use our oidc client

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

services/proxy/pkg/middleware/oidc_auth.go

@@ -14,7 +14,6 @@ import (
 	"github.com/owncloud/ocis/v2/services/proxy/pkg/config"
 
 	"github.com/MicahParks/keyfunc"
-	gOidc "github.com/coreos/go-oidc/v3/oidc"
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/pkg/errors"
 	"github.com/shamaton/msgpack/v2"
@@ -28,11 +27,6 @@ const (
 	_bearerPrefix        = "Bearer "
 )
 
-// OIDCProvider used to mock the oidc provider during tests
-type OIDCProvider interface {
-	UserInfo(ctx context.Context, ts oauth2.TokenSource) (*gOidc.UserInfo, error)
-}
-
 // NewOIDCAuthenticator returns a ready to use authenticator which can handle OIDC authentication.
 func NewOIDCAuthenticator(opts ...Option) *OIDCAuthenticator {
 	options := newOptions(opts...)
@@ -44,10 +38,9 @@ func NewOIDCAuthenticator(opts ...Option) *OIDCAuthenticator {
 		DefaultTokenCacheTTL:    options.DefaultAccessTokenTTL,
 		HTTPClient:              options.HTTPClient,
 		OIDCIss:                 options.OIDCIss,
-		ProviderFunc:            options.OIDCProviderFunc,
+		oidcClient:              options.OIDCClient,
 		JWKSOptions:             options.JWKS,
 		AccessTokenVerifyMethod: options.AccessTokenVerifyMethod,
-		providerLock:            &sync.Mutex{},
 		jwksLock:                &sync.Mutex{},
 	}
 }
@@ -60,13 +53,10 @@ type OIDCAuthenticator struct {
 	userInfoCache           store.Store
 	sessionLookupCache      store.Store
 	DefaultTokenCacheTTL    time.Duration
-	ProviderFunc            func() (OIDCProvider, error)
+	oidcClient              oidc.OIDCProvider
 	AccessTokenVerifyMethod string
 	JWKSOptions             config.JWKS
 
-	providerLock *sync.Mutex
-	provider     OIDCProvider
-
 	jwksLock *sync.Mutex
 	JWKS     *keyfunc.JWKS
 }
@@ -108,7 +98,7 @@ func (m *OIDCAuthenticator) getClaims(token string, req *http.Request) (map[stri
 		AccessToken: token,
 	}
 
-	userInfo, err := m.getProvider().UserInfo(
+	userInfo, err := m.oidcClient.UserInfo(
 		context.WithValue(req.Context(), oauth2.HTTPClient, m.HTTPClient),
 		oauth2.StaticTokenSource(oauth2Token),
 	)
@@ -252,26 +242,6 @@ func (m *OIDCAuthenticator) getKeyfunc() *keyfunc.JWKS {
 	return m.JWKS
 }
 
-func (m *OIDCAuthenticator) getProvider() OIDCProvider {
-	m.providerLock.Lock()
-	defer m.providerLock.Unlock()
-	if m.provider == nil {
-		// Lazily initialize a provider
-
-		// provider needs to be cached as when it is created
-		// it will fetch the keys from the issuer using the .well-known
-		// endpoint
-		provider, err := m.ProviderFunc()
-		if err != nil {
-			m.Logger.Error().Err(err).Msg("could not initialize oidcAuth provider")
-			return nil
-		}
-
-		m.provider = provider
-	}
-	return m.provider
-}
-
 // Authenticate implements the authenticator interface to authenticate requests via oidc auth.
 func (m *OIDCAuthenticator) Authenticate(r *http.Request) (*http.Request, bool) {
 	// there is no bearer token on the request,
@@ -282,10 +252,6 @@ func (m *OIDCAuthenticator) Authenticate(r *http.Request) (*http.Request, bool)
 		return nil, false
 	}
 
-	if m.getProvider() == nil {
-		return nil, false
-	}
-
 	// Force init of jwks keyfunc if needed (contacts the .well-known and jwks endpoints on first call)
 	if m.AccessTokenVerifyMethod == config.AccessTokenVerificationJWT && m.getKeyfunc() == nil {
 		return nil, false

services/proxy/pkg/middleware/options.go

@@ -6,6 +6,7 @@ import (
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/oidc"
 	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
 	storesvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/store/v0"
 	"github.com/owncloud/ocis/v2/services/proxy/pkg/config"
@@ -34,7 +35,7 @@ type Options struct {
 	// SettingsRoleService for the roles API in settings
 	SettingsRoleService settingssvc.RoleService
 	// OIDCProviderFunc to lazily initialize an oidc provider, must be set for the oidc_auth middleware
-	OIDCProviderFunc func() (OIDCProvider, error)
+	OIDCClient oidc.OIDCProvider
 	// OIDCIss is the oidcAuth-issuer
 	OIDCIss string
 	// RevaGatewayClient to send requests to the reva gateway
@@ -113,10 +114,10 @@ func SettingsRoleService(rc settingssvc.RoleService) Option {
 	}
 }
 
-// OIDCProviderFunc provides a function to set the the oidc provider function option.
-func OIDCProviderFunc(f func() (OIDCProvider, error)) Option {
+// OIDCClient provides a function to set the the oidc client option.
+func OIDCClient(val oidc.OIDCProvider) Option {
 	return func(o *Options) {
-		o.OIDCProviderFunc = f
+		o.OIDCClient = val
 	}
 }