@boxyhq/saml-jackson 1.2.1 → 1.3.0

package/dist/controller/oauth.js

@@ -39,6 +39,7 @@ exports.OAuthController = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const util_1 = require("util");
 const zlib_1 = require("zlib");
+const openid_client_1 = require("openid-client");
 const jose = __importStar(require("jose"));
 const dbutils = __importStar(require("../db/utils"));
 const metrics = __importStar(require("../opentelemetry/metrics"));
@@ -49,8 +50,9 @@ const allowed = __importStar(require("./oauth/allowed"));
 const codeVerifier = __importStar(require("./oauth/code-verifier"));
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
+const x509_1 = __importDefault(require("../saml/x509"));
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
-const validateResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
+const validateSAMLResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
     const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
     if (profile && profile.claims) {
         // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
@@ -83,31 +85,37 @@ function getScopeValues(scope) {
     return typeof scope === 'string' ? scope.split(' ').filter((s) => s.length > 0) : [];
 }
 class OAuthController {
-    constructor({ configStore, sessionStore, codeStore, tokenStore, opts }) {
-        this.configStore = configStore;
+    constructor({ connectionStore, sessionStore, codeStore, tokenStore, opts }) {
+        this.connectionStore = connectionStore;
         this.sessionStore = sessionStore;
         this.codeStore = codeStore;
         this.tokenStore = tokenStore;
         this.opts = opts;
     }
-    resolveMultipleConfigMatches(samlConfigs, idp_hint, originalParams, isIdpFlow = false) {
-        if (samlConfigs.length > 1) {
+    resolveMultipleConnectionMatches(connections, idp_hint, originalParams, isIdpFlow = false) {
+        if (connections.length > 1) {
             if (idp_hint) {
-                return { resolvedSamlConfig: samlConfigs.find(({ clientID }) => clientID === idp_hint) };
+                return { resolvedConnection: connections.find(({ clientID }) => clientID === idp_hint) };
             }
             else if (this.opts.idpDiscoveryPath) {
                 if (!isIdpFlow) {
                     // redirect to IdP selection page
-                    const idpList = samlConfigs.map(({ idpMetadata: { provider }, clientID }) => JSON.stringify({
-                        provider,
-                        clientID,
-                    }));
+                    const idpList = connections.map(({ idpMetadata, oidcProvider, clientID }) => {
+                        var _a;
+                        return JSON.stringify({
+                            provider: (_a = idpMetadata === null || idpMetadata === void 0 ? void 0 : idpMetadata.provider) !== null && _a !== void 0 ? _a : oidcProvider === null || oidcProvider === void 0 ? void 0 : oidcProvider.provider,
+                            clientID,
+                            connectionIsSAML: idpMetadata && typeof idpMetadata === 'object',
+                            connectionIsOIDC: oidcProvider && typeof oidcProvider === 'object',
+                        });
+                    });
                     return {
                         redirect_url: redirect.success(this.opts.externalUrl + this.opts.idpDiscoveryPath, Object.assign(Object.assign({}, originalParams), { idp: idpList })),
                     };
                 }
                 else {
-                    const appList = samlConfigs.map(({ product, name, description, clientID }) => ({
+                    // Relevant to IdP initiated SAML flow
+                    const appList = connections.map(({ product, name, description, clientID }) => ({
                         product,
                         name,
                         description,
@@ -132,29 +140,31 @@ class OAuthController {
     }
     authorize(body) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { response_type = 'code', client_id, redirect_uri, state, tenant, product, access_type, resource, scope, nonce, code_challenge, code_challenge_method = '', 
-            // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            provider = 'saml', idp_hint, } = body;
+            const { response_type = 'code', client_id, redirect_uri, state, scope, nonce, code_challenge, code_challenge_method = '', idp_hint, prompt, } = body;
+            const tenant = 'tenant' in body ? body.tenant : undefined;
+            const product = 'product' in body ? body.product : undefined;
+            const access_type = 'access_type' in body ? body.access_type : undefined;
+            const resource = 'resource' in body ? body.resource : undefined;
             let requestedTenant = tenant;
             let requestedProduct = product;
             metrics.increment('oauthAuthorize');
             if (!redirect_uri) {
                 throw new error_1.JacksonError('Please specify a redirect URL.', 400);
             }
-            let samlConfig;
+            let connection;
             const requestedScopes = getScopeValues(scope);
             const requestedOIDCFlow = requestedScopes.includes('openid');
             if (tenant && product) {
-                const samlConfigs = yield this.configStore.getByIndex({
+                const connections = yield this.connectionStore.getByIndex({
                     name: utils_1.IndexNames.TenantProduct,
                     value: dbutils.keyFromParts(tenant, product),
                 });
-                if (!samlConfigs || samlConfigs.length === 0) {
-                    throw new error_1.JacksonError('SAML configuration not found.', 403);
+                if (!connections || connections.length === 0) {
+                    throw new error_1.JacksonError('IdP connection not found.', 403);
                 }
-                samlConfig = samlConfigs[0];
+                connection = connections[0];
                 // Support multiple matches
-                const { resolvedSamlConfig, redirect_url } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, {
+                const { resolvedConnection, redirect_url } = this.resolveMultipleConnectionMatches(connections, idp_hint, {
                     response_type,
                     client_id,
                     redirect_uri,
@@ -167,17 +177,16 @@ class OAuthController {
                     nonce,
                     code_challenge,
                     code_challenge_method,
-                    provider,
                 });
                 if (redirect_url) {
                     return { redirect_url };
                 }
-                if (resolvedSamlConfig) {
-                    samlConfig = resolvedSamlConfig;
+                if (resolvedConnection) {
+                    connection = resolvedConnection;
                 }
             }
             else if (client_id && client_id !== '' && client_id !== 'undefined' && client_id !== 'null') {
-                // if tenant and product are encoded in the client_id then we parse it and check for the relevant config(s)
+                // if tenant and product are encoded in the client_id then we parse it and check for the relevant connection(s)
                 let sp = getEncodedTenantProduct(client_id);
                 if (!sp && access_type) {
                     sp = getEncodedTenantProduct(access_type);
@@ -194,16 +203,16 @@ class OAuthController {
                 if (sp && sp.tenant && sp.product) {
                     requestedTenant = sp.tenant;
                     requestedProduct = sp.product;
-                    const samlConfigs = yield this.configStore.getByIndex({
+                    const connections = yield this.connectionStore.getByIndex({
                         name: utils_1.IndexNames.TenantProduct,
                         value: dbutils.keyFromParts(sp.tenant, sp.product),
                     });
-                    if (!samlConfigs || samlConfigs.length === 0) {
-                        throw new error_1.JacksonError('SAML configuration not found.', 403);
+                    if (!connections || connections.length === 0) {
+                        throw new error_1.JacksonError('IdP connection not found.', 403);
                     }
-                    samlConfig = samlConfigs[0];
+                    connection = connections[0];
                     // Support multiple matches
-                    const { resolvedSamlConfig, redirect_url } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, {
+                    const { resolvedConnection, redirect_url } = this.resolveMultipleConnectionMatches(connections, idp_hint, {
                         response_type,
                         client_id,
                         redirect_uri,
@@ -216,30 +225,29 @@ class OAuthController {
                         nonce,
                         code_challenge,
                         code_challenge_method,
-                        provider,
                     });
                     if (redirect_url) {
                         return { redirect_url };
                     }
-                    if (resolvedSamlConfig) {
-                        samlConfig = resolvedSamlConfig;
+                    if (resolvedConnection) {
+                        connection = resolvedConnection;
                     }
                 }
                 else {
-                    samlConfig = yield this.configStore.get(client_id);
-                    if (samlConfig) {
-                        requestedTenant = samlConfig.tenant;
-                        requestedProduct = samlConfig.product;
+                    connection = yield this.connectionStore.get(client_id);
+                    if (connection) {
+                        requestedTenant = connection.tenant;
+                        requestedProduct = connection.product;
                     }
                 }
             }
             else {
                 throw new error_1.JacksonError('You need to specify client_id or tenant & product', 403);
             }
-            if (!samlConfig) {
-                throw new error_1.JacksonError('SAML configuration not found.', 403);
+            if (!connection) {
+                throw new error_1.JacksonError('IdP connection not found.', 403);
             }
-            if (!allowed.redirect(redirect_uri, samlConfig.redirectUrl)) {
+            if (!allowed.redirect(redirect_uri, connection.redirectUrl)) {
                 throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
             }
             if (requestedOIDCFlow &&
@@ -271,37 +279,120 @@ class OAuthController {
                     }),
                 };
             }
+            // Connection retrieved: Handover to IdP starts here
             let ssoUrl;
             let post = false;
-            const { sso } = samlConfig.idpMetadata;
-            if ('redirectUrl' in sso) {
-                // HTTP Redirect binding
-                ssoUrl = sso.redirectUrl;
-            }
-            else if ('postUrl' in sso) {
-                // HTTP-POST binding
-                ssoUrl = sso.postUrl;
-                post = true;
+            const connectionIsSAML = connection.idpMetadata && typeof connection.idpMetadata === 'object';
+            const connectionIsOIDC = connection.oidcProvider && typeof connection.oidcProvider === 'object';
+            // Init sessionId
+            const sessionId = crypto_1.default.randomBytes(16).toString('hex');
+            const relayState = utils_1.relayStatePrefix + sessionId;
+            // SAML connection: SAML request will be constructed here
+            let samlReq;
+            if (connectionIsSAML) {
+                const { sso } = connection.idpMetadata;
+                if ('redirectUrl' in sso) {
+                    // HTTP Redirect binding
+                    ssoUrl = sso.redirectUrl;
+                }
+                else if ('postUrl' in sso) {
+                    // HTTP-POST binding
+                    ssoUrl = sso.postUrl;
+                    post = true;
+                }
+                else {
+                    return {
+                        redirect_url: (0, utils_1.OAuthErrorResponse)({
+                            error: 'invalid_request',
+                            error_description: 'SAML binding could not be retrieved',
+                            redirect_uri,
+                            state,
+                        }),
+                    };
+                }
+                try {
+                    const { validTo } = new crypto_1.default.X509Certificate(connection.certs.publicKey);
+                    const isValidExpiry = validTo != 'Bad time value' && new Date(validTo) > new Date();
+                    if (!isValidExpiry) {
+                        const certs = yield x509_1.default.generate();
+                        connection.certs = certs;
+                        if (certs) {
+                            yield this.connectionStore.put(connection.clientID, connection, {
+                                // secondary index on entityID
+                                name: utils_1.IndexNames.EntityID,
+                                value: connection.idpMetadata.entityID,
+                            }, {
+                                // secondary index on tenant + product
+                                name: utils_1.IndexNames.TenantProduct,
+                                value: dbutils.keyFromParts(connection.tenant, connection.product),
+                            });
+                        }
+                        else {
+                            throw new Error('Error generating x509 certs');
+                        }
+                    }
+                    // We will get undefined or Space delimited, case sensitive list of ASCII string values in prompt
+                    // If login is one of the value in prompt we want to enable forceAuthn
+                    // Else use the saml connection forceAuthn value
+                    const promptOptions = prompt ? prompt.split(' ').filter((p) => p === 'login') : [];
+                    samlReq = saml20_1.default.request({
+                        ssoUrl,
+                        entityID: this.opts.samlAudience,
+                        callbackUrl: this.opts.externalUrl + this.opts.samlPath,
+                        signingKey: connection.certs.privateKey,
+                        publicKey: connection.certs.publicKey,
+                        forceAuthn: promptOptions.length > 0 ? true : !!connection.forceAuthn,
+                    });
+                }
+                catch (err) {
+                    return {
+                        redirect_url: (0, utils_1.OAuthErrorResponse)({
+                            error: 'server_error',
+                            error_description: (0, utils_1.getErrorMessage)(err),
+                            redirect_uri,
+                            state,
+                        }),
+                    };
+                }
             }
-            else {
-                return {
-                    redirect_url: (0, utils_1.OAuthErrorResponse)({
-                        error: 'invalid_request',
-                        error_description: 'SAML binding could not be retrieved',
-                        redirect_uri,
-                        state,
-                    }),
-                };
+            // OIDC Connection: Issuer discovery, openid-client init and extraction of authorization endpoint happens here
+            let oidcCodeVerifier;
+            if (connectionIsOIDC) {
+                const { discoveryUrl, clientId, clientSecret } = connection.oidcProvider;
+                try {
+                    const oidcIssuer = yield openid_client_1.Issuer.discover(discoveryUrl);
+                    const oidcClient = new oidcIssuer.Client({
+                        client_id: clientId,
+                        client_secret: clientSecret,
+                        redirect_uris: [this.opts.externalUrl + this.opts.oidcPath],
+                        response_types: ['code'],
+                    });
+                    oidcCodeVerifier = openid_client_1.generators.codeVerifier();
+                    const code_challenge = openid_client_1.generators.codeChallenge(oidcCodeVerifier);
+                    ssoUrl = oidcClient.authorizationUrl({
+                        scope: [...requestedScopes, 'openid', 'email', 'profile']
+                            .filter((value, index, self) => self.indexOf(value) === index) // filter out duplicates
+                            .join(' '),
+                        code_challenge,
+                        code_challenge_method: 'S256',
+                        state: relayState,
+                    });
+                }
+                catch (err) {
+                    if (err) {
+                        return {
+                            redirect_url: (0, utils_1.OAuthErrorResponse)({
+                                error: 'server_error',
+                                error_description: (err === null || err === void 0 ? void 0 : err.error) || (0, utils_1.getErrorMessage)(err),
+                                redirect_uri,
+                                state,
+                            }),
+                        };
+                    }
+                }
             }
+            // Session persistence happens here
             try {
-                const samlReq = saml20_1.default.request({
-                    ssoUrl,
-                    entityID: this.opts.samlAudience,
-                    callbackUrl: this.opts.externalUrl + this.opts.samlPath,
-                    signingKey: samlConfig.certs.privateKey,
-                    publicKey: samlConfig.certs.publicKey,
-                });
-                const sessionId = crypto_1.default.randomBytes(16).toString('hex');
                 const requested = { client_id, state, redirect_uri };
                 if (requestedTenant) {
                     requested.tenant = requestedTenant;
@@ -321,42 +412,58 @@ class OAuthController {
                 if (requestedScopes) {
                     requested.scope = requestedScopes;
                 }
-                yield this.sessionStore.put(sessionId, {
-                    id: samlReq.id,
+                const sessionObj = {
                     redirect_uri,
                     response_type,
                     state,
                     code_challenge,
                     code_challenge_method,
                     requested,
-                });
-                const relayState = utils_1.relayStatePrefix + sessionId;
-                let redirectUrl;
-                let authorizeForm;
-                if (!post) {
-                    // HTTP Redirect binding
-                    redirectUrl = redirect.success(ssoUrl, {
-                        RelayState: relayState,
-                        SAMLRequest: Buffer.from(yield deflateRawAsync(samlReq.request)).toString('base64'),
-                    });
+                };
+                yield this.sessionStore.put(sessionId, connectionIsSAML
+                    ? Object.assign(Object.assign({}, sessionObj), { id: samlReq === null || samlReq === void 0 ? void 0 : samlReq.id }) : Object.assign(Object.assign({}, sessionObj), { id: connection.clientID, oidcCodeVerifier }));
+                // Redirect to IdP
+                if (connectionIsSAML) {
+                    let redirectUrl;
+                    let authorizeForm;
+                    if (!post) {
+                        // HTTP Redirect binding
+                        redirectUrl = redirect.success(ssoUrl, {
+                            RelayState: relayState,
+                            SAMLRequest: Buffer.from(yield deflateRawAsync(samlReq.request)).toString('base64'),
+                        });
+                    }
+                    else {
+                        // HTTP POST binding
+                        authorizeForm = saml20_1.default.createPostForm(ssoUrl, [
+                            {
+                                name: 'RelayState',
+                                value: relayState,
+                            },
+                            {
+                                name: 'SAMLRequest',
+                                value: Buffer.from(samlReq.request).toString('base64'),
+                            },
+                        ]);
+                    }
+                    return {
+                        redirect_url: redirectUrl,
+                        authorize_form: authorizeForm,
+                    };
+                }
+                else if (connectionIsOIDC) {
+                    return { redirect_url: ssoUrl };
                 }
                 else {
-                    // HTTP POST binding
-                    authorizeForm = saml20_1.default.createPostForm(ssoUrl, [
-                        {
-                            name: 'RelayState',
-                            value: relayState,
-                        },
-                        {
-                            name: 'SAMLRequest',
-                            value: Buffer.from(samlReq.request).toString('base64'),
-                        },
-                    ]);
+                    return {
+                        redirect_url: (0, utils_1.OAuthErrorResponse)({
+                            error: 'invalid_request',
+                            error_description: 'Connection appears to be misconfigured',
+                            redirect_uri,
+                            state,
+                        }),
+                    };
                 }
-                return {
-                    redirect_url: redirectUrl,
-                    authorize_form: authorizeForm,
-                };
             }
             catch (err) {
                 return {
@@ -386,22 +493,22 @@ class OAuthController {
             if (!issuer) {
                 throw new error_1.JacksonError('Issuer not found.', 403);
             }
-            const samlConfigs = yield this.configStore.getByIndex({
+            const samlConnections = yield this.connectionStore.getByIndex({
                 name: utils_1.IndexNames.EntityID,
                 value: issuer,
             });
-            if (!samlConfigs || samlConfigs.length === 0) {
-                throw new error_1.JacksonError('SAML configuration not found.', 403);
+            if (!samlConnections || samlConnections.length === 0) {
+                throw new error_1.JacksonError('SAML connection not found.', 403);
             }
-            let samlConfig = samlConfigs[0];
+            let samlConnection = samlConnections[0];
             if (isIdPFlow) {
                 RelayState = '';
-                const { resolvedSamlConfig, app_select_form } = this.resolveMultipleConfigMatches(samlConfigs, idp_hint, { SAMLResponse }, true);
+                const { resolvedConnection, app_select_form } = this.resolveMultipleConnectionMatches(samlConnections, idp_hint, { SAMLResponse }, true);
                 if (app_select_form) {
                     return { app_select_form };
                 }
-                if (resolvedSamlConfig) {
-                    samlConfig = resolvedSamlConfig;
+                if (resolvedConnection) {
+                    samlConnection = resolvedConnection;
                 }
             }
             let session;
@@ -413,33 +520,35 @@ class OAuthController {
             }
             if (!isIdPFlow) {
                 // Resolve if there are multiple matches for SP login. TODO: Support multiple matches for IdP login
-                samlConfig =
-                    samlConfigs.length === 1
-                        ? samlConfigs[0]
-                        : samlConfigs.filter((c) => {
+                samlConnection =
+                    samlConnections.length === 1
+                        ? samlConnections[0]
+                        : samlConnections.filter((c) => {
                             var _a, _b, _c;
                             return (c.clientID === ((_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.client_id) ||
                                 (c.tenant === ((_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.tenant) && c.product === ((_c = session === null || session === void 0 ? void 0 : session.requested) === null || _c === void 0 ? void 0 : _c.product)));
                         })[0];
             }
-            if (!samlConfig) {
-                throw new error_1.JacksonError('SAML configuration not found.', 403);
+            if (!samlConnection) {
+                throw new error_1.JacksonError('SAML connection not found.', 403);
             }
             const validateOpts = {
-                thumbprint: samlConfig.idpMetadata.thumbprint,
+                thumbprint: samlConnection.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,
-                privateKey: samlConfig.certs.privateKey,
+                privateKey: samlConnection.certs.privateKey,
             };
-            if (session && session.redirect_uri && !allowed.redirect(session.redirect_uri, samlConfig.redirectUrl)) {
+            if (session &&
+                session.redirect_uri &&
+                !allowed.redirect(session.redirect_uri, samlConnection.redirectUrl)) {
                 throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
             }
             if (session && session.id) {
                 validateOpts.inResponseTo = session.id;
             }
             let profile;
-            const redirect_uri = (session && session.redirect_uri) || samlConfig.defaultRedirectUrl;
+            const redirect_uri = (session && session.redirect_uri) || samlConnection.defaultRedirectUrl;
             try {
-                profile = yield validateResponse(rawResponse, validateOpts);
+                profile = yield validateSAMLResponse(rawResponse, validateOpts);
             }
             catch (err) {
                 // return error to redirect_uri
@@ -456,8 +565,8 @@ class OAuthController {
             const code = crypto_1.default.randomBytes(20).toString('hex');
             const codeVal = {
                 profile,
-                clientID: samlConfig.clientID,
-                clientSecret: samlConfig.clientSecret,
+                clientID: samlConnection.clientID,
+                clientSecret: samlConnection.clientSecret,
                 requested: session === null || session === void 0 ? void 0 : session.requested,
             };
             if (session) {
@@ -494,6 +603,127 @@ class OAuthController {
             return { redirect_url: redirectUrl };
         });
     }
+    extractOIDCUserProfile(tokenSet, oidcClient) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            const profile = { claims: {} };
+            const idTokenClaims = tokenSet.claims();
+            const userinfo = yield oidcClient.userinfo(tokenSet);
+            profile.claims.id = idTokenClaims.sub;
+            profile.claims.email = (_a = idTokenClaims.email) !== null && _a !== void 0 ? _a : userinfo.email;
+            profile.claims.firstName = (_b = idTokenClaims.given_name) !== null && _b !== void 0 ? _b : userinfo.given_name;
+            profile.claims.lastName = (_c = idTokenClaims.family_name) !== null && _c !== void 0 ? _c : userinfo.family_name;
+            profile.claims.raw = userinfo;
+            return profile;
+        });
+    }
+    oidcAuthzResponse(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { code: opCode, state, error, error_description } = body;
+            let RelayState = state || '';
+            if (!RelayState) {
+                throw new error_1.JacksonError('State from original request is missing.', 403);
+            }
+            RelayState = RelayState.replace(utils_1.relayStatePrefix, '');
+            const session = yield this.sessionStore.get(RelayState);
+            if (!session) {
+                throw new error_1.JacksonError('Unable to validate state from the original request.', 403);
+            }
+            const oidcConnection = yield this.connectionStore.get(session.id);
+            if (session.redirect_uri && !allowed.redirect(session.redirect_uri, oidcConnection.redirectUrl)) {
+                throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
+            }
+            const redirect_uri = (session && session.redirect_uri) || oidcConnection.defaultRedirectUrl;
+            if (error) {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error,
+                        error_description: error_description !== null && error_description !== void 0 ? error_description : 'Authorization failure at OIDC Provider',
+                        redirect_uri,
+                        state: session.state,
+                    }),
+                };
+            }
+            if (!opCode) {
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'server_error',
+                        error_description: 'Authorization code could not be retrieved from OIDC Provider',
+                        redirect_uri,
+                        state: session.state,
+                    }),
+                };
+            }
+            // Reconstruct the oidcClient
+            const { discoveryUrl, clientId, clientSecret } = oidcConnection.oidcProvider;
+            let profile;
+            try {
+                const oidcIssuer = yield openid_client_1.Issuer.discover(discoveryUrl);
+                const oidcClient = new oidcIssuer.Client({
+                    client_id: clientId,
+                    client_secret: clientSecret,
+                    redirect_uris: [this.opts.externalUrl + this.opts.oidcPath],
+                    response_types: ['code'],
+                });
+                const tokenSet = yield oidcClient.callback(this.opts.externalUrl + this.opts.oidcPath, {
+                    code: opCode,
+                }, { code_verifier: session.oidcCodeVerifier });
+                profile = yield this.extractOIDCUserProfile(tokenSet, oidcClient);
+            }
+            catch (err) {
+                if (err) {
+                    return {
+                        redirect_url: (0, utils_1.OAuthErrorResponse)({
+                            error: 'server_error',
+                            error_description: (err === null || err === void 0 ? void 0 : err.error) || (0, utils_1.getErrorMessage)(err),
+                            redirect_uri,
+                            state: session.state,
+                        }),
+                    };
+                }
+            }
+            // store details against a code
+            const code = crypto_1.default.randomBytes(20).toString('hex');
+            const codeVal = {
+                profile,
+                clientID: oidcConnection.clientID,
+                clientSecret: oidcConnection.clientSecret,
+                requested: session === null || session === void 0 ? void 0 : session.requested,
+            };
+            if (session) {
+                codeVal.session = session;
+            }
+            try {
+                yield this.codeStore.put(code, codeVal);
+            }
+            catch (err) {
+                // return error to redirect_uri
+                return {
+                    redirect_url: (0, utils_1.OAuthErrorResponse)({
+                        error: 'server_error',
+                        error_description: (0, utils_1.getErrorMessage)(err),
+                        redirect_uri,
+                        state: session.state,
+                    }),
+                };
+            }
+            const params = {
+                code,
+            };
+            if (session && session.state) {
+                params.state = session.state;
+            }
+            const redirectUrl = redirect.success(redirect_uri, params);
+            // delete the session
+            try {
+                yield this.sessionStore.delete(RelayState);
+            }
+            catch (_err) {
+                // ignore error
+            }
+            return { redirect_url: redirectUrl };
+        });
+    }
     /**
      * @swagger
      *
@@ -515,13 +745,17 @@ class OAuthController {
      *       - name: client_id
      *         in: formData
      *         type: string
-     *         description: Use the client_id returned by the SAML config API
+     *         description: Use the client_id returned by the SAML connection API
      *         required: true
      *       - name: client_secret
      *         in: formData
      *         type: string
-     *         description: Use the client_secret returned by the SAML config API
+     *         description: Use the client_secret returned by the SAML connection API
      *         required: true
+     *       - name: code_verifier
+     *         in: formData
+     *         type: string
+     *         description: code_verifier against the code_challenge in the authz request (relevant to PKCE flow)
      *       - name: redirect_uri
      *         in: formData
      *         type: string
@@ -550,9 +784,12 @@ class OAuthController {
      *             expires_in: 300
      */
     token(body) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e;
         return __awaiter(this, void 0, void 0, function* () {
-            const { client_id, client_secret, code_verifier, code, grant_type = 'authorization_code', redirect_uri, } = body;
+            const { code, grant_type = 'authorization_code', redirect_uri } = body;
+            const client_id = 'client_id' in body ? body.client_id : undefined;
+            const client_secret = 'client_secret' in body ? body.client_secret : undefined;
+            const code_verifier = 'code_verifier' in body ? body.code_verifier : undefined;
             metrics.increment('oauthToken');
             if (grant_type !== 'authorization_code') {
                 throw new error_1.JacksonError('Unsupported grant_type', 400);
@@ -590,6 +827,9 @@ class OAuthController {
                         }
                     }
                     else {
+                        if (sp.tenant !== ((_b = codeVal.requested) === null || _b === void 0 ? void 0 : _b.tenant) || sp.product !== ((_c = codeVal.requested) === null || _c === void 0 ? void 0 : _c.product)) {
+                            throw new error_1.JacksonError('Invalid tenant or product', 401);
+                        }
                         // encoded client_id, verify client_secret
                         if (client_secret !== this.opts.clientSecretVerifier) {
                             throw new error_1.JacksonError('Invalid client_secret', 401);
@@ -608,8 +848,8 @@ class OAuthController {
             // store details against a token
             const token = crypto_1.default.randomBytes(20).toString('hex');
             const tokenVal = Object.assign(Object.assign({}, codeVal.profile), { requested: codeVal.requested });
-            const requestedOIDCFlow = !!((_b = codeVal.requested) === null || _b === void 0 ? void 0 : _b.oidc);
-            const requestHasNonce = !!((_c = codeVal.requested) === null || _c === void 0 ? void 0 : _c.nonce);
+            const requestedOIDCFlow = !!((_d = codeVal.requested) === null || _d === void 0 ? void 0 : _d.oidc);
+            const requestHasNonce = !!((_e = codeVal.requested) === null || _e === void 0 ? void 0 : _e.nonce);
             if (requestedOIDCFlow) {
                 const { jwtSigningKeys, jwsAlg } = this.opts.openid;
                 if (!jwtSigningKeys || !(0, utils_1.isJWSKeyPairLoaded)(jwtSigningKeys)) {
@@ -671,11 +911,21 @@ class OAuthController {
      *               type: string
      *             lastName:
      *               type: string
+     *             raw:
+     *               type: object
+     *             requested:
+     *               type: object
      *           example:
      *             id: 32b5af58fdf
      *             email: jackson@coolstartup.com
      *             firstName: SAML
      *             lastName: Jackson
+     *             raw: {
+     *
+     *             }
+     *             requested: {
+     *
+     *             }
      */
     userInfo(token) {
         return __awaiter(this, void 0, void 0, function* () {