From 01d09065ff963797576a128317f546ee24350be7 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Tue, 31 Jan 2023 10:09:31 -0500
Subject: [PATCH] add gitlab OIDC

---
 gitlab.com/.well-known/openid-configuration | 75 +++++++++++++++++++++
 gitlab.com/oauth/discovery/keys             | 20 ++++++
 issuer.enforce.dev/keys                     | 28 ++++----
 urls.txt                                    |  5 ++
 4 files changed, 114 insertions(+), 14 deletions(-)
 create mode 100644 gitlab.com/.well-known/openid-configuration
 create mode 100644 gitlab.com/oauth/discovery/keys

diff --git a/gitlab.com/.well-known/openid-configuration b/gitlab.com/.well-known/openid-configuration
new file mode 100644
index 00000000..48f01e6a
--- /dev/null
+++ b/gitlab.com/.well-known/openid-configuration
@@ -0,0 +1,75 @@
+{
+  "issuer": "https://gitlab.com",
+  "authorization_endpoint": "https://gitlab.com/oauth/authorize",
+  "token_endpoint": "https://gitlab.com/oauth/token",
+  "revocation_endpoint": "https://gitlab.com/oauth/revoke",
+  "introspection_endpoint": "https://gitlab.com/oauth/introspect",
+  "userinfo_endpoint": "https://gitlab.com/oauth/userinfo",
+  "jwks_uri": "https://gitlab.com/oauth/discovery/keys",
+  "scopes_supported": [
+    "api",
+    "read_api",
+    "read_user",
+    "read_repository",
+    "write_repository",
+    "read_registry",
+    "write_registry",
+    "sudo",
+    "admin_mode",
+    "openid",
+    "profile",
+    "email"
+  ],
+  "response_types_supported": [
+    "code"
+  ],
+  "response_modes_supported": [
+    "query",
+    "fragment",
+    "form_post"
+  ],
+  "grant_types_supported": [
+    "authorization_code",
+    "password",
+    "client_credentials",
+    "refresh_token"
+  ],
+  "token_endpoint_auth_methods_supported": [
+    "client_secret_basic",
+    "client_secret_post"
+  ],
+  "subject_types_supported": [
+    "public"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "RS256"
+  ],
+  "claim_types_supported": [
+    "normal"
+  ],
+  "claims_supported": [
+    "iss",
+    "sub",
+    "aud",
+    "exp",
+    "iat",
+    "sub_legacy",
+    "name",
+    "nickname",
+    "preferred_username",
+    "email",
+    "email_verified",
+    "website",
+    "profile",
+    "picture",
+    "groups",
+    "groups_direct",
+    "https://gitlab.org/claims/groups/owner",
+    "https://gitlab.org/claims/groups/maintainer",
+    "https://gitlab.org/claims/groups/developer"
+  ],
+  "code_challenge_methods_supported": [
+    "plain",
+    "S256"
+  ]
+}
diff --git a/gitlab.com/oauth/discovery/keys b/gitlab.com/oauth/discovery/keys
new file mode 100644
index 00000000..62f37cb9
--- /dev/null
+++ b/gitlab.com/oauth/discovery/keys
@@ -0,0 +1,20 @@
+{
+  "keys": [
+    {
+      "kty": "RSA",
+      "kid": "kewiQq9jiC84CvSsJYOB-N6A8WFLSV20Mb-y7IlWDSQ",
+      "e": "AQAB",
+      "n": "5RyvCSgBoOGNE03CMcJ9Bzo1JDvsU8XgddvRuJtdJAIq5zJ8fiUEGCnMfAZI4of36YXBuBalIycqkgxrRkSOENRUCWN45bf8xsQCcQ8zZxozu0St4w5S-aC7N7UTTarPZTp4BZH8ttUm-VnK4aEdMx9L3Izo0hxaJ135undTuA6gQpK-0nVsm6tRVq4akDe3OhC-7b2h6z7GWJX1SD4sAD3iaq4LZa8y1mvBBz6AIM9co8R-vU1_CduxKQc3KxCnqKALbEKXm0mTGsXha9aNv3pLNRNs_J-cCjBpb1EXAe_7qOURTiIHdv8_sdjcFTJ0OTeLWywuSf7mD0Wpx2LKcD6ImENbyq5IBuR1e2ghnh5Y9H33cuQ0FRni8ikq5W3xP3HSMfwlayhIAJN_WnmbhENRU-m2_hDPiD9JYF2CrQneLkE3kcazSdtarPbg9ZDiydHbKWCV-X7HxxIKEr9N7P1V5HKatF4ZUrG60e3eBnRyccPwmT66i9NYyrcy1_ZNN8D1DY8xh9kflUDy4dSYu4R7AEWxNJWQQov525v0MjD5FNAS03rpk4SuW3Mt7IP73m-_BpmIhW3LZsnmfd8xHRjf0M9veyJD0--ETGmh8t3_CXh3I3R9IbcSEntUl_2lCvc_6B-m8W-t2nZr4wvOq9-iaTQXAn1Au6EaOYWvDRE",
+      "use": "sig",
+      "alg": "RS256"
+    },
+    {
+      "kty": "RSA",
+      "kid": "4i3sFE7sxqNPOT7FdvcGA1ZVGGI_r-tsDXnEuYT4ZqE",
+      "e": "AQAB",
+      "n": "4cxDjTcJRJFID6UCgepPV45T1XDz_cLXSPgMur00WXB4jJrR9bfnZDx6dWqwps2dCw-lD3Fccj2oItwdRQ99In61l48MgiJaITf5JK2c63halNYiNo22_cyBG__nCkDZTZwEfGdfPRXSOWMg1E0pgGc1PoqwOdHZrQVqTcP3vWJt8bDQSOuoZBHSwVzDSjHPY6LmJMEO42H27t3ZkcYtS5crU8j2Yf-UH5U6rrSEyMdrCpc9IXe9WCmWjz5yOQa0r3U7M5OPEKD1-8wuP6_dPw0DyNO_Ei7UerVtsx5XSTd-Z5ujeB3PFVeAdtGxJ23oRNCq2MCOZBa58EGeRDLR7Q",
+      "use": "sig",
+      "alg": "RS256"
+    }
+  ]
+}
diff --git a/issuer.enforce.dev/keys b/issuer.enforce.dev/keys
index b26b2855..98efa230 100644
--- a/issuer.enforce.dev/keys
+++ b/issuer.enforce.dev/keys
@@ -1,19 +1,5 @@
 {
   "keys": [
-    {
-      "kty": "RSA",
-      "kid": "1ef82a599a111a2ee769b9901aecd7f5f2f61bb6a415c7d207ca1511dcd2441a",
-      "alg": "RS256",
-      "n": "6kqwFlGq8XxJOPEzTrwdfpWOyi5ZqGQRMNCYGGt930tiTBodexkSsDSB9h5tawa8690R1GzynT-RRF63T8qGcl9WeMIaCr_xKmqApbcKP5epx37gUl2daDDJEzrO8viOBSnDRw27qjzMoOBvfxCq41bu7Zm4sudchImVaD5B5s7r3UASYJxZyPlucdT2-7YFk5oW5ybJ95OBwoHYnIZ3tT0GAAp8R7UpeHyljO2uEtBtcAEXG_afO8q27htpms1HClLl_lpee3dVEyo8bCJNFJJTXDWZIkNwxWUMAuiY4Y0bL9XXoiINmKCxKn5a79hWEuY-6pN-xwMEXRoE50E5PlKMi5pULJEFZfr4IWbkcICPm1E_xsBNdD2SDr-aU7zmENDeUhagXnXifwJN29yk6NWibDkP_PhLOsYRmKbc7-YaSP02aPvM1iCMorKSedk11mEAo24qTtWidfQuYG5cF_JId5TtRVncFFE0ybWuRsro3j4rlNmyjClJn2yusijCvUfWFXBh_RDWEv1uRMIcMJgfNrtFkx17akEbNJBb2rd-BwX0KbuyKzRCvxxZsZPbzFSebecr3iWhRV0rtL6SbVJDr9v1jE9BtYNkVy6cvQ9Az4BvcTrnW_wwUrL5pJ68W0Zih6nQUjsKn_e8d7IDMb_hXK0_BTTVa7ApSw2Q00U",
-      "e": "AQAB"
-    },
-    {
-      "kty": "RSA",
-      "kid": "bc5109482442fc71a8250cd39c049dd9e518f91021938528de1af190312753cd",
-      "alg": "RS256",
-      "n": "k4e-T79qS1fJDoxnlZRp_8Ky2-rtO8db1YsFFTyaFY-a9L32G52IWKtMnwm0DL7nMXkXgVkVyLchXAH4GzwsvtnjAF_I_Y5_LN0HJ7aaCTavCKydsjqO1Zj36Sq54O6h7TvW6RJKCG5sw8sxSXMY68I0xtNBtIj58UyPw-lqgo0Rsb7OCFbFNw1RKrht7AcuaAoVqXZVz3umMyMWV9nVT8y8C_paWz5Joyoli6wFIxCkGUPWejcqO5WJ0ZijfqWXlEHrGJ9t9xP_0U8FA_J4jGiMoxE6ycqjLi8DgdHmvqvOVnQ6T5dzVqzhyKPGkenfB3aIBs1ltZwUhIzZR33aWsu3yjItAdG1YWImgPg6-_i_7WIuRlEdjCoVjaBZHh9b3C1LUTTNllH1DXhRLqUVXjW0juTM4IYHS6nv1dvNxSuwBdTrs4CVf_VSlH3fneVPmoWboCG54jXk13P95gQwfVaYmmF1E7CaaMFTHBTY9MQ4iFtk8bxVgCwuX3Eqni09Ry-WuJjwMwISjDnbwVDjurXbeb2opz8PVah2vY8RMAhlRWbrAyPU8zBTn7MXEYwvG5d--nen4x-fYKA5cBNeQ4uScTGLVn5idf-JjsJdbdzCxYRnUF7vH9LtDO123UT4UwJRr0phUbmWxB2BFQOtc82_-lwnz4tydGMylOkeLMs",
-      "e": "AQAB"
-    },
     {
       "kty": "RSA",
       "kid": "b133b6857c42dfe675d902a840807f89412afd9f28ea1d2184132f57a8eef580",
@@ -27,6 +13,20 @@
       "alg": "RS256",
       "n": "7k7UPJToiyo5v61YURWQu_zi3DFHmePTN9BtyUwiLqW3hC64y-AXENqrldMh_mwXvgkxZ4Js2kc18IW2sRbfEmaOL9Ng3MQhwB_B48FK2z25IweYC07_KNNHoBwvXKx8jk7qdazNnWIM_uJqq_zwQIFY27_gNXzfxqj6PIhdmELJTe-qYeMwvspj0IycDBMb4jW_LfD852xN1oxglUST5Jpxno9j6g5VT6mZZL_5ZH1nyXiKEx2FiTEi3qRBLzBQxxZt7Mo7wGxGifDtvH--p0bk2ub-Lpdyx9UR0bP-f_nSbkjK-jlwRgGhmMrGiOkchrvallhJH73zOniUICQytA9S0kH75WY6pYdW-z5mtNgzUHmX431YH3bJLMVuvgeMc1Fum0BNjbjjxIiIt2Gkm_sc49MQwZYE2biAAy8SkAB_I_Io7tRvAeckBqkKCYkfmj5BkHVUcz527MK0ODg600vBxQBPoeRLJds-VdjtCpkIyDtJDCodGjJ1HnxH65KJBRdXl2Kgqxx5BJJJXEyDbJg829Jw8WvzYzEu3LZ0WxlucHj06lh11C_jEuF1Y_ksaziCgfc58Fdecp_MpgqEjescpq-enbjhOZFeaclFVgIutN383S46yy9UxhlYZmBD3niDYpfYAS5qURkk3-KnlJhD6RcBpaRAEyNCEArHJ30",
       "e": "AQAB"
+    },
+    {
+      "kty": "RSA",
+      "kid": "fddba41b828756bd82146a3d092ebaafdab06586ad6f81d3fa16afd18972001d",
+      "alg": "RS256",
+      "n": "zr3roBw4QQbJapcmwqj4WQSd1k3RFpEfVUueXOrrC9arZX3m7vlvjZwTP81SsId_uVBg0HUq5W9Nv1PgstyJrWwFLRpvwMJBMjIkPUlZC6VoJM9rCZI1ArZKRpOmBcKra5piUaaDxjbg3vJshRGfV1_bj3yNq_TxTJKxcqYLtC2y6WY65j0wGH5jw43SYvRqTRkdxadXb6pq8YDyz2jHzVxtPAiY1_hU2HFUMUZBDpFuHelEC0DWB2CtAd2EzYocyb45NZIOdQ5DDwSkGiLLZZQwTZlc2xRoz4mgL0ABfHBmIi78FsP3tOjiqH-RFf3Xm25MerLeHgZaEgmbjh10NrH6qKen0XP4JljlrlTMRf2BhnOT5e462tbUAZekDKX_fjAzVuCQDIXI9dkwb6yfdJ_lL6rrZzffXoo53FTmkZSrsU5kMpTPmnSs-HrlltoQrVS-oGe8W9q8AARKnP9kRLq-w5LEe5Dp-aufHl1GamHeH4Vj_ButjAArJVi7EsPM2WeGV1J3Dt9ol1DVQKU1kiTsyW_bue6qkgHgrFPDmlQIsH7evUie2ONs1E1OZ3bzQajtXI9fiADdTFjC_-PMa883MeXv0WjsoGeXbLrzLXmHOtiMWUBk_oFkEB0V-1W6uMv3GqcAWZoDotxQstw6FjCdF49bv8CGkbHVt46MOgc",
+      "e": "AQAB"
+    },
+    {
+      "kty": "RSA",
+      "kid": "5dc684e45bfd89e4337ab340739619b37a5ae912fac8e9d8ad5bc8b6ce950482",
+      "alg": "RS256",
+      "n": "lVSZVxVQGMndKBuNRLV7e5pG7B-veVm1sZweANCZ9CU2xImCDzsQ_SZ1rYL0dXdAbDUmUh07BKgeecwO9bkOimpz722enFARTlI5kWFXFECixTRyLeccYptOIzmG4XDvJ6U2yn96hVC-CLfOiGzdFVlcsLlt5SNg0tQ_tZ0JtZkWuxfhdRm0gAVeF6-yQDVNBDj6wpnsEuj832zaL0FU6ArgQw9feEXKekpu8kdfhjq_l9OZNaaSHo_OPB3GRk_ikK6jqWPTGOW_RgewMKV__iMlvpAg6xHv-81jJFoCgsJ_jYhuyyKLEMadoixy7IALEt85loFktVX_jCRixlaLMhc6SoUV5jbVGUt72_u0SWv-VJlYFuPbSHeHkErH26CGiUwgEf2BOQ_bK7721ICgn55mfuSDqR4rZKT1l-S4xHBOiBj1bjY3eB0kRgwXF4fdGbnBnCHVediFoFaPZa8EpZ4_1dSplvWuE7P15Gi3ov5rJHqMxrD_1ZzVjBAkvNt6UDyjckhONnM2FbsGvQLyqXhPjEj0V2Fg3hXSJIMNdq4IWFMXe9oPpkO27MbphDrLM0vvgaCLNLvF5DyMxS6Ot-h4J0HDDNSHPAMy7euatDIKof9ACbN-o_srP7lC4xI0M1GPdEiPp4LH74M4Q31x0oqzmmuUkKPQ1oWkguPPLkc",
+      "e": "AQAB"
     }
   ]
 }
diff --git a/urls.txt b/urls.txt
index 47ad7bcd..77de90b8 100644
--- a/urls.txt
+++ b/urls.txt
@@ -14,3 +14,8 @@ https://token.actions.githubusercontent.com/.well-known/jwks
 
 # GitHub API meta
 https://api.github.com/meta
+
+# Gitlab OIDC
+https://gitlab.com/.well-known/openid-configuration
+https://gitlab.com/oauth/discovery/keys
+