Imagine a situation: analysts at Foobar Inc. conducted a thorough study of the market situation and business processes of the company and came to the conclusion that in order to optimize costs and significantly increase the profit of Foobar, nosebleed requires a Telegram bot companion that can cheer up employees in difficult times.
Naturally, Foobar cannot allow insidious competitors to take advantage of their know-how by simply adding their bot to their contacts. Therefore, the bot is required to talk only with Foobar employees who authenticate with the corporate single sign-on (SSO) based on OpenId Connect.
In theory
OpenId Connect (OIDC) is an authentication protocol based on the OAuth 2.0 family of specifications. In it, the authentication process can take place according to various scenarios called flows, and includes three parties:
- resource owner - user;
- client - an application requesting authentication;
- authorization server (authorization server) - an application that stores information about the user and is able to authenticate him.
JWT- (JSON Web Token). OIDC, , , OIDC.
, , : Telegram- SSO. .
, . OIDC :
- (authorization code flow),
- (implicit flow),
- (hybrid flow),
- , OAuth 2.0.
— HTTP, .
:
- .
- .
- .
- (, ).
- callback URL .
- ID .
- .
, , , ID , , Telegram- .
state , (XSRF). state 2 URL , 5 callback URL . , 2 state id Telegram-, 7 state id Telegram- . !
, , :
- Keycloak — open source (Identity and Access Management), OAuth 2.0, Open ID Connect SAML.
- Spring Boot .
- TelegramBots — Java Telegram-. — Spring Boot.
- ScribeJava — OAuth Java. , OAuth , Keycloak. , Keycloak - , Spring Boot — . Keycloak , — Telegram-, state id Telegram-, .
- Java JWT Auth0 — JWT Java, ID .
:
@Component
public class Bot extends TelegramLongPollingBot {
private final OidcService oidcService;
@Override
public void onUpdateReceived(Update update) {
if (!update.hasMessage()) {
log.debug("Update has no message. Skip processing.");
return;
}
var userId = update.getMessage().getFrom().getId();
var chatId = update.getMessage().getChatId();
oidcService.findUserInfo(userId).ifPresentOrElse(
userInfo -> greet(userInfo, chatId),
() -> askForLogin(userId, chatId));
}
private void greet(UserInfo userInfo, Long chatId) {
var username = userInfo.getPreferredUsername();
var message = String.format(
"Hello, <b>%s</b>!\nYou are the best! Have a nice day!",
username);
sendHtmlMessage(message, chatId);
}
private void askForLogin(Integer userId, Long chatId) {
var url = oidcService.getAuthUrl(userId);
var message = String.format("Please, <a href=\"%s\">log in</a>.", url);
sendHtmlMessage(message, chatId);
}
}
— UserInfo id Telegram- URL :
@Service
public class OidcService {
private final OAuth20Service oAuthService;
private final UserTrackerStorage userTrackers;
private final TokenStorage accessTokens;
public Optional<UserInfo> findUserInfo(Integer userId) {
return accessTokens.find(userId)
.map(UserInfo::of);
}
public String getAuthUrl(Integer userId) {
var state = UUID.randomUUID().toString();
userTrackers.put(state, userId);
return oAuthService.getAuthorizationUrl(state);
}
}
, , :
public class UserInfo {
private final String subject;
private final String preferredUsername;
static UserInfo of(OpenIdOAuth2AccessToken token) {
var jwt = JWT.decode(token.getOpenIdToken());
var subject = jwt.getSubject();
var preferredUsername = jwt.getClaim("preferred_username").asString();
return new UserInfo(subject, preferredUsername);
}
}
OAuth20Service:
@Configuration
@EnableConfigurationProperties(OidcProperties.class)
class OidcAutoConfiguration {
@Bean
OAuth20Service oAuthService(OidcProperties properties) {
return new ServiceBuilder(properties.getClientId())
.apiSecret(properties.getClientSecret())
.defaultScope("openid offline_access")
.callback(properties.getCallback())
.build(KeycloakApi.instance(properties.getBaseUrl(), properties.getRealm()));
}
}
Callback endpoint :
@Component
@Path("/auth")
public class AuthEndpoint {
private final URI botUri;
private final OidcService oidcService;
@GET
@Produces("text/plain; charset=UTF-8")
public Response auth(
@QueryParam("state") String state,
@QueryParam("code") String code) {
return oidcService.completeAuth(state, code)
.map(userInfo -> Response.temporaryRedirect(botUri).build())
.orElseGet(() -> Response.serverError().entity("Cannot complete authentication").build());
}
}
OidcService, completeAuth:
@Service
public class OidcService {
private final OAuth20Service oAuthService;
private final UserTrackerStorage userTrackers;
private final TokenStorage accessTokens;
public Optional<UserInfo> completeAuth(String state, String code) {
return userTrackers.find(state)
.map(userId -> requestAndStoreToken(code, userId))
.map(UserInfo::of);
}
private OpenIdOAuth2AccessToken requestAndStoreToken(
String code,
Integer userId) {
var token = requestToken(code);
accessTokens.put(userId, token);
return token;
}
private OpenIdOAuth2AccessToken requestToken(String code) {
try {
return (OpenIdOAuth2AccessToken) oAuthService.getAccessToken(code);
} catch (IOException | InterruptedException | ExecutionException e) {
throw new RuntimeException("Cannot get access token", e);
}
}
}
!
, , , , . , - , / .
These issues have already been resolved for us in more branchy OAuth clients like Spring Security and Google OAuth Client . But for demonstration purposes, we are ok :)
All sources can be found on GitHub .