andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-31 11:32:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(action v2): add JWT and JWE payload type options (#11196)

Browse Source 
# Which Problems Are Solved

The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.

# How the Problems Are Solved

- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
  - added a `fingerprint` column
  - dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies

# Additional Changes

None

# Additional Context

closes #11061

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Livio Spring
2025-12-29 13:35:53 +00:00
committed by GitHub
co-authored by Marco A. conblem Silvan
parent 72c8f0192c
commit 791d0587aa
124 changed files with 5040 additions and 782 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/grpc/server/middleware/execution_interceptor_test.go
+216 -70
View File
@@ -1,24 +1,42 @@
package middleware
import (
"bytes"
"context"
"crypto/rand"
"crypto/rsa"
"encoding/json"
"io"
"net/http"
"net/http/httptest"
"reflect"
"testing"
"time"
"github.com/go-jose/go-jose/v4"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"google.golang.org/protobuf/encoding/protojson"
"google.golang.org/protobuf/proto"
"google.golang.org/protobuf/types/known/structpb"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/execution"
target_domain "github.com/zitadel/zitadel/internal/execution/target"
)
var (
privateKey = func() *rsa.PrivateKey {
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
return privateKey
}()
encryptionKey = func() []byte {
data, _ := crypto.PublicKeyToBytes(&privateKey.PublicKey)
return data
}()
encryptionKeyID = "encryption-key-id"
signingAlgorithm = jose.RS256
)
func newMockContentRequest(content string) proto.Message {
return &structpb.Struct{
Fields: map[string]*structpb.Value{
@@ -46,18 +64,20 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
type target struct {
reqBody execution.ContextInfo
sleep time.Duration
statusCode int
respBody interface{}
reqBody execution.ContextInfo
sleep time.Duration
statusCode int
respBody interface{}
requestVerification func(*testing.T) func([]byte, []byte) bool
}
type args struct {
ctx context.Context
executionTargets []target_domain.Target
targets []target
fullMethod string
req interface{}
executionTargets []target_domain.Target
targets []target
fullMethod string
req interface{}
getActiveSigningWebKey execution.GetActiveSigningWebKey
}
type res struct {
want interface{}
@@ -128,10 +148,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusBadRequest,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusBadRequest,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -157,10 +178,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusBadRequest,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusBadRequest,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -185,10 +207,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -212,7 +235,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
},
targets: []target{
{reqBody: newMockContextInfoRequest("/service/method", "wrong")},
{
reqBody: newMockContextInfoRequest("/service/method", "wrong"),
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
},
@@ -236,10 +262,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -263,10 +290,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -290,10 +318,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -318,9 +347,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
sleep: 0,
statusCode: http.StatusInternalServerError,
reqBody: newMockContextInfoRequest("/service/method", "content"),
sleep: 0,
statusCode: http.StatusInternalServerError,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -345,10 +375,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -373,10 +404,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -416,22 +448,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
{
reqBody: newMockContextInfoRequest("/service/method", "content1"),
respBody: newMockContentRequest("content2"),
sleep: 0,
statusCode: http.StatusBadRequest,
reqBody: newMockContextInfoRequest("/service/method", "content1"),
respBody: newMockContentRequest("content2"),
sleep: 0,
statusCode: http.StatusBadRequest,
requestVerification: validateJSONPayload,
},
{
reqBody: newMockContextInfoRequest("/service/method", "content2"),
respBody: newMockContentRequest("content3"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content2"),
respBody: newMockContentRequest("content3"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -470,22 +505,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
{
reqBody: newMockContextInfoRequest("/service/method", "content1"),
respBody: newMockContentRequest("content2"),
sleep: 5 * time.Second,
statusCode: http.StatusBadRequest,
reqBody: newMockContextInfoRequest("/service/method", "content1"),
respBody: newMockContentRequest("content2"),
sleep: 5 * time.Second,
statusCode: http.StatusBadRequest,
requestVerification: validateJSONPayload,
},
{
reqBody: newMockContextInfoRequest("/service/method", "content2"),
respBody: newMockContentRequest("content3"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
reqBody: newMockContextInfoRequest("/service/method", "content2"),
respBody: newMockContentRequest("content3"),
sleep: 5 * time.Second,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
@@ -494,6 +532,70 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
wantErr: true,
},
},
{
"payload JWT, ok",
args{
ctx: context.Background(),
fullMethod: "/service/method",
executionTargets: []target_domain.Target{
{
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
TargetID: "target",
TargetType: target_domain.TargetTypeWebhook,
Timeout: time.Minute,
InterruptOnError: true,
PayloadType: target_domain.PayloadTypeJWT,
},
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJWTPayload,
},
},
req: newMockContentRequest("content"),
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
},
res{
want: newMockContentRequest("content"),
},
},
{
"payload JWE, ok",
args{
ctx: context.Background(),
fullMethod: "/service/method",
executionTargets: []target_domain.Target{
{
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
TargetID: "target",
TargetType: target_domain.TargetTypeWebhook,
Timeout: time.Minute,
InterruptOnError: true,
PayloadType: target_domain.PayloadTypeJWE,
EncryptionKey: encryptionKey,
EncryptionKeyID: encryptionKeyID,
},
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJWEPayload,
},
},
req: newMockContentRequest("content"),
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
},
res{
want: newMockContentRequest("content"),
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@@ -504,6 +606,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
target.sleep,
target.statusCode,
target.respBody,
target.requestVerification(t),
)
tt.args.executionTargets[i].Endpoint = url
@@ -516,6 +619,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
tt.args.fullMethod,
tt.args.req,
nil,
tt.args.getActiveSigningWebKey,
)
if tt.res.wantErr {
@@ -537,6 +641,7 @@ func testServerCall(
sleep time.Duration,
statusCode int,
respBody interface{},
requestVerification func(expected, sent []byte) bool,
) (string, func()) {
handler := func(w http.ResponseWriter, r *http.Request) {
data, err := json.Marshal(reqBody)
@@ -551,7 +656,7 @@ func testServerCall(
return
}
if !reflect.DeepEqual(data, sentBody) {
if !requestVerification(data, sentBody) {
http.Error(w, "error", http.StatusInternalServerError)
return
}
@@ -580,6 +685,45 @@ func testServerCall(
return server.URL, server.Close
}
func mockGetActiveSigningWebKey() func(ctx context.Context) (*jose.JSONWebKey, error) {
return func(ctx context.Context) (*jose.JSONWebKey, error) {
return &jose.JSONWebKey{
Key: privateKey,
Algorithm: string(signingAlgorithm),
Use: "sig",
}, nil
}
}
func validateJSONPayload(t *testing.T) func(expected, sent []byte) bool {
return bytes.Equal
}
func validateJWTPayload(t *testing.T) func(expected, sent []byte) bool {
return func(expected, sent []byte) bool {
jws, err := jose.ParseSigned(string(sent), []jose.SignatureAlgorithm{jose.RS256})
require.NoError(t, err)
payload, err := jws.Verify(privateKey.Public())
require.NoError(t, err)
return bytes.Equal(expected, payload)
}
}
func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
return func(expected, sent []byte) bool {
parsedJWE, err := jose.ParseEncrypted(string(sent), []jose.KeyAlgorithm{jose.RSA_OAEP_256, jose.ECDH_ES_A256KW}, []jose.ContentEncryption{jose.A256GCM})
if err != nil {
return false
}
require.Equal(t, encryptionKeyID, parsedJWE.Header.KeyID)
require.Equal(t, "JWT", parsedJWE.Header.ExtraHeaders[jose.HeaderContentType].(string))
decryptedJWS, err := parsedJWE.Decrypt(privateKey)
require.NoError(t, err)
return validateJWTPayload(t)(expected, decryptedJWS)
}
}
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
type target struct {
reqBody execution.ContextInfo
@@ -699,6 +843,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
target.sleep,
target.statusCode,
target.respBody,
validateJSONPayload(t),
)
tt.args.executionTargets[i].Endpoint = url
@@ -712,6 +857,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
tt.args.req,
tt.args.resp,
nil,
mockGetActiveSigningWebKey(),
)
if tt.res.wantErr {