Merge branch 'main' of github.com:vmware-tanzu/pinniped into active-directory-identity-provider

pkg/oidcclient/login.go

@@ -28,6 +28,7 @@ import (
 	"golang.org/x/term"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	supervisoroidc "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	"go.pinniped.dev/internal/httputil/httperr"
 	"go.pinniped.dev/internal/httputil/securityheader"
 	"go.pinniped.dev/internal/oidc/provider"
@@ -52,11 +53,6 @@ const (
 	// we set this to be relatively long.
 	overallTimeout = 90 * time.Minute
 
-	supervisorAuthorizeUpstreamNameParam      = "pinniped_idp_name"
-	supervisorAuthorizeUpstreamTypeParam      = "pinniped_idp_type"
-	supervisorAuthorizeUpstreamUsernameHeader = "Pinniped-Username"
-	supervisorAuthorizeUpstreamPasswordHeader = "Pinniped-Password" // nolint:gosec // this is not a credential
-
 	defaultLDAPUsernamePrompt = "Username: "
 	defaultLDAPPasswordPrompt = "Password: "
 
@@ -237,8 +233,8 @@ func WithRequestAudience(audience string) Option {
 // WithCLISendingCredentials causes the login flow to use CLI-based prompts for username and password and causes the
 // call to the Issuer's authorize endpoint to be made directly (no web browser) with the username and password on custom
 // HTTP headers. This is only intended to be used when the issuer is a Pinniped Supervisor and the upstream identity
-// provider type supports this style of authentication. Currently this is supported by LDAPIdentityProviders and
-// ActiveDirectoryIdentityProviders.
+// provider type supports this style of authentication. Currently, this is supported by LDAPIdentityProviders, ActiveDirectoryIdentityProviders,
+// and by OIDCIdentityProviders which optionally enable the resource owner password credentials grant flow.
 // This should never be used with non-Supervisor issuers because it will send the user's password to the authorization
 // endpoint as a custom header, which would be ignored but could potentially get logged somewhere by the issuer.
 func WithCLISendingCredentials() Option {
@@ -389,8 +385,12 @@ func (h *handlerState) baseLogin() (*oidctypes.Token, error) {
 		h.pkce.Method(),
 	}
 	if h.upstreamIdentityProviderName != "" {
-		authorizeOptions = append(authorizeOptions, oauth2.SetAuthURLParam(supervisorAuthorizeUpstreamNameParam, h.upstreamIdentityProviderName))
-		authorizeOptions = append(authorizeOptions, oauth2.SetAuthURLParam(supervisorAuthorizeUpstreamTypeParam, h.upstreamIdentityProviderType))
+		authorizeOptions = append(authorizeOptions,
+			oauth2.SetAuthURLParam(supervisoroidc.AuthorizeUpstreamIDPNameParamName, h.upstreamIdentityProviderName),
+		)
+		authorizeOptions = append(authorizeOptions,
+			oauth2.SetAuthURLParam(supervisoroidc.AuthorizeUpstreamIDPTypeParamName, h.upstreamIdentityProviderType),
+		)
 	}
 
 	// Choose the appropriate authorization and authcode exchange strategy.
@@ -445,8 +445,8 @@ func (h *handlerState) cliBasedAuth(authorizeOptions *[]oauth2.AuthCodeOption) (
 	if err != nil {
 		return nil, fmt.Errorf("could not build authorize request: %w", err)
 	}
-	authReq.Header.Set(supervisorAuthorizeUpstreamUsernameHeader, username)
-	authReq.Header.Set(supervisorAuthorizeUpstreamPasswordHeader, password)
+	authReq.Header.Set(supervisoroidc.AuthorizeUsernameHeaderName, username)
+	authReq.Header.Set(supervisoroidc.AuthorizePasswordHeaderName, password)
 	authRes, err := h.httpClient.Do(authReq)
 	if err != nil {
 		return nil, fmt.Errorf("authorization response error: %w", err)

pkg/oidcclient/login_test.go

@@ -238,7 +238,7 @@ func TestLogin(t *testing.T) { // nolint:gocyclo
 	formPostProviderMux.HandleFunc("/.well-known/openid-configuration", discoveryHandler(formPostSuccessServer, []string{"query", "form_post"}))
 	formPostProviderMux.HandleFunc("/token", tokenHandler)
 
-	defaultDiscoveryResponse := func(req *http.Request) (*http.Response, error) { // nolint:unparam
+	defaultDiscoveryResponse := func(req *http.Request) (*http.Response, error) {
 		// Call the handler function from the test server to calculate the response.
 		handler, _ := providerMux.Handler(req)
 		recorder := httptest.NewRecorder()
@@ -246,7 +246,7 @@ func TestLogin(t *testing.T) { // nolint:gocyclo
 		return recorder.Result(), nil
 	}
 
-	defaultLDAPTestOpts := func(t *testing.T, h *handlerState, authResponse *http.Response, authError error) error { // nolint:unparam
+	defaultLDAPTestOpts := func(t *testing.T, h *handlerState, authResponse *http.Response, authError error) error {
 		h.generateState = func() (state.State, error) { return "test-state", nil }
 		h.generatePKCE = func() (pkce.Code, error) { return "test-pkce", nil }
 		h.generateNonce = func() (nonce.Nonce, error) { return "test-nonce", nil }