[TT-13185] Implement Password Flow OAuth

apidef/api_definitions.go

@@ -808,11 +808,32 @@ type UpstreamOAuth struct {
 	Enabled bool `bson:"enabled" json:"enabled"`
 	// ClientCredentials holds the client credentials for upstream OAuth2 authentication.
 	ClientCredentials ClientCredentials `bson:"client_credentials" json:"client_credentials"`
+	// PasswordAuthentication holds the configuration for upstream OAauth password authentication flow.
+	PasswordAuthentication PasswordAuthentication `bson:"password_authentication,omitempty" json:"passwordAuthentication,omitempty"`
 	// HeaderName is the custom header name to be used for upstream basic authentication.
 	// Defaults to `Authorization`.
 	HeaderName string `bson:"header_name" json:"header_name,omitempty"`
 }
 
+// PasswordAuthentication holds the configuration for upstream OAuth2 password authentication flow.
+type PasswordAuthentication struct {
+	ClientAuthData
+	// Enabled activates upstream OAuth2 password authentication.
+	Enabled bool `bson:"enabled" json:"enabled"`
+	// Username is the username to be used for upstream OAuth2 password authentication.
+	Username string `bson:"username" json:"username"`
+	// Password is the password to be used for upstream OAuth2 password authentication.
+	Password string `bson:"password" json:"password"`
+	// TokenURL is the resource server's token endpoint
+	// URL. This is a constant specific to each server.
+	TokenURL string `bson:"token_url" json:"token_url"`
+	// Scopes specifies optional requested permissions.
+	Scopes []string `bson:"scopes" json:"scopes,omitempty"`
+
+	// TokenProvider is the OAuth2 password authentication flow token for internal use.
+	Token *oauth2.Token `bson:"-" json:"-"`
+}
+
 // ClientAuthData holds the client ID and secret for upstream OAuth2 authentication.
 type ClientAuthData struct {
 	// ClientID is the application's ID.

apidef/oas/schema/x-tyk-api-gateway.json

@@ -2052,13 +2052,42 @@
             "tokenUrl": {
               "type": "string"
             },
-            "scopes":{
-              "type": ["array", "null"]
+            "scopes": {
+              "type": [
+                "array",
+                "null"
+              ]
             }
           }
         },
-        "headerName": {
-          "type": "string"
+        "passwordAuthentication": {
+          "type": "object",
+          "properties": {
+            "clientId": {
+              "type": "string"
+            },
+            "clientSecret": {
+              "type": "string"
+            },
+            "tokenUrl": {
+              "type": "string"
+            },
+            "scopes": {
+              "type": [
+                "array",
+                "null"
+              ]
+            },
+            "username": {
+              "type": "string"
+            },
+            "password": {
+              "type": "string"
+            }
+          },
+          "headerName": {
+            "type": "string"
+          }
         }
       }
     }

apidef/oas/upstream.go

@@ -639,17 +639,40 @@ type UpstreamOAuth struct {
 	Enabled bool `bson:"enabled" json:"enabled"`
 	// ClientCredentials holds the configuration for OAuth2 Client Credentials flow.
 	ClientCredentials *ClientCredentials `bson:"clientCredentials,omitempty" json:"clientCredentials,omitempty"`
+	// PasswordAuthentication holds the configuration for upstream OAauth password authentication flow.
+	PasswordAuthentication *PasswordAuthentication `bson:"passwordAuthentication,omitempty" json:"passwordAuthentication,omitempty"`
 	// HeaderName is the custom header name to be used for upstream basic authentication.
 	// Defaults to `Authorization`.
 	HeaderName string `bson:"headerName" json:"headerName"`
 }
 
-// ClientCredentials holds the configuration for OAuth2 Client Credentials flow.
-type ClientCredentials struct {
+// PasswordAuthentication holds the configuration for upstream OAuth2 password authentication flow.
+type PasswordAuthentication struct {
+	ClientAuthData
+	// Enabled activates upstream OAuth2 password authentication.
+	Enabled bool `bson:"enabled" json:"enabled"`
+	// Username is the username to be used for upstream OAuth2 password authentication.
+	Username string `bson:"username" json:"username"`
+	// Password is the password to be used for upstream OAuth2 password authentication.
+	Password string `bson:"password" json:"password"`
+	// TokenURL is the resource server's token endpoint
+	// URL. This is a constant specific to each server.
+	TokenURL string `bson:"tokenURL" json:"tokenURL"`
+	// Scopes specifies optional requested permissions.
+	Scopes []string `bson:"scopes" json:"scopes,omitempty"`
+}
+
+// ClientAuthData holds the client ID and secret for OAuth2 authentication.
+type ClientAuthData struct {
 	// ClientID is the application's ID.
-	ClientID string `bson:"clientID" json:"clientID"`
+	ClientID string `bson:"clientId" json:"clientId"`
 	// ClientSecret is the application's secret.
 	ClientSecret string `bson:"clientSecret" json:"clientSecret"`
+}
+
+// ClientCredentials holds the configuration for OAuth2 Client Credentials flow.
+type ClientCredentials struct {
+	ClientAuthData
 	// TokenURL is the resource server's token endpoint
 	// URL. This is a constant specific to each server.
 	TokenURL string `bson:"tokenURL" json:"tokenURL"`
@@ -664,6 +687,14 @@ func (c *ClientCredentials) Fill(api apidef.ClientCredentials) {
 	c.Scopes = api.Scopes
 }
 
+func (p *PasswordAuthentication) Fill(api apidef.PasswordAuthentication) {
+	p.Enabled = api.Enabled
+	p.Username = api.Username
+	p.Password = api.Password
+	p.TokenURL = api.TokenURL
+	p.Scopes = api.Scopes
+}
+
 func (u *UpstreamOAuth) Fill(api apidef.UpstreamOAuth) {
 	u.Enabled = api.Enabled
 	u.HeaderName = api.HeaderName
@@ -675,6 +706,14 @@ func (u *UpstreamOAuth) Fill(api apidef.UpstreamOAuth) {
 	if ShouldOmit(u.ClientCredentials) {
 		u.ClientCredentials = nil
 	}
+
+	if u.PasswordAuthentication == nil {
+		u.PasswordAuthentication = &PasswordAuthentication{}
+	}
+	u.PasswordAuthentication.Fill(api.PasswordAuthentication)
+	if ShouldOmit(u.PasswordAuthentication) {
+		u.PasswordAuthentication = nil
+	}
 }
 
 func (c *ClientCredentials) ExtractTo(api *apidef.ClientCredentials) {
@@ -684,6 +723,14 @@ func (c *ClientCredentials) ExtractTo(api *apidef.ClientCredentials) {
 	api.Scopes = c.Scopes
 }
 
+func (p *PasswordAuthentication) ExtractTo(api *apidef.PasswordAuthentication) {
+	api.Enabled = p.Enabled
+	api.Username = p.Username
+	api.Password = p.Password
+	api.TokenURL = p.TokenURL
+	api.Scopes = p.Scopes
+}
+
 func (u *UpstreamOAuth) ExtractTo(api *apidef.UpstreamOAuth) {
 	api.Enabled = u.Enabled
 	api.HeaderName = u.HeaderName
@@ -695,4 +742,12 @@ func (u *UpstreamOAuth) ExtractTo(api *apidef.UpstreamOAuth) {
 		}()
 	}
 	u.ClientCredentials.ExtractTo(&api.ClientCredentials)
+
+	if u.PasswordAuthentication == nil {
+		u.PasswordAuthentication = &PasswordAuthentication{}
+		defer func() {
+			u.PasswordAuthentication = nil
+		}()
+	}
+	u.PasswordAuthentication.ExtractTo(&api.PasswordAuthentication)
 }

apidef/schema.go

@@ -808,6 +808,33 @@ const Schema = `{
 								}	
 							}
 						},
+						"password_authentication": {
+						  "type": "object",
+						  "properties": {
+								"client_id": {
+								  "type": "string"
+								},
+								"client_secret": {
+								  "type": "string"
+								},
+								"enabled": {
+								  "type": "boolean"
+								},
+								"username": {
+								  "type": "string"
+								},
+								"password": {
+								  "type": "string"
+								},
+								"token_url": {
+								  "type": "string"
+								},
+								"scopes": {
+								  "type": ["array", "null"]
+								}
+							}
+						  }
+						},
 						"header_name": {
 							"type": "string"		
 						}

gateway/mw_oauth2_auth.go

@@ -34,14 +34,63 @@ type ClientCredentialsOAuthProvider struct{}
 
 type PerAPIClientCredentialsOAuthProvider struct{}
 
-func newUpstreamOAuthClientCredentialsCache(connectionHandler *storage.ConnectionHandler) *upstreamOAuthClientCredentialsCache {
+type PasswordOAuthProvider struct{}
+
+func newUpstreamOAuthClientCredentialsCache(connectionHandler *storage.ConnectionHandler) UpstreamOAuthCache {
 	return &upstreamOAuthClientCredentialsCache{RedisCluster: storage.RedisCluster{KeyPrefix: "upstreamOAuthCC-", ConnectionHandler: connectionHandler}}
 }
 
+func newUpstreamOAuthPasswordCache(connectionHandler *storage.ConnectionHandler) UpstreamOAuthCache {
+	return &upstreamOAuthPasswordCache{RedisCluster: storage.RedisCluster{KeyPrefix: "upstreamOAuthPW-", ConnectionHandler: connectionHandler}}
+}
+
 type upstreamOAuthClientCredentialsCache struct {
 	storage.RedisCluster
 }
 
+type upstreamOAuthPasswordCache struct {
+	storage.RedisCluster
+}
+
+func (cache *upstreamOAuthPasswordCache) getToken(r *http.Request, OAuthSpec *UpstreamOAuth) (string, error) {
+	cacheKey := generatePasswordOAuthCacheKey(OAuthSpec.Spec.UpstreamAuth.OAuth, OAuthSpec.Spec.APIID)
+
+	tokenString, err := retryGetKeyAndLock(cacheKey, &cache.RedisCluster)
+	if err != nil {
+		return "", err
+	}
+
+	if tokenString != "" {
+		decryptedToken := decrypt(getPaddedSecret(OAuthSpec.Gw.GetConfig().Secret), tokenString)
+		return decryptedToken, nil
+	}
+
+	token, err := cache.obtainToken(r.Context(), OAuthSpec)
+	if err != nil {
+		return "", err
+	}
+
+	encryptedToken := encrypt(getPaddedSecret(OAuthSpec.Gw.GetConfig().Secret), token.AccessToken)
+
+	ttl := time.Until(token.Expiry)
+	if err := setTokenInCache(cacheKey, encryptedToken, ttl, &cache.RedisCluster); err != nil {
+		return "", err
+	}
+
+	return token.AccessToken, nil
+}
+
+func (cache *upstreamOAuthPasswordCache) obtainToken(ctx context.Context, OAuthSpec *UpstreamOAuth) (*oauth2.Token, error) {
+	cfg := newOAuth2PasswordConfig(OAuthSpec)
+
+	token, err := cfg.PasswordCredentialsToken(ctx, OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.Username, OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.Password)
+	if err != nil {
+		return &oauth2.Token{}, err
+	}
+
+	return token, nil
+}
+
 type UpstreamOAuthCache interface {
 	// getToken returns the token from cache or issues a request to obtain it from the OAuth provider.
 	getToken(r *http.Request, OAuthSpec *UpstreamOAuth) (string, error)
@@ -102,8 +151,20 @@ func (OAuthSpec *UpstreamOAuth) ProcessRequest(_ http.ResponseWriter, r *http.Re
 }
 
 func getOAuthHeaderProvider(oauthConfig apidef.UpstreamOAuth) (OAuthHeaderProvider, error) {
-	// to be extended when PasswordAuth is implemented
-	return &ClientCredentialsOAuthProvider{}, nil
+	if !oauthConfig.IsEnabled() {
+		return nil, fmt.Errorf("upstream OAuth is not enabled")
+	}
+
+	switch {
+	case oauthConfig.ClientCredentials.ClientID != "" && oauthConfig.PasswordAuthentication.ClientID != "":
+		return nil, fmt.Errorf("both client credentials and password authentication are provided")
+	case oauthConfig.ClientCredentials.ClientID != "":
+		return &ClientCredentialsOAuthProvider{}, nil
+	case oauthConfig.PasswordAuthentication.ClientID != "":
+		return &PasswordOAuthProvider{}, nil
+	default:
+		return nil, fmt.Errorf("no valid OAuth configuration provided")
+	}
 }
 
 func (p *PerAPIClientCredentialsOAuthProvider) getOAuthHeaderValue(r *http.Request, OAuthSpec *UpstreamOAuth) (string, error) {
@@ -143,7 +204,34 @@ func (p *ClientCredentialsOAuthProvider) getOAuthToken(r *http.Request, OAuthSpe
 	return fmt.Sprintf("Bearer %s", token), nil
 }
 
-func generateCacheKey(config apidef.UpstreamOAuth, apiId string) string {
+func (p *PasswordOAuthProvider) getOAuthToken(r *http.Request, OAuthSpec *UpstreamOAuth) (string, error) {
+	if OAuthSpec.Gw.UpstreamOAuthCache == nil {
+		OAuthSpec.Gw.UpstreamOAuthCache = newUpstreamOAuthPasswordCache(OAuthSpec.Gw.StorageConnectionHandler)
+	}
+
+	token, err := OAuthSpec.Gw.UpstreamOAuthCache.getToken(r, OAuthSpec)
+	if err != nil {
+		return handleOAuthError(r, OAuthSpec, err)
+	}
+
+	return fmt.Sprintf("Bearer %s", token), nil
+
+}
+
+func generatePasswordOAuthCacheKey(config apidef.UpstreamOAuth, apiId string) string {
+	key := fmt.Sprintf(
+		"%s|%s|%s|%s",
+		apiId,
+		config.PasswordAuthentication.ClientID,
+		config.PasswordAuthentication.ClientSecret,
+		strings.Join(config.PasswordAuthentication.Scopes, ","))
+
+	hash := sha256.New()
+	hash.Write([]byte(key))
+	return hex.EncodeToString(hash.Sum(nil))
+}
+
+func generateClientCredentialsCacheKey(config apidef.UpstreamOAuth, apiId string) string {
 	key := fmt.Sprintf(
 		"%s|%s|%s|%s",
 		apiId,
@@ -157,15 +245,15 @@ func generateCacheKey(config apidef.UpstreamOAuth, apiId string) string {
 }
 
 func (cache *upstreamOAuthClientCredentialsCache) getToken(r *http.Request, OAuthSpec *UpstreamOAuth) (string, error) {
-	cacheKey := generateCacheKey(OAuthSpec.Spec.UpstreamAuth.OAuth, OAuthSpec.Spec.APIID)
+	cacheKey := generateClientCredentialsCacheKey(OAuthSpec.Spec.UpstreamAuth.OAuth, OAuthSpec.Spec.APIID)
 
 	tokenString, err := retryGetKeyAndLock(cacheKey, &cache.RedisCluster)
 	if err != nil {
 		return "", err
 	}
 
 	if tokenString != "" {
-		decryptedToken := decrypt(getPaddedSecret(OAuthSpec.Gw), tokenString)
+		decryptedToken := decrypt(getPaddedSecret(OAuthSpec.Gw.GetConfig().Secret), tokenString)
 		return decryptedToken, nil
 	}
 
@@ -174,7 +262,7 @@ func (cache *upstreamOAuthClientCredentialsCache) getToken(r *http.Request, OAut
 		return "", err
 	}
 
-	encryptedToken := encrypt(getPaddedSecret(OAuthSpec.Gw), token.AccessToken)
+	encryptedToken := encrypt(getPaddedSecret(OAuthSpec.Gw.GetConfig().Secret), token.AccessToken)
 
 	ttl := time.Until(token.Expiry)
 	if err := setTokenInCache(cacheKey, encryptedToken, ttl, &cache.RedisCluster); err != nil {
@@ -218,6 +306,17 @@ func newOAuth2ClientCredentialsConfig(OAuthSpec *UpstreamOAuth) oauth2clientcred
 	}
 }
 
+func newOAuth2PasswordConfig(OAuthSpec *UpstreamOAuth) oauth2.Config {
+	return oauth2.Config{
+		ClientID:     OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.ClientID,
+		ClientSecret: OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.ClientSecret,
+		Endpoint: oauth2.Endpoint{
+			TokenURL: OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.TokenURL,
+		},
+		Scopes: OAuthSpec.Spec.UpstreamAuth.OAuth.PasswordAuthentication.Scopes,
+	}
+}
+
 func (cache *upstreamOAuthClientCredentialsCache) obtainToken(ctx context.Context, OAuthSpec *UpstreamOAuth) (*oauth2.Token, error) {
 	cfg := newOAuth2ClientCredentialsConfig(OAuthSpec)