Implementing Oauth2 JWKS

Frappe Framework
1

As mentioned here https://github.com/frappe/frappe/issues/6080#issuecomment-497030145 JWKS is not implemented in frappe

Can we override this class methods in https://github.com/frappe/frappe/blob/develop/frappe/integrations/oauth2.py
and add JWKS any how if we are using frappe cloud

Thanks

2
  1. Create custom app
  2. Implement oauth.py in your app instead of frappe.oauth
  3. Refer frappe/integrations/oauth2.py and implement your own endpoints importing your oauth implementation instead of using frappeā€™s
  4. Optionally, in hooks override whitelisted functions from frappe.integrations.oauth2 by functions from your app. Or you need to change endpoints as per your appā€™s module structure.
1 Like
3

thanks @revant_one will try the custom app

4

Frappe uses client_secret (HS256) to sign and verify id_token, if you implement jwks verification then send it as PR, it may be slower than custom app to implement. Itā€™ll be reviewed by frappe developers and community contributors. Itā€™ll help community.

  • private keys: can be added to some ā€œsettingsā€ doctype as child table, it can then also rotate using scheduler events, keep number_of_keys at a time, add new and remove old every rotation_interval days. number_of_keys will always be present at a time.
  • add jwks endpoint to publish public keys
  • ā€œsettingsā€ will specify HS256 or RS256, default to RS256, publish the algo used in frappe.integrations.oauth2.openid_configuration
  • as per algo in settings sign id_token
5

Hi @Dhaval_Dalwadi,
Did you figured out implementing JWKS or something else ?

I am trying to use frappe as auth provider over all my sites/apps running in my kubernetes cluster.
I tried to use oauth2-proxy with frappe, so to not handle any kind of auth etc in my apps. but due to jwks not being implemented it throws 500 after login and never redirects to original url.
Error redeeming code during OAuth2 callback: could not verify id_token: failed to verify token: failed to verify signature: fetching keys oidc: get keys failed Get "": unsupported protocol scheme ""

6

it is not supported.

7

Hi, can you please take a look.

I will try to send a pr.

I am using erpnext in a kubernetes setup and wanted some of my webapps to have frappe as auth provider.
Earlier I was using keycloak with oauth2-proxy(Welcome | OAuth2 Proxy). As it requires JWKS to supported by auth provider. So have tried it and the custom image with this patch just works.
It would be helpful to get some feedback before sending a pr.

1 Like
8

Check comments.
Send it to official frappe/frappe develop branch.

How do you plan to add scope based id_token response?

e.g.

  • the scope openid adds user id,
  • email will add email
  • profile will add name
  • phone will add phone
  • custom will add custom string | json