From 5231ab8d1680a66460f7d126d7092315ab0f9e23 Mon Sep 17 00:00:00 2001 From: Vivien Kraus Date: Sun, 27 Jun 2021 22:28:31 +0200 Subject: Merge the identity provider program with webid-oidc --- bootstrap | 2 +- doc/webid-oidc.texi | 6 +- guix/vkraus/packages/webid-oidc.scm | 2 +- guix/vkraus/services/webid-oidc.scm | 5 +- man/Makefile.am | 6 +- po/fr.po | 696 +++++++++++++++++++------------ po/webid-oidc.pot | 380 ++++++++--------- src/Makefile.am | 2 +- src/scm/webid-oidc/identity-provider.scm | 243 ----------- src/scm/webid-oidc/program.scm | 183 +++++++- 10 files changed, 786 insertions(+), 739 deletions(-) diff --git a/bootstrap b/bootstrap index 745ffab..02e9c63 100755 --- a/bootstrap +++ b/bootstrap @@ -4,7 +4,7 @@ autoreconf -vif || exit 1 sed -i 's|SHELL = /bin/sh|SHELL = @SHELL@|g' po/Makefile.in.in || exit 1 ## Prepare the man pages -SCRIPTS_THAT_GET_EXECUTED="../src/webid-oidc-issuer ../src/webid-oidc ../src/webid-oidc-client-service ../src/webid-oidc-example-app" +SCRIPTS_THAT_GET_EXECUTED="../src/webid-oidc ../src/webid-oidc-client-service ../src/webid-oidc-example-app" mkdir -p .native || exit 1 cd .native || exit 1 diff --git a/doc/webid-oidc.texi b/doc/webid-oidc.texi index f7da5b3..6e51bd1 100644 --- a/doc/webid-oidc.texi +++ b/doc/webid-oidc.texi @@ -376,15 +376,15 @@ This project is packaged with a barebones identity provider. It has an authorization endpoint and a token endpoint (and it serves its public keys), but it is only intended for one specific person. -You can start it by invoking the @code{webid-oidc-issuer} program, -with the following options: +You can start it by invoking the @code{webid-oidc} program with the +@code{issuer} command, with the following options: @table @asis @item @code{-h}, or @code{--help} prints a summary of options and exit. @item @code{-v}, or @code{--version} prints the version of the program and exits. -@item @code{-i @var{URI}}, or @code{--issuer=@var{URI}} +@item @code{-n @var{URI}}, or @code{--server-name=@var{URI}} sets the global server name of the identity provider. It should have an empty path. @item @code{-k @var{FILE.jwk}}, or @code{--key-file=@var{FILE.jwk}} diff --git a/guix/vkraus/packages/webid-oidc.scm b/guix/vkraus/packages/webid-oidc.scm index 8ada121..eddd511 100644 --- a/guix/vkraus/packages/webid-oidc.scm +++ b/guix/vkraus/packages/webid-oidc.scm @@ -83,7 +83,7 @@ (format #f "~a/bin/webid-oidc-~a" out program) `("GUILE_LOAD_PATH" ":" = ,mod-paths) `("GUILE_LOAD_COMPILED_PATH" ":" = ,go-paths))) - '(client-service example-app hello issuer)))))))) + '(client-service example-app hello)))))))) (native-inputs `(("pkg-config" ,pkg-config) ("guile" ,guile-3.0) diff --git a/guix/vkraus/services/webid-oidc.scm b/guix/vkraus/services/webid-oidc.scm index b648494..d2af344 100644 --- a/guix/vkraus/services/webid-oidc.scm +++ b/guix/vkraus/services/webid-oidc.scm @@ -144,8 +144,9 @@ (prepare-directory "/var/cache/webid-oidc")) (make-forkexec-constructor (list - (string-append #$webid-oidc "/bin/webid-oidc-issuer") - "--issuer" #$issuer + (string-append #$webid-oidc "/bin/webid-oidc") + "identity-provider" + "--server-name" #$issuer "--key-file" #$key-file "--subject" #$subject "--password" #$password diff --git a/man/Makefile.am b/man/Makefile.am index 2832a72..af39c66 100644 --- a/man/Makefile.am +++ b/man/Makefile.am @@ -1,11 +1,7 @@ -dist_man8_MANS = webid-oidc-issuer.man webid-oidc.man webid-oidc-client-service.man +dist_man8_MANS = webid-oidc.man webid-oidc-client-service.man EXTRA_DIST = ./reset-env -webid-oidc-issuer.man: ../src/scm/webid-oidc/identity-provider.scm ../configure.ac - $(AM_V_GEN) ../pre-inst-env ./reset-env $(HELP2MAN) $(srcdir)/../src/webid-oidc-issuer > $@-t - mv $@-t $(srcdir)/$@ - webid-oidc.man: ../src/scm/webid-oidc/program.scm ../configure.ac $(AM_V_GEN) ../pre-inst-env ./reset-env $(HELP2MAN) $(srcdir)/../src/webid-oidc > $@-t mv $@-t $(srcdir)/$@ diff --git a/po/fr.po b/po/fr.po index cf787bf..d736a5c 100644 --- a/po/fr.po +++ b/po/fr.po @@ -2,8 +2,8 @@ msgid "" msgstr "" "Project-Id-Version: webid-oidc 0.0.0\n" "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n" -"POT-Creation-Date: 2021-06-27 21:10+0200\n" -"PO-Revision-Date: 2021-06-27 21:22+0200\n" +"POT-Creation-Date: 2021-06-27 22:30+0200\n" +"PO-Revision-Date: 2021-06-27 22:41+0200\n" "Last-Translator: Vivien Kraus \n" "Language-Team: French \n" "Language: fr\n" @@ -827,262 +827,6 @@ msgstr "Type d’exception non pris en charge ~a." msgid "Warning: generating a new key pair." msgstr "Attention : génération d'une nouvelle paire de clé." -#: src/scm/webid-oidc/identity-provider.scm:148 -#: src/scm/webid-oidc/hello-world.scm:31 src/scm/webid-oidc/client.scm:619 -#: src/scm/webid-oidc/example-app.scm:100 src/scm/webid-oidc/program.scm:50 -msgid "command-line|version" -msgstr "version" - -#: src/scm/webid-oidc/identity-provider.scm:150 -#: src/scm/webid-oidc/hello-world.scm:33 src/scm/webid-oidc/client.scm:621 -#: src/scm/webid-oidc/example-app.scm:102 -msgid "comand-line|help" -msgstr "aide" - -#: src/scm/webid-oidc/identity-provider.scm:152 -msgid "comand-line|issuer" -msgstr "émetteur" - -#: src/scm/webid-oidc/identity-provider.scm:154 -msgid "comand-line|key-file" -msgstr "fichier-clé" - -#: src/scm/webid-oidc/identity-provider.scm:156 -msgid "comand-line|subject" -msgstr "sujet" - -#: src/scm/webid-oidc/identity-provider.scm:158 -msgid "comand-line|password" -msgstr "mot-de-passe" - -#: src/scm/webid-oidc/identity-provider.scm:160 -msgid "comand-line|jwks-uri" -msgstr "uri-jwks" - -#: src/scm/webid-oidc/identity-provider.scm:162 -msgid "comand-line|authorization-endpoint-uri" -msgstr "uri-terminal-autorisation" - -#: src/scm/webid-oidc/identity-provider.scm:164 -msgid "comand-line|token-endpoint-uri" -msgstr "uri-terminal-jeton" - -#: src/scm/webid-oidc/identity-provider.scm:166 -#: src/scm/webid-oidc/hello-world.scm:35 src/scm/webid-oidc/client.scm:631 -msgid "comand-line|port" -msgstr "port" - -#: src/scm/webid-oidc/identity-provider.scm:168 -#: src/scm/webid-oidc/client.scm:633 src/scm/webid-oidc/program.scm:62 -msgid "comand-line|log-file" -msgstr "fichier-journal" - -#: src/scm/webid-oidc/identity-provider.scm:170 -#: src/scm/webid-oidc/client.scm:635 src/scm/webid-oidc/program.scm:64 -msgid "comand-line|error-file" -msgstr "fichier-erreur" - -#: src/scm/webid-oidc/identity-provider.scm:188 -#, scheme-format -msgid "" -"Usage: ~a [OPTIONS]...\n" -"\n" -"Run the Solid identity provider for a specific user.\n" -"\n" -"Options:\n" -" -h, --~a:\n" -" display this help message and exit.\n" -" -v, --~a:\n" -" display the version information (~a) and exit.\n" -" -i URI, --~a=URI:\n" -" set the public server host name.\n" -" -k FILE, --~a=FILE.jwk:\n" -" set the file name of the key file. If it does not exist, a new\n" -" key is generated.\n" -" -s WEBID, --~a=WEBID:\n" -" set the identity of the subject.\n" -" -w PASSWORD, --~a=PASSWORD:\n" -" set the password to recognize the user.\n" -" -j URI, --~a=URI:\n" -" set the URI to query the key of the server.\n" -" -a URI, --~a=URI:\n" -" set the authorization endpoint of the issuer.\n" -" -t URI, --~a=URI:\n" -" set the token endpoint of the issuer.\n" -" -p PORT, --~a=PORT:\n" -" set the port to bind (instead of 8080).\n" -" -l FILE.log, --~a=FILE.log:\n" -" dump the standard output to that file.\n" -" -e FILE.err, --~a=FILE.err:\n" -" dump the standard error to that file.\n" -"\n" -"Environment variables:\n" -"\n" -" LANG: set the locale of the sysadmin-facing interface (the user\n" -"pages are translated according to the user agent’s Accept-language\n" -"header), for log files and command-line interface. It is currently ~a.\n" -"\n" -" XDG_DATA_HOME: where to store the refresh tokens (under the\n" -"webid-oidc directory). For a system service, it is recommended to set\n" -"it to /var/lib. Currently set to ~a.\n" -"\n" -" XDG_CACHE_HOME: where to store and update the seed file for the\n" -"random number generator. If you remove it, you need to restart the\n" -"program to use a different seed. Currently set to ~a.\n" -"\n" -" HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n" -"computed from the value of the HOME environment variable. It is not\n" -"used otherwise. Currently set to ~a.\n" -"\n" -"Example used in webid-oidc-demo.planete-kraus.eu (except it’s managed\n" -"by shepherd in reality):\n" -"\n" -" export LANG=C\n" -" export XDG_DATA_HOME=/var/lib\n" -" export XDG_CACHE_HOME=/var/cache\n" -" webid-oidc-issuer \\\n" -" --issuer https://webid-oidc-demo.planete-kraus.eu \\\n" -" --key-file /var/lib/webid-oidc/issuer/key.jwk \\\n" -" --subject https://webid-oidc-demo.planete-kraus.eu/profile/card#me \\\n" -" --password \"$PASSWORD\" \\\n" -" --jwks-uri https://webid-oidc-demo.planete-kraus.eu/keys \\\n" -" --authorization-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/" -"authorize \\\n" -" --token-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/token " -"\\\n" -" --port $PORT\n" -"\n" -"If you find a bug, send a report to ~a.\n" -msgstr "" -"Utilisation : ~a [OPTIONS]...\n" -"\n" -"Exécute le fournisseur d’identité Solid pour un utilisateur spécifique.\n" -"\n" -"Options :\n" -" -h, --~a :\n" -" affiche ce message d’aide et quitte.\n" -" -v, --~a :\n" -" affiche le numéro de version (~a) et quitte.\n" -" -i URI, --~a=URI :\n" -" définit le nom public du serveur.\n" -" -k FICHIER, --~a=FICHIER.jwk :\n" -" définit le nom du fichier de clé. S’il n’existe pas, une\n" -" nouvelle clé sera générée.\n" -" -s WEBID, --~a=WEBID :\n" -" définit l’identité du sujet.\n" -" -w MOTDEPASSE, --~a=MOTDEPASSE :\n" -" définit le mot de passe pour reconnaître l’utilisateur.\n" -" -j URI, --~a=URI :\n" -" définit l’URI pour obtenir la clé publique du serveur.\n" -" -a URI, --~a=URI :\n" -" définit le terminal d’autorisation de l’émetteur (authorization\n" -" endpoint).\n" -" -t URI, --~a=URI :\n" -" définit le terminal de jeton de l’émetteur (token endpoint).\n" -" -p PORT, --~a=PORT :\n" -" définit le port à lier (au lieu de 8080).\n" -" -l FICHIER.log, --~a=FICHIER.log :\n" -" déverser la sortie standard vers ce fichier.\n" -" -e FICHIER.err, --~a=FICHIER.err :\n" -" déverser la sortie d’erreur vers ce fichier.\n" -"\n" -"Variables d’environnement :\n" -"\n" -" LANG : définit la locale de l’interface de l’administrateur système\n" -"(les pages utilisateur sont traduites selon l’en-tête Accept-Language\n" -"de l’agent), pour les fichiers de journaux et l’interface en ligne de\n" -"commande. Elle vaut actuellement ~a.\n" -"\n" -" XDG_DATA_HOME : où stocker les jetons de rafraîchissement (refresh\n" -"tokens, dans un sous-dossier webid-oidc). Pour un service système, il\n" -"est recommandé d’affecter /var/lib. Actuellement définie à ~a.\n" -"\n" -" XDG_CACHE_HOME : où stocker et modifier le fichier de graine pour le\n" -"générateur de nombres aléatoires. Si vous le supprimez, vous devez\n" -"redémarrer le programme pour utiliser une graine\n" -"différente. Actuellement définie à ~a.\n" -"\n" -" HOME : si XDG_DATA_HOME ou XDG_CACHE_HOME ne sont pas définies,\n" -"elles sont calculées à partir de la valeur de la variable\n" -"d’environnement HOME. Elle n’est pas utilisée dans les autres\n" -"cas. Actuellement définie à ~a.\n" -"\n" -"Exemple utilisé pour webid-oidc-demo.planete-kraus.eu (sauf que le\n" -"service est géré par shepherd en réalité, et les URI sont en\n" -"anglais) :\n" -"\n" -" export LANG=fr_FR.UTF-8\n" -" export XDG_DATA_HOME=/var/lib\n" -" export XDG_CACHE_HOME=/var/cache\n" -" webid-oidc-issuer \\\n" -" --émetteur https://webid-oidc-demo.planete-kraus.eu \\\n" -" --fichier-clé /var/lib/webid-oidc/émetteur/clé.jwk \\\n" -" --sujet https://webid-oidc-demo.planete-kraus.eu/profil/carte#moi \\\n" -" --mot-de-passe \"$MOTDEPASSE\" \\\n" -" --uri-jwks https://webid-oidc-demo.planete-kraus.eu/clés \\\n" -" --uri-terminal-autorisation https://webid-oidc-demo.planete-kraus.eu/" -"autoriser \\\n" -" --uri-terminal-jeton https://webid-oidc-demo.planete-kraus.eu/jeton " -"\\\n" -" --port $PORT\n" -"\n" -"Si vous trouvez une erreur dans le programme, envoyez-en un rapport à ~a.\n" - -#: src/scm/webid-oidc/identity-provider.scm:267 -#: src/scm/webid-oidc/hello-world.scm:61 src/scm/webid-oidc/client.scm:700 -#: src/scm/webid-oidc/example-app.scm:143 src/scm/webid-oidc/program.scm:177 -#, scheme-format -msgid "~a version ~a\n" -msgstr "~a version ~a\n" - -#: src/scm/webid-oidc/identity-provider.scm:294 -msgid "You need to set the issuer.\n" -msgstr "Vous devez définir l'émetteur.\n" - -#: src/scm/webid-oidc/identity-provider.scm:298 -msgid "You need to set the file name of the key file.\n" -msgstr "Vous devez définir le nom de ficher du fichier de clé.\n" - -#: src/scm/webid-oidc/identity-provider.scm:302 -msgid "You need to set the identity of the subject.\n" -msgstr "Vous devez définir l'identité du sujet.\n" - -#: src/scm/webid-oidc/identity-provider.scm:306 -msgid "You need to set the password to verify the identity of the subject.\n" -msgstr "Vous devez définir le mot de passe pour identifier le sujet.\n" - -#: src/scm/webid-oidc/identity-provider.scm:310 -msgid "You need to set the JWKS URI.\n" -msgstr "Vous devez définir l'URI du JWKS.\n" - -#: src/scm/webid-oidc/identity-provider.scm:315 -msgid "You need to set the authorization endpoint URI.\n" -msgstr "Vous devez définir l'URI du terminal d'autorisation.\n" - -#: src/scm/webid-oidc/identity-provider.scm:320 -msgid "You need to set the token endpoint URI.\n" -msgstr "Vous devez définir l'URI du terminal de jeton.\n" - -#: src/scm/webid-oidc/identity-provider.scm:327 -#: src/scm/webid-oidc/hello-world.scm:72 src/scm/webid-oidc/client.scm:738 -msgid "The port should be a number between 0 and 65535.\n" -msgstr "Le port doit être un nombre entre 0 et 65535.\n" - -#: src/scm/webid-oidc/identity-provider.scm:346 -#: src/scm/webid-oidc/client.scm:749 -#, scheme-format -msgid "~a: Internal server error: ~a\n" -msgstr "~a : Erreur interne du serveur : ~a\n" - -#: src/scm/webid-oidc/identity-provider.scm:357 -#, scheme-format -msgid "" -"The client locale ~s can’t be approximated by system locale ~s (because ~a), " -"using C.\n" -msgstr "" -"La locale du client ~s ne peut pas être approchée par la locale système ~s " -"(parce que ~a), on utilise C.\n" - #: src/scm/webid-oidc/authorization-page-unsafe.scm:29 msgid "xml-lang|en" msgstr "fr" @@ -1226,6 +970,20 @@ msgstr "" msgid "~a: authentication failure: ~a\n" msgstr "~a : échec d’authentificationn : ~a\n" +#: src/scm/webid-oidc/hello-world.scm:31 src/scm/webid-oidc/client.scm:619 +#: src/scm/webid-oidc/example-app.scm:100 src/scm/webid-oidc/program.scm:52 +msgid "command-line|version" +msgstr "version" + +#: src/scm/webid-oidc/hello-world.scm:33 src/scm/webid-oidc/client.scm:621 +#: src/scm/webid-oidc/example-app.scm:102 +msgid "comand-line|help" +msgstr "aide" + +#: src/scm/webid-oidc/hello-world.scm:35 src/scm/webid-oidc/client.scm:631 +msgid "comand-line|port" +msgstr "port" + #: src/scm/webid-oidc/hello-world.scm:44 #, scheme-format msgid "" @@ -1253,6 +1011,16 @@ msgstr "" " -p PORT, --~a=8080 :\n" " définit le port à lier.\n" +#: src/scm/webid-oidc/hello-world.scm:61 src/scm/webid-oidc/client.scm:700 +#: src/scm/webid-oidc/example-app.scm:143 src/scm/webid-oidc/program.scm:268 +#, scheme-format +msgid "~a version ~a\n" +msgstr "~a version ~a\n" + +#: src/scm/webid-oidc/hello-world.scm:72 src/scm/webid-oidc/client.scm:738 +msgid "The port should be a number between 0 and 65535.\n" +msgstr "Le port doit être un nombre entre 0 et 65535.\n" + #: src/scm/webid-oidc/client.scm:623 msgid "comand-line|client-id" msgstr "id-client" @@ -1269,6 +1037,14 @@ msgstr "nom-client" msgid "comand-line|client-uri" msgstr "uri-client" +#: src/scm/webid-oidc/client.scm:633 +msgid "comand-line|log-file" +msgstr "fichier-journal" + +#: src/scm/webid-oidc/client.scm:635 +msgid "comand-line|error-file" +msgstr "fichier-erreur" + #: src/scm/webid-oidc/client.scm:650 #, scheme-format msgid "" @@ -1376,6 +1152,11 @@ msgstr "Vous devez définir l'URI de redirection.\n" msgid "The client URI should be an URI.\n" msgstr "L’URI du client doit être un URI.\n" +#: src/scm/webid-oidc/client.scm:749 src/scm/webid-oidc/program.scm:401 +#, scheme-format +msgid "~a: Internal server error: ~a\n" +msgstr "~a : Erreur interne du serveur : ~a\n" + #: src/scm/webid-oidc/example-app.scm:35 #, scheme-format msgid "~a.\t~a, certified by ~a;\n" @@ -1523,27 +1304,59 @@ msgstr "" msgid "There was an error: ~a\n" msgstr "Il y a eu une erreur : ~a\n" -#: src/scm/webid-oidc/program.scm:52 +#: src/scm/webid-oidc/program.scm:54 msgid "command-line|help" msgstr "aide" -#: src/scm/webid-oidc/program.scm:54 +#: src/scm/webid-oidc/program.scm:56 msgid "command-line|server|port" msgstr "port" -#: src/scm/webid-oidc/program.scm:56 +#: src/scm/webid-oidc/program.scm:58 msgid "command-line|server|server-name" msgstr "nom-du-serveur" -#: src/scm/webid-oidc/program.scm:58 +#: src/scm/webid-oidc/program.scm:60 msgid "command-line|server|reverse-proxy|backend-uri" msgstr "uri-arrière-plan" -#: src/scm/webid-oidc/program.scm:60 +#: src/scm/webid-oidc/program.scm:62 msgid "command-line|server|reverse-proxy|header" msgstr "en-tête" +#: src/scm/webid-oidc/program.scm:64 +msgid "command-line|server|issuer|key-file" +msgstr "fichier-clé" + +#: src/scm/webid-oidc/program.scm:66 +msgid "command-line|server|issuer|subject" +msgstr "sujet" + +#: src/scm/webid-oidc/program.scm:68 +msgid "command-line|server|issuer|password" +msgstr "mot-de-passe" + +#: src/scm/webid-oidc/program.scm:70 +msgid "command-line|server|issuer|jwks-uri" +msgstr "uri-jwks" + +#: src/scm/webid-oidc/program.scm:72 +msgid "command-line|server|issuer|authorization-endpoint-uri" +msgstr "uri-terminal-autorisation" + +#: src/scm/webid-oidc/program.scm:74 +msgid "command-line|server|issuer|token-endpoint-uri" +msgstr "uri-terminal-jeton" + +#: src/scm/webid-oidc/program.scm:76 +msgid "command-line|log-file" +msgstr "fichier-journal" + #: src/scm/webid-oidc/program.scm:78 +msgid "command-line|error-file" +msgstr "fichier-erreur" + +#: src/scm/webid-oidc/program.scm:98 #, scheme-format msgid "" "Usage: ~a COMMAND [OPTIONS]...\n" @@ -1551,8 +1364,10 @@ msgid "" "Run the webid-oidc COMMAND.\n" "\n" "Available commands:\n" -" ~a: \n" +" ~a:\n" " run an authenticating reverse proxy.\n" +" ~a:\n" +" run an identity provider.\n" "\n" "General options:\n" " -h, --~a:\n" @@ -1578,11 +1393,38 @@ msgid "" " set the backend URI for the reverse proxy, only for the\n" " reverse-proxy command.\n" "\n" +"Options for the identity provider:\n" +" -k FILE, --~a=FILE.jwk:\n" +" set the file name of the key file. If it does not exist, a new\n" +" key is generated.\n" +" -s WEBID, --~a=WEBID:\n" +" set the identity of the subject.\n" +" -w PASSWORD, --~a=PASSWORD:\n" +" set the password to recognize the user.\n" +" -j URI, --~a=URI:\n" +" set the URI to query the key of the server.\n" +" -a URI, --~a=URI:\n" +" set the authorization endpoint of the issuer.\n" +" -t URI, --~a=URI:\n" +" set the token endpoint of the issuer.\n" +"\n" "Environment variables:\n" "\n" " LANG: set the locale of the user interface (for the server commands,\n" "the user is the system administrator).~a\n" "\n" +" XDG_DATA_HOME: where the program stores persistent data. The\n" +"identity provider stores the refresh tokens. For a system service, it\n" +"is recommended to set it to /var/lib.~a\n" +"\n" +" XDG_CACHE_HOME: where the program stores and updates the seed file,\n" +"and the web client cache. You can remove this directory at any\n" +"time. The seed file will be initialized from /dev/random.~a\n" +"\n" +" HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n" +"computed from the value of the HOME environment variable. It is not\n" +"used otherwise.~a\n" +"\n" "Running a reverse proxy\n" "\n" "Suppose that you operate data.provider.com. You want to run an\n" @@ -1602,6 +1444,23 @@ msgid "" " --~a '/var/log/proxy.log' \\\n" " --~a '/var/log/proxy.err'\n" "\n" +"Running an identity provider\n" +"\n" +"The identity provider running at webid-oidc-demo.planete-kraus.eu is\n" +"invoked with the following options:\n" +"\n" +" export XDG_DATA_HOME=/var/lib\n" +" export XDG_CACHE_HOME=/var/cache\n" +" ~a ~a \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu' \\\n" +" --~a '/var/lib/webid-oidc/issuer/key.jwk' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/profile/card#me' \\\n" +" --~a \"$PASSWORD\" \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/keys' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/authorize' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\\n" +" --~a $PORT\n" +"\n" "If you find a bug, then please send a report to ~a.\n" msgstr "" "Utilisation : ~a COMMANDE [OPTIONS]...\n" @@ -1611,6 +1470,8 @@ msgstr "" "Commandes disponibles :\n" " ~a :\n" " exécute le proxy inverse authentifiant.\n" +" ~a :\n" +" exécute le fournisseur d’identité.\n" "\n" "Options générales :\n" " -h, --~a :\n" @@ -1629,18 +1490,47 @@ msgstr "" " définit le nom public du serveur (schéma, userinfo, hôte, et port).\n" "\n" "Options pour le proxy inverse :\n" -" -h ENTÊTE, --~a=ENTÊTE :\n" +" -H ENTÊTE, --~a=ENTÊTE :\n" " passe les requêtes avec un ENTÊTE optionnel défini par la valeur\n" " du webid, XXX-Agent par défaut.\n" " -b URI, --~a=URI :\n" " définit l’URI d’arrière-plan pour le proxy inverse, uniquement\n" " pour la commande proxy-inversé.\n" "\n" +"Options pour le fournisseur d’identité :\n" +" -k FICHIER, --~a=FICHIER.jwk :\n" +" définit le nom du fichier de clé. S’il n’existe pas, une\n" +" nouvelle clé sera générée.\n" +" -s WEBID, --~a=WEBID :\n" +" définit l’identité du sujet.\n" +" -w MOTDEPASSE, --~a=MOTDEPASSE :\n" +" définit le mot de passe pour reconnaître l’utilisateur.\n" +" -j URI, --~a=URI :\n" +" définit l’URI à requêter pour obtenir la clé du serveur.\n" +" -a URI, --~a=URI :\n" +" définit le terminal d’autorisation du fournisseur d’identité.\n" +" -t URI, --~a=URI :\n" +" définit le terminal de jeton du fournisseur d’identité.\n" +"\n" "Variables d’environnement :\n" "\n" " LANG : définit la locale de l’interface utilisateur (pour les\n" "commandes serveur, l’utilisateur est l’administrateur système).~a\n" "\n" +" XDG_DATA_HOME : là où le programme sauvegarde les données\n" +"persistantes. Le fournisseur d’identité archive les jetons de\n" +"rafraîchissement. Pour un service système, il est recommandé de la\n" +"définir à /var/lib.~a\n" +"\n" +" XDG_CACHE_HOME : là où le programme sauvegarde et modifie le fichier\n" +"de graine aléatoire, et le cache du client web. Vous pouvez supprimer\n" +"ce dossier n’importe quand. Le fichier de graine sera initialisé à\n" +"partir de /dev/random.~a\n" +"\n" +" HOME : si ni XDG_DATA_HOME ni XDG_CACHE_HOME ne sont définies, elles\n" +"sont calculées à partir de la valeur de la variable d’environnement\n" +"HOME. Elle n’est pas utilisée autrement.~a\n" +"\n" "Exécution d’un proxy inverse\n" "\n" "Supposons que vous opérez donnees.fournisseur.com. Vous voulez\n" @@ -1661,44 +1551,69 @@ msgstr "" " --~a '/var/log/proxy.log' \\\n" " --~a '/var/log/proxy.err'\n" "\n" +"Exécution d’un fournisseur d’identité\n" +"\n" +"Le fournisseur d’identité de nom webid-oidc-demo.planete-kraus.eu est\n" +"invoqué avec les options suivantes :\n" +"\n" +" export LANG=fr_FR.UTF-8\n" +" export XDG_DATA_HOME=/var/lib\n" +" export XDG_CACHE_HOME=/var/cache\n" +" ~a ~a \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu' \\\n" +" --~a '/var/lib/webid-oidc/issuer/key.jwk' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/profile/card#me' \\\n" +" --~a \"$PASSWORD\" \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/keys' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/authorize' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\\n" +" --~a $PORT\n" +"\n" "Si vous trouvez une erreur dans le programme, envoyez-en un rapport à\n" "~a.\n" -#: src/scm/webid-oidc/program.scm:139 src/scm/webid-oidc/program.scm:170 -#: src/scm/webid-oidc/program.scm:236 +#: src/scm/webid-oidc/program.scm:205 src/scm/webid-oidc/program.scm:255 +#: src/scm/webid-oidc/program.scm:341 msgid "command-line|command|reverse-proxy" msgstr "proxy-inversé" -#: src/scm/webid-oidc/program.scm:163 +#: src/scm/webid-oidc/program.scm:206 src/scm/webid-oidc/program.scm:261 +#: src/scm/webid-oidc/program.scm:359 +msgid "command-line|command|identity-provider" +msgstr "fournisseur-identité" + +#: src/scm/webid-oidc/program.scm:236 src/scm/webid-oidc/program.scm:240 +#: src/scm/webid-oidc/program.scm:244 src/scm/webid-oidc/program.scm:248 #, scheme-format msgid "an environment variable| It is currently set to ~s." msgstr " Elle vaut actuellement ~s." -#: src/scm/webid-oidc/program.scm:165 +#: src/scm/webid-oidc/program.scm:238 src/scm/webid-oidc/program.scm:242 +#: src/scm/webid-oidc/program.scm:246 src/scm/webid-oidc/program.scm:250 msgid "an environment variable| It is currently unset." msgstr " Elle n’est actuellement pas définie." -#: src/scm/webid-oidc/program.scm:185 +#: src/scm/webid-oidc/program.scm:276 #, scheme-format msgid "The --~a argument must be a number, not ~s.\n" msgstr "L’argument de --~a doit être un nombre, pas ~s.\n" -#: src/scm/webid-oidc/program.scm:191 +#: src/scm/webid-oidc/program.scm:282 #, scheme-format msgid "The --~a argument must be an integer, not ~s.\n" msgstr "L’argument de --~a doit être un entier, pas ~s.\n" -#: src/scm/webid-oidc/program.scm:197 +#: src/scm/webid-oidc/program.scm:288 #, scheme-format msgid "The --~a argument must be positive, ~s is invalid.\n" msgstr "L’argument de --~a doit être positif, ~s est invalide.\n" -#: src/scm/webid-oidc/program.scm:202 +#: src/scm/webid-oidc/program.scm:293 #, scheme-format msgid "The --~a argument must be less than 65536, ~s is invalid.\n" msgstr "L’argument de --~a doit être inférieur à 65536, ~s est invalide.\n" -#: src/scm/webid-oidc/program.scm:220 +#: src/scm/webid-oidc/program.scm:325 #, scheme-format msgid "" "Usage: ~a COMMAND [OPTIONS]...\n" @@ -1707,21 +1622,248 @@ msgstr "" "Utilisation : ~a COMMANDE [OPTIONS]...\n" "Voir --~a (-h).\n" -#: src/scm/webid-oidc/program.scm:239 +#: src/scm/webid-oidc/program.scm:344 src/scm/webid-oidc/program.scm:362 #, scheme-format msgid "You must pass --~a to set the server name.\n" msgstr "Vous devez passer --~a pour définir le nom du serveur.\n" -#: src/scm/webid-oidc/program.scm:243 +#: src/scm/webid-oidc/program.scm:348 #, scheme-format msgid "You must pass --~a to set the backend URI.\n" msgstr "Vous devez passer --~a pour définir l'URI du service d’arrière-plan.\n" -#: src/scm/webid-oidc/program.scm:255 +#: src/scm/webid-oidc/program.scm:366 +#, scheme-format +msgid "" +"You must pass --~a to set the file where to store the identity provider " +"key.\n" +msgstr "" +"Vous devez passer --~a pour définir le nom du fichier pour sauvegarder\n" +"la clé du fournisseur d’identité.\n" + +#: src/scm/webid-oidc/program.scm:370 +#, scheme-format +msgid "You must pass --~a to set the subject of the identity provider.\n" +msgstr "" +"Vous devez passer --~a pour définir le sujet du fournisseur d’identité.\n" + +#: src/scm/webid-oidc/program.scm:374 +#, scheme-format +msgid "You must pass --~a to set the subject’s password.\n" +msgstr "Vous devez passer --~a pour définir le mot de passe du sujet.\n" + +#: src/scm/webid-oidc/program.scm:378 +#, scheme-format +msgid "You must pass --~a to set the JWKS URI.\n" +msgstr "Vous devez passer --~a pour définir l'URI du JWKS.\n" + +#: src/scm/webid-oidc/program.scm:382 +#, scheme-format +msgid "You must pass --~a to set the authorization endpoint URI.\n" +msgstr "" +"Vous devez passer --~a pour définir l'URI du terminal d'autorisation.\n" + +#: src/scm/webid-oidc/program.scm:386 +#, scheme-format +msgid "You must pass --~a to set the token endpoint URI.\n" +msgstr "Vous devez passer --~a pour définir l'URI du terminal de jeton.\n" + +#: src/scm/webid-oidc/program.scm:412 +#, scheme-format +msgid "" +"The client locale ~s can’t be approximated by system locale ~s (because ~a), " +"using C.\n" +msgstr "" +"La locale du client ~s ne peut pas être approchée par la locale système ~s " +"(parce que ~a), on utilise C.\n" + +#: src/scm/webid-oidc/program.scm:426 #, scheme-format msgid "Unknown command ~s\n" msgstr "Commande inconnue ~s\n" +#~ msgid "comand-line|issuer" +#~ msgstr "émetteur" + +#~ msgid "comand-line|key-file" +#~ msgstr "fichier-clé" + +#~ msgid "comand-line|subject" +#~ msgstr "sujet" + +#~ msgid "comand-line|password" +#~ msgstr "mot-de-passe" + +#~ msgid "comand-line|jwks-uri" +#~ msgstr "uri-jwks" + +#, scheme-format +#~ msgid "" +#~ "Usage: ~a [OPTIONS]...\n" +#~ "\n" +#~ "Run the Solid identity provider for a specific user.\n" +#~ "\n" +#~ "Options:\n" +#~ " -h, --~a:\n" +#~ " display this help message and exit.\n" +#~ " -v, --~a:\n" +#~ " display the version information (~a) and exit.\n" +#~ " -i URI, --~a=URI:\n" +#~ " set the public server host name.\n" +#~ " -k FILE, --~a=FILE.jwk:\n" +#~ " set the file name of the key file. If it does not exist, a new\n" +#~ " key is generated.\n" +#~ " -s WEBID, --~a=WEBID:\n" +#~ " set the identity of the subject.\n" +#~ " -w PASSWORD, --~a=PASSWORD:\n" +#~ " set the password to recognize the user.\n" +#~ " -j URI, --~a=URI:\n" +#~ " set the URI to query the key of the server.\n" +#~ " -a URI, --~a=URI:\n" +#~ " set the authorization endpoint of the issuer.\n" +#~ " -t URI, --~a=URI:\n" +#~ " set the token endpoint of the issuer.\n" +#~ " -p PORT, --~a=PORT:\n" +#~ " set the port to bind (instead of 8080).\n" +#~ " -l FILE.log, --~a=FILE.log:\n" +#~ " dump the standard output to that file.\n" +#~ " -e FILE.err, --~a=FILE.err:\n" +#~ " dump the standard error to that file.\n" +#~ "\n" +#~ "Environment variables:\n" +#~ "\n" +#~ " LANG: set the locale of the sysadmin-facing interface (the user\n" +#~ "pages are translated according to the user agent’s Accept-language\n" +#~ "header), for log files and command-line interface. It is currently ~a.\n" +#~ "\n" +#~ " XDG_DATA_HOME: where to store the refresh tokens (under the\n" +#~ "webid-oidc directory). For a system service, it is recommended to set\n" +#~ "it to /var/lib. Currently set to ~a.\n" +#~ "\n" +#~ " XDG_CACHE_HOME: where to store and update the seed file for the\n" +#~ "random number generator. If you remove it, you need to restart the\n" +#~ "program to use a different seed. Currently set to ~a.\n" +#~ "\n" +#~ " HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n" +#~ "computed from the value of the HOME environment variable. It is not\n" +#~ "used otherwise. Currently set to ~a.\n" +#~ "\n" +#~ "Example used in webid-oidc-demo.planete-kraus.eu (except it’s managed\n" +#~ "by shepherd in reality):\n" +#~ "\n" +#~ " export LANG=C\n" +#~ " export XDG_DATA_HOME=/var/lib\n" +#~ " export XDG_CACHE_HOME=/var/cache\n" +#~ " webid-oidc-issuer \\\n" +#~ " --issuer https://webid-oidc-demo.planete-kraus.eu \\\n" +#~ " --key-file /var/lib/webid-oidc/issuer/key.jwk \\\n" +#~ " --subject https://webid-oidc-demo.planete-kraus.eu/profile/card#me " +#~ "\\\n" +#~ " --password \"$PASSWORD\" \\\n" +#~ " --jwks-uri https://webid-oidc-demo.planete-kraus.eu/keys \\\n" +#~ " --authorization-endpoint-uri https://webid-oidc-demo.planete-kraus." +#~ "eu/authorize \\\n" +#~ " --token-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/token " +#~ "\\\n" +#~ " --port $PORT\n" +#~ "\n" +#~ "If you find a bug, send a report to ~a.\n" +#~ msgstr "" +#~ "Utilisation : ~a [OPTIONS]...\n" +#~ "\n" +#~ "Exécute le fournisseur d’identité Solid pour un utilisateur spécifique.\n" +#~ "\n" +#~ "Options :\n" +#~ " -h, --~a :\n" +#~ " affiche ce message d’aide et quitte.\n" +#~ " -v, --~a :\n" +#~ " affiche le numéro de version (~a) et quitte.\n" +#~ " -i URI, --~a=URI :\n" +#~ " définit le nom public du serveur.\n" +#~ " -k FICHIER, --~a=FICHIER.jwk :\n" +#~ " définit le nom du fichier de clé. S’il n’existe pas, une\n" +#~ " nouvelle clé sera générée.\n" +#~ " -s WEBID, --~a=WEBID :\n" +#~ " définit l’identité du sujet.\n" +#~ " -w MOTDEPASSE, --~a=MOTDEPASSE :\n" +#~ " définit le mot de passe pour reconnaître l’utilisateur.\n" +#~ " -j URI, --~a=URI :\n" +#~ " définit l’URI pour obtenir la clé publique du serveur.\n" +#~ " -a URI, --~a=URI :\n" +#~ " définit le terminal d’autorisation de l’émetteur (authorization\n" +#~ " endpoint).\n" +#~ " -t URI, --~a=URI :\n" +#~ " définit le terminal de jeton de l’émetteur (token endpoint).\n" +#~ " -p PORT, --~a=PORT :\n" +#~ " définit le port à lier (au lieu de 8080).\n" +#~ " -l FICHIER.log, --~a=FICHIER.log :\n" +#~ " déverser la sortie standard vers ce fichier.\n" +#~ " -e FICHIER.err, --~a=FICHIER.err :\n" +#~ " déverser la sortie d’erreur vers ce fichier.\n" +#~ "\n" +#~ "Variables d’environnement :\n" +#~ "\n" +#~ " LANG : définit la locale de l’interface de l’administrateur système\n" +#~ "(les pages utilisateur sont traduites selon l’en-tête Accept-Language\n" +#~ "de l’agent), pour les fichiers de journaux et l’interface en ligne de\n" +#~ "commande. Elle vaut actuellement ~a.\n" +#~ "\n" +#~ " XDG_DATA_HOME : où stocker les jetons de rafraîchissement (refresh\n" +#~ "tokens, dans un sous-dossier webid-oidc). Pour un service système, il\n" +#~ "est recommandé d’affecter /var/lib. Actuellement définie à ~a.\n" +#~ "\n" +#~ " XDG_CACHE_HOME : où stocker et modifier le fichier de graine pour le\n" +#~ "générateur de nombres aléatoires. Si vous le supprimez, vous devez\n" +#~ "redémarrer le programme pour utiliser une graine\n" +#~ "différente. Actuellement définie à ~a.\n" +#~ "\n" +#~ " HOME : si XDG_DATA_HOME ou XDG_CACHE_HOME ne sont pas définies,\n" +#~ "elles sont calculées à partir de la valeur de la variable\n" +#~ "d’environnement HOME. Elle n’est pas utilisée dans les autres\n" +#~ "cas. Actuellement définie à ~a.\n" +#~ "\n" +#~ "Exemple utilisé pour webid-oidc-demo.planete-kraus.eu (sauf que le\n" +#~ "service est géré par shepherd en réalité, et les URI sont en\n" +#~ "anglais) :\n" +#~ "\n" +#~ " export LANG=fr_FR.UTF-8\n" +#~ " export XDG_DATA_HOME=/var/lib\n" +#~ " export XDG_CACHE_HOME=/var/cache\n" +#~ " webid-oidc-issuer \\\n" +#~ " --émetteur https://webid-oidc-demo.planete-kraus.eu \\\n" +#~ " --fichier-clé /var/lib/webid-oidc/émetteur/clé.jwk \\\n" +#~ " --sujet https://webid-oidc-demo.planete-kraus.eu/profil/carte#moi " +#~ "\\\n" +#~ " --mot-de-passe \"$MOTDEPASSE\" \\\n" +#~ " --uri-jwks https://webid-oidc-demo.planete-kraus.eu/clés \\\n" +#~ " --uri-terminal-autorisation https://webid-oidc-demo.planete-kraus." +#~ "eu/autoriser \\\n" +#~ " --uri-terminal-jeton https://webid-oidc-demo.planete-kraus.eu/jeton " +#~ "\\\n" +#~ " --port $PORT\n" +#~ "\n" +#~ "Si vous trouvez une erreur dans le programme, envoyez-en un rapport à " +#~ "~a.\n" + +#~ msgid "You need to set the issuer.\n" +#~ msgstr "Vous devez définir l'émetteur.\n" + +#~ msgid "You need to set the file name of the key file.\n" +#~ msgstr "Vous devez définir le nom de ficher du fichier de clé.\n" + +#~ msgid "You need to set the identity of the subject.\n" +#~ msgstr "Vous devez définir l'identité du sujet.\n" + +#~ msgid "" +#~ "You need to set the password to verify the identity of the subject.\n" +#~ msgstr "Vous devez définir le mot de passe pour identifier le sujet.\n" + +#~ msgid "You need to set the JWKS URI.\n" +#~ msgstr "Vous devez définir l'URI du JWKS.\n" + +#~ msgid "You need to set the token endpoint URI.\n" +#~ msgstr "Vous devez définir l'URI du terminal de jeton.\n" + #~ msgid "command-line|inbound-uri" #~ msgstr "uri-entrant" diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot index 84850fc..67e3b0f 100644 --- a/po/webid-oidc.pot +++ b/po/webid-oidc.pot @@ -8,7 +8,7 @@ msgid "" msgstr "" "Project-Id-Version: webid-oidc SNAPSHOT\n" "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n" -"POT-Creation-Date: 2021-06-27 21:10+0200\n" +"POT-Creation-Date: 2021-06-27 22:30+0200\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -794,187 +794,6 @@ msgstr "" msgid "Warning: generating a new key pair." msgstr "" -#: src/scm/webid-oidc/identity-provider.scm:148 -#: src/scm/webid-oidc/hello-world.scm:31 src/scm/webid-oidc/client.scm:619 -#: src/scm/webid-oidc/example-app.scm:100 src/scm/webid-oidc/program.scm:50 -msgid "command-line|version" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:150 -#: src/scm/webid-oidc/hello-world.scm:33 src/scm/webid-oidc/client.scm:621 -#: src/scm/webid-oidc/example-app.scm:102 -msgid "comand-line|help" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:152 -msgid "comand-line|issuer" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:154 -msgid "comand-line|key-file" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:156 -msgid "comand-line|subject" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:158 -msgid "comand-line|password" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:160 -msgid "comand-line|jwks-uri" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:162 -msgid "comand-line|authorization-endpoint-uri" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:164 -msgid "comand-line|token-endpoint-uri" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:166 -#: src/scm/webid-oidc/hello-world.scm:35 src/scm/webid-oidc/client.scm:631 -msgid "comand-line|port" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:168 -#: src/scm/webid-oidc/client.scm:633 src/scm/webid-oidc/program.scm:62 -msgid "comand-line|log-file" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:170 -#: src/scm/webid-oidc/client.scm:635 src/scm/webid-oidc/program.scm:64 -msgid "comand-line|error-file" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:188 -#, scheme-format -msgid "" -"Usage: ~a [OPTIONS]...\n" -"\n" -"Run the Solid identity provider for a specific user.\n" -"\n" -"Options:\n" -" -h, --~a:\n" -" display this help message and exit.\n" -" -v, --~a:\n" -" display the version information (~a) and exit.\n" -" -i URI, --~a=URI:\n" -" set the public server host name.\n" -" -k FILE, --~a=FILE.jwk:\n" -" set the file name of the key file. If it does not exist, a new\n" -" key is generated.\n" -" -s WEBID, --~a=WEBID:\n" -" set the identity of the subject.\n" -" -w PASSWORD, --~a=PASSWORD:\n" -" set the password to recognize the user.\n" -" -j URI, --~a=URI:\n" -" set the URI to query the key of the server.\n" -" -a URI, --~a=URI:\n" -" set the authorization endpoint of the issuer.\n" -" -t URI, --~a=URI:\n" -" set the token endpoint of the issuer.\n" -" -p PORT, --~a=PORT:\n" -" set the port to bind (instead of 8080).\n" -" -l FILE.log, --~a=FILE.log:\n" -" dump the standard output to that file.\n" -" -e FILE.err, --~a=FILE.err:\n" -" dump the standard error to that file.\n" -"\n" -"Environment variables:\n" -"\n" -" LANG: set the locale of the sysadmin-facing interface (the user\n" -"pages are translated according to the user agent’s Accept-language\n" -"header), for log files and command-line interface. It is currently ~a.\n" -"\n" -" XDG_DATA_HOME: where to store the refresh tokens (under the\n" -"webid-oidc directory). For a system service, it is recommended to set\n" -"it to /var/lib. Currently set to ~a.\n" -"\n" -" XDG_CACHE_HOME: where to store and update the seed file for the\n" -"random number generator. If you remove it, you need to restart the\n" -"program to use a different seed. Currently set to ~a.\n" -"\n" -" HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n" -"computed from the value of the HOME environment variable. It is not\n" -"used otherwise. Currently set to ~a.\n" -"\n" -"Example used in webid-oidc-demo.planete-kraus.eu (except it’s managed\n" -"by shepherd in reality):\n" -"\n" -" export LANG=C\n" -" export XDG_DATA_HOME=/var/lib\n" -" export XDG_CACHE_HOME=/var/cache\n" -" webid-oidc-issuer \\\n" -" --issuer https://webid-oidc-demo.planete-kraus.eu \\\n" -" --key-file /var/lib/webid-oidc/issuer/key.jwk \\\n" -" --subject https://webid-oidc-demo.planete-kraus.eu/profile/card#me \\\n" -" --password \"$PASSWORD\" \\\n" -" --jwks-uri https://webid-oidc-demo.planete-kraus.eu/keys \\\n" -" --authorization-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/" -"authorize \\\n" -" --token-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/token " -"\\\n" -" --port $PORT\n" -"\n" -"If you find a bug, send a report to ~a.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:267 -#: src/scm/webid-oidc/hello-world.scm:61 src/scm/webid-oidc/client.scm:700 -#: src/scm/webid-oidc/example-app.scm:143 src/scm/webid-oidc/program.scm:177 -#, scheme-format -msgid "~a version ~a\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:294 -msgid "You need to set the issuer.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:298 -msgid "You need to set the file name of the key file.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:302 -msgid "You need to set the identity of the subject.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:306 -msgid "You need to set the password to verify the identity of the subject.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:310 -msgid "You need to set the JWKS URI.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:315 -msgid "You need to set the authorization endpoint URI.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:320 -msgid "You need to set the token endpoint URI.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:327 -#: src/scm/webid-oidc/hello-world.scm:72 src/scm/webid-oidc/client.scm:738 -msgid "The port should be a number between 0 and 65535.\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:346 -#: src/scm/webid-oidc/client.scm:749 -#, scheme-format -msgid "~a: Internal server error: ~a\n" -msgstr "" - -#: src/scm/webid-oidc/identity-provider.scm:357 -#, scheme-format -msgid "" -"The client locale ~s can’t be approximated by system locale ~s (because ~a), " -"using C.\n" -msgstr "" - #: src/scm/webid-oidc/authorization-page-unsafe.scm:29 msgid "xml-lang|en" msgstr "" @@ -1112,6 +931,20 @@ msgstr "" msgid "~a: authentication failure: ~a\n" msgstr "" +#: src/scm/webid-oidc/hello-world.scm:31 src/scm/webid-oidc/client.scm:619 +#: src/scm/webid-oidc/example-app.scm:100 src/scm/webid-oidc/program.scm:52 +msgid "command-line|version" +msgstr "" + +#: src/scm/webid-oidc/hello-world.scm:33 src/scm/webid-oidc/client.scm:621 +#: src/scm/webid-oidc/example-app.scm:102 +msgid "comand-line|help" +msgstr "" + +#: src/scm/webid-oidc/hello-world.scm:35 src/scm/webid-oidc/client.scm:631 +msgid "comand-line|port" +msgstr "" + #: src/scm/webid-oidc/hello-world.scm:44 #, scheme-format msgid "" @@ -1128,6 +961,16 @@ msgid "" " set the port to bind.\n" msgstr "" +#: src/scm/webid-oidc/hello-world.scm:61 src/scm/webid-oidc/client.scm:700 +#: src/scm/webid-oidc/example-app.scm:143 src/scm/webid-oidc/program.scm:268 +#, scheme-format +msgid "~a version ~a\n" +msgstr "" + +#: src/scm/webid-oidc/hello-world.scm:72 src/scm/webid-oidc/client.scm:738 +msgid "The port should be a number between 0 and 65535.\n" +msgstr "" + #: src/scm/webid-oidc/client.scm:623 msgid "comand-line|client-id" msgstr "" @@ -1144,6 +987,14 @@ msgstr "" msgid "comand-line|client-uri" msgstr "" +#: src/scm/webid-oidc/client.scm:633 +msgid "comand-line|log-file" +msgstr "" + +#: src/scm/webid-oidc/client.scm:635 +msgid "comand-line|error-file" +msgstr "" + #: src/scm/webid-oidc/client.scm:650 #, scheme-format msgid "" @@ -1205,6 +1056,11 @@ msgstr "" msgid "The client URI should be an URI.\n" msgstr "" +#: src/scm/webid-oidc/client.scm:749 src/scm/webid-oidc/program.scm:401 +#, scheme-format +msgid "~a: Internal server error: ~a\n" +msgstr "" + #: src/scm/webid-oidc/example-app.scm:35 #, scheme-format msgid "~a.\t~a, certified by ~a;\n" @@ -1311,27 +1167,59 @@ msgstr "" msgid "There was an error: ~a\n" msgstr "" -#: src/scm/webid-oidc/program.scm:52 +#: src/scm/webid-oidc/program.scm:54 msgid "command-line|help" msgstr "" -#: src/scm/webid-oidc/program.scm:54 +#: src/scm/webid-oidc/program.scm:56 msgid "command-line|server|port" msgstr "" -#: src/scm/webid-oidc/program.scm:56 +#: src/scm/webid-oidc/program.scm:58 msgid "command-line|server|server-name" msgstr "" -#: src/scm/webid-oidc/program.scm:58 +#: src/scm/webid-oidc/program.scm:60 msgid "command-line|server|reverse-proxy|backend-uri" msgstr "" -#: src/scm/webid-oidc/program.scm:60 +#: src/scm/webid-oidc/program.scm:62 msgid "command-line|server|reverse-proxy|header" msgstr "" +#: src/scm/webid-oidc/program.scm:64 +msgid "command-line|server|issuer|key-file" +msgstr "" + +#: src/scm/webid-oidc/program.scm:66 +msgid "command-line|server|issuer|subject" +msgstr "" + +#: src/scm/webid-oidc/program.scm:68 +msgid "command-line|server|issuer|password" +msgstr "" + +#: src/scm/webid-oidc/program.scm:70 +msgid "command-line|server|issuer|jwks-uri" +msgstr "" + +#: src/scm/webid-oidc/program.scm:72 +msgid "command-line|server|issuer|authorization-endpoint-uri" +msgstr "" + +#: src/scm/webid-oidc/program.scm:74 +msgid "command-line|server|issuer|token-endpoint-uri" +msgstr "" + +#: src/scm/webid-oidc/program.scm:76 +msgid "command-line|log-file" +msgstr "" + #: src/scm/webid-oidc/program.scm:78 +msgid "command-line|error-file" +msgstr "" + +#: src/scm/webid-oidc/program.scm:98 #, scheme-format msgid "" "Usage: ~a COMMAND [OPTIONS]...\n" @@ -1339,8 +1227,10 @@ msgid "" "Run the webid-oidc COMMAND.\n" "\n" "Available commands:\n" -" ~a: \n" +" ~a:\n" " run an authenticating reverse proxy.\n" +" ~a:\n" +" run an identity provider.\n" "\n" "General options:\n" " -h, --~a:\n" @@ -1366,11 +1256,38 @@ msgid "" " set the backend URI for the reverse proxy, only for the\n" " reverse-proxy command.\n" "\n" +"Options for the identity provider:\n" +" -k FILE, --~a=FILE.jwk:\n" +" set the file name of the key file. If it does not exist, a new\n" +" key is generated.\n" +" -s WEBID, --~a=WEBID:\n" +" set the identity of the subject.\n" +" -w PASSWORD, --~a=PASSWORD:\n" +" set the password to recognize the user.\n" +" -j URI, --~a=URI:\n" +" set the URI to query the key of the server.\n" +" -a URI, --~a=URI:\n" +" set the authorization endpoint of the issuer.\n" +" -t URI, --~a=URI:\n" +" set the token endpoint of the issuer.\n" +"\n" "Environment variables:\n" "\n" " LANG: set the locale of the user interface (for the server commands,\n" "the user is the system administrator).~a\n" "\n" +" XDG_DATA_HOME: where the program stores persistent data. The\n" +"identity provider stores the refresh tokens. For a system service, it\n" +"is recommended to set it to /var/lib.~a\n" +"\n" +" XDG_CACHE_HOME: where the program stores and updates the seed file,\n" +"and the web client cache. You can remove this directory at any\n" +"time. The seed file will be initialized from /dev/random.~a\n" +"\n" +" HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n" +"computed from the value of the HOME environment variable. It is not\n" +"used otherwise.~a\n" +"\n" "Running a reverse proxy\n" "\n" "Suppose that you operate data.provider.com. You want to run an\n" @@ -1390,61 +1307,124 @@ msgid "" " --~a '/var/log/proxy.log' \\\n" " --~a '/var/log/proxy.err'\n" "\n" +"Running an identity provider\n" +"\n" +"The identity provider running at webid-oidc-demo.planete-kraus.eu is\n" +"invoked with the following options:\n" +"\n" +" export XDG_DATA_HOME=/var/lib\n" +" export XDG_CACHE_HOME=/var/cache\n" +" ~a ~a \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu' \\\n" +" --~a '/var/lib/webid-oidc/issuer/key.jwk' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/profile/card#me' \\\n" +" --~a \"$PASSWORD\" \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/keys' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/authorize' \\\n" +" --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\\n" +" --~a $PORT\n" +"\n" "If you find a bug, then please send a report to ~a.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:139 src/scm/webid-oidc/program.scm:170 -#: src/scm/webid-oidc/program.scm:236 +#: src/scm/webid-oidc/program.scm:205 src/scm/webid-oidc/program.scm:255 +#: src/scm/webid-oidc/program.scm:341 msgid "command-line|command|reverse-proxy" msgstr "" -#: src/scm/webid-oidc/program.scm:163 +#: src/scm/webid-oidc/program.scm:206 src/scm/webid-oidc/program.scm:261 +#: src/scm/webid-oidc/program.scm:359 +msgid "command-line|command|identity-provider" +msgstr "" + +#: src/scm/webid-oidc/program.scm:236 src/scm/webid-oidc/program.scm:240 +#: src/scm/webid-oidc/program.scm:244 src/scm/webid-oidc/program.scm:248 #, scheme-format msgid "an environment variable| It is currently set to ~s." msgstr "" -#: src/scm/webid-oidc/program.scm:165 +#: src/scm/webid-oidc/program.scm:238 src/scm/webid-oidc/program.scm:242 +#: src/scm/webid-oidc/program.scm:246 src/scm/webid-oidc/program.scm:250 msgid "an environment variable| It is currently unset." msgstr "" -#: src/scm/webid-oidc/program.scm:185 +#: src/scm/webid-oidc/program.scm:276 #, scheme-format msgid "The --~a argument must be a number, not ~s.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:191 +#: src/scm/webid-oidc/program.scm:282 #, scheme-format msgid "The --~a argument must be an integer, not ~s.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:197 +#: src/scm/webid-oidc/program.scm:288 #, scheme-format msgid "The --~a argument must be positive, ~s is invalid.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:202 +#: src/scm/webid-oidc/program.scm:293 #, scheme-format msgid "The --~a argument must be less than 65536, ~s is invalid.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:220 +#: src/scm/webid-oidc/program.scm:325 #, scheme-format msgid "" "Usage: ~a COMMAND [OPTIONS]...\n" "See --~a (-h).\n" msgstr "" -#: src/scm/webid-oidc/program.scm:239 +#: src/scm/webid-oidc/program.scm:344 src/scm/webid-oidc/program.scm:362 #, scheme-format msgid "You must pass --~a to set the server name.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:243 +#: src/scm/webid-oidc/program.scm:348 #, scheme-format msgid "You must pass --~a to set the backend URI.\n" msgstr "" -#: src/scm/webid-oidc/program.scm:255 +#: src/scm/webid-oidc/program.scm:366 +#, scheme-format +msgid "" +"You must pass --~a to set the file where to store the identity provider " +"key.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:370 +#, scheme-format +msgid "You must pass --~a to set the subject of the identity provider.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:374 +#, scheme-format +msgid "You must pass --~a to set the subject’s password.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:378 +#, scheme-format +msgid "You must pass --~a to set the JWKS URI.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:382 +#, scheme-format +msgid "You must pass --~a to set the authorization endpoint URI.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:386 +#, scheme-format +msgid "You must pass --~a to set the token endpoint URI.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:412 +#, scheme-format +msgid "" +"The client locale ~s can’t be approximated by system locale ~s (because ~a), " +"using C.\n" +msgstr "" + +#: src/scm/webid-oidc/program.scm:426 #, scheme-format msgid "Unknown command ~s\n" msgstr "" diff --git a/src/Makefile.am b/src/Makefile.am index 1876a55..5932f1d 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1,6 +1,6 @@ lib_LTLIBRARIES += %reldir%/libwebidoidc.la -dist_bin_SCRIPTS += %reldir%/webid-oidc-issuer %reldir%/webid-oidc %reldir%/webid-oidc-hello %reldir%/webid-oidc-client-service %reldir%/webid-oidc-example-app +dist_bin_SCRIPTS += %reldir%/webid-oidc %reldir%/webid-oidc-hello %reldir%/webid-oidc-client-service %reldir%/webid-oidc-example-app AM_CPPFLAGS += -I %reldir% -I $(srcdir)/%reldir% diff --git a/src/scm/webid-oidc/identity-provider.scm b/src/scm/webid-oidc/identity-provider.scm index 8df4386..6f96b44 100644 --- a/src/scm/webid-oidc/identity-provider.scm +++ b/src/scm/webid-oidc/identity-provider.scm @@ -122,246 +122,3 @@ (body (h1 "Resource not found") (p "This OpenID Connect identity provider does not know the resource you are requesting.")))))))))))))))) - -(define-public (main) - (define* (http-get-with-log uri #:key (headers '())) - (define date (date->string (time-utc->date (current-time)))) - (define uri-string (if (uri? uri) (uri->string uri) uri)) - (format (current-error-port) "~a: GET ~a ~s...\n" - date uri-string headers) - (receive (response response-body) (http-get uri #:headers headers) - (if response-body - (format (current-error-port) "~a: GET ~a ~s: ~s ~a bytes\n" - date uri-string headers response - (if (bytevector? response-body) - (bytevector-length response-body) - (string-length response-body))) - (format (current-error-port) "~a: GET ~a ~s: ~s\n" - date uri-string headers response)) - (values response response-body))) - (define cache-http-get - (with-cache #:http-get http-get-with-log)) - (setlocale LC_ALL "") - (bindtextdomain cfg:package cfg:localedir) - (textdomain cfg:package) - (let ((version-sym - (string->symbol (G_ "command-line|version"))) - (help-sym - (string->symbol (G_ "comand-line|help"))) - (issuer-sym - (string->symbol (G_ "comand-line|issuer"))) - (key-file-sym - (string->symbol (G_ "comand-line|key-file"))) - (subject-sym - (string->symbol (G_ "comand-line|subject"))) - (password-sym - (string->symbol (G_ "comand-line|password"))) - (jwks-uri-sym - (string->symbol (G_ "comand-line|jwks-uri"))) - (authorization-endpoint-uri-sym - (string->symbol (G_ "comand-line|authorization-endpoint-uri"))) - (token-endpoint-uri-sym - (string->symbol (G_ "comand-line|token-endpoint-uri"))) - (port-sym - (string->symbol (G_ "comand-line|port"))) - (log-file-sym - (string->symbol (G_ "comand-line|log-file"))) - (error-file-sym - (string->symbol (G_ "comand-line|error-file")))) - (let ((options - (let ((option-spec - `((,version-sym (single-char #\v) (value #f)) - (,help-sym (single-char #\h) (value #f)) - (,issuer-sym (single-char #\i) (value #t)) - (,key-file-sym (single-char #\k) (value #t)) - (,subject-sym (single-char #\s) (value #t)) - (,password-sym (single-char #\w) (value #t)) - (,jwks-uri-sym (single-char #\j) (value #t)) - (,authorization-endpoint-uri-sym (single-char #\a) (value #t)) - (,token-endpoint-uri-sym (single-char #\t) (value #t)) - (,port-sym (single-char #\p) (value #t)) - (,log-file-sym (single-char #\l) (value #t)) - (,error-file-sym (single-char #\e) (value #t))))) - (getopt-long (command-line) option-spec)))) - (cond - ((option-ref options help-sym #f) - (format #t (G_ "Usage: ~a [OPTIONS]... - -Run the Solid identity provider for a specific user. - -Options: - -h, --~a: - display this help message and exit. - -v, --~a: - display the version information (~a) and exit. - -i URI, --~a=URI: - set the public server host name. - -k FILE, --~a=FILE.jwk: - set the file name of the key file. If it does not exist, a new - key is generated. - -s WEBID, --~a=WEBID: - set the identity of the subject. - -w PASSWORD, --~a=PASSWORD: - set the password to recognize the user. - -j URI, --~a=URI: - set the URI to query the key of the server. - -a URI, --~a=URI: - set the authorization endpoint of the issuer. - -t URI, --~a=URI: - set the token endpoint of the issuer. - -p PORT, --~a=PORT: - set the port to bind (instead of 8080). - -l FILE.log, --~a=FILE.log: - dump the standard output to that file. - -e FILE.err, --~a=FILE.err: - dump the standard error to that file. - -Environment variables: - - LANG: set the locale of the sysadmin-facing interface (the user -pages are translated according to the user agent’s Accept-language -header), for log files and command-line interface. It is currently ~a. - - XDG_DATA_HOME: where to store the refresh tokens (under the -webid-oidc directory). For a system service, it is recommended to set -it to /var/lib. Currently set to ~a. - - XDG_CACHE_HOME: where to store and update the seed file for the -random number generator. If you remove it, you need to restart the -program to use a different seed. Currently set to ~a. - - HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are -computed from the value of the HOME environment variable. It is not -used otherwise. Currently set to ~a. - -Example used in webid-oidc-demo.planete-kraus.eu (except it’s managed -by shepherd in reality): - - export LANG=C - export XDG_DATA_HOME=/var/lib - export XDG_CACHE_HOME=/var/cache - webid-oidc-issuer \\ - --issuer https://webid-oidc-demo.planete-kraus.eu \\ - --key-file /var/lib/webid-oidc/issuer/key.jwk \\ - --subject https://webid-oidc-demo.planete-kraus.eu/profile/card#me \\ - --password \"$PASSWORD\" \\ - --jwks-uri https://webid-oidc-demo.planete-kraus.eu/keys \\ - --authorization-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/authorize \\ - --token-endpoint-uri https://webid-oidc-demo.planete-kraus.eu/token \\ - --port $PORT - -If you find a bug, send a report to ~a. -") - (car (command-line)) - help-sym version-sym - cfg:version - issuer-sym key-file-sym subject-sym password-sym - jwks-uri-sym authorization-endpoint-uri-sym - token-endpoint-uri-sym port-sym log-file-sym error-file-sym - (or (getenv "LANG") "") - (or (getenv "XDG_DATA_HOME") "") - (or (getenv "XDG_CACHE_HOME") "") - (or (getenv "HOME") "") - cfg:package-bugreport)) - ((option-ref options version-sym #f) - (format #t (G_ "~a version ~a\n") - cfg:package cfg:version)) - (else - (let ((issuer (option-ref options issuer-sym #f)) - (key-file (option-ref options key-file-sym #f)) - (subject (option-ref options subject-sym #f)) - (password (option-ref options password-sym #f)) - (jwks-uri (option-ref options jwks-uri-sym #f)) - (authorization-endpoint-uri - (option-ref options authorization-endpoint-uri-sym #f)) - (token-endpoint-uri - (option-ref options token-endpoint-uri-sym #f)) - (port-string - (option-ref options port-sym "8080")) - (log-file-string - (option-ref options log-file-sym #f)) - (error-file-string - (option-ref options error-file-sym #f)) - (jti-list (make-jti-list))) - (when log-file-string - (set-current-output-port (stubs:open-output-file* log-file-string)) - (setvbuf (current-output-port) 'none)) - (when error-file-string - (set-current-error-port (stubs:open-output-file* error-file-string)) - (setvbuf (current-error-port) 'none)) - (unless (and issuer (string->uri issuer)) - (format (current-error-port) - (G_ "You need to set the issuer.\n")) - (exit 1)) - (unless key-file - (format (current-error-port) - (G_ "You need to set the file name of the key file.\n")) - (exit 1)) - (unless (and subject (string->uri subject)) - (format (current-error-port) - (G_ "You need to set the identity of the subject.\n")) - (exit 1)) - (unless password - (format (current-error-port) - (G_ "You need to set the password to verify the identity of the subject.\n")) - (exit 1)) - (unless (and jwks-uri (string->uri jwks-uri)) - (format (current-error-port) - (G_ "You need to set the JWKS URI.\n")) - (exit 1)) - (unless (and authorization-endpoint-uri - (string->uri authorization-endpoint-uri)) - (format (current-error-port) - (G_ "You need to set the authorization endpoint URI.\n")) - (exit 1)) - (unless (and token-endpoint-uri - (string->uri token-endpoint-uri)) - (format (current-error-port) - (G_ "You need to set the token endpoint URI.\n")) - (exit 1)) - (unless (and (string->number port-string) - (integer? (string->number port-string)) - (>= (string->number port-string) 0) - (<= (string->number port-string) 65535)) - (format (current-error-port) - (G_ "The port should be a number between 0 and 65535.\n")) - (exit 1)) - (let ((handler - (make-identity-provider - (string->uri issuer) - key-file - (string->uri subject) - password - (string->uri jwks-uri) - (string->uri authorization-endpoint-uri) - (string->uri token-endpoint-uri) - jti-list - #:current-time current-time - #:http-get cache-http-get))) - (let ((handler-with-log - (lambda (request request-body) - (with-exception-handler - (lambda (error) - (format (current-error-port) - (G_ "~a: Internal server error: ~a\n") - (date->string (time-utc->date (current-time))) - (error->str error)) - (values - (build-response #:code 500 - #:reason-phrase "Internal Server Error") - "Sorry, there was an error.")) - (lambda () - (with-exception-handler - (lambda (error) - (format (current-error-port) - (G_ "The client locale ~s can’t be approximated by system locale ~s (because ~a), using C.\n") - ((record-accessor &unknown-client-locale 'web-locale) error) - ((record-accessor &unknown-client-locale 'c-locale) error) - (error->str error))) - (lambda () - (handler request request-body)) - #:unwind? #t - #:unwind-for-type &unknown-client-locale)) - #:unwind? #t)))) - (install-suspendable-ports!) - (run-server handler-with-log 'http (list #:port (string->number port-string))))))))))) diff --git a/src/scm/webid-oidc/program.scm b/src/scm/webid-oidc/program.scm index b8878b0..3582eaa 100644 --- a/src/scm/webid-oidc/program.scm +++ b/src/scm/webid-oidc/program.scm @@ -1,6 +1,8 @@ (define-module (webid-oidc program) #:use-module (webid-oidc errors) #:use-module (webid-oidc reverse-proxy) + #:use-module (webid-oidc identity-provider) + #:use-module (webid-oidc jti) #:use-module ((webid-oidc stubs) #:prefix stubs:) #:use-module ((webid-oidc config) #:prefix cfg:) #:use-module (ice-9 optargs) @@ -58,16 +60,34 @@ (string->symbol (G_ "command-line|server|reverse-proxy|backend-uri"))) (header-sym (string->symbol (G_ "command-line|server|reverse-proxy|header"))) + (key-file-sym + (string->symbol (G_ "command-line|server|issuer|key-file"))) + (subject-sym + (string->symbol (G_ "command-line|server|issuer|subject"))) + (password-sym + (string->symbol (G_ "command-line|server|issuer|password"))) + (jwks-uri-sym + (string->symbol (G_ "command-line|server|issuer|jwks-uri"))) + (authorization-endpoint-uri-sym + (string->symbol (G_ "command-line|server|issuer|authorization-endpoint-uri"))) + (token-endpoint-uri-sym + (string->symbol (G_ "command-line|server|issuer|token-endpoint-uri"))) (log-file-sym - (string->symbol (G_ "comand-line|log-file"))) + (string->symbol (G_ "command-line|log-file"))) (error-file-sym - (string->symbol (G_ "comand-line|error-file")))) + (string->symbol (G_ "command-line|error-file")))) (let ((options (let ((spec `((,version-sym (single-char #\v) (value #f)) (,help-sym (single-char #\h) (value #f)) (,log-file-sym (single-char #\l) (value #t)) (,error-file-sym (single-char #\e) (value #t)) + (,key-file-sym (single-char #\k) (value #t)) + (,subject-sym (single-char #\s) (value #t)) + (,password-sym (single-char #\w) (value #t)) + (,jwks-uri-sym (single-char #\j) (value #t)) + (,authorization-endpoint-uri-sym (single-char #\a) (value #t)) + (,token-endpoint-uri-sym (single-char #\t) (value #t)) (,port-sym (single-char #\p) (value #t)) (,server-name-sym (single-char #\n) (value #t)) (,header-sym (single-char #\H) (value #t)) @@ -80,8 +100,10 @@ Run the webid-oidc COMMAND. Available commands: - ~a: + ~a: run an authenticating reverse proxy. + ~a: + run an identity provider. General options: -h, --~a: @@ -107,11 +129,38 @@ Options for the reverse proxy: set the backend URI for the reverse proxy, only for the reverse-proxy command. +Options for the identity provider: + -k FILE, --~a=FILE.jwk: + set the file name of the key file. If it does not exist, a new + key is generated. + -s WEBID, --~a=WEBID: + set the identity of the subject. + -w PASSWORD, --~a=PASSWORD: + set the password to recognize the user. + -j URI, --~a=URI: + set the URI to query the key of the server. + -a URI, --~a=URI: + set the authorization endpoint of the issuer. + -t URI, --~a=URI: + set the token endpoint of the issuer. + Environment variables: LANG: set the locale of the user interface (for the server commands, the user is the system administrator).~a + XDG_DATA_HOME: where the program stores persistent data. The +identity provider stores the refresh tokens. For a system service, it +is recommended to set it to /var/lib.~a + + XDG_CACHE_HOME: where the program stores and updates the seed file, +and the web client cache. You can remove this directory at any +time. The seed file will be initialized from /dev/random.~a + + HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are +computed from the value of the HOME environment variable. It is not +used otherwise.~a + Running a reverse proxy Suppose that you operate data.provider.com. You want to run an @@ -131,12 +180,30 @@ from this reverse proxy. --~a '/var/log/proxy.log' \\ --~a '/var/log/proxy.err' +Running an identity provider + +The identity provider running at webid-oidc-demo.planete-kraus.eu is +invoked with the following options: + + export XDG_DATA_HOME=/var/lib + export XDG_CACHE_HOME=/var/cache + ~a ~a \\ + --~a 'https://webid-oidc-demo.planete-kraus.eu' \\ + --~a '/var/lib/webid-oidc/issuer/key.jwk' \\ + --~a 'https://webid-oidc-demo.planete-kraus.eu/profile/card#me' \\ + --~a \"$PASSWORD\" \\ + --~a 'https://webid-oidc-demo.planete-kraus.eu/keys' \\ + --~a 'https://webid-oidc-demo.planete-kraus.eu/authorize' \\ + --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\ + --~a $PORT + If you find a bug, then please send a report to ~a. ") ;; Usage: (car (command-line)) ;; Available commands: (G_ "command-line|command|reverse-proxy") + (G_ "command-line|command|identity-provider") ;; General options ;; help help-sym @@ -157,12 +224,30 @@ If you find a bug, then please send a report to ~a. header-sym ;; backend-uri backend-uri-sym + ;; Options for the identity provider + key-file-sym + subject-sym + password-sym + jwks-uri-sym + authorization-endpoint-uri-sym + token-endpoint-uri-sym ;; Environment variables - ;; LANG (if (getenv "LANG") (format #f (G_ "an environment variable| It is currently set to ~s.") (getenv "LANG")) (G_ "an environment variable| It is currently unset.")) + (if (getenv "XDG_DATA_HOME") + (format #f (G_ "an environment variable| It is currently set to ~s.") + (getenv "XDG_DATA_HOME")) + (G_ "an environment variable| It is currently unset.")) + (if (getenv "XDG_CACHE_HOME") + (format #f (G_ "an environment variable| It is currently set to ~s.") + (getenv "XDG_CACHE_HOME")) + (G_ "an environment variable| It is currently unset.")) + (if (getenv "HOME") + (format #f (G_ "an environment variable| It is currently set to ~s.") + (getenv "HOME")) + (G_ "an environment variable| It is currently unset.")) ;; Running a reverse proxy ;; Program name (car (command-line)) @@ -171,6 +256,12 @@ If you find a bug, then please send a report to ~a. ;; options port-sym server-name-sym backend-uri-sym header-sym log-file-sym error-file-sym + ;; Running an identity provider + (car (command-line)) + (G_ "command-line|command|identity-provider") + server-name-sym key-file-sym subject-sym password-sym + jwks-uri-sym authorization-endpoint-uri-sym + token-endpoint-uri-sym port-sym ;; Bug report cfg:package-bugreport)) ((option-ref options version-sym #f) @@ -214,7 +305,21 @@ If you find a bug, then please send a report to ~a. (header (let ((str (option-ref options header-sym #f))) (and str - (string->symbol str))))) + (string->symbol str)))) + (key-file (option-ref options key-file-sym #f)) + (subject + (let ((str (option-ref options subject-sym #f))) + (and str (string->uri str)))) + (password (option-ref options password-sym #f)) + (jwks-uri + (let ((str (option-ref options jwks-uri-sym #f))) + (and str (string->uri str)))) + (authorization-endpoint-uri + (let ((str (option-ref options authorization-endpoint-uri-sym #f))) + (and str (string->uri str)))) + (token-endpoint-uri + (let ((str (option-ref options token-endpoint-uri-sym #f))) + (and str (string->uri str))))) (when (null? rest) (format (current-error-port) (G_ "Usage: ~a COMMAND [OPTIONS]...\nSee --~a (-h).\n") @@ -251,7 +356,73 @@ If you find a bug, then please send a report to ~a. #:auth-header header) 'http (list #:port port)))) - (else + ((equal? command (G_ "command-line|command|identity-provider")) + (begin + (unless server-name + (format (current-error-port) (G_ "You must pass --~a to set the server name.\n") + server-name-sym) + (exit 1)) + (unless key-file + (format (current-error-port) (G_ "You must pass --~a to set the file where to store the identity provider key.\n") + key-file-sym) + (exit 1)) + (unless subject + (format (current-error-port) (G_ "You must pass --~a to set the subject of the identity provider.\n") + subject-sym) + (exit 1)) + (unless password + (format (current-error-port) (G_ "You must pass --~a to set the subject’s password.\n") + password-sym) + (exit 1)) + (unless jwks-uri + (format (current-error-port) (G_ "You must pass --~a to set the JWKS URI.\n") + jwks-uri-sym) + (exit 1)) + (unless authorization-endpoint-uri + (format (current-error-port) (G_ "You must pass --~a to set the authorization endpoint URI.\n") + authorization-endpoint-uri-sym) + (exit 1)) + (unless token-endpoint-uri + (format (current-error-port) (G_ "You must pass --~a to set the token endpoint URI.\n") + token-endpoint-uri-sym) + (exit 1)) + (let ((handler + (make-identity-provider + server-name key-file subject password jwks-uri + authorization-endpoint-uri token-endpoint-uri + (make-jti-list) + #:current-time current-time + #:http-get cache-http-get))) + (let ((handler-with-log + (lambda (request request-body) + (with-exception-handler + (lambda (error) + (format (current-error-port) + (G_ "~a: Internal server error: ~a\n") + (date->string (time-utc->date (current-time))) + (error->str error)) + (values + (build-response #:code 500 + #:reason-phrase "Internal Server Error") + "Sorry, there was an error.")) + (lambda () + (with-exception-handler + (lambda (error) + (format (current-error-port) + (G_ "The client locale ~s can’t be approximated by system locale ~s (because ~a), using C.\n") + ((record-accessor &unknown-client-locale 'web-locale) error) + ((record-accessor &unknown-client-locale 'c-locale) error) + (error->str error))) + (lambda () + (handler request request-body)) + #:unwind? #t + #:unwind-for-type &unknown-client-locale)) + #:unwind? #t)))) + (run-server + handler-with-log + 'http + (list #:port port)))))) + (else (format (current-error-port) (G_ "Unknown command ~s\n") command) (exit 1)))))))))) -- cgit v1.2.3