feat: link oidc credentials when login

cmd/clidoc/main.go

@@ -163,6 +163,8 @@ func init() {
 		"NewInfoSelfServiceLoginCode":                             text.NewInfoSelfServiceLoginCode(),
 		"NewErrorValidationRegistrationRetrySuccessful":           text.NewErrorValidationRegistrationRetrySuccessful(),
 		"NewInfoSelfServiceRegistrationRegisterCode":              text.NewInfoSelfServiceRegistrationRegisterCode(),
+		"NewInfoSelfServiceLoginLinkCredentials":                  text.NewInfoSelfServiceLoginLinkCredentials(),
+		"NewErrorValidationLoginLinkedCredentialsDoNotMatch":      text.NewErrorValidationLoginLinkedCredentialsDoNotMatch(),
 	}
 }
 

schema/errors.go

@@ -349,3 +349,13 @@ func NewLoginCodeInvalid() error {
 		Messages: new(text.Messages).Add(text.NewErrorValidationLoginCodeInvalidOrAlreadyUsed()),
 	})
 }
+
+func NewLinkedCredentialsDoNotMatch() error {
+	return errors.WithStack(&ValidationError{
+		ValidationError: &jsonschema.ValidationError{
+			Message:     `linked credentials do not match`,
+			InstancePtr: "#/",
+		},
+		Messages: new(text.Messages).Add(text.NewErrorValidationLoginLinkedCredentialsDoNotMatch()),
+	})
+}

selfservice/flow/flow.go

@@ -8,18 +8,27 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 
 	"github.com/ory/herodot"
 	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/ui/container"
 	"github.com/ory/kratos/x"
-
-	"github.com/gofrs/uuid"
-
+	"github.com/ory/x/sqlxx"
 	"github.com/ory/x/urlx"
 )
 
+const InternalContextDuplicateCredentialsPath = "registration_duplicate_credentials"
+const InternalContextLinkCredentialsPath = "link_credentials"
+
+type RegistrationDuplicateCredentials struct {
+	CredentialsType     identity.CredentialsType
+	CredentialsConfig   sqlxx.JSONRawMessage
+	DuplicateIdentifier string
+}
+
 func AppendFlowTo(src *url.URL, id uuid.UUID) *url.URL {
 	return urlx.CopyWithQuery(src, url.Values{"flow": {id.String()}})
 }

selfservice/flow/login/.schema/link_credentials.schema.json

@@ -0,0 +1,10 @@
+{
+  "$id": "https://schemas.ory.sh/kratos/selfservice/flow/link_credentials.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "linkCredentialsFlow": {
+      "type": "string"
+    }
+  }
+}

selfservice/flow/login/handler.go

@@ -4,10 +4,15 @@
 package login
 
 import (
+	_ "embed"
+	"encoding/json"
 	"net/http"
 	"net/url"
 	"time"
 
+	"github.com/tidwall/gjson"
+	"github.com/tidwall/sjson"
+
 	"github.com/gofrs/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/pkg/errors"
@@ -32,6 +37,9 @@ import (
 	"github.com/ory/x/urlx"
 )
 
+//go:embed .schema/link_credentials.schema.json
+var linkCredentialsSchema []byte
+
 const (
 	RouteInitBrowserFlow = "/self-service/login/browser"
 	RouteInitAPIFlow     = "/self-service/login/api"
@@ -772,6 +780,37 @@ continueLogin:
 		return
 	}
 
+	internalContextDuplicateCredentials := gjson.GetBytes(f.InternalContext, flow.InternalContextDuplicateCredentialsPath)
+	if internalContextDuplicateCredentials.IsObject() {
+		// If return_to was set before, we need to preserve it.
+		var opts []FlowOption
+		if len(f.ReturnTo) > 0 {
+			opts = append(opts, WithFlowReturnTo(f.ReturnTo))
+		}
+		opts = append(opts, func(newFlow *Flow) {
+			newFlow.UI.Messages.Add(text.NewInfoSelfServiceLoginLinkCredentials())
+			var linkCredentials flow.RegistrationDuplicateCredentials
+			if err := json.Unmarshal([]byte(internalContextDuplicateCredentials.Raw), &linkCredentials); err != nil {
+				h.d.LoginFlowErrorHandler().WriteFlowError(w, r, f, node.DefaultGroup, err)
+				return
+			}
+			newFlow.InternalContext, err = sjson.SetBytes(newFlow.InternalContext, flow.InternalContextLinkCredentialsPath,
+				linkCredentials)
+			if err != nil {
+				h.d.LoginFlowErrorHandler().WriteFlowError(w, r, f, node.DefaultGroup, err)
+				return
+			}
+		})
+		loginFlow, _, err := h.NewLoginFlow(w, r, flow.TypeBrowser, opts...)
+		if err != nil {
+			h.d.LoginFlowErrorHandler().WriteFlowError(w, r, f, node.DefaultGroup, err)
+			return
+		}
+
+		http.Redirect(w, r, loginFlow.AppendTo(h.d.Config().SelfServiceFlowLoginUI(r.Context())).String(), http.StatusSeeOther)
+		return
+	}
+
 	var i *identity.Identity
 	var group node.UiNodeGroup
 	for _, ss := range h.d.AllLoginStrategies() {

selfservice/flow/login/hook.go

@@ -5,10 +5,17 @@ package login
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"time"
 
+	"github.com/gofrs/uuid"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/kratos/schema"
+	"github.com/ory/x/decoderx"
+
 	"go.opentelemetry.io/otel/trace"
 
 	"github.com/ory/kratos/x/events"
@@ -46,6 +53,7 @@ type (
 	executorDependencies interface {
 		config.Provider
 		hydra.Provider
+		identity.PrivilegedPoolProvider
 		session.ManagementProvider
 		session.PersistenceProvider
 		x.CSRFTokenGeneratorProvider
@@ -54,7 +62,9 @@ type (
 		x.TracingProvider
 		sessiontokenexchange.PersistenceProvider
 
+		FlowPersistenceProvider
 		HooksProvider
+		StrategyProvider
 	}
 	HookExecutor struct {
 		d executorDependencies
@@ -128,6 +138,10 @@ func (e *HookExecutor) PostLoginHook(
 	r = r.WithContext(ctx)
 	defer otelx.End(span, &err)
 
+	if err := e.linkCredentials(r, s, i, a); err != nil {
+		return err
+	}
+
 	if err := s.Activate(r, i, e.d.Config(), time.Now().UTC()); err != nil {
 		return err
 	}
@@ -301,3 +315,91 @@ func (e *HookExecutor) PreLoginHook(w http.ResponseWriter, r *http.Request, a *F
 
 	return nil
 }
+
+func (e *HookExecutor) linkCredentials(r *http.Request, s *session.Session, i *identity.Identity, f *Flow) error {
+	var lc flow.RegistrationDuplicateCredentials
+
+	if r.Method == "POST" {
+		var p struct {
+			FlowID string `json:"linkCredentialsFlow" form:"linkCredentialsFlow"`
+		}
+
+		if err := decoderx.NewHTTP().Decode(r, &p,
+			decoderx.HTTPDecoderSetValidatePayloads(true),
+			decoderx.MustHTTPRawJSONSchemaCompiler(linkCredentialsSchema),
+			decoderx.HTTPDecoderJSONFollowsFormFormat()); err != nil {
+			return err
+		}
+
+		if p.FlowID != "" {
+			linkCredentialsFlowID, innerErr := uuid.FromString(p.FlowID)
+			if innerErr != nil {
+				return innerErr
+			}
+			linkCredentialsFlow, innerErr := e.d.LoginFlowPersister().GetLoginFlow(r.Context(), linkCredentialsFlowID)
+			if innerErr != nil {
+				return innerErr
+			}
+			innerErr = e.getInternalContextLinkCredentials(linkCredentialsFlow, flow.InternalContextDuplicateCredentialsPath, &lc)
+			if innerErr != nil {
+				return innerErr
+			}
+		}
+	}
+
+	if lc.CredentialsType == "" {
+		err := e.getInternalContextLinkCredentials(f, flow.InternalContextLinkCredentialsPath, &lc)
+		if err != nil {
+			return err
+		}
+	}
+
+	if lc.CredentialsType != "" {
+		if err := e.checkDuplecateCredentialsIdentifierMatch(r.Context(), i.ID, lc.DuplicateIdentifier); err != nil {
+			return err
+		}
+		strategy, err := e.d.AllLoginStrategies().Strategy(lc.CredentialsType)
+		if err != nil {
+			return err
+		}
+
+		linkableStrategy, ok := strategy.(LinkableStrategy)
+		if !ok {
+			return errors.New(fmt.Sprintf("Strategy is not linkable: %T", linkableStrategy))
+		}
+
+		if err := linkableStrategy.Link(r.Context(), i, lc.CredentialsConfig); err != nil {
+			return err
+		}
+
+		method := strategy.CompletedAuthenticationMethod(r.Context())
+		s.CompletedLoginFor(method.Method, method.AAL)
+	}
+
+	return nil
+}
+
+func (e *HookExecutor) getInternalContextLinkCredentials(f *Flow, internalContextPath string, lc *flow.RegistrationDuplicateCredentials) error {
+	internalContextLinkCredentials := gjson.GetBytes(f.InternalContext, internalContextPath)
+	if internalContextLinkCredentials.IsObject() {
+		if err := json.Unmarshal([]byte(internalContextLinkCredentials.Raw), lc); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (e *HookExecutor) checkDuplecateCredentialsIdentifierMatch(ctx context.Context, identityID uuid.UUID, match string) error {
+	i, err := e.d.PrivilegedIdentityPool().GetIdentityConfidential(ctx, identityID)
+	if err != nil {
+		return err
+	}
+	for _, credentials := range i.Credentials {
+		for _, identifier := range credentials.Identifiers {
+			if identifier == match {
+				return nil
+			}
+		}
+	}
+	return schema.NewLinkedCredentialsDoNotMatch()
+}

selfservice/flow/login/strategy.go

@@ -7,6 +7,8 @@ import (
 	"context"
 	"net/http"
 
+	"github.com/ory/x/sqlxx"
+
 	"github.com/gofrs/uuid"
 
 	"github.com/ory/kratos/session"
@@ -29,6 +31,10 @@ type Strategy interface {
 
 type Strategies []Strategy
 
+type LinkableStrategy interface {
+	Link(ctx context.Context, i *identity.Identity, credentials sqlxx.JSONRawMessage) error
+}
+
 func (s Strategies) Strategy(id identity.CredentialsType) (Strategy, error) {
 	ids := make([]identity.CredentialsType, len(s))
 	for k, ss := range s {

selfservice/flow/registration/flow.go

@@ -11,25 +11,20 @@ import (
 	"time"
 
 	"github.com/gobuffalo/pop/v6"
-
+	"github.com/gofrs/uuid"
+	"github.com/pkg/errors"
 	"github.com/tidwall/gjson"
-
-	"github.com/ory/x/sqlxx"
+	"github.com/tidwall/sjson"
 
 	hydraclientgo "github.com/ory/hydra-client-go/v2"
-
 	"github.com/ory/kratos/driver/config"
 	"github.com/ory/kratos/hydra"
-	"github.com/ory/kratos/ui/container"
-
-	"github.com/gofrs/uuid"
-	"github.com/pkg/errors"
-
-	"github.com/ory/x/urlx"
-
 	"github.com/ory/kratos/identity"
 	"github.com/ory/kratos/selfservice/flow"
+	"github.com/ory/kratos/ui/container"
 	"github.com/ory/kratos/x"
+	"github.com/ory/x/sqlxx"
+	"github.com/ory/x/urlx"
 )
 
 // swagger:model registrationFlow
@@ -267,3 +262,34 @@ func (f *Flow) GetFlowName() flow.FlowName {
 func (f *Flow) SetState(state State) {
 	f.State = state
 }
+
+const internalContextOuterLoginFlowPath = "outer_flow"
+
+type OuterLoginFlow struct {
+	ID string
+}
+
+func (f *Flow) GetOuterLoginFlowID() (*uuid.UUID, error) {
+	la := gjson.GetBytes(f.InternalContext, internalContextOuterLoginFlowPath)
+	if !la.IsObject() {
+		return nil, nil
+	}
+	var internalContextOuterFlow OuterLoginFlow
+	if err := json.Unmarshal([]byte(la.Raw), &internalContextOuterFlow); err != nil {
+		return nil, err
+	}
+	id, err := uuid.FromString(internalContextOuterFlow.ID)
+	if err != nil {
+		return nil, err
+	}
+	return &id, nil
+}
+
+func (f *Flow) SetOuterLoginFlowID(flowID uuid.UUID) error {
+	var err error = nil
+	f.InternalContext, err = sjson.SetBytes(f.InternalContext, internalContextOuterLoginFlowPath,
+		OuterLoginFlow{
+			ID: flowID.String(),
+		})
+	return err
+}