add userinfo endpoint

Signed-off-by: hongming <hongming@kubesphere.io>

pkg/apiserver/authentication/oauth/error.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2020 The KubeSphere Authors.
+Copyright 2021 The KubeSphere Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package oauth
 
 import "fmt"
 
+// The following error type is defined in https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
 var (
 	// ErrorInvalidClient
 	// Client authentication failed (e.g., unknown client, no

pkg/apiserver/authentication/oauth/options.go

@@ -191,7 +191,7 @@ type Token struct {
 type Client struct {
 	// The name of the OAuth client is used as the client_id parameter when making requests to <master>/oauth/authorize
 	// and <master>/oauth/token.
-	Name string
+	Name string `json:"name" yaml:"name,omitempty"`
 
 	// Secret is the unique secret associated with a client
 	Secret string `json:"-" yaml:"secret,omitempty"`
@@ -225,19 +225,7 @@ type Client struct {
 
 var (
 	// AllowAllRedirectURI Allow any redirect URI if the redirectURI is defined in request
-	AllowAllRedirectURI                 = "*"
-	DefaultTokenMaxAge                  = time.Second * 86400
-	DefaultAccessTokenInactivityTimeout = time.Duration(0)
-	DefaultClients                      = []Client{{
-		Name:                         "default",
-		Secret:                       "kubesphere",
-		RespondWithChallenges:        true,
-		RedirectURIs:                 []string{AllowAllRedirectURI},
-		GrantMethod:                  GrantHandlerAuto,
-		ScopeRestrictions:            []string{"full"},
-		AccessTokenMaxAge:            &DefaultTokenMaxAge,
-		AccessTokenInactivityTimeout: &DefaultAccessTokenInactivityTimeout,
-	}}
+	AllowAllRedirectURI = "*"
 )
 
 func (o *Options) OAuthClient(name string) (Client, error) {
@@ -246,11 +234,6 @@ func (o *Options) OAuthClient(name string) (Client, error) {
 			return found, nil
 		}
 	}
-	for _, defaultClient := range DefaultClients {
-		if defaultClient.Name == name {
-			return defaultClient, nil
-		}
-	}
 	return Client{}, ErrorClientNotFound
 }
 

pkg/apiserver/authentication/oauth/options_test.go

@@ -19,77 +19,39 @@ package oauth
 import (
 	"encoding/json"
 	"testing"
-	"time"
 
-	"github.com/google/go-cmp/cmp"
 	"gopkg.in/yaml.v3"
 )
 
-func TestDefaultAuthOptions(t *testing.T) {
-	oneDay := time.Second * 86400
-	zero := time.Duration(0)
-	expect := Client{
-		Name:                         "default",
-		RespondWithChallenges:        true,
-		Secret:                       "kubesphere",
-		RedirectURIs:                 []string{AllowAllRedirectURI},
-		GrantMethod:                  GrantHandlerAuto,
-		ScopeRestrictions:            []string{"full"},
-		AccessTokenMaxAge:            &oneDay,
-		AccessTokenInactivityTimeout: &zero,
-	}
-
-	options := NewOptions()
-	client, err := options.OAuthClient("default")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if diff := cmp.Diff(expect, client); len(diff) != 0 {
-		t.Errorf("%T differ (-got, +expected), %s", expect, diff)
-	}
-}
-
 func TestClientResolveRedirectURL(t *testing.T) {
-	options := NewOptions()
-	defaultClient, err := options.OAuthClient("default")
-	if err != nil {
-		t.Fatal(err)
-	}
+
 	tests := []struct {
 		Name      string
 		client    Client
 		wantErr   bool
 		expectURL string
 	}{
-		{
-			Name:      "default client test",
-			client:    defaultClient,
-			wantErr:   false,
-			expectURL: "https://localhost:8080/auth/cb",
-		},
 		{
 			Name: "custom client test",
 			client: Client{
-				Name:                  "default",
-				RespondWithChallenges: true,
-				RedirectURIs:          []string{"https://foo.bar.com/oauth/cb"},
-				GrantMethod:           GrantHandlerAuto,
-				ScopeRestrictions:     []string{"full"},
-			},
-			wantErr:   true,
-			expectURL: "https://foo.bar.com/oauth/err",
-		},
-		{
-			Name: "custom client test",
-			client: Client{
-				Name:                  "default",
+				Name:                  "custom",
 				RespondWithChallenges: true,
 				RedirectURIs:          []string{AllowAllRedirectURI, "https://foo.bar.com/oauth/cb"},
 				GrantMethod:           GrantHandlerAuto,
-				ScopeRestrictions:     []string{"full"},
 			},
 			wantErr:   false,
-			expectURL: "https://foo.bar.com/oauth/err2",
+			expectURL: "https://foo.bar.com/oauth/cb",
+		},
+		{
+			Name: "custom client test",
+			client: Client{
+				Name:                  "custom",
+				RespondWithChallenges: true,
+				RedirectURIs:          []string{"https://foo.bar.com/oauth/cb"},
+				GrantMethod:           GrantHandlerAuto,
+			},
+			wantErr:   true,
+			expectURL: "https://foo.bar.com/oauth/cb2",
 		},
 	}