Add caching support to IDPMetadata()

saml/authn_request.go

@@ -125,6 +125,8 @@ func WithClock(clock clockwork.Clock) Option {
 			opts.clock = clock
 		case *parseResponseOptions:
 			opts.clock = clock
+		case *idpMetadataOptions:
+			opts.clock = clock
 		}
 	}
 }

saml/go.mod

@@ -5,6 +5,7 @@ go 1.19
 require (
 	github.com/beevik/etree v1.2.0
 	github.com/crewjam/go-xmlsec v0.0.0-20200414151428-d2b1a58f7262
+	github.com/crewjam/saml v0.4.13
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/jonboulle/clockwork v0.4.0
 	github.com/russellhaering/gosaml2 v0.9.1

saml/go.sum

@@ -6,9 +6,17 @@ github.com/crewjam/errset v0.0.0-20160219153700-f78d65de925c h1:dCJ9oZ0VgnzJHR5B
 github.com/crewjam/errset v0.0.0-20160219153700-f78d65de925c/go.mod h1:XhiWL7J86xoqJ8+x2OA+AM2l9skQP2DZ0UOXQYVg7uI=
 github.com/crewjam/go-xmlsec v0.0.0-20200414151428-d2b1a58f7262 h1:3V8RSsB1mxeAfxMb7lGSd0HlCHhc/ElJj1peaJMAkyk=
 github.com/crewjam/go-xmlsec v0.0.0-20200414151428-d2b1a58f7262/go.mod h1:M9eHnKpImgRwzOFdlFQnbgJRqFwW/eX1cKAVobv03uE=
+github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
+github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc=
+github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dchest/uniuri v1.2.0/go.mod h1:fSzm4SLHzNZvWLvWJew423PhAzkpNQYq+uNLq4kxhkY=
+github.com/golang-jwt/jwt/v4 v4.4.3 h1:Hxl6lhQFj4AnOX6MLrsCb/+7tCj7DxP7VA+2rDIq5AU=
+github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
@@ -17,8 +25,9 @@ github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST
 github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -28,30 +37,51 @@ github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxq
 github.com/moov-io/signedxml v1.1.1 h1:TQ2fK4DRCYv7agH+z6RjtnBTmEyYMAztFzuHIPtUJpg=
 github.com/moov-io/signedxml v1.1.1/go.mod h1:p+b4f/Wo/qKyew8fHW8VZOgsILWylyvvjdE68egzbwc=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russellhaering/gosaml2 v0.9.1 h1:H/whrl8NuSoxyW46Ww5lKPskm+5K+qYLw9afqJ/Zef0=
 github.com/russellhaering/gosaml2 v0.9.1/go.mod h1:ja+qgbayxm+0mxBRLMSUuX3COqy+sb0RRhIGun/W2kc=
+github.com/russellhaering/goxmldsig v1.2.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
 github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/zenazn/goji v1.0.1/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
+golang.org/x/crypto v0.0.0-20220128200615-198e4374d7ed/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
 golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=

saml/models/metadata/duration.go

@@ -0,0 +1,22 @@
+package metadata
+
+import (
+	"time"
+
+	crewjamSaml "github.com/crewjam/saml"
+)
+
+// Duration is a time.Duration that uses the xsd:duration format for text
+// marshalling and unmarshalling.
+type Duration time.Duration
+
+// MarshalText implements the encoding.TextMarshaler interface.
+func (d Duration) MarshalText() ([]byte, error) {
+	return crewjamSaml.Duration(d).MarshalText()
+}
+
+// UnmarshalText implements the encoding.TextUnmarshaler interface.
+func (d *Duration) UnmarshalText(text []byte) error {
+	cp := (*crewjamSaml.Duration)(d)
+	return cp.UnmarshalText(text)
+}

saml/models/metadata/duration_test.go

@@ -0,0 +1,56 @@
+package metadata
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+var durationMarshalTests = []struct {
+	in       time.Duration
+	expected []byte
+}{
+	{0, nil},
+	{time.Hour, []byte("PT1H")},
+	{-time.Hour, []byte("-PT1H")},
+}
+
+func TestDuration(t *testing.T) {
+	for i, testCase := range durationMarshalTests {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			actual, err := Duration(testCase.in).MarshalText()
+			require.NoError(t, err)
+			require.Equal(t, testCase.expected, actual)
+		})
+	}
+}
+
+var durationUnmarshalTests = []struct {
+	in       []byte
+	expected time.Duration
+	err      error
+}{
+	{nil, 0, nil},
+	{[]byte("-PT1H"), -time.Hour, nil},
+	{[]byte("P1D"), 24 * time.Hour, nil},
+	{[]byte("P1M"), 720 * time.Hour, nil},
+	{[]byte("PT1.S"), 0, errors.New("invalid duration (PT1.S)")},
+}
+
+func TestDurationUnmarshal(t *testing.T) {
+	for i, testCase := range durationUnmarshalTests {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			var actual Duration
+			err := actual.UnmarshalText(testCase.in)
+			if testCase.err == nil {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, testCase.err.Error())
+			}
+			require.Equal(t, Duration(testCase.expected), actual)
+		})
+	}
+}

saml/models/metadata/entity_descriptor.go

@@ -37,9 +37,9 @@ const (
 
 // DescriptorCommon defines common fields used in Entity- and EntitiesDescriptor.
 type DescriptorCommon struct {
-	ID            string        `xml:",attr,omitempty"`
-	ValidUntil    *time.Time    `xml:"validUntil,attr,omitempty"`
-	CacheDuration time.Duration `xml:"cacheDuration,attr,omitempty"`
+	ID            string     `xml:",attr,omitempty"`
+	ValidUntil    *time.Time `xml:"validUntil,attr,omitempty"`
+	CacheDuration *Duration  `xml:"cacheDuration,attr,omitempty"`
 	Signature     *dsig.Signature
 }
 

saml/sp.go

@@ -8,9 +8,12 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"sync"
+	"time"
 
 	"github.com/hashicorp/cap/saml/models/core"
 	"github.com/hashicorp/cap/saml/models/metadata"
+	"github.com/jonboulle/clockwork"
 	dsig "github.com/russellhaering/goxmldsig/types"
 )
 
@@ -81,6 +84,10 @@ func WithAdditionalACSEndpoint(b core.ServiceBinding, location url.URL) Option {
 // ServiceProvider defines a type for service providers
 type ServiceProvider struct {
 	cfg *Config
+
+	metadata            *metadata.EntityDescriptorIDPSSO
+	metadataCachedUntil *time.Time
+	metadataLock        sync.Mutex
 }
 
 // NewServiceProvider creates a new ServiceProvider.
@@ -156,21 +163,103 @@ func (sp *ServiceProvider) CreateMetadata(opt ...Option) *metadata.EntityDescrip
 	return &spsso
 }
 
+type idpMetadataOptions struct {
+	cache    bool
+	useStale bool
+	clock    clockwork.Clock
+}
+
+func idpMetadataOptionsDefault() idpMetadataOptions {
+	return idpMetadataOptions{
+		cache:    true,
+		useStale: false,
+		clock:    clockwork.NewRealClock(),
+	}
+}
+
+func getIDPMetadataOptions(opt ...Option) idpMetadataOptions {
+	opts := idpMetadataOptionsDefault()
+	ApplyOpts(&opts, opt...)
+	return opts
+}
+
+// WithCache control whether we should cache IDP Metadata.
+func WithCache(cache bool) Option {
+	return func(o interface{}) {
+		if o, ok := o.(*idpMetadataOptions); ok {
+			o.cache = cache
+		}
+	}
+}
+
+// WithStale control whether we should use a stale IDP Metadata document if
+// refreshing it fails.
+func WithStale(stale bool) Option {
+	return func(o interface{}) {
+		if o, ok := o.(*idpMetadataOptions); ok {
+			o.useStale = stale
+		}
+	}
+}
+
 // IDPMetadata fetches the metadata XML document from the configured identity provider.
-func (sp *ServiceProvider) IDPMetadata() (*metadata.EntityDescriptorIDPSSO, error) {
+// Options:
+// - WithClock
+// - WithCache
+// - WithStale
+func (sp *ServiceProvider) IDPMetadata(opt ...Option) (*metadata.EntityDescriptorIDPSSO, error) {
 	const op = "saml.ServiceProvider.FetchIDPMetadata"
 
+	opts := getIDPMetadataOptions(opt...)
+
 	var err error
 	var ed *metadata.EntityDescriptorIDPSSO
 
+	isValid := func(md *metadata.EntityDescriptorIDPSSO) bool {
+		if md == nil {
+			return false
+		}
+		if md.ValidUntil == nil {
+			return true
+		}
+		return opts.clock.Now().Before(*md.ValidUntil)
+	}
+
+	isAlive := func(md *metadata.EntityDescriptorIDPSSO, expireAt *time.Time) bool {
+		if md == nil || !opts.cache || expireAt == nil {
+			return false
+		}
+
+		return opts.clock.Now().Before(*expireAt)
+	}
+
+	if opts.cache {
+		// We only take the lock when caching is enabled so that requests can be
+		// done concurrently when it is not
+		sp.metadataLock.Lock()
+		defer sp.metadataLock.Unlock()
+
+		switch {
+		case !isValid(sp.metadata):
+			sp.metadata = nil
+			sp.metadataCachedUntil = nil
+		case isValid(sp.metadata) && isAlive(sp.metadata, sp.metadataCachedUntil):
+			return sp.metadata, nil
+		}
+	}
+
 	// Order of switch case determines IDP metadata config precedence
 	switch {
 	case sp.cfg.MetadataURL != "":
 		ed, err = fetchIDPMetadata(sp.cfg.MetadataURL)
-		if err != nil {
+		switch {
+		case err != nil && opts.useStale && isValid(sp.metadata):
+			// An error occurred but we have a cached metadata document that
+			// we can use
+			return sp.metadata, nil
+		case err != nil:
 			return nil, fmt.Errorf("%s: %w", op, err)
 		}
-		return ed, nil
 
 	case sp.cfg.MetadataXML != "":
 		ed, err = parseIDPMetadata([]byte(sp.cfg.MetadataXML))
@@ -188,6 +277,17 @@ func (sp *ServiceProvider) IDPMetadata() (*metadata.EntityDescriptorIDPSSO, erro
 		return nil, fmt.Errorf("%s: no IDP metadata configuration set: %w", op, ErrInvalidParameter)
 	}
 
+	if !isValid(ed) {
+		return nil, fmt.Errorf("the IDP configuration was only valid until %s", ed.ValidUntil.Format(time.RFC3339))
+	}
+
+	sp.metadata = ed
+	sp.metadataCachedUntil = nil
+	if sp.metadata.CacheDuration != nil {
+		cachedUntil := opts.clock.Now().Add(time.Duration(*sp.metadata.CacheDuration))
+		sp.metadataCachedUntil = &cachedUntil
+	}
+
 	return ed, err
 }