Guidence on OKTA access token fetch

[hixichen]

Use Case

Would like to use this plugin to configure okta as provider for oauth2.0

Describe the Solution You Would Like

Would like to use this plugin to configure okta oauth2.0 with private_key_jwt, client_credentials for access token

Describe Alternatives You've Considered

N/A

Additional Context

For okta, https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/

The private_key_jwt client authentication method is the only supported method for OAuth service apps that want to get access tokens with Okta scopes.

# 1. Enable the plugin
vault secrets enable -path=oauth2 oauthapp

# 2. Configure the server
vault write oauth2/servers/okta \
    provider="odic" \
    token_endpoint="https://your-org.okta.com/oauth2/v1/token" \
    token_endpoint_auth_method="private_key_jwt" \
    client_id="your-client-id" \
    client_private_key=@private.pem

# 3. Configure the client
vault write oauth2/self/okta-m2m \
    server="okta" \
    grant_type="client_credentials" \
    scopes="okta.apps.read" \
    audience="https://your-org.okta.com/oauth2/v1/token"

# 4. Get a token
vault read oauth2/creds/okta-m2m


Error writing data to oauth2/self/okta-m2m: Error making API request.
URL: PUT http://127.0.0.1:8200/v1/oauth2/self/okta-m2m
Code: 400. Errors:
* client credentials flow failed: missing client secret in configuration

[hixichen]

package main

import (
	"context"
	"crypto/rsa"
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"io"
	"log"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"golang.org/x/oauth2/jws"
)

// OktaCredentials holds the configuration for token generation
type OktaCredentials struct {
	ClientID     string
	PrivateKey   *rsa.PrivateKey
	OktaDomain   string
	Scopes       []string
	TokenURL     string
}

// ErrorResponse represents Okta's error response
type ErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description"`
}

// Token represents the OAuth token response
type Token struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	ExpiresIn   int    `json:"expires_in"`
}

func main() {
	// Read private key from file
	privateKeyPEM, err := os.ReadFile("your-private.pem")
	if err != nil {
		log.Fatalf("Failed to read private key file: %v", err)
	}

	// Parse private key
	privKey, err := parsePrivateKey(privateKeyPEM)
	if err != nil {
		log.Fatalf("Failed to parse private key: %v", err)
	}

	// Create credentials configuration
	creds := &OktaCredentials{
		ClientID:   "0oxxxxxxxx", // Your client ID
		PrivateKey: privKey,
		OktaDomain: "xxxxx.okta.com",
		Scopes:     []string{"okta.groups.manage", "okta.groups.read", "okta.orgs.read", "okta.orgs.manage"},
	}

	// Set TokenURL based on domain
	creds.TokenURL = fmt.Sprintf("https://%s/oauth2/v1/token", creds.OktaDomain)

	// Generate token
	ctx := context.Background()
	token, err := creds.Token(ctx)
	if err != nil {
		log.Fatalf("Failed to get token: %v", err)
	}

	fmt.Printf("Access Token: %s\n", token.AccessToken)
	fmt.Printf("Token Type: %s\n", token.TokenType)
	fmt.Printf("Expires In: %d seconds\n", token.ExpiresIn)
}

// createClientAssertion creates a signed JWT assertion for the token request
func (c *OktaCredentials) createClientAssertion() (string, error) {
	header := &jws.Header{
		Algorithm: "RS256",
		Typ:      "JWT",
		// KeyID: "your-key-id",  // Optional: if you have multiple keys
	}

	now := time.Now()
	claims := &jws.ClaimSet{
		Iss: c.ClientID,
		Sub: c.ClientID,
		Aud: c.TokenURL,
		Iat: now.Unix(),
		Exp: now.Add(time.Minute * 5).Unix(),
	}

	// Encode the JWT
	return jws.Encode(header, claims, c.PrivateKey)
}

// Token generates an OAuth2 token using client credentials flow
func (c *OktaCredentials) Token(ctx context.Context) (*Token, error) {
	// Generate JWT assertion
	assertion, err := c.createClientAssertion()
	if err != nil {
		return nil, fmt.Errorf("failed to create client assertion: %w", err)
	}

	// Prepare form data
	data := url.Values{}
	data.Set("grant_type", "client_credentials")
	data.Set("scope", strings.Join(c.Scopes, " "))
	data.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
	data.Set("client_assertion", assertion)

	// Create request
	req, err := http.NewRequestWithContext(ctx, "POST", c.TokenURL, strings.NewReader(data.Encode()))
	if err != nil {
		return nil, fmt.Errorf("failed to create request: %w", err)
	}

	req.Header.Add("Accept", "application/json")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	// Send request
	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("failed to send request: %w", err)
	}
	defer resp.Body.Close()

	// Read response body
	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("failed to read response body: %w", err)
	}

	// Log response for debugging
	log.Printf("Response Status: %d", resp.StatusCode)
	log.Printf("Response Body: %s", string(body))

	// Check response status
	if resp.StatusCode != http.StatusOK {
		// Try to parse error response
		var errResp ErrorResponse
		if err := json.Unmarshal(body, &errResp); err == nil {
			return nil, fmt.Errorf("authentication failed: %s - %s", errResp.Error, errResp.ErrorDescription)
		}
		// If error parsing fails, return raw body
		return nil, fmt.Errorf("request failed with status %d: %s", resp.StatusCode, string(body))
	}

	// Parse success response
	var token Token
	if err := json.Unmarshal(body, &token); err != nil {
		return nil, fmt.Errorf("failed to parse response: %w", err)
	}

	return &token, nil
}

// parsePrivateKey converts PEM formatted private key to *rsa.PrivateKey
func parsePrivateKey(pemData []byte) (*rsa.PrivateKey, error) {
	block, _ := pem.Decode(pemData)
	if block == nil {
		return nil, fmt.Errorf("failed to parse PEM block")
	}

	privKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		// Try PKCS1 if PKCS8 fails
		privKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
		if err != nil {
			return nil, fmt.Errorf("failed to parse private key: %w", err)
		}
	}

	rsaKey, ok := privKey.(*rsa.PrivateKey)
	if !ok {
		return nil, fmt.Errorf("private key is not RSA")
	}

	return rsaKey, nil
}

response:

2024/10/28 10:43:54 Response Status: 200
2024/10/28 10:43:54 Response Body: {"token_type":"Bearer","expires_in":3600,"access_token":"eyJxxxxxxxw","scope":"okta.groups.manage okta.groups.read okta.orgs.read okta.orgs.manage"}
Access Token: eyJraWx2xw
Token Type: Bearer
Expires In: 3600 seconds

[hixichen]

all right, next step, I will write a provider from my own repo