OAuth2 testing scripts

get-oauth2-client.sh

#!/bin/bash
# RFC 7591 OAuth 2.0 Dynamic Client Registration Protocol
set -euo pipefail

BASE_DOMAIN="$1"
OAUTH_META="$(curl -sSfL "https://$BASE_DOMAIN/.well-known/oauth-authorization-server" -H Accept:application/json)"

ISSUER="$(echo "$OAUTH_META" | jq -r '.issuer')"
REGISTRATION_ENDPOINT="$(echo "$OAUTH_META" | jq -r '.registration_endpoint')"

echo "Registering with $ISSUER ..." >&2

if [[ "$4" == https:* ]]; then
	APP_TYPE="web"
else
	APP_TYPE="native"
fi

OAUTH_CLIENT_INFO="$(curl -sSf -H Content-Type:application/json -H Accept:application/json "$REGISTRATION_ENDPOINT" --data-binary \
	"{\"client_name\":\"$2\",\"client_uri\":\"$3\",\"application_type\":\"$APP_TYPE\",\"redirect_uris\":[\"$4\"]}")"

CLIENT_ID="$(echo "$OAUTH_CLIENT_INFO" | jq -r '.client_id')"
CLIENT_SECRET="$(echo "$OAUTH_CLIENT_INFO" | jq -r '.client_secret')"

echo "$CLIENT_ID"
echo "$CLIENT_SECRET"

get-oauth2-meta.sh

#!/bin/bash
# OAuth 2.0 Authorization Server Metadata, OpenID Connect Discovery 1.0
set -euo pipefail
HOST="$1";
shift
curl -sfL "https://$HOST/.well-known/oauth-authorization-server" "$@" || 
curl -sfL "https://$HOST/.well-known/openid-configuration" "$@"

get-oauth2-token.sh

#!/bin/bash
# Dynamic client registration, non-standard OOB redirect URI, retrieve token.
set -euo pipefail

BASE_DOMAIN="$1"
OAUTH_META="$(curl -sSfL "https://$BASE_DOMAIN/.well-known/oauth-authorization-server" -H Accept:application/json)"

ISSUER="$(echo "$OAUTH_META" | jq -r '.issuer')"
AUTHORIZATION_ENDPOINT="$(echo "$OAUTH_META" | jq -r '.authorization_endpoint')"
TOKEN_ENDPOINT="$(echo "$OAUTH_META" | jq -r '.token_endpoint')"
REGISTRATION_ENDPOINT="$(echo "$OAUTH_META" | jq -r '.registration_endpoint')"

echo "Registering with $ISSUER ..." >&2

OAUTH_CLIENT_INFO="$(curl -sSf -H Content-Type:application/json -H Accept:application/json "$REGISTRATION_ENDPOINT" --data-binary '{"client_name":"get-token.sh","client_uri":"https://example.com","redirect_uris":["urn:ietf:wg:oauth:2.0:oob"]}')"

CLIENT_ID="$(echo "$OAUTH_CLIENT_INFO" | jq -r '.client_id')"
CLIENT_SECRET="$(echo "$OAUTH_CLIENT_INFO" | jq -r '.client_secret')"

# XXX no url escaping query params
# TODO &scope=prosody:admin%20openid
open "$AUTHORIZATION_ENDPOINT?response_type=code&client_id=$CLIENT_ID" #"&scope=openid"
read -p "Paste authorization code: " -s -r AUTHORIZATION_CODE

# could build the JSON with jq instead of HTTPie
http --form "$TOKEN_ENDPOINT" 'grant_type=authorization_code' "client_id=$CLIENT_ID" "client_secret=$CLIENT_SECRET" "code=$AUTHORIZATION_CODE"