add iss check to oidc auth resp flow

Author: allisonlarson

api/acl.go

@@ -1232,6 +1232,8 @@ type ACLOIDCCompleteAuthRequest struct {
 	State       string
 	Code        string
 
+	Iss string
+
 	// RedirectURI is the URL that authorization should redirect to. This is a
 	// required parameter.
 	RedirectURI string

command/login.go

@@ -256,6 +256,7 @@ func (l *LoginCommand) loginOIDC(ctx context.Context, client *api.Client) (*api.
 		ClientNonce:    callbackServer.Nonce(),
 		Code:           req.Code,
 		State:          req.State,
+		Iss:            req.Iss,
 	}
 
 	token, _, err := client.ACLAuth().CompleteAuth(&cbArgs, nil)

lib/auth/oidc/server.go

@@ -87,6 +87,7 @@ func (s *CallbackServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		State:       q.Get("state"),
 		ClientNonce: s.clientNonce,
 		Code:        q.Get("code"),
+		Iss:         q.Get("iss"),
 	}
 
 	// Send our result. We don't block here because the channel should be

nomad/acl_endpoint.go

@@ -2767,6 +2767,20 @@ func (a *ACL) OIDCCompleteAuth(
 		return fmt.Errorf("failed to generate OIDC provider: %v", err)
 	}
 
+	// Check if the OIDC provider requires the `iss` parameter to be
+	// validated
+	providerMetadata := struct {
+		AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported"`
+	}{}
+	if err := oidcProvider.Claims(&providerMetadata); err != nil {
+		return fmt.Errorf("failed to retrieve OIDC provider metadata: %v", err)
+	}
+	if providerMetadata.AuthorizationResponseIssParameterSupported {
+		if args.Iss == "" || args.Iss != authMethod.Config.OIDCDiscoveryURL {
+			return structs.NewErrRPCCodedf(http.StatusBadRequest, "invalid or missing iss parameter")
+		}
+	}
+
 	// Retrieve the request generated in OIDCAuthURL()
 	oidcReq := a.oidcRequestCache.LoadAndDelete(args.ClientNonce) // I am so done with this NONCENSE
 	if oidcReq == nil {

nomad/structs/acl.go

@@ -2350,6 +2350,7 @@ type ACLOIDCCompleteAuthRequest struct {
 	ClientNonce string
 	State       string
 	Code        string
+	Iss         string
 
 	// RedirectURI is the URL that authorization should redirect to. This is a
 	// required parameter.