# The naming scheme in non-Mandriva-based distros
%if 0%{!?mkrel:1}
%define mkrel(c) %{1}%{?dist}
%endif

%if 0%{?mklibname:1}
%define pampluginname %{mklibname pam_oauthbearer}
%define saslpluginname %{mklibname sasl2-plug-oauthbearer}
%else
%define pampluginname pam_oauthbearer
%define saslpluginname cyrus-sasl-oauthbearer
%endif

%if "%{_vendor}" == "openEuler" || 0%{?centos} || 0%{?epel}
%global debug_package %{nil}
%endif

%define commit b33edc4ce115667e5b6de59ce0c78b94967325b4
%define date 20260925

Name:           crudeoauth
Version:        2.0.1
Group:          System/Libraries
# No stable release yet
Release:        %mkrel %{?commit:0.git%{date}.}1
Summary:        A SASL plugin and PAM implementation of OAUTHBEARER
License:        AGPL-3.0-only
URL:            https://github.com/univention/crudeoauth
Source0:        https://github.com/univention/crudeoauth/archive/refs/heads/master.zip#/%{name}-%{commit}.tar.gz
Source1:        %{name}-vendor.tar.xz
Source2:        config.toml

# The dependency "ring" only supports these architectures
ExclusiveArch:  %arm32 %arm64 %ix86 %x86_64 wasm32

BuildRequires:  cargo >= 1.88.0
BuildRequires:  clang
# pkgconfig needed to get the location of the PAM and SASL2 directories
BuildRequires:  pkgconfig
BuildRequires:  pkgconfig(libsasl2) >= 2.1
BuildRequires:  pkgconfig(pam)

%global pamlibdir %(pkg-config --variable=libdir pam)
%global sasllibdir %(pkg-config --variable=libdir libsasl2)

%global _description %{expand:
crudeoauth provides a PAM module and a Cyrus SASL plugin for authentication with OAuth 2.0 bearer access tokens. The SASL implementation uses the OAUTHBEARER mechanism defined by RFC 7628.

The server-side verifier accepts signed JWT access tokens, verifies their signatures against locally configured JWKS files, and applies configurable claim and security policy checks. The implementation uses the Rust jsonwebtoken crate.

The artifacts can be used:

* by user-facing services to validate OAuth 2.0 access tokens through PAM;
* by SASL clients to send an OAuth 2.0 access token with OAUTHBEARER; and
* by protected resources such as OpenLDAP to accept OAUTHBEARER SASL binds and validate the presented access token.

In UCS, for example, a user-facing service can be the Univention Management Console and the protected resource can be OpenLDAP slapd.

The verifier:

* parses the JWT and requires a signing-key identifier (kid);
* selects the corresponding key only from configured JWKS files;
* verifies the JWT signature;
* checks the configured issuer and audience;
* optionally checks the authorized party (azp);
* requires and checks exp, and checks nbf and iat when present, with a configurable clock-skew grace period;
* optionally requires OAuth scopes;
* extracts the configured username claim;
* optionally rejects configured usernames, case-insensitively; and
* applies an explicit JWT signature-algorithm policy.

JWKS files may contain keys that are unrelated to access-token signatures. Unsupported keys and keys intended for encryption are ignored instead of making the complete JWKS unusable. In particular, RSA-OAEP is a JWE key-management algorithm, not a JWT signature algorithm, and is not accepted as a JWT signing algorithm.

The token's JWK metadata, when present, must be compatible with signature verification. The verifier does not use token-provided key URLs or embedded keys as trust sources.

The implementation has been tested with Keycloak 26.7.x. The verifier checks the aud claim; depending on the Keycloak client configuration, an appropriate audience may need to be added to the access token.
}

%description
%{_description}

%prep
%autosetup -a1 -p1 -n %{name}-%{commit}

mkdir .cargo
cp %{SOURCE2} .cargo

%build
cargo build --release --verbose
cargo doc --verbose

%install
pushd target/release
mkdir -p %{buildroot}%{pamlibdir}/security
install -m755 libpam_oauthbearer.so %{buildroot}%{pamlibdir}/security
mkdir -p %{buildroot}%{sasllibdir}/sasl2
install -m755 liboauthbearer.so %{buildroot}%{sasllibdir}/sasl2
popd
mkdir -p %{buildroot}%{_mandir}/man5
install -m644 pam/pam_oauthbearer.5 %{buildroot}%{_mandir}/man5/
install -m644 sasl/sasl_oauthbearer.5 %{buildroot}%{_mandir}/man5/

%package -n %pampluginname
Summary:        OAUTHBEARER plugin for PAM

%description -n %pampluginname
A PAM module for authentication with OAuth 2.0 bearer access tokens.

%{_description}

%package -n %saslpluginname
Summary:        OAUTHBEARER plugin for SASL2
# Consistent cross-distro name:
Provides:       sasl-oauthbearer = %{version}-%{release}

%description -n %saslpluginname
A Cyrus SASL plugin for authentication with OAuth 2.0 bearer access tokens. The
SASL implementation uses the OAUTHBEARER mechanism defined by RFC 7628.

%{_description}

%files -n %pampluginname
%doc README.md SECURITY.md
%doc debian/changelog
%doc target/doc/pam_oauthbearer/*.html
%license LICENSE
%{pamlibdir}/security/
%{_mandir}/man?/pam_oauthbearer.*

%files -n %saslpluginname
%doc README.md SECURITY.md
%doc debian/changelog
%doc target/doc/oauthbearer/*.html
%license LICENSE
%{sasllibdir}/sasl2/
%{_mandir}/man?/sasl_oauthbearer.*