onelogin 1.5.0 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -11,6 +11,15 @@
11
11
  <div class="alert alert-danger message" role="alert">
12
12
  </div>
13
13
 
14
+ <% url_base = CUSTOM_DOMAIN || ONELOGIN_SUBDOMAIN + ".onelogin.com" %>
15
+ <% url_create_session = "https://" + url_base + "/session_via_api_token" %>
16
+
17
+ <form action="<%= url_create_session %>" method="post" class="cookie-session-post-form">
18
+ <input type="hidden" id="cookie_session_token" name="session_token" value="">
19
+ <input id="auth_token" type="hidden">
20
+ <button type="submit">Creating Session ...</button>
21
+ </form>
22
+
14
23
  <%= form_tag("/login", method: "post", class: 'login-form') do %>
15
24
  <div class="form-group">
16
25
  <label for="username">Username</label>
@@ -61,6 +70,8 @@
61
70
  <button type="submit" class="btn btn-primary">Save Password</button>
62
71
  <% end %>
63
72
 
73
+ <form method="POST" action="" id="sp"></form>
74
+
64
75
  </div>
65
76
  <div class="col-sm">
66
77
  </div>
@@ -72,19 +83,42 @@
72
83
 
73
84
  <script type="text/javascript">
74
85
 
75
- var ONELOGIN_SUBDOMAIN = "<%= ONELOGIN_SUBDOMAIN %>"
86
+ var ONELOGIN_SUBDOMAIN = "<%= ONELOGIN_SUBDOMAIN %>";
87
+ var CUSTOM_DOMAIN = "<%= CUSTOM_DOMAIN %>";
88
+ var COOKIE_VIA_POST_FORM = <%= COOKIE_VIA_POST_FORM || false %>;
76
89
 
77
90
  function makeCors(session_token) {
78
91
  var xhr = new XMLHttpRequest();
79
92
  xhr.withCredentials = true;
80
93
  method = "POST";
81
- var url = "https://" + ONELOGIN_SUBDOMAIN + ".onelogin.com/session_via_api_token";
94
+ if (CUSTOM_DOMAIN) {
95
+ var url = "https://" + CUSTOM_DOMAIN + "/session_via_api_token";
96
+ } else {
97
+ var url = "https://" + ONELOGIN_SUBDOMAIN + ".onelogin.com/session_via_api_token";
98
+ }
82
99
  xhr.open(method, url, true);
83
100
  xhr.setRequestHeader("Content-Type", "application/json");
84
101
  body = {"session_token": session_token};
102
+ xhr.onreadystatechange = function () {
103
+ if(xhr.readyState === 4 && xhr.status === 200) {
104
+ if(getUrlParameter("origin")){
105
+ // If there is an origin SP then redirect to it
106
+ redirectToSP()
107
+ } else{
108
+ // Otherwise redirect to the main dashboard
109
+ window.location.href = '/dashboard';
110
+ }
111
+ }
112
+ };
85
113
  xhr.send(JSON.stringify(body));
86
114
  };
87
115
 
116
+ function sendPostForm(session_token){
117
+ $(".cookie-session-post-form").show();
118
+ $("#cookie_session_token").val(session_token);
119
+ $(".cookie-session-post-form").submit();
120
+ }
121
+
88
122
  function showAlert(type, message){
89
123
  $(".message").removeClass("alert-danger").removeClass("alert-success");
90
124
  $(".message").addClass("alert-" + type).text(message).show();
@@ -94,9 +128,32 @@
94
128
  $(".message").hide();
95
129
  }
96
130
 
131
+ function getUrlParameter(sParam) {
132
+ var sPageURL = window.location.search.substring(1),
133
+ sURLVariables = sPageURL.split('&'),
134
+ sParameterName,
135
+ i;
136
+
137
+ for (i = 0; i < sURLVariables.length; i++) {
138
+ sParameterName = sURLVariables[i].split('=');
139
+
140
+ if (sParameterName[0] === sParam) {
141
+ return sParameterName[1] === undefined ? true : decodeURIComponent(sParameterName[1]);
142
+ }
143
+ }
144
+ };
145
+
146
+ function redirectToSP() {
147
+ var origin = getUrlParameter("origin");
148
+ var samlRequest = getUrlParameter("SAMLRequest");
149
+ var url = origin + "&SAMLRequest=" + samlRequest;
150
+ $("#sp").attr("action", url).submit();
151
+ }
152
+
97
153
  $(function(){
98
154
  hideAlert();
99
155
  $(".login-form").show();
156
+ $(".cookie-session-post-form").hide();
100
157
  $(".mfa-form").hide();
101
158
  $(".forgot-password-form").hide();
102
159
  $(".reset-password-form").hide();
@@ -124,9 +181,12 @@
124
181
  $(".login-form").hide();
125
182
  $(".mfa-form").show();
126
183
 
127
- }else{
128
- makeCors(res.session_token);
129
- window.location.href = '/dashboard';
184
+ } else {
185
+ if (typeof COOKIE_VIA_POST_FORM === 'boolean' && COOKIE_VIA_POST_FORM === true) {
186
+ sendPostForm(res.session_token);
187
+ } else {
188
+ makeCors(res.session_token);
189
+ }
130
190
  }
131
191
  },
132
192
  error: function(xhr, status, err) {
@@ -147,8 +207,11 @@
147
207
  success: function(res, status, xhr) {
148
208
  console.log(res);
149
209
 
150
- makeCors(res.session_token);
151
- window.location.href = '/dashboard';
210
+ if (typeof COOKIE_VIA_POST_FORM === 'boolean' && COOKIE_VIA_POST_FORM === true) {
211
+ sendPostForm(res.session_token);
212
+ } else {
213
+ makeCors(res.session_token);
214
+ }
152
215
  },
153
216
  error: function(xhr, status, err) {
154
217
  console.log(err);
@@ -206,4 +269,4 @@
206
269
  event.preventDefault();
207
270
  });
208
271
  })
209
- </script>
272
+ </script>
@@ -1,4 +1,6 @@
1
1
  ONELOGIN_CLIENT_ID = Rails.application.secrets.ONELOGIN_CLIENT_ID
2
2
  ONELOGIN_CLIENT_SECRET = Rails.application.secrets.ONELOGIN_CLIENT_SECRET
3
3
  ONELOGIN_REGION = Rails.application.secrets.ONELOGIN_REGION
4
- ONELOGIN_SUBDOMAIN = Rails.application.secrets.ONELOGIN_SUBDOMAIN
4
+ ONELOGIN_SUBDOMAIN = Rails.application.secrets.ONELOGIN_SUBDOMAIN
5
+ CUSTOM_DOMAIN = Rails.application.secrets.CUSTOM_DOMAIN
6
+ COOKIE_VIA_POST_FORM = Rails.application.secrets.COOKIE_VIA_POST_FORM
@@ -23,6 +23,8 @@ development:
23
23
  ONELOGIN_CLIENT_SECRET:
24
24
  ONELOGIN_REGION: us
25
25
  ONELOGIN_SUBDOMAIN:
26
+ CUSTOM_DOMAIN:
27
+ COOKIE_VIA_POST_FORM:
26
28
 
27
29
  test:
28
30
  secret_key_base: 4560f08eba120b9601635410e1ceb958d9e119733b1ed614dee82dfb8cd6d121ed756463ae53dd9876bea1995505f85f8c86cc6848397fd2b3f63ae4f8980d30