providers/oauth2: create access tokens as JWT

authentik/providers/oauth2/migrations/0003_auto_20200916_2129.py

@@ -27,10 +27,6 @@ class Migration(migrations.Migration):
             field=models.TextField(
                 choices=[
                     ("code", "code (Authorization Code Flow)"),
-                    (
-                        "code_adfs",
-                        "code (ADFS Compatibility Mode, sends id_token as access_token)",
-                    ),
                     ("id_token", "id_token (Implicit Flow)"),
                     ("id_token token", "id_token token (Implicit Flow)"),
                     ("code token", "code token (Hybrid Flow)"),

authentik/providers/oauth2/migrations/0005_auto_20200920_1240.py

@@ -19,10 +19,6 @@ class Migration(migrations.Migration):
             field=models.TextField(
                 choices=[
                     ("code", "code (Authorization Code Flow)"),
-                    (
-                        "code#adfs",
-                        "code (ADFS Compatibility Mode, sends id_token as access_token)",
-                    ),
                     ("id_token", "id_token (Implicit Flow)"),
                     ("id_token token", "id_token token (Implicit Flow)"),
                     ("code token", "code token (Hybrid Flow)"),

authentik/providers/oauth2/migrations/0010_auto_20201227_1804.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.1.4 on 2020-12-27 18:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_providers_oauth2", "0009_remove_oauth2provider_response_type"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="refreshtoken",
+            name="access_token",
+            field=models.TextField(verbose_name="Access Token"),
+        ),
+    ]

authentik/providers/oauth2/models.py

@@ -84,10 +84,6 @@ class ResponseTypes(models.TextChoices):
     """Response Type required by the client."""
 
     CODE = "code", _("code (Authorization Code Flow)")
-    CODE_ADFS = (
-        "code#adfs",
-        _("code (ADFS Compatibility Mode, sends id_token as access_token)"),
-    )
     ID_TOKEN = "id_token", _("id_token (Implicit Flow)")
     ID_TOKEN_TOKEN = "id_token token", _("id_token token (Implicit Flow)")
     CODE_TOKEN = "code token", _("code token (Hybrid Flow)")
@@ -218,19 +214,17 @@ class OAuth2Provider(Provider):
     )
 
     def create_refresh_token(
-        self, user: User, scope: List[str], id_token: Optional["IDToken"] = None
+        self, user: User, scope: List[str], request: HttpRequest
     ) -> "RefreshToken":
         """Create and populate a RefreshToken object."""
         token = RefreshToken(
             user=user,
             provider=self,
-            access_token=uuid4().hex,
             refresh_token=uuid4().hex,
             expires=timezone.now() + timedelta_from_string(self.token_validity),
             scope=scope,
         )
-        if id_token:
+        token.access_token = token.create_access_token(user, request)
-            token.id_token = id_token
         return token
 
     def get_jwt_keys(self) -> List[Key]:
@@ -444,9 +438,7 @@ class IDToken:
 class RefreshToken(ExpiringModel, BaseGrantModel):
     """OAuth2 Refresh Token"""
 
-    access_token = models.CharField(
+    access_token = models.TextField(verbose_name=_("Access Token"))
-        max_length=255, unique=True, verbose_name=_("Access Token")
-    )
     refresh_token = models.CharField(
         max_length=255, unique=True, verbose_name=_("Refresh Token")
     )
@@ -485,6 +477,13 @@ class RefreshToken(ExpiringModel, BaseGrantModel):
             .decode("ascii")
         )
 
+    def create_access_token(self, user: User, request: HttpRequest) -> str:
+        """Create access token with a similar format as Okta, Keycloak, ADFS"""
+        token = self.create_id_token(user, request).to_dict()
+        token["cid"] = self.provider.client_id
+        token["uid"] = uuid4().hex
+        return self.provider.encode(token)
+
     def create_id_token(self, user: User, request: HttpRequest) -> IDToken:
         """Creates the id_token.
         See: http://openid.net/specs/openid-connect-core-1_0.html#IDToken"""

authentik/providers/oauth2/views/authorize.py

@@ -101,7 +101,7 @@ class OAuthAuthorizationParams:
         response_type = query_dict.get("response_type", "")
         grant_type = None
         # Determine which flow to use.
-        if response_type in [ResponseTypes.CODE, ResponseTypes.CODE_ADFS]:
+        if response_type in [ResponseTypes.CODE]:
             grant_type = GrantTypes.AUTHORIZATION_CODE
         elif response_type in [
             ResponseTypes.ID_TOKEN,
@@ -273,7 +273,6 @@ class OAuthFulfillmentStage(StageView):
         """Create a final Response URI the user is redirected to."""
         uri = urlsplit(self.params.redirect_uri)
         query_params = parse_qs(uri.query)
-        query_fragment = {}
 
         try:
             code = None
@@ -290,10 +289,34 @@ class OAuthFulfillmentStage(StageView):
                 query_params["state"] = [
                     str(self.params.state) if self.params.state else ""
                 ]
-            elif self.params.grant_type in [GrantTypes.IMPLICIT, GrantTypes.HYBRID]:
+
+                uri = uri._replace(query=urlencode(query_params, doseq=True))
+                return urlunsplit(uri)
+            if self.params.grant_type in [GrantTypes.IMPLICIT, GrantTypes.HYBRID]:
+                query_fragment = self.create_implicit_response(code)
+
+                uri = uri._replace(
+                    fragment=uri.fragment + urlencode(query_fragment, doseq=True),
+                )
+                return urlunsplit(uri)
+            raise OAuth2Error()
+        except OAuth2Error as error:
+            LOGGER.exception("Error when trying to create response uri", error=error)
+            raise AuthorizeError(
+                self.params.redirect_uri,
+                "server_error",
+                self.params.grant_type,
+                self.params.state,
+            )
+
+    def create_implicit_response(self, code: Optional[AuthorizationCode]) -> dict:
+        """Create implicit response's URL Fragment dictionary"""
+        query_fragment = {}
+
         token = self.provider.create_refresh_token(
             user=self.request.user,
             scope=self.params.scope,
+            request=self.request,
         )
 
         # Check if response_type must include access_token in the response.
@@ -330,9 +353,7 @@ class OAuthFulfillmentStage(StageView):
                 ResponseTypes.CODE_ID_TOKEN,
                 ResponseTypes.CODE_ID_TOKEN_TOKEN,
             ]:
-                        query_fragment["id_token"] = self.provider.encode(
+                query_fragment["id_token"] = self.provider.encode(id_token.to_dict())
-                            id_token.to_dict()
-                        )
             token.id_token = id_token
 
         # Store the token.
@@ -348,28 +369,7 @@ class OAuthFulfillmentStage(StageView):
         ).seconds
         query_fragment["state"] = self.params.state if self.params.state else ""
 
-        except OAuth2Error as error:
+        return query_fragment
-            LOGGER.exception("Error when trying to create response uri", error=error)
-            raise AuthorizeError(
-                self.params.redirect_uri,
-                "server_error",
-                self.params.grant_type,
-                self.params.state,
-            )
-
-        replace_kwargs = {}
-        if self.params.grant_type in [GrantTypes.IMPLICIT, GrantTypes.HYBRID]:
-            replace_kwargs = {
-                "fragment": uri.fragment + urlencode(query_fragment, doseq=True),
-            }
-        else:
-            replace_kwargs = {
-                "query": urlencode(query_params, doseq=True),
-            }
-
-        uri = uri._replace(**replace_kwargs)
-
-        return urlunsplit(uri)
 
 
 class AuthorizationFlowInitView(PolicyAccessView):

authentik/providers/oauth2/views/token.py

@@ -177,6 +177,7 @@ class TokenView(View):
         refresh_token = self.params.authorization_code.provider.create_refresh_token(
             user=self.params.authorization_code.user,
             scope=self.params.authorization_code.scope,
+            request=self.request,
         )
 
         if self.params.authorization_code.is_open_id:
@@ -204,13 +205,6 @@ class TokenView(View):
             "id_token": refresh_token.provider.encode(refresh_token.id_token.to_dict()),
         }
 
-        # if self.params.provider.response_type == ResponseTypes.CODE_ADFS:
-        #     # This seems to be expected by some OIDC Clients
-        #     # namely VMware vCenter. This is not documented in any OpenID or OAuth2 Standard.
-        #     # Maybe this should be a setting
-        #     # in the future?
-        #     response_dict["access_token"] = response_dict["id_token"]
-
         return response_dict
 
     def create_refresh_response_dic(self) -> Dict[str, Any]:
@@ -227,6 +221,7 @@ class TokenView(View):
         refresh_token: RefreshToken = provider.create_refresh_token(
             user=self.params.refresh_token.user,
             scope=self.params.scope,
+            request=self.request,
         )
 
         # If the Token has an id_token it's an Authentication request.