masks-server 0.7.0

data/app/models/masks/server/resource_metadata.rb

@@ -0,0 +1,70 @@
+module Masks
+  module Server
+    class ResourceMetadata
+      WELL_KNOWN = "/.well-known/oauth-protected-resource".freeze
+      LIMIT = 64 * 1024
+      OPEN_TIMEOUT = 2
+      READ_TIMEOUT = 3
+      LONGEST = 200
+      TTL = 5.minutes
+
+      class << self
+        def describe(resources, scopes)
+          published = Array(resources).reject(&:blank?).reduce({}) do |held, resource|
+            new(resource).descriptions.merge(held)
+          end
+
+          Scopes.list(scopes).map do |scope|
+            [ scope, (published[scope].presence unless owned?(scope)) || Scopes.description_for(scope) ]
+          end
+        end
+
+        def owned?(scope)
+          Scopes::DESCRIBED.key?(scope) || Scopes.reserved(scope).any?
+        end
+      end
+
+      def initialize(resource)
+        @resource = resource.to_s
+      end
+
+      def descriptions
+        Localized.fields(document, "scope_descriptions").each_with_object({}) do |(scope, description), held|
+          held[scope.to_s] = description.to_s.truncate(LONGEST)
+        end
+      end
+
+      private
+
+        def document
+          @document ||= ::Rails.cache.fetch([ "resource_metadata", @resource ], expires_in: TTL, skip_nil: true) do
+            candidates.lazy.filter_map { |url| fetch(url) }.first
+          end || {}
+        end
+
+        def candidates
+          uri = URI.parse(@resource)
+          return [] if uri.host.blank?
+
+          port = ":#{uri.port}" unless uri.port == uri.default_port
+          origin = "#{uri.scheme}://#{uri.host}#{port}"
+
+          [ "#{origin}#{WELL_KNOWN}#{uri.path.to_s.chomp('/')}", "#{origin}#{WELL_KNOWN}" ].uniq
+        rescue URI::InvalidURIError
+          []
+        end
+
+        def fetch(url)
+          uri = URI.parse(url)
+
+          body = Outbound.fetch!(uri, open: OPEN_TIMEOUT, read: READ_TIMEOUT, ceiling: LIMIT,
+                                      headers: { "Accept" => "application/json" })
+
+          parsed = JSON.parse(body)
+          parsed.is_a?(Hash) ? parsed : nil
+        rescue StandardError
+          nil
+        end
+    end
+  end
+end

data/app/models/masks/server/risk.rb

@@ -0,0 +1,110 @@
+module Masks
+  module Server
+    class Risk
+      WEIGHTS = {
+        "new_device" => 30,
+        "new_network" => 25,
+        "risky_network" => 50,
+        "failed_attempts" => 20,
+        "many_failed_attempts" => 40,
+        "dormant" => 10,
+        "breached_password" => 40
+      }.freeze
+
+      MOST = 100
+      LOOKBACK = 90.days
+      DORMANT = 180.days
+      FAILURES_WITHIN = 1.hour
+      FEW_FAILURES = 3
+      MANY_FAILURES = 10
+
+      attr_reader :actor, :device, :ip_address, :breached
+
+      def self.networks(value)
+        value.to_s.split(/[\s,]+/).filter_map do |entry|
+          IPAddr.new(entry)
+        rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+          nil
+        end
+      end
+
+      def initialize(actor:, device:, ip_address:, tenant: Current.tenant, breached: false)
+        @actor = actor
+        @device = device
+        @ip_address = ip_address
+        @tenant = tenant
+        @breached = breached
+      end
+
+      def signals
+        @signals ||= [
+          ("new_device" if new_device?),
+          ("new_network" if new_network?),
+          ("risky_network" if risky_network?),
+          failures,
+          ("dormant" if dormant?),
+          ("breached_password" if breached)
+        ].compact
+      end
+
+      def score
+        [ signals.sum { |signal| WEIGHTS.fetch(signal) }, MOST ].min
+      end
+
+      private
+
+        def history
+          @history ||= Session.where(actor: actor).where(created_at: LOOKBACK.ago..).to_a
+        end
+
+        def known?
+          history.any?
+        end
+
+        def new_device?
+          return false unless known?
+          return true if device.nil?
+
+          history.none? { |session| session.device_id == device.id } && !device.remembers?(actor, DeviceFactor::SECOND_FACTOR)
+        end
+
+        def new_network?
+          return false unless known? && address
+
+          history.none? { |session| (seen = parse(session.ip_address)) && network(seen).include?(seen) && network(address).include?(seen) }
+        end
+
+        def risky_network?
+          address && self.class.networks(@tenant&.risky_networks).any? { |range| range.include?(address) }
+        end
+
+        def failures
+          count = Event.where(action: Event::LOGIN_REFUSED, actor: actor, created_at: FAILURES_WITHIN.ago..).count
+
+          if count >= MANY_FAILURES then "many_failed_attempts"
+          elsif count >= FEW_FAILURES then "failed_attempts"
+          end
+        end
+
+        def dormant?
+          actor.last_login_at.present? && actor.last_login_at < DORMANT.ago
+        end
+
+        def address
+          return @address if defined?(@address)
+
+          @address = parse(ip_address)
+        end
+
+        def parse(value)
+          value.present? ? IPAddr.new(value.to_s) : nil
+        rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+          nil
+        end
+
+        def network(held)
+          held.mask(held.ipv4? ? 24 : 48)
+        end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/farewells.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class Farewells
+        WAIT = 10.minutes
+
+        attr_reader :finish
+
+        def self.resume(request_id, client:)
+          key = key_for(request_id)
+          held = ::Rails.cache.read(key)
+
+          return nil unless held.is_a?(Hash) && held["client_id"] == client.client_id
+
+          ::Rails.cache.delete(key)
+          new(held["steps"], held["finish"])
+        end
+
+        def self.key_for(request_id)
+          [ "saml-farewell", Current.tenant&.id, Digest::SHA256.hexdigest(request_id.to_s) ].compact.join(":")
+        end
+
+        def initialize(steps, finish)
+          @steps = Array(steps).dup
+          @finish = finish
+        end
+
+        def advance(issuer)
+          while (id = steps.shift)
+            participation = SamlParticipation.listening.includes(:client).find_by(id: id)
+
+            next if participation.nil?
+
+            sign_off = participation.sign_off(issuer)
+            ::Rails.cache.write(self.class.key_for(sign_off.id),
+                                { "client_id" => participation.client.client_id, "steps" => steps, "finish" => finish },
+                                expires_in: WAIT)
+
+            return sign_off
+          end
+
+          nil
+        end
+
+        private
+
+          attr_reader :steps
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/logout_reply.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class LogoutReply < Message
+        attr_reader :in_response_to
+
+        def read!
+          open!
+          timely!
+          addressed!(SamlIdentity.slo_url(issuer))
+          client.saml_x509_certificate&.then { |certificate| signed!(certificate) }
+          @in_response_to = root["InResponseTo"].to_s
+
+          raise Refused, "a LogoutResponse answers a request masks sent" unless in_response_to.match?(IDENTIFIER)
+
+          self
+        end
+
+        private
+
+          def field
+            "SAMLResponse"
+          end
+
+          def element
+            "LogoutResponse"
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/logout_request.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class LogoutRequest < Message
+        NAMES = { "samlp" => PROTOCOL_NS, "saml" => ASSERTION_NS }.freeze
+
+        attr_reader :name_id, :session_indexes
+
+        def read!
+          open!
+          timely!
+          addressed!(SamlIdentity.slo_url(issuer))
+          answerable!
+          signed!(client.saml_x509_certificate || raise(Refused, "#{client.name} has no certificate to check its logout requests against"))
+          current!
+          @name_id = subject!
+          @session_indexes = document.xpath("/samlp:LogoutRequest/samlp:SessionIndex", NAMES).map { |index| index.text.strip }.compact_blank
+          once!("saml-logout")
+
+          self
+        end
+
+        private
+
+          def element
+            "LogoutRequest"
+          end
+
+          def answerable!
+            raise Refused, "#{client.name} has no single logout URL to answer at" if client.saml_slo_url.blank?
+          end
+
+          def current!
+            return if root["NotOnOrAfter"].blank?
+
+            raise Refused, "that LogoutRequest has expired" if Time.iso8601(root["NotOnOrAfter"]) <= CLOCK_SKEW.ago
+          rescue ArgumentError
+            raise Refused, "that LogoutRequest's NotOnOrAfter is not a time"
+          end
+
+          def subject!
+            named = document.at_xpath("/samlp:LogoutRequest/saml:NameID", NAMES)&.text.to_s.strip
+
+            raise Refused, "a LogoutRequest names who is signing out with a NameID" if named.blank?
+
+            named
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/message.rb

@@ -0,0 +1,171 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class Message
+        SIGNATURE_ALGORITHMS = [
+          XMLSecurity::Document::RSA_SHA256, XMLSecurity::Document::RSA_SHA384, XMLSecurity::Document::RSA_SHA512
+        ].freeze
+        IDENTIFIER = /\A[A-Za-z_][\w.-]{0,127}\z/
+
+        attr_reader :client, :id, :relay_state
+
+        def self.read!(request, issuer:)
+          new(request, issuer: issuer).tap(&:read!)
+        end
+
+        def initialize(request, issuer:)
+          @request = request
+          @issuer = issuer
+          @relay_state = carried("RelayState").presence
+        end
+
+        private
+
+          attr_reader :request, :issuer, :xml, :document, :root
+
+          def field
+            "SAMLRequest"
+          end
+
+          def named
+            "#{element.start_with?('A') ? 'an' : 'a'} #{element}"
+          end
+
+          def open!
+            raw = carried(field).to_s
+
+            raise Refused, "a #{field} is required" if raw.blank?
+            raise Refused, "that #{field} is too large" if raw.bytesize > LIMIT
+
+            @xml = decode(raw)
+            @document = SamlIdentity.parse!(xml, what: "that #{field}")
+            @root = document.root
+
+            raise Refused, "that is not #{named}" unless root&.name == element && root.namespace&.href == PROTOCOL_NS
+            raise Refused, "only SAML 2.0 messages are read" unless root["Version"] == "2.0"
+
+            @id = root["ID"].to_s
+            raise Refused, "#{named} carries an ID" unless id.match?(IDENTIFIER)
+            raise Refused, "#{named} names each ID once" unless document.xpath("//@ID").map(&:value).tally.values.all?(1)
+
+            @client = registered
+          end
+
+          def redirect?
+            request.get?
+          end
+
+          def raw_query
+            @raw_query ||= request.query_string.split("&").each_with_object({}) do |pair, held|
+              name, value = pair.split("=", 2)
+              raise Refused, "#{CGI.unescape(name.to_s)} is sent more than once" if held.key?(CGI.unescape(name.to_s))
+
+              held[CGI.unescape(name.to_s)] = value.to_s
+            end
+          end
+
+          def carried(name)
+            redirect? ? raw_query[name]&.then { |value| CGI.unescape(value) } : request.request_parameters[name]
+          end
+
+          def decode(raw)
+            bytes = Base64.decode64(raw)
+            xml = bytes.lstrip.start_with?("<") ? bytes : inflate(bytes)
+
+            xml.force_encoding(Encoding::UTF_8)
+
+            raise Refused, "that #{field} is not UTF-8" unless xml.valid_encoding?
+
+            xml
+          end
+
+          def inflate(bytes)
+            inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+            inflated = +""
+
+            inflater.inflate(bytes) do |chunk|
+              inflated << chunk
+              raise Refused, "that #{field} is too large" if inflated.bytesize > LIMIT
+            end
+
+            inflated
+          rescue Zlib::Error
+            raise Refused, "that #{field} could not be read"
+          ensure
+            inflater&.close
+          end
+
+          def registered
+            entity = document.at_xpath("/samlp:#{element}/saml:Issuer", "samlp" => PROTOCOL_NS, "saml" => ASSERTION_NS)&.text.to_s.strip
+
+            raise Refused, "#{named} names its Issuer" if entity.blank?
+
+            Client.saml_for(entity) || raise(Refused, "no application is registered here as #{entity}")
+          end
+
+          def timely!
+            made = Time.iso8601(root["IssueInstant"].to_s)
+
+            raise Refused, "that #{element} was made too long ago" if made < (LIFETIME + CLOCK_SKEW).ago
+            raise Refused, "that #{element} was made in the future" if made > CLOCK_SKEW.from_now
+          rescue ArgumentError
+            raise Refused, "#{named} says when it was made"
+          end
+
+          def addressed!(url)
+            destination = root["Destination"].presence
+
+            return if destination.nil? || destination == url
+
+            raise Refused, "that #{element} was sent to #{destination}, not here"
+          end
+
+          def signed!(certificate)
+            redirect? ? query_signed!(certificate) : document_signed!(certificate)
+          end
+
+          def query_signed!(certificate)
+            algorithm = CGI.unescape(raw_query["SigAlg"].to_s)
+
+            raise Refused, "a signed redirect carries SigAlg with SHA-256 or stronger" unless SIGNATURE_ALGORITHMS.include?(algorithm)
+            raise Refused, "a signed redirect carries a Signature" if raw_query["Signature"].blank?
+
+            signed = OneLogin::RubySaml::Utils.build_query_from_raw_parts(
+              type: field, raw_data: raw_query[field], raw_relay_state: raw_query["RelayState"],
+              raw_sig_alg: raw_query["SigAlg"]
+            )
+
+            verified = OneLogin::RubySaml::Utils.verify_signature(
+              cert: certificate, sig_alg: algorithm, signature: CGI.unescape(raw_query["Signature"]), query_string: signed
+            )
+
+            raise Refused, "that #{element}'s signature does not verify" unless verified
+          rescue OpenSSL::PKey::PKeyError
+            raise Refused, "that #{element}'s signature does not verify"
+          end
+
+          def document_signed!(certificate)
+            signatures = document.xpath("//ds:Signature", "ds" => DSIG_NS)
+
+            raise Refused, "a signed #{element} carries exactly one Signature, its own" unless signatures.one? && signatures.first.parent == root
+
+            reference = signatures.first.at_xpath("ds:SignedInfo/ds:Reference", "ds" => DSIG_NS)&.[]("URI")
+            raise Refused, "that signature covers something other than the #{element}" unless reference == "##{id}"
+
+            algorithm = signatures.first.at_xpath("ds:SignedInfo/ds:SignatureMethod", "ds" => DSIG_NS)&.[]("Algorithm")
+            raise Refused, "a signed #{element} uses SHA-256 or stronger" unless SIGNATURE_ALGORITHMS.include?(algorithm)
+
+            verified = XMLSecurity::SignedDocument.new(xml).validate_document_with_cert(certificate, true)
+
+            raise Refused, "that #{element}'s signature does not verify" unless verified
+          end
+
+          def once!(kind)
+            return if Replay.first?(kind, id, within: client.id, expires_in: LIFETIME + (CLOCK_SKEW * 2))
+
+            raise Refused, "that #{element} has already been answered"
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/metadata.rb

@@ -0,0 +1,43 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class Metadata
+        def initialize(issuer)
+          @issuer = issuer
+        end
+
+        def to_xml
+          Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+            xml["md"].EntityDescriptor("xmlns:md" => METADATA_NS, "xmlns:ds" => DSIG_NS, "entityID" => SamlIdentity.entity_id(issuer)) do
+              xml["md"].IDPSSODescriptor(WantAuthnRequestsSigned: "false", protocolSupportEnumeration: PROTOCOL_NS) do
+                certificates.each do |certificate|
+                  xml["md"].KeyDescriptor(use: "signing") do
+                    xml["ds"].KeyInfo do
+                      xml["ds"].X509Data { xml["ds"].X509Certificate(Base64.strict_encode64(certificate.to_der)) }
+                    end
+                  end
+                end
+
+                xml["md"].SingleLogoutService(Binding: REDIRECT_BINDING, Location: SamlIdentity.slo_url(issuer))
+                xml["md"].SingleLogoutService(Binding: POST_BINDING, Location: SamlIdentity.slo_url(issuer))
+
+                NAME_ID_FORMATS.each { |format| xml["md"].NameIDFormat(format) }
+
+                xml["md"].SingleSignOnService(Binding: REDIRECT_BINDING, Location: SamlIdentity.sso_url(issuer))
+                xml["md"].SingleSignOnService(Binding: POST_BINDING, Location: SamlIdentity.sso_url(issuer))
+              end
+            end
+          end.to_xml
+        end
+
+        private
+
+          attr_reader :issuer
+
+          def certificates
+            Tenant.switch(issuer.tenant) { SigningKey.published.map(&:certificate) }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/request.rb

@@ -0,0 +1,57 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class Request < Message
+        attr_reader :acs_url, :name_id_format, :force_authn, :passive
+
+        def read!
+          open!
+          timely!
+          addressed!(SamlIdentity.sso_url(issuer))
+          vouched!
+          @acs_url = consumer!
+          @name_id_format = format!
+          @force_authn = root["ForceAuthn"] == "true"
+          @passive = root["IsPassive"] == "true"
+          once!("saml-request")
+
+          self
+        end
+
+        private
+
+          def element
+            "AuthnRequest"
+          end
+
+          def vouched!
+            return unless client.saml_requests_signed?
+
+            signed!(client.saml_x509_certificate || raise(Refused, "#{client.name} has no certificate to check its requests against"))
+          end
+
+          def consumer!
+            binding = root["ProtocolBinding"].presence
+            raise Refused, "responses are only sent with HTTP-POST" if binding && binding != POST_BINDING
+            raise Refused, "an AssertionConsumerServiceIndex is not read; name the URL" if root["AssertionConsumerServiceIndex"].present?
+
+            wanted = root["AssertionConsumerServiceURL"].presence
+
+            return client.redirect_uris.first if wanted.nil?
+            return wanted if client.redirect_uri?(wanted)
+
+            raise Refused, "#{wanted} is not an assertion consumer service registered for #{client.name}"
+          end
+
+          def format!
+            asked = document.at_xpath("/samlp:AuthnRequest/samlp:NameIDPolicy", "samlp" => PROTOCOL_NS)&.[]("Format").presence
+
+            return client.saml_name_id_format.presence || PERSISTENT if asked.nil? || asked == UNSPECIFIED
+            return asked if NAME_ID_FORMATS.include?(asked)
+
+            raise Refused, "#{asked} is not a NameID format masks issues"
+          end
+      end
+    end
+  end
+end