OIDC Entegrasyonu

//v18
import groovy.json.JsonSlurper
import groovy.json.JsonOutput
import java.net.URLEncoder
import java.net.URLDecoder
import java.util.zip.GZIPOutputStream
import java.util.zip.GZIPInputStream
import java.io.ByteArrayOutputStream
import java.io.ByteArrayInputStream
import java.nio.charset.StandardCharsets
import java.security.MessageDigest
import java.security.SecureRandom
import java.time.Instant
import java.util.Base64
import java.util.UUID
import javax.crypto.Cipher
import javax.crypto.spec.IvParameterSpec
import javax.crypto.spec.SecretKeySpec
import org.apache.http.client.methods.HttpGet
import org.apache.http.client.methods.HttpPost
import org.apache.http.impl.client.HttpClients
import org.apache.http.entity.StringEntity
import org.apache.http.util.EntityUtils

// ################## OIDC Configuration ##################
def OIDC_CONFIG = [

        clientId: "client_name",
        clientSecret: "client_secret",
        realm: "realm_name",
        scope: "openid email",
        discovery: "https://auth.keycloak.local/realms/realm_name/.well-known/openid-configuration",
        authorizationEndpoint: "https://auth.keycloak.local/realms/realm_name/protocol/openid-connect/auth",
        introspectionEndpoint: "https://auth.keycloak.local/realms/realm_name/protocol/openid-connect/token/introspect",
        tokenEndpoint: "https://auth.keycloak.local/realms/realm_name/protocol/openid-connect/token",
        redirectAfterLogoutUri: "https://auth.keycloak.local/realms/realm_name/protocol/openid-connect/logout",
        postLogoutRedirectUri: "https://application.local/application_ui/", //zorunlu 
        logoutPath: "/logout",
        redirectUri: "https://application.local/application_ui/",
        redirectAfterLogoutWithIdTokenHint: true,

        usePkce: true,
        useNonce: true,

        bearerJwtAuthEnable: true,  // Header ile authentication izni
        accessTokenHeaderName: "Authorization", //hangi header ile authenticate olabilir
        accessTokenAsBearer: true, //header bearer token olarak mı eklensin
        addAccessTokenHeader: true, //access token'ı request'e ekleyelim mi?
        authAcceptTokenAs: "header_cookie", // "header", "cookie", veya "header_cookie"
        addTokenToCookie: true, // Header'daki token'ı cookie'ye taşı

        addIdTokenHeader: false, //id token değerini varsa request'e ekleyelim mi?
        idTokenHeaderName: "IdToken", // id token değerini hangi isim ile ekleyelim
       
        disableUserinfoHeader: false,       // Userinfo header'ı devre dışı bırak
        userinfoHeaderName: "UserInfo",  // Kullanıcı bilgilerini hangi header'da göndereceğiz

        ignoreRequestMethods: ["OPTIONS"],
        ignoreRequestPatterns: "static/media,static/js,static/css,static/html,*.json,*.ico,*.png,*.svg,*.js,*.woff2,*.css,*.html,bnpl-result,bnpl-workflow-fail",
        
        accessTokenCookieName: "authorization",
        enableRefreshTokenCookie: false, 
        refreshTokenCookieName: "refresh-token-cookie",
        enableIdTokenCookie: false, 
        idTokenCookieName: "id-token-cookie",
        validateAccessTokenWithApi: true,  

        validateIssuer: true,         //access token jwt ise, Issuer kontrolü yapılsın mı?
        expectedIssuer: "https://auth.keycloak.local/realms/realm_name", // Beklenen issuer değeri
        validateAudience: false,       //access token jwt ise, Audience kontrolü yapılsın mı?
        expectedAudience: "client name", // Beklenen audience değeri (genellikle clientId değeriyle aynıdır)

        // Session settings
        sessionCookieName: "cookie name",
        sessionCookieSecure: true, // Use false for HTTP testing
        sessionAbsoluteTimeout: 34560000,

        // Encryption settings (for cookie)
        encryptionKey: "c2d6b2n4f6k6l7n8m9f0s1b5b4v3x1z2", // 32-byte key for AES-256
        encryptionIv: "z9x8c7v6b5n4g7h8",  // 16-byte IV for AES
        debugEnabled: true,
        setCookieDelimiter: "#"
]

if(customVariableMap.get("Location")!=null ){
	responseHeaderMapToClient.put("Location", customVariableMap.get("Location"))
	statusCodeToClient=302;
}

 
customVariableMap.each { key, value ->
    if (key.toLowerCase().contains("cookie")) { 
        responseHeaderMapToClient.put(key, value)
    }
}

# Fragment kullanımı (ÇALIŞMAZ): https://example.com/callback#access_token=eyJ0...&token_type=bearer&...

# Query kullanımı (ÇALIŞIR): https://example.com/callback?access_token=eyJ0...&token_type=bearer&...

nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"

nginx.ingress.kubernetes.io/client-header-buffer-size: "8k"

nginx.ingress.kubernetes.io/large-client-header-buffers: "4 8k"