soar_authentication_token 0.1.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cba64c87af18ce0cacb4333430c2056b2a8dbf4d
-  data.tar.gz: 2b78253b2ce7ed01e483075950e81400c8d7435b
+  metadata.gz: 87964e7ea8211a562a63c243129746ca015c41f0
+  data.tar.gz: 9391628582b905df4d720f559bf787cdc1a46eaa
 SHA512:
-  metadata.gz: 98fabb13ee0409d95199d7eceb98a1eed2af9c0f0b4a506e6e883ed9f762d488bdef6a5e786cac824f78a1437af3f32cd4b587e10a7ca1819e3a2d896a3512e5
-  data.tar.gz: ec3ec0e4f402d2effabe925dfbefe3e7b7413eb0462cd8e6b3765386828d40d690f95a21965241f6fd14c0e9f2d7b4bbb9bc8134d9eac7874358057cad1de56b
+  metadata.gz: ac01a6c65000634dfa674bf4fdee98dd943739e2b12626de27ed57750f44b8daf94d87c828d13f6592bcf62991dc46d190502d5939b1079bd6e3a74a228807a2
+  data.tar.gz: 287ca8ee2cf219bea7a132a8c41e18d5c33427fa99a1c01df1a187ee2928c3e5d394e9247d34bb8daea36b1329852540c6af00bda25c3a2204e7de1e92ae3000

data/.gitmodules

@@ -0,0 +1,8 @@
+[submodule "authentication-token-generator-service"]
+	path = authentication-token-generator-service
+	url = git@gitlab.host-h.net:hetznerZA/authentication-token-generator-service.git
+	branch = master
+[submodule "authentication-token-validator-service"]
+	path = authentication-token-validator-service
+	url = git@gitlab.host-h.net:hetznerZA/authentication-token-validator-service.git
+	branch = master

data/Gemfile

@@ -1,4 +1,5 @@
 # A sample Gemfile
 source "https://rubygems.org"
+source 'http://gems.hetzner.co.za'
 
 gemspec

data/docker-compose.yml

@@ -1,7 +1,7 @@
 version: '2.0'
 services:
   soar-authentication-token:
-    command: /bin/bash -c 'sleep 10; bundle exec rspec -cfd spec'
+    command: /bin/bash -c 'sleep 5; bundle update; bundle exec rspec -cfd spec'
     build: .
     image: soar-authentication-token
     volumes:
@@ -10,22 +10,22 @@ services:
       - authentication-token-generator-service
       - authentication-token-validator-service
   authentication-token-generator-service:
-    build: ../authentication-token-generator-service
+    build: authentication-token-generator-service
     image: authentication-token-generator-service
     expose:
       - "9393"
     volumes:
-      - ../authentication-token-generator-service:/usr/local/src/
+      - ./authentication-token-generator-service:/usr/local/src/
     environment:
       - RACK_ENV=development
-      - ENVIRONMENT_FILE=environment_local.yml
+      - ENVIRONMENT_FILE=environment_local_ecosystem.yml
   authentication-token-validator-service:
-    build: ../authentication-token-validator-service
+    build: authentication-token-validator-service
     image: authentication-token-validator-service
     expose:
       - "9393"
     volumes:
-      - ../authentication-token-validator-service:/usr/local/src/
+      - ./authentication-token-validator-service:/usr/local/src/
     environment:
       - RACK_ENV=development
-      - ENVIRONMENT_FILE=environment_local.yml
+      - ENVIRONMENT_FILE=environment_local_ecosystem.yml

data/lib/soar_authentication_token/rack_middleware.rb

@@ -10,9 +10,10 @@ module SoarAuthenticationToken
     def call(env)
       request = Rack::Request.new env
       session, params = request.session, request.params
-      valid, authenticated_identifier = validate_and_resolve_token(request.env['HTTP_AUTHORIZATION'],params['flow_identifier'])
+      valid, token_meta = validate_and_resolve_token(request.env['HTTP_AUTHORIZATION'],params['flow_identifier'])
       if valid
-        session['user'] = authenticated_identifier
+        session['user'] = token_meta['authenticated_identifier']
+        session['auth_token_meta'] = token_meta
         @app.call env
       else
         [401, {"Content-Type" => "text/html"}, ["401 - Not authenticated"]]

data/lib/soar_authentication_token/token_generator.rb

@@ -9,6 +9,7 @@ require 'json'
 module SoarAuthenticationToken
   class TokenGenerator
     DEFAULT_CONFIGURATION = {
+      'expiry' => 604800 #a days worth of seconds
     } unless defined? DEFAULT_CONFIGURATION; DEFAULT_CONFIGURATION.freeze
 
     def initialize(configuration)
@@ -17,6 +18,10 @@ module SoarAuthenticationToken
       @private_key = OpenSSL::PKey::EC.new(@configuration['private_key'])
     end
 
+    def inject_store_provider(store_provider)
+      @store_provider = store_provider
+    end
+
     def generate(authenticated_identifier:, flow_identifier: nil)
       return generate_locally(authenticated_identifier) if 'local' == @configuration['mode']
       return generate_remotely(authenticated_identifier,flow_identifier)
@@ -25,7 +30,7 @@ module SoarAuthenticationToken
     private
 
     def generate_locally(authenticated_identifier)
-      encode(payload(authenticated_identifier))
+      encode(meta(authenticated_identifier))
     end
 
     def generate_remotely(authenticated_identifier,flow_identifier)
@@ -49,15 +54,17 @@ module SoarAuthenticationToken
       body['data']['token']
     end
 
-    def payload(authenticated_identifier)
+    def meta(authenticated_identifier)
+      current_time = Time.now
       { 'authenticated_identifier' => authenticated_identifier,
-        'issue_time'               => Time.now.utc.iso8601(3),
-        'nounce'                   => SecureRandom.hex(32)
+        'token_issue_time'         => current_time.utc.iso8601(3),
+        'token_expiry_time'        => (current_time + @configuration['expiry']).utc.iso8601(3),
+        'token_identifier'         => SecureRandom.hex(32)
       }
     end
 
-    def encode(payload)
-      JWT.encode(payload, @private_key, 'ES512')
+    def encode(meta)
+      JWT.encode(meta, @private_key, 'ES512')
     end
 
     def validate_configuration
@@ -67,6 +74,8 @@ module SoarAuthenticationToken
         raise "'generator-url' must be configured in remote mode" if @configuration['generator-url'].nil?
       else
         raise "'private_key' must be configured in local mode" unless @configuration['private_key']
+        raise "'expiry' must be configured in local mode" unless @configuration['expiry']
+        raise "'expiry' must be an integer" unless Integer(@configuration['expiry'])
       end
     end
 
@@ -74,5 +83,13 @@ module SoarAuthenticationToken
       configuration = {} unless configuration
       Hash.deep_merge(DEFAULT_CONFIGURATION,configuration)
     end
+
+    def add_token_to_store?(meta)
+      @store_provider.add(
+        token_identifier:         meta['token_identifier'],
+        authenticated_identifier: meta['authenticated_identifier'],
+        token_issue_time:         meta['token_issue_time'],
+        token_expiry_time:        meta['token_expiry_time'])
+    end
   end
 end

data/lib/soar_authentication_token/token_validator.rb

@@ -4,7 +4,7 @@ require 'jwt'
 module SoarAuthenticationToken
   class TokenValidator
     DEFAULT_CONFIGURATION = {
-      'expiry'        => 604800 #a days worth of seconds
+      'expiry' => 604800 #a days worth of seconds
     } unless defined? DEFAULT_CONFIGURATION; DEFAULT_CONFIGURATION.freeze
 
     def initialize(configuration)
@@ -14,21 +14,45 @@ module SoarAuthenticationToken
       @public_key.private_key = nil
     end
 
+    def inject_store_provider(store_provider)
+      @store_provider = store_provider
+    end
+
     def validate(authentication_token:,flow_identifier: nil)
       return validate_locally(authentication_token) if 'local' == @configuration['mode']
       return validate_remotely(authentication_token,flow_identifier)
     end
 
+    def token(authentication_token:,flow_identifier: nil)
+      return validate_locally(authentication_token) if 'local' == @configuration['mode']
+      return validate_remotely(authentication_token,flow_identifier)
+    end
+
     private
 
     def validate_locally(authentication_token)
-      decoded_token_payload = decode(authentication_token)
-      return [false, nil] if expired?(decoded_token_payload[0]['issue_time'])
-      [true, decoded_token_payload[0]['authenticated_identifier']]
+      meta = token_meta(authentication_token)
+      return [false, nil] if token_expired?(meta)
+      return [false, nil] if token_exist_in_store?(meta)
+      [true, meta]
     rescue JWT::VerificationError, JWT::DecodeError
       [false, nil]
     end
 
+    def token_meta(authentication_token)
+      decoded_token_payload = decode(authentication_token)
+      {
+        'authenticated_identifier' => decoded_token_payload[0]['authenticated_identifier'],
+        'token_issue_time' =>         decoded_token_payload[0]['token_issue_time'],
+        'token_expiry_time' =>        decoded_token_payload[0]['token_expiry_time'],
+        'token_age' =>                token_age(decoded_token_payload[0]['token_issue_time'])
+      }
+    end
+
+    def token_age(token_issue_time)
+      Time.now - Time.parse(token_issue_time)
+    end
+
     def validate_remotely(authentication_token,flow_identifier)
       uri = URI.parse(@configuration['validator-url'])
 
@@ -75,8 +99,16 @@ module SoarAuthenticationToken
       JWT.decode(authentication_token, @public_key, true, { :algorithm => 'ES512' })
     end
 
-    def expired?(issue_time)
-      (Time.parse(issue_time) + @configuration['expiry']) < Time.now
+    def token_expired?(meta)
+      Time.parse(meta['token_expiry_time']) < Time.now
+    end
+
+    def token_exist_in_store?(meta)
+      @store_provider.token_exist?(
+        token_identifier:         meta['token_identifier'],
+        authenticated_identifier: meta['authenticated_identifier'],
+        token_issue_time:         meta['token_issue_time'],
+        token_expiry_time:        meta['token_expiry_time'])
     end
   end
 end

data/lib/soar_authentication_token/version.rb

@@ -1,3 +1,3 @@
 module SoarAuthenticationToken
-  VERSION = '0.1.0'
+  VERSION = '1.0.0'
 end

data/soar_authentication_token.gemspec

@@ -22,6 +22,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'soar_xt', '~> 0.0.3'
   spec.add_dependency 'jwt', '~> 1.5', '>= 1.5.6'
   spec.add_dependency "rack", '~> 1.6', '>= 1.6.4'
+  spec.add_dependency 'auth_token_store_provider', '~> 1.0.0'
 
   spec.add_development_dependency 'pry', '~> 0'
   spec.add_development_dependency 'bundler', '~> 1.3'

data/spec/rack_middleware_spec.rb

@@ -5,7 +5,17 @@ require 'rack/test'
 describe SoarAuthenticationToken::RackMiddleware do
   include Rack::Test::Methods
 
-  def create_token_generator
+  def create_valid_token_generator
+    keypair_generator = SoarAuthenticationToken::KeypairGenerator.new
+    private_key, public_key = keypair_generator.generate
+    configuration = {
+      'mode' => 'remote',
+      'generator-url' => 'http://authentication-token-generator-service:9393/generate'
+    }
+    [ SoarAuthenticationToken::TokenGenerator.new(configuration), private_key, public_key ]
+  end
+
+  def create_invalid_token_generator
     keypair_generator = SoarAuthenticationToken::KeypairGenerator.new
     private_key, public_key = keypair_generator.generate
     configuration = {
@@ -17,8 +27,8 @@ describe SoarAuthenticationToken::RackMiddleware do
   end
 
   before :all do
-    @local_valid_generator,   @valid_private_key,   @valid_public_key   = create_token_generator
-    @local_invalid_generator, @imvalid_private_key, @invalid_public_key = create_token_generator
+    @local_valid_generator,   @valid_private_key,   @valid_public_key   = create_valid_token_generator
+    @local_invalid_generator, @imvalid_private_key, @invalid_public_key = create_invalid_token_generator
   end
 
   before :each do
@@ -27,7 +37,11 @@ describe SoarAuthenticationToken::RackMiddleware do
       session = request.session
       [200, {"Content-Type"=>"text/html"}, ["tested with authenticated user #{session['user']}"] ]
     end
-    @iut_configuration = { 'mode' => 'local', 'public_key' => @valid_public_key}
+    @iut_configuration = {
+      'mode' => 'remote',
+      'generator-url' => 'http://authentication-token-generator-service:9393/generate',
+      'validator-url' => 'http://authentication-token-validator-service:9393/validate'
+    }
     @iut = SoarAuthenticationToken::RackMiddleware.new(@test_app, @iut_configuration)
   end
 

data/spec/spec_helper.rb

@@ -3,3 +3,4 @@ $LOAD_PATH.unshift File.expand_path('../../spec/support', __FILE__)
 
 require 'soar_authentication_token'
 require 'pry'
+require 'auth_token_store_provider'

data/spec/token_generator_spec.rb

@@ -21,6 +21,8 @@ describe SoarAuthenticationToken::TokenGenerator do
       'generator-url' => 'http://authentication-token-generator-service:9393/generate',
       'validator-url' => 'http://authentication-token-validator-service:9393/validate'
     }
+
+    @test_store = AuthTokenStoreProvider::StubClient.new
   end
 
   after :each do
@@ -34,29 +36,33 @@ describe SoarAuthenticationToken::TokenGenerator do
   end
 
   context "when generating a new token locally" do
-    it 'should provide token using configured private key' do
+    it 'should generate the token locally using configured private key' do
       @iut = SoarAuthenticationToken::TokenGenerator.new(@generator_configuration_local)
+      @iut.inject_store_provider(@test_store)
       @validator = SoarAuthenticationToken::TokenValidator.new(@validator_configuration_local)
+      @validator.inject_store_provider(@test_store)
 
       token = @iut.generate(authenticated_identifier: @test_authenticated_identifier, flow_identifier: 'test-flow-id')
-      token_validity, token_identifier = @validator.validate(authentication_token: token, flow_identifier: 'test-flow-id')
+      token_validity, token_meta = @validator.validate(authentication_token: token, flow_identifier: 'test-flow-id')
 
       expect(token_validity).to eq(true)
-      expect(token_identifier).to eq(@test_authenticated_identifier)
+      expect(token_meta['authenticated_identifier']).to eq(@test_authenticated_identifier)
     end
   end
 
   context "when generating a new token remotely" do
-    it 'should provide token using the configured remote service' do
+    it 'should request the token from the configured remote service' do
       @iut = SoarAuthenticationToken::TokenGenerator.new(@configuration_remote)
+      @iut.inject_store_provider(@test_store)
 
       token = @iut.generate(authenticated_identifier: @test_authenticated_identifier, flow_identifier: 'test-flow-id')
 
       @validator = SoarAuthenticationToken::TokenValidator.new(@configuration_remote)
-      token_validity, token_identifier = @validator.validate(authentication_token: token, flow_identifier: 'test-flow-id')
+      @iut.inject_store_provider(@test_store)
+      token_validity, token_meta = @validator.validate(authentication_token: token, flow_identifier: 'test-flow-id')
 
       expect(token_validity).to eq(true)
-      expect(token_identifier).to eq(@test_authenticated_identifier)
+      expect(token_meta['authenticated_identifier']).to eq(@test_authenticated_identifier)
     end
   end
 end

data/spec/token_validator_spec.rb

@@ -3,6 +3,7 @@ require 'yaml'
 
 describe SoarAuthenticationToken::TokenValidator do
   before :all do
+    @test_store = AuthTokenStoreProvider::StubClient.new
     keypair_generator = SoarAuthenticationToken::KeypairGenerator.new
     @valid_private_key,   @valid_public_key   = keypair_generator.generate
     @invalid_private_key, @invalid_public_key = keypair_generator.generate
@@ -28,12 +29,15 @@ describe SoarAuthenticationToken::TokenValidator do
       'validator-url' => 'http://authentication-token-validator-service:9393/validate'
     }
     @local_valid_generator = SoarAuthenticationToken::TokenGenerator.new(@local_valid_generator_configuration)
+    @local_valid_generator.inject_store_provider(@test_store)
     @local_invalid_generator = SoarAuthenticationToken::TokenGenerator.new(@local_invalid_generator_configuration)
+    @local_invalid_generator.inject_store_provider(@test_store)
     @remote_generator = SoarAuthenticationToken::TokenGenerator.new(@remote_generator_configuration)
   end
 
   before :each do
     @iut_local  = SoarAuthenticationToken::TokenValidator.new(@local_validator_configuration)
+    @iut_local.inject_store_provider(@test_store)
     @iut_remote = SoarAuthenticationToken::TokenValidator.new(@remote_validator_configuration)
   end
 
@@ -47,26 +51,26 @@ describe SoarAuthenticationToken::TokenValidator do
   context "when validating a token locally using the configured public key" do
     it 'should indicate valid if the token is valid' do
       token = @local_valid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta = @iut_local.validate(authentication_token: token)
       expect(token_validity).to eq true
     end
 
     it 'should indicate invalid if the token is invalid' do
       token = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta = @iut_local.validate(authentication_token: token)
       expect(token_validity).to eq false
     end
 
     it 'should provide the authenticated_identifier if the token is valid' do
       token = @local_valid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_local.validate(authentication_token: token)
-      expect(token_identifier).to eq @test_identifier
+      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      expect(token_meta['authenticated_identifier']).to eq @test_identifier
     end
 
     it 'should not provide the authenticated_identifier if the token is invalid' do
       token = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_local.validate(authentication_token: token)
-      expect(token_identifier).to eq nil
+      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      expect(token_meta).to eq nil
     end
 
     it 'should indicate as invalid tokens that are older than the configured expiry time' do
@@ -83,26 +87,26 @@ describe SoarAuthenticationToken::TokenValidator do
   context "when validating a token remotely using the configured url" do
     it 'should indicate valid if the token is valid' do
       token = @remote_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
       expect(token_validity).to eq true
     end
 
     it 'should indicate invalid if the token is invalid' do
       token = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
       expect(token_validity).to eq false
     end
 
     it 'should provide the authenticated_identifier if the token is valid' do
       token = @remote_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_remote.validate(authentication_token: token)
-      expect(token_identifier).to eq @test_identifier
+      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      expect(token_meta['authenticated_identifier']).to eq @test_identifier
     end
 
     it 'should not provide the authenticated_identifier if the token is invalid' do
       token = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_identifier = @iut_remote.validate(authentication_token: token)
-      expect(token_identifier).to eq nil
+      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      expect(token_meta).to eq nil
     end
 
     it 'should indicate as invalid tokens that are older than the configured expiry time' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: soar_authentication_token
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Barney de Villiers
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-12-07 00:00:00.000000000 Z
+date: 2017-01-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: soar_xt
@@ -64,6 +64,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.6.4
+- !ruby/object:Gem::Dependency
+  name: auth_token_store_provider
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.0.0
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
@@ -151,6 +165,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".gitmodules"
 - ".rspec"
 - ".ruby-gemset"
 - ".ruby-version"