feat(oidc): client authentication modes (#5150)

This adds a feature to OpenID Connect 1.0 where clients can be restricted to a specific client authentication mode, as well as implements some backend requirements for the private_key_jwt client authentication mode (and potentially the tls_client_auth / self_signed_tls_client_auth client authentication modes). It also adds some improvements to configuration defaults and validations which will for now be warnings but likely be made into errors.

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>

1 files changed, 94 insertions, 0 deletions

diff --git a/internal/configuration/validator/util.go b/internal/configuration/validator/util.go
index b68bfee7a..59b9411b1 100644
--- a/internal/configuration/validator/util.go
+++ b/internal/configuration/validator/util.go
@@ -4,6 +4,8 @@ import (
 	"strings"
 
 	"golang.org/x/net/publicsuffix"
+
+	"github.com/authelia/authelia/v4/internal/utils"
 )
 
 func isCookieDomainAPublicSuffix(domain string) (valid bool) {
@@ -13,3 +15,95 @@ func isCookieDomainAPublicSuffix(domain string) (valid bool) {
 
 	return len(strings.TrimLeft(domain, ".")) == len(suffix)
 }
+
+func strJoinOr(items []string) string {
+	return strJoinComma("or", items)
+}
+
+func strJoinAnd(items []string) string {
+	return strJoinComma("and", items)
+}
+
+func strJoinComma(word string, items []string) string {
+	if word == "" {
+		return buildJoinedString(",", "", "'", items)
+	}
+
+	return buildJoinedString(",", word, "'", items)
+}
+
+func buildJoinedString(sep, sepFinal, quote string, items []string) string {
+	n := len(items)
+
+	if n == 0 {
+		return ""
+	}
+
+	b := &strings.Builder{}
+
+	for i := 0; i < n; i++ {
+		if quote != "" {
+			b.WriteString(quote)
+		}
+
+		b.WriteString(items[i])
+
+		if quote != "" {
+			b.WriteString(quote)
+		}
+
+		if i == (n - 1) {
+			continue
+		}
+
+		if sep != "" {
+			if sepFinal == "" || n != 2 {
+				b.WriteString(sep)
+			}
+
+			b.WriteString(" ")
+		}
+
+		if sepFinal != "" && i == (n-2) {
+			b.WriteString(strings.Trim(sepFinal, " "))
+			b.WriteString(" ")
+		}
+	}
+
+	return b.String()
+}
+
+func validateList(values, valid []string, chkDuplicate bool) (invalid, duplicates []string) { //nolint:unparam
+	chkValid := len(valid) != 0
+
+	for i, value := range values {
+		if chkValid {
+			if !utils.IsStringInSlice(value, valid) {
+				invalid = append(invalid, value)
+
+				// Skip checking duplicates for invalid values.
+				continue
+			}
+		}
+
+		if chkDuplicate {
+			for j, valueAlt := range values {
+				if i == j {
+					continue
+				}
+
+				if value != valueAlt {
+					continue
+				}
+
+				if utils.IsStringInSlice(value, duplicates) {
+					continue
+				}
+
+				duplicates = append(duplicates, value)
+			}
+		}
+	}
+
+	return
+}