Add OIDCGWClient to deployment.yaml

.dockerignore

@@ -5,7 +5,6 @@ README.md
 .git/
 node_modules/
 .drone.yml
-deployment.yaml
 
 # Editor directories and files
 .vscode/*

app.js

@@ -9,31 +9,61 @@ async function run() {
 
     const issuer = await Issuer.discover(process.env.OIDC_GATEWAY_URI);
     console.log('Discovered issuer %s %O', issuer.issuer, issuer.metadata);
-
     const client = new issuer.Client({
         client_id: process.env.OIDC_CLIENT_ID,
+        client_secret: process.env.OIDC_CLIENT_SECRET,
         redirect_uris: [process.env.OIDC_REDIRECT_URIS],
-        response_types: ['id_token'],
+        response_types: ['code'],
         // id_token_signed_response_alg (default "RS256")
     })
-    const nonce = generators.nonce();
+    const code_verifier = generators.codeVerifier();
+    const code_challenge = generators.codeChallenge(code_verifier);
+
 
     app.get('/', async function (req, res) {
         let url = client.authorizationUrl({
             redirect_uri: process.env.CLIENT_URL + '/cb',
-            scope: 'openid',
+            scope: 'openid profile offline_access',
-            response_mode: 'form_post',
+            response_type: 'code',
-            nonce,
+            code_challenge,
+            code_challenge_method: 'S256',
         });
 
         res.redirect(url);
     });
-    app.post('/cb', async function (req, res) {
+
-        const params = client.callbackParams(req);
+    app.get('/cb', async function (req, res) {
-        const tokenSet = await client.callback(process.env.CLIENT_URL + '/cb', params, {nonce});
+         const params = client.callbackParams(req);
-        console.log('received and validated tokens %j', tokenSet);
+        const tokenSet = await client.callback(process.env.CLIENT_URL + '/cb', params,{ code_verifier });
-        console.log('validated ID Token claims %j', tokenSet.claims());
+        const userinfo = await client.userinfo(tokenSet.access_token);
-        res.send(tokenSet.claims());
+        res.send(
+            `
+                <code>${JSON.stringify(userinfo)}</code>
+                <code>${JSON.stringify(tokenSet)}</code>
+                <a href="/refresh/${tokenSet.refresh_token}">refresh</a>
+                <a href="/access/${tokenSet.access_token}">access</a>
+                 `
+        )
+    });
+
+    app.get('/access/:token', async function (req, res) {
+        const access = await client.userinfo(req.params.token)
+        res.send(
+            `
+                <code>${JSON.stringify(access)}</code>
+                <a href="/access/${req.params.token}">access</a>
+                 `
+        )
+    });
+
+    app.get('/refresh/:token', async function (req, res) {
+        const refresh = await client.refresh(req.params.token)
+        res.send(
+            `
+                <code>${JSON.stringify(refresh)}</code>
+                <a href="/refresh/${refresh.refresh_token}">refresh</a>
+                 `
+        )
     });
 
     app.listen(3000);

deployment.yaml

@@ -1,4 +1,27 @@
 ---
+apiVersion: codemowers.io/v1alpha1
+kind: OIDCGWClient
+metadata:
+  name: authorization-code-sample-client
+spec:
+  uri: 'https://client-gab7y.codemowers.ee/'
+  redirectUris:
+    - 'https://client-gab7y.codemowers.ee/cb'
+  #  allowedGroups: # if no groups are set, everyone is allowed
+  #    - 'codemowers:users'
+  grantTypes:
+    - 'authorization_code'
+    - 'refresh_token' # might be supported by some implementations
+  responseTypes:
+    - 'code'
+  #    - 'code id_token' # might be needed in some implementations
+  availableScopes:
+    - 'openid'
+    - 'profile'
+    - 'offline_access'
+  tokenEndpointAuthMethod: 'client_secret_basic'
+  pkce: true
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -63,4 +86,5 @@ spec:
               value: https://client-gab7y.codemowers.ee
           envFrom:
             - secretRef:
-                name: oidc-client-implicit-id-token-sample-client-owner-secrets
+                name: oidc-client-authorization-code-sample-client-owner-secrets
+