[oidc-discovery-provider] Fix keys url

support/oidc-discovery-provider/config.go

@@ -81,6 +81,15 @@ type Config struct {
 
 	// JWTIssuer specifies the issuer for the OIDC provider configuration request.
 	JWTIssuer string `hcl:"jwt_issuer"`
+
+	// JWKSURI specifies the absolute uri to the jwks keys document. Use this if you are fronting the
+	// discovery provider with a load balancer or reverse proxy
+	JWKSURI string `hcl:"jwks_uri"`
+
+	// ServerPathPrefix specifies the prefix to strip from the path of requests to route to the server.
+	// Example: if ServerPathPrefix is /foo then a request to http://127.0.0.1/foo/.well-known/openid-configuration and
+	// http://127.0.0.1/foo/keys will function with the server.
+	ServerPathPrefix string `hcl:"server_path_prefix"`
 }
 
 type ServingCertFileConfig struct {
@@ -308,6 +317,12 @@ func ParseConfig(hclConfig string) (_ *Config, err error) {
 			return nil, errors.New("the jwt_issuer url must contain a host")
 		}
 	}
+	if c.JWKSURI != "" {
+		jwksURI, err := url.Parse(c.JWKSURI)
+		if err != nil || jwksURI.Scheme == "" || jwksURI.Host == "" {
+			return nil, fmt.Errorf("the jwks_uri setting could not be parsed: %w", err)
+		}
+	}
 	return c, nil
 }
 

support/oidc-discovery-provider/handler.go

@@ -24,24 +24,40 @@ type Handler struct {
 	allowInsecureScheme bool
 	setKeyUse           bool
 	log                 logrus.FieldLogger
-	jwtIssuer           string
+	jwtIssuer           *url.URL
+	jwksURI             *url.URL
+	serverPathPrefix    string
 
 	http.Handler
 }
 
-func NewHandler(log logrus.FieldLogger, domainPolicy DomainPolicy, source JWKSSource, allowInsecureScheme bool, setKeyUse bool, jwtIssuer string) *Handler {
+func NewHandler(log logrus.FieldLogger, domainPolicy DomainPolicy, source JWKSSource, allowInsecureScheme bool, setKeyUse bool, jwtIssuer *url.URL, jwksURI *url.URL, serverPathPrefix string) *Handler {
+	if serverPathPrefix == "" {
+		serverPathPrefix = "/"
+	}
 	h := &Handler{
 		domainPolicy:        domainPolicy,
 		source:              source,
 		allowInsecureScheme: allowInsecureScheme,
 		setKeyUse:           setKeyUse,
 		log:                 log,
 		jwtIssuer:           jwtIssuer,
+		jwksURI:             jwksURI,
+		serverPathPrefix:    serverPathPrefix,
 	}
 
 	mux := http.NewServeMux()
-	mux.Handle("/.well-known/openid-configuration", handlers.ProxyHeaders(http.HandlerFunc(h.serveWellKnown)))
-	mux.Handle("/keys", http.HandlerFunc(h.serveKeys))
+	wkPath, err := url.JoinPath(serverPathPrefix, "/.well-known/openid-configuration")
+	if err != nil {
+		return nil
+	}
+	jwksPath, err := url.JoinPath(serverPathPrefix, "/keys")
+	if err != nil {
+		return nil
+	}
+
+	mux.Handle(wkPath, handlers.ProxyHeaders(http.HandlerFunc(h.serveWellKnown)))
+	mux.Handle(jwksPath, http.HandlerFunc(h.serveKeys))
 
 	h.Handler = mux
 	return h
@@ -53,35 +69,49 @@ func (h *Handler) serveWellKnown(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var host string
-	var path string
-	var urlScheme string
-	if h.jwtIssuer != "" {
-		jwtIssuerURL, _ := url.Parse(h.jwtIssuer)
-		host = jwtIssuerURL.Host
-		path = jwtIssuerURL.Path
-		urlScheme = jwtIssuerURL.Scheme
+	var issuerURL *url.URL
+	if h.jwtIssuer != nil {
+		issuerURL = &url.URL{
+			Scheme: h.jwtIssuer.Scheme,
+			Host:   h.jwtIssuer.Host,
+			Path:   h.jwtIssuer.Path,
+		}
 	} else {
-		host = r.Host
-		urlScheme = "https"
+		urlScheme := "https"
 		if h.allowInsecureScheme && r.TLS == nil && r.URL.Scheme != "https" {
 			urlScheme = "http"
 		}
+		issuerURL = &url.URL{
+			Scheme: urlScheme,
+			Host:   r.Host,
+		}
 	}
 
-	if err := h.verifyHost(host); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
+	var jwksURI *url.URL
+	if h.jwksURI != nil {
+		jwksURI = h.jwksURI
+	} else {
+		tmpURLScheme := "https"
+		if h.allowInsecureScheme && r.TLS == nil && r.URL.Scheme != "https" {
+			tmpURLScheme = "http"
+		}
+		keysPath, err := url.JoinPath(h.serverPathPrefix, "keys")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		jwksURI = &url.URL{
+			Scheme: tmpURLScheme,
+			Host:   r.Host,
+			Path:   keysPath,
+		}
 	}
 
-	issuerURL := url.URL{
-		Scheme: urlScheme,
-		Host:   host,
-		Path:   path,
+	if err := h.verifyHost(r.Host); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
 	}
 
-	jwksURI := issuerURL.JoinPath("keys")
-
 	doc := struct {
 		Issuer  string `json:"issuer"`
 		JWKSURI string `json:"jwks_uri"`