some improvements

pkg/core/types.go

@@ -8,6 +8,7 @@ type User struct {
 	Password string
 	Created  string
 	Secret   string
+	Claims   map[string]string
 	Admin    bool
 	Disabled bool
 	Locked   int

pkg/db/user.go

@@ -39,9 +39,12 @@ func (db *DB) GetUsers() (users core.Users, err error) {
 	return
 }
 
-func (db *DB) GetUserWithoutPassword(username string) (u *core.User, err error) {
+func (db *DB) GetUserWithoutSecrets(username string) (u *core.User, err error) {
 	u, err = db.GetUser(username)
 	u.Password = ""
+	if u.Secret != "" {
+		u.Secret = "redacted"
+	}
 	return
 }
 

pkg/server/context.go

@@ -301,9 +301,16 @@ func (c *Context) Admin() bool {
 	return c.Token.Claims.GetBool(adminClaim)
 }
 
-func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) {
+func (c *Context) ApproveLogin(u *core.User, challenge string) (rdr string, err error) {
+	accept := client.NewAcceptLoginRequest(u.Username)
+	accept.Acr = new(string)
+	if u.Secret == "" {
+		*accept.Acr = "pwd"
+	} else {
+		*accept.Acr = "mfa"
+	}
 	cr, resp, err := c.Srv.API.AdminApi.AcceptLoginRequest(context.Background()).
-		AcceptLoginRequest(*client.NewAcceptLoginRequest(user)).
+		AcceptLoginRequest(*accept).
 		LoginChallenge(challenge).
 		Execute()
 	if err != nil {
@@ -314,7 +321,7 @@ func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) {
 	return
 }
 
-func (c *Context) ApproveConsent(challenge string) (rdr string, err error) {
+func (c *Context) ApproveConsent(u *core.User, challenge string) (rdr string, err error) {
 	ci, err := c.Consent(challenge)
 	if err != nil {
 		return
@@ -324,6 +331,15 @@ func (c *Context) ApproveConsent(challenge string) (rdr string, err error) {
 	accept.GrantAccessTokenAudience = ci.RequestedAccessTokenAudience
 	accept.Remember = new(bool)
 	*accept.Remember = true
+	accept.Session = &client.ConsentRequestSession{
+		IdToken: u.Claims,
+	}
+	/*
+		map[string]string{
+			"apps":      "git",
+			"git_group": "admin",
+		},
+	*/
 	cr, resp, err := c.Srv.API.AdminApi.AcceptConsentRequest(context.Background()).
 		AcceptConsentRequest(*accept).
 		ConsentChallenge(challenge).
@@ -399,14 +415,11 @@ func (c *Context) RevokeSession(user, client string, all bool) (err error) {
 	if client == "" && !all {
 		return
 	}
-	req := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()).
+	resp, err := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()).
-		Subject(user)
+		Subject(user).
-	if all {
+		Client(client).
-		req = req.All(all)
+		All(all).
-	} else {
+		Execute()
-		req = req.Client(client)
-	}
-	resp, err := req.Execute()
 	if err != nil {
 		return
 	}

pkg/server/handler.go

@@ -112,10 +112,7 @@ func sessionsHandler(ctx *Context) {
 
 func loginHandler(ctx *Context) {
 	log := ctx.log.WithName("login")
-	var (
+	var data loginData
-		data loginData
-		err  error
-	)
 	data.LoginChallenge = ctx.Query("login_challenge")
 	ctx.Template("loginHandler")
 	ctx.Data = webData{
@@ -125,7 +122,12 @@ func loginHandler(ctx *Context) {
 	if ctx.LoggedOn() {
 		rdr := sessions
 		if data.LoginChallenge != "" {
-			rdr, err = ctx.ApproveLogin(ctx.User(), data.LoginChallenge)
+			u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User())
+			if err != nil {
+				ctx.Error(err)
+				return
+			}
+			rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
 			if err != nil {
 				ctx.Error(err)
 				return
@@ -174,7 +176,7 @@ func loginHandler(ctx *Context) {
 		ctx.Login(u, remember)
 		rdr := sessions
 		if data.LoginChallenge != "" {
-			rdr, err = ctx.ApproveLogin(data.User, data.LoginChallenge)
+			rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
 			if err != nil {
 				ctx.Error(err)
 				return
@@ -224,7 +226,7 @@ func loginTotpHandler(ctx *Context) {
 		ctx.Login(u, ctx.Remember())
 		rdr := sessions
 		if data.LoginChallenge != "" {
-			rdr, err = ctx.ApproveLogin(user, data.LoginChallenge)
+			rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
 			if err != nil {
 				ctx.Error(err)
 				ctx.log.Error(err, "error approving login")
@@ -243,6 +245,11 @@ func consentHandler(ctx *Context) {
 		BodyTitle: "Authorize",
 	}
 	var data consentData
+	u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User())
+	if err != nil {
+		ctx.Error(err)
+		return
+	}
 	switch ctx.Method() {
 	case "GET":
 		data.ConsentChallenge = ctx.Query("consent_challenge")
@@ -254,7 +261,7 @@ func consentHandler(ctx *Context) {
 			return
 		}
 		if cr.GetSkip() {
-			rdr, err := ctx.ApproveConsent(data.ConsentChallenge)
+			rdr, err := ctx.ApproveConsent(u, data.ConsentChallenge)
 			if err != nil {
 				ctx.log.Error(err, "error approving consent")
 				ctx.Error("error approving consent")
@@ -276,7 +283,7 @@ func consentHandler(ctx *Context) {
 		var err error
 		rdr := root
 		if consent == "approve" {
-			rdr, err = ctx.ApproveConsent(data.ConsentChallenge)
+			rdr, err = ctx.ApproveConsent(u, data.ConsentChallenge)
 			if err != nil {
 				ctx.log.Error(err, "error approving consent")
 				ctx.Error("error approving consent")
@@ -356,7 +363,7 @@ func userEditHandler(ctx *Context) {
 		Title:     "Edit User",
 		BodyTitle: "Edit User",
 	}
-	u, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
+	u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user"))
 	if err != nil {
 		ctx.Error(err)
 		return
@@ -523,7 +530,7 @@ func userDelHandler(ctx *Context) {
 	}
 	switch ctx.Method() {
 	case "GET":
-		user, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
+		user, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user"))
 		if err != nil {
 			ctx.Error(err)
 			return