okta-auth-proxy 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 29d6ec6994ef42bb021bfc2f2ad9f02941ea1af4
+  data.tar.gz: 8dca49d5119505c14c28914bfe10078afd01f176
+SHA512:
+  metadata.gz: 880d4eda3831c0766098b576ea2941b6a88985f86ef65bfc70e4840c5db26912fab6ed0cfaa5d8c43c05c0536d6549ab15dcc1387e1d80b591d92bd70ccf9ad4
+  data.tar.gz: 6475e2b99700c8e48e6d9b9338685a052ec2422f1f2824cb8bbe02c9b66b8498702e06427a928a1c7cf57d66f0c6b6cc94a74cb8fda93e2184ca6d75cbce5812

data/bin/okta-auth-proxy

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+$LOAD_PATH.unshift(File.expand_path('../lib', __dir__))
+require 'okta-auth-proxy/cli'
+require 'benchmark'
+
+begin
+  etime = Benchmark.realtime { OktaAuthProxy::CLI.start(ARGV) }
+  $stderr.puts "Completed in #{etime}s"
+rescue Thor::UndefinedCommandError, Thor::UnknownArgumentError, Thor::AmbiguousCommandError, Thor::InvocationError => e
+  $stderr.puts(e.message)
+  exit(64)
+rescue Thor::Error => e
+  $stderr.puts(e.message)
+  exit(1)
+end

data/lib/okta-auth-proxy.rb

@@ -0,0 +1,5 @@
+require 'active_support/all'
+require 'okta-auth-proxy/version'
+require 'okta-auth-proxy/app'
+require 'okta-auth-proxy/auth'
+require 'okta-auth-proxy/server'

data/lib/okta-auth-proxy/app.rb

@@ -0,0 +1,44 @@
+require 'sinatra'
+require 'okta-auth-proxy/auth'
+
+module OktaAuthProxy
+  class ProxyApp < Sinatra::Base
+    register OktaAuthProxy::OktaAuth
+
+     # Block that is called back when authentication is successful
+    [:get, :post, :put, :head, :delete, :options, :patch, :link, :unlink].each do |verb|
+
+      send verb, '/*' do
+        pass if request.host == (ENV['AUTH_DOMAIN'] || 'localhost')
+        pass if request.path == '/auth/saml/callback'
+        protected!
+        # If authorized, serve request
+        if url = authorized?(request.host)
+          headers "X-Remote-User" => session[:email]
+          headers "X-Reproxy-URL" => File.join(url, request.fullpath)
+          headers "X-Accel-Redirect" => "/reproxy"
+          redirect to('http://localhost')
+        end
+      end
+
+      send verb, '/auth/:name/callback' do
+        auth = request.env['omniauth.auth']
+        session[:logged] = true
+        session[:provider] = auth.provider
+        session[:uid] = auth.uid
+        session[:name] = auth.info.name
+        session[:email] = auth.info.email
+        if request.env.has_key? 'HTTP_X_FORWARDED_FOR'
+          session[:remote_ip] = request.env['HTTP_X_FORWARDED_FOR']
+        else
+          session[:remote_ip] = request.env['HTTP_X_REAL_IP']
+        end
+        redirect to(params[:RelayState] || '/')
+      end
+
+      send verb, '/auth/failure' do
+        'Login failed'
+      end
+    end
+  end
+end

data/lib/okta-auth-proxy/auth.rb

@@ -0,0 +1,71 @@
+require 'sinatra/base'
+require 'omniauth'
+require 'omniauth-saml'
+
+module OktaAuthProxy
+  module OktaAuth
+
+    module AuthHelpers
+      def protected!
+        return if authorized?(request.host)
+        redirect to("/auth/saml?redirectUrl=#{URI::encode(request.path)}")
+      end
+
+      def authorized?(host)
+        if session[:uid]
+          return ENV['PROXY_TARGET']
+        else
+          return false
+        end
+      end
+    end
+
+    def self.registered(app)
+      app.helpers OktaAuthProxy::OktaAuth::AuthHelpers
+      # Use a wildcard cookie to achieve single sign-on for all subdomains
+      app.use Rack::Session::Cookie, secret: ENV['COOKIE_SECRET'] || 'replaceme',
+                                     domain: ENV['COOKIE_DOMAIN'] || 'localhost'
+      app.use OmniAuth::Builder do
+        provider :saml,
+        issuer:                             "http://localhost:3311",
+        idp_sso_target_url:                 ENV['SSO_TARGET_URL'],
+        idp_cert:                           File.read( ENV['CERT_PATH'] || 'okta_cert.pem'),
+        name_identifier_format:             "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+        idp_sso_target_url_runtime_params:  {:redirectUrl => :RelayState}
+      end
+    end
+  end
+end
+
+
+#def authenticated?
+#  #check_remote_ip = nil
+#  #if request.env.has_key? 'HTTP_X_FORWARDED_FOR'
+#  #  check_remote_ip = request.env['HTTP_X_FORWARDED_FOR']
+#  #else
+#  #  check_remote_ip = request.env['HTTP_X_REAL_IP']
+#  #end
+#  if session[:logged] == true #and session[:remote_ip] == check_remote_ip
+#    return true
+#  else
+#    return false
+#  end
+#end
+#
+## Return internal URL or false if unauthorized
+#def authorized?(host)
+#  authorized = false
+#  # Check whether the email address is authorized
+#  if ! session.has_key? :email
+#    return false
+#  end
+#  split_email_address = session[:email].split('@')
+#  if defined? settings.allowed_email_domains and settings.allowed_email_domains.include? split_email_address.last
+#    authorized = true
+#  end
+#  if authorized == true #and settings.routing.has_key? host
+#    return settings.routing[host]
+#  else
+#    return false
+#  end
+#end

data/lib/okta-auth-proxy/cli.rb

@@ -0,0 +1,15 @@
+require 'thor'
+require 'okta-auth-proxy'
+
+class OktaAuthProxy::CLI < Thor
+
+  desc 'serve', 'Start the server'
+  method_option :threads, type: :numeric, default: 1000, banner: 'THREADS', desc: 'Number of worker threads', aliases: '-t'
+  method_option :bind, type: :string, default: '127.0.0.1', banner: 'BIND_HOST', desc: 'Address to bind to', aliases: '-b'
+  method_option :port, type: :numeric, default: 3311, banner: 'PORT', desc: 'Port to listen on', aliases: '-p'
+  method_option :debug, type: :boolean, default: false, desc: 'Run in debug mode', aliases: '-d'
+  def serve(port: nil, threads: nil, bind: nil, debug: nil)
+    opts = options.deep_symbolize_keys
+    OktaAuthProxy::ProxyServer.new(**opts).run
+  end
+end

data/lib/okta-auth-proxy/server.rb

@@ -0,0 +1,42 @@
+require 'okta-auth-proxy/app'
+require 'thin'
+require 'em-synchrony'
+
+module OktaAuthProxy
+  class ProxyServer
+    def initialize(port: 3311, threads:1000, bind: '127.0.0.1', debug:false)
+      debug ||= ENV['DEBUG']
+
+      if debug
+        $stdout.sync = true
+        $stderr.sync = true
+      end
+
+      app = ProxyApp.new
+      dispatch = Rack::Builder.app do
+        map '/' do
+          run app
+        end
+      end
+      @server = Thin::Server.new(port, bind, dispatch, threadpool_size: threads).backend
+    end
+
+    def start
+      @server.start
+    end
+
+    def run
+      EM.run do
+        init_sighandlers
+        @server.start
+      end
+    end
+  private
+
+    def init_sighandlers
+      trap(:INT)  { 'Got interrupt'; EM.stop; exit }
+      trap(:TERM) { 'Got term';      EM.stop; exit }
+      trap(:KILL) { 'Got kill';      EM.stop; exit }
+    end
+  end
+end

data/lib/okta-auth-proxy/version.rb

@@ -0,0 +1,3 @@
+module OktaAuthProxy
+  VERSION = '0.0.2'
+end

metadata

@@ -0,0 +1,219 @@
+--- !ruby/object:Gem::Specification
+name: okta-auth-proxy
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- Dale Hamel
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-04-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: sinatra
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.4.7
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.4.7
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.3.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.3.1
+- !ruby/object:Gem::Dependency
+  name: omniauth-saml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.5.0
+- !ruby/object:Gem::Dependency
+  name: em-synchrony
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.4
+- !ruby/object:Gem::Dependency
+  name: thin
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.6.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.6.4
+- !ruby/object:Gem::Dependency
+  name: thor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.19.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.19.1
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 4.2.5
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 4.2.5
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.10.3
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.10.3
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 10.4.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 10.4.2
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+description: Auth backend for use with nginx to protect applications with Okta SAML
+email: dale.hamel@srvthe.net
+executables:
+- okta-auth-proxy
+extensions: []
+extra_rdoc_files: []
+files:
+- bin/okta-auth-proxy
+- lib/okta-auth-proxy.rb
+- lib/okta-auth-proxy/app.rb
+- lib/okta-auth-proxy/auth.rb
+- lib/okta-auth-proxy/cli.rb
+- lib/okta-auth-proxy/server.rb
+- lib/okta-auth-proxy/version.rb
+homepage: https://github.com/dalehamel/okta-auth-proxy
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: Okta for apps without SAML support
+test_files: []