
|
type openIDConfigurationResponse struct {
|
|
Issuer string `json:"issuer"`
|
|
JwksURI string `json:"jwks_uri"`
|
|
SubjectTypesSupported []string `json:"subject_types_supported"`
|
|
ResponseTypesSupported []string `json:"response_types_supported"`
|
|
ClaimsSupported []string `json:"claims_supported"`
|
|
IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported"`
|
|
ScopesSupported []string `json:"scopes_supported"`
|
|
}
|
|
|
|
func prepareTestEnvActionsOIDC(t *testing.T) func() {
|
|
t.Helper()
|
|
f := tests.PrepareTestEnv(t, 1)
|
|
return f
|
|
}
|
|
|
|
func TestActionsOIDC(t *testing.T) {
|
|
defer prepareTestEnvActionsOIDC(t)()
|
|
|
|
// get config information
|
|
req := NewRequest(t, "GET", "/api/actions/.well-known/openid-configuration")
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
var config openIDConfigurationResponse
|
|
DecodeJSON(t, resp, &config)
|
|
assert.Equal(t, setting.AppURL+"api/actions", config.Issuer)
|
|
assert.Equal(t, setting.AppURL+"api/actions/.well-known/keys", config.JwksURI)
|
|
assert.Equal(t, []string{"public"}, config.SubjectTypesSupported)
|
|
assert.Equal(t, []string{"id_token"}, config.ResponseTypesSupported)
|
|
assert.Equal(t, []string{"sub", "aud", "exp", "iat", "iss", "nbf", "actor", "base_ref", "event_name", "head_ref", "ref", "ref_protected", "ref_type", "repository", "repository_owner", "run_attempt", "run_id", "run_number", "sha", "workflow", "workflow_ref"}, config.ClaimsSupported)
|
|
assert.Equal(t, []string{"RS256"}, config.IDTokenSigningAlgValuesSupported)
|
|
assert.Equal(t, []string{"openid"}, config.ScopesSupported)
|
|
|
|
// get JWKs information
|
|
req = NewRequest(t, "GET", config.JwksURI)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
var jwks jwksResponse
|
|
DecodeJSON(t, resp, &jwks)
|
|
require.Len(t, jwks["keys"], 1)
|
|
key := jwks["keys"][0]
|
|
require.Equal(t, "RSA", key["kty"])
|
|
require.Equal(t, "RS256", key["alg"])
|
|
require.Equal(t, "sig", key["use"])
|
|
|
|
// Basic validation of returned exponents
|
|
if _, err := base64.RawURLEncoding.DecodeString(key["e"]); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if _, err := base64.RawURLEncoding.DecodeString(key["n"]); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|