Easily addressable PR feedback

cli.go

@@ -116,11 +116,10 @@ func callbackHandler(c *api.Client, mount string, doneCh chan<- loginResp) http.
 	return func(w http.ResponseWriter, req *http.Request) {
 		var response string
 		var secret *api.Secret
-		var err error
 
 		defer func() {
 			w.Write([]byte(response))
-			doneCh <- loginResp{secret, err}
+			doneCh <- loginResp{secret, nil}
 		}()
 
 		// Pull any parameters from either the body or query parameters.
@@ -148,7 +147,7 @@ func callbackHandler(c *api.Client, mount string, doneCh chan<- loginResp) http.
 			delete(data, "id_token")
 		}
 
-		secret, err = c.Logical().ReadWithData(fmt.Sprintf("auth/%s/oidc/callback", mount), data)
+		secret, err := c.Logical().ReadWithData(fmt.Sprintf("auth/%s/oidc/callback", mount), data)
 		if err != nil {
 			summary, detail := parseError(err)
 			response = errorHTML(summary, detail)

path_config.go

@@ -323,7 +323,7 @@ type jwtConfig struct {
 	OIDCClientID         string   `json:"oidc_client_id"`
 	OIDCClientSecret     string   `json:"oidc_client_secret"`
 	OIDCResponseMode     string   `json:"oidc_response_mode"`
-	OIDCResponseTypes    []string `json:"oidc_response_types`
+	OIDCResponseTypes    []string `json:"oidc_response_types"`
 	JWKSURL              string   `json:"jwks_url"`
 	JWKSCAPEM            string   `json:"jwks_ca_pem"`
 	JWTValidationPubKeys []string `json:"jwt_validation_pubkeys"`

path_oidc.go

@@ -39,7 +39,7 @@ type oidcState struct {
 	nonce       string
 	redirectURI string
 	code        string
-	id_token    string
+	idToken     string
 }
 
 func pathOIDC(b *jwtAuthBackend) []*framework.Path {
@@ -115,7 +115,7 @@ func (b *jwtAuthBackend) pathCallbackPost(ctx context.Context, req *logical.Requ
 
 	stateID := d.Get("state").(string)
 	code := d.Get("code").(string)
-	id_token := d.Get("id_token").(string)
+	idToken := d.Get("id_token").(string)
 
 	resp := &logical.Response{
 		Data: map[string]interface{}{
@@ -125,7 +125,7 @@ func (b *jwtAuthBackend) pathCallbackPost(ctx context.Context, req *logical.Requ
 	}
 
 	// Store the provided code and/or token into state, which must already exist.
-	state, err := b.amendState(stateID, code, id_token)
+	state, err := b.amendState(stateID, code, idToken)
 	if err != nil {
 		resp.Data[logical.HTTPRawBody] = []byte(errorHTML(errLoginFailed, "Expired or missing OAuth state."))
 		resp.Data[logical.HTTPStatusCode] = http.StatusBadRequest
@@ -204,10 +204,10 @@ func (b *jwtAuthBackend) pathCallback(ctx context.Context, req *logical.Request,
 	}
 
 	if code == "" {
-		if state.id_token == "" {
+		if state.idToken == "" {
 			return logical.ErrorResponse(errLoginFailed + " No code or id_token received."), nil
 		}
-		rawToken = state.id_token
+		rawToken = state.idToken
 	} else {
 		oauth2Token, err = oauth2Config.Exchange(oidcCtx, code)
 		if err != nil {
@@ -440,15 +440,15 @@ func (b *jwtAuthBackend) createState(rolename, redirectURI string) (string, stri
 	return stateID, nonce, nil
 }
 
-func (b *jwtAuthBackend) amendState(stateID, code, id_token string) (*oidcState, error) {
+func (b *jwtAuthBackend) amendState(stateID, code, idToken string) (*oidcState, error) {
 	stateRaw, ok := b.oidcStates.Get(stateID)
 	if !ok {
 		return nil, errors.New("OIDC state not found")
 	}
 
 	state := stateRaw.(*oidcState)
 	state.code = code
-	state.id_token = id_token
+	state.idToken = idToken
 
 	b.oidcStates.SetDefault(stateID, state)
 
@@ -502,12 +502,10 @@ func validRedirect(uri string, allowed []string) bool {
 
 // parseMount attempts to extract the mount path from a redirect URI.
 func parseMount(redirectURI string) string {
-	parts := strings.Split(redirectURI, "/")
-
-	for i := 0; i+2 < len(parts); i++ {
-		if parts[i] == "v1" && parts[i+1] == "auth" {
-			return parts[i+2]
-		}
+	parts := strings.Split(redirectURI, "/v1/auth/")
+	if len(parts) != 2 {
+		// This doesn't look like an auth engine mount.
+		return ""
 	}
-	return ""
+	return parts[1]
 }

path_oidc_test.go

@@ -942,3 +942,12 @@ func sampleClaims(nonce string) map[string]interface{} {
 		"password": "foo",
 	}
 }
+
+func TestParseMount(t *testing.T) {
+	if result := parseMount("https://example.com/v1/auth/oidc"); result != "oidc" {
+		t.Fatalf("unexpected result: %s", result)
+	}
+	if result := parseMount("https://example.com/v1/auth/oidc/foo"); result != "oidc/foo" {
+		t.Fatalf("unexpected result: %s", result)
+	}
+}