Add OAuth support to cupsd

[michaelrsweet]

This bug is a placeholder for adding OAuth server support to cupsd and figuring out the right default callbacks on different platforms.

[michaelrsweet]

Related to issue #100 which adds the basic client callback support in libcups.

[ShivanshCharak]

Okay so by authorization you mean when we open the localhost:631 it asks for username and password of the machine there we have to add authorization?

[michaelrsweet]

@ShivanshCharak No, this is to integrate support for using OAuth/OpenID with CUPS - on the client side to open a browser window to authorize access, and on the server (cupsd) side to "introspect" the access token to get the authorized user name.

In short, an alternative to the usual username + password stuff.

[yarons]

It's easier to manage from security perspective by allowing having a single identity per employee and auditing (SAML is a good example, think about controlling the paper type and color/b&w centrally in that case).
OpenID Connect is usually for public services authentication such as Google, Facebook, etc., I don't think it's mandatory for such project.

[ShivanshCharak]

@michaelrsweet okay so you mean by using openid we have to do Authorization by poping up the window there we have to give our detail like email or password and by using tge system will give us access

[michaelrsweet]

@ShivanshCharak I appreciate the enthusiasm!

We are finalizing some OAuth things over in the Printer Working Group now, and I hope to post an initial document for discussion this week (I'll add a link here).

Aside from the logistics of what bits of OAuth/OpenID to support, there are also a bunch of security things to think about in implementation to prevent arbitrary programs from collecting access tokens.

[michaelrsweet]

OK, so I've been noodling some things for how to implement this:

• Add an Authorization header store per FQDN (like the "ssl" directory, but for OAuth) with a simple API for getting/setting/clearing tokens
• Also support a CUPS_HTTP_AUTHORIZATION environment variable to specify the Authorization: header to use for non-interactive usage
• Add a command (cupsoauth?) to manage the encrypted store (get/set/clear)
• Add cupsd support for OAuthServer URI directive and AuthType Bearer value to cupsd.conf, with requirement for OpenID/RFC 8414 metadata and JWT usage so that tokens can be introspected locally

For GUI applications, the CPDB UI will need to handle bringing up the OAuth authorization page and collecting the bearer token.

[michaelrsweet]

A lot of this is already implemented. What remains is the server side, so re-titling...

[michaelrsweet]

Some details as I'm getting ready to add this:

• Add MS Entrada ID client_id information to CUPS source code, which becomes the default client_id if none is stored for the current auth server and the auth server URL matches the MS "https://login.microsoftonline.com/TENANT/v2.0" pattern.
• New cups-files.conf directives:
  • OAuthGroup NAME FILENAME: File lists JWT "email" or "sub" values that should map to "@" groups, one per line
  • OAuthServer https://hostname/PATH: URL for authorization server
  • OAuthScopes SCOPE [... SCOPE]: Lists the scopes to ask for, defaults to all of the supported scopes if not specified
• New cupsd.conf [Default]AuthType Bearer directive to enable OAuth
• Map OAuth "name" to requesting-user-name/job-originating-user-name attributes
• Map OAuth "email" to requesting-user-uri/job-originating-user-uri attributes
• Update "@group" auth code to use OAuth lookups for OAuth accounts
• Pass current Bearer token in environment (HTTP_AUTHORIZATION) to CGI programs, so they can pass the value through when sending requests.