soar_authentication_token 2.0.3 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: baa47e9f9627e8cc1171a02147912ba35f12decc
-  data.tar.gz: 0bb45eef7c46871eb88d372c9c17a0d22ee8aa8a
+  metadata.gz: c1a6ee48994978d49a24f51df0e4a0fa78e9b48c
+  data.tar.gz: 40f3341de578f6cff681c5478e2a90b74bc9bdbb
 SHA512:
-  metadata.gz: 7ad0fedc417cca42974b94ad8486e2aa962d91b74d2a6e12eae5a9d7ac78035ce1b8fac04a22fae86eea08e2dd2547a0486e8cdc5101c36067397f8347fa69b0
-  data.tar.gz: 7e6b05a978c6edef2f9cbf28af3a6c83bf1a51c0cd96687a059eafddb2e808a620db4423a123cfd9ffccadb1bac0056d342108e6cad2db3d0e44d43c6061c975
+  metadata.gz: e9226cada6118f03955459088df8fdf03a51601fd42b1faab5e1eaff53312331259347c7f39969c03fa9eb71b3a30b884cb89c4f4807b7d3d5e31c25040c66bc
+  data.tar.gz: c56869b6c2a76520e64524513913598282883715a54a0d8686bdbdc2b1ee13cae8c34969f489891b13ac3da2ec0a577274dc51d34367b48d237149a156a479c9

data/README.md

@@ -20,6 +20,20 @@ Or install it yourself as:
 
     $ gem install soar_authentication_token
 
+## Configuration
+
+There are three modes of operation.
+### Local
+In local mode the tokens are decoded, verified and meta extracted locally using configured key material.
+
+### Remote
+In remote mode the tokens are passed to a validation service for dynamic validation.  The key material are therefore managed on the validation service.  In this mode you only have to provide the url of the validation service.
+
+### Static
+In this mode the validator are configured with a list of preconfigured static tokens.  Incoming tokens are simply checked against this list.  No extraction of meta is performed on the tokens but retrieved from the configuration.  This mode is to be used in only two scenarios:
+* Between the various authentication token services that requires authentication between themselves.  These services do not have such a service to rely on. Circular dependency.
+* In test scenarios where you do not want to pull in the authentication services to perform testing of your services.
+
 
 ## Testing
 
@@ -37,6 +51,15 @@ Locally run a subset:
     $ bundle exec rspec -cfd spec/rack_middleware_spec.rb
 
 
+## Updating
+
+In order to pull the latest from the referenced projects, simply the following command:
+
+```bash
+git pull && git submodule foreach 'git fetch origin --tags; git checkout master; git pull'
+docker-compose build
+```
+
 ## Usage
 
 

data/docker-compose.yml

@@ -1,7 +1,7 @@
 version: '2.0'
 services:
   soar-authentication-token:
-    command: /bin/bash -c 'sleep 5; bundle exec rspec -cfd spec'
+    command: /bin/bash -c 'bundle exec rspec -cfd spec'
     build: .
     image: soar-authentication-token
     volumes:

data/lib/soar_authentication_token/rack_middleware.rb

@@ -2,20 +2,22 @@ require 'rack'
 
 module SoarAuthenticationToken
   class RackMiddleware
-    def initialize(app, configuration)
+    def initialize(app, configuration, auditing = nil)
       @app = app
       @configuration = configuration
+      @auditing = auditing
     end
 
     def call(env)
       request = Rack::Request.new env
       session, params = request.session, request.params
-      valid, token_meta = validate_and_resolve_token(request.env['HTTP_AUTHORIZATION'],params['flow_identifier'])
-      if valid
+      token_valid, token_meta, message = validate_and_resolve_token(request.env['HTTP_AUTHORIZATION'],params['flow_identifier'])
+      if token_valid
         session['user'] = token_meta['authenticated_identifier']
         session['auth_token_meta'] = token_meta
         @app.call env
       else
+        audit_token_rejection("Token rejected due to #{message}",params['flow_identifier'])
         [401, {"Content-Type" => "text/html"}, ["401 - Not authenticated"]]
       end
     end
@@ -26,5 +28,9 @@ module SoarAuthenticationToken
       token_validator = SoarAuthenticationToken::TokenValidator.new(@configuration)
       token_validator.validate(authentication_token: authentication_token,flow_identifier: flow_identifier)
     end
+
+    def audit_token_rejection(message, flow_id)
+      @auditing.warn(message,flow_id) if @auditing
+    end
   end
 end

data/lib/soar_authentication_token/token_validator.rb

@@ -19,39 +19,66 @@ module SoarAuthenticationToken
     end
 
     def validate(authentication_token:,flow_identifier: nil)
-      return validate_locally(authentication_token) if 'local' == @configuration['mode']
+      return validate_locally(authentication_token)    if 'local' == @configuration['mode']
+      return validate_statically(authentication_token) if 'static' == @configuration['mode']
       return validate_remotely(authentication_token,flow_identifier)
     end
 
-    def token(authentication_token:,flow_identifier: nil)
-      return validate_locally(authentication_token) if 'local' == @configuration['mode']
-      return validate_remotely(authentication_token,flow_identifier)
+    private
+
+    def validate_statically(authentication_token)
+      found_static_token = find_configured_static_token(authentication_token)
+      return rejection_result(reason: 'Unknown static token') if found_static_token.nil?
+      meta = compile_meta(token_identifier:         'static_token',
+                          authenticated_identifier: found_static_token['authenticated_identifier'],
+                          token_issue_time:         found_static_token['token_issue_time'],
+                          token_expiry_time:        found_static_token['token_expiry_time'])
+      return rejection_result(reason: "Expired token <#{meta['token_expiry_time']}> for <#{meta['authenticated_identifier']}>") if token_expired?(meta)
+      return success_result(token_meta: meta)
+
     end
 
-    private
+    def find_configured_static_token(authentication_token)
+      @configuration['static_tokens'].each { |static_token|
+        if authentication_token == static_token['token']
+          return static_token
+        end
+      }
+      nil
+    end
 
     def validate_locally(authentication_token)
-      meta = token_meta(authentication_token)
-      return [false, nil] if token_expired?(meta)
-      return [false, nil] unless token_exist_in_store?(meta)
-      [true, meta]
+      meta = decode_token_meta(authentication_token)
+      return rejection_result(reason: "Expired token <#{meta['token_expiry_time']}> for <#{meta['authenticated_identifier']}>") if token_expired?(meta)
+      return rejection_result(reason: "Unknown token for <#{meta['authenticated_identifier']}>") unless token_exist_in_store?(meta)
+      success_result(token_meta: meta)
     rescue JWT::VerificationError, JWT::DecodeError
-      [false, nil]
+      rejection_result(reason: 'Token decode/verification failure')
     end
 
-    def token_meta(authentication_token)
+    def decode_token_meta(authentication_token)
       decoded_token_payload = decode(authentication_token)
+      compile_meta(token_identifier:         decoded_token_payload[0]['token_identifier'],
+                   authenticated_identifier: decoded_token_payload[0]['authenticated_identifier'],
+                   token_issue_time:         decoded_token_payload[0]['token_issue_time'],
+                   token_expiry_time:        decoded_token_payload[0]['token_expiry_time'])
+    end
+
+    def compile_meta(token_identifier:,
+                     authenticated_identifier:,
+                     token_issue_time:,
+                     token_expiry_time:)
       {
-        'token_identifier' =>         decoded_token_payload[0]['token_identifier'],
-        'authenticated_identifier' => decoded_token_payload[0]['authenticated_identifier'],
-        'token_issue_time' =>         decoded_token_payload[0]['token_issue_time'],
-        'token_expiry_time' =>        decoded_token_payload[0]['token_expiry_time'],
-        'token_age' =>                token_age(decoded_token_payload[0]['token_issue_time'])
+        'token_identifier' =>         token_identifier,
+        'authenticated_identifier' => authenticated_identifier,
+        'token_issue_time' =>         token_issue_time,
+        'token_expiry_time' =>        token_expiry_time,
+        'token_age' =>                token_age(token_issue_time)
       }
     end
 
     def token_age(token_issue_time)
-      Time.now - Time.parse(token_issue_time)
+      Time.now - Time.parse(token_issue_time.to_s)
     end
 
     def validate_remotely(authentication_token,flow_identifier)
@@ -72,24 +99,34 @@ module SoarAuthenticationToken
       body = JSON.parse(response.body)
       if 'success' == body['status']
         raise 'Token validation service did not provide authenticated_identifier' if body['data'].nil? or body['data']['authenticated_identifier'].nil?
-        return [true, body['data']]
+        return success_result(token_meta: body['data'])
       end
       if 'fail' == body['status']
-        return [false, nil]
+        return rejection_result(reason: 'remote validation failed')
       end
       raise "Failure validating token with token validation service. Status '#{body['status']}' received"
     end
 
     def validate_configuration
       raise "'mode' must be configured" unless @configuration['mode']
-      raise "'mode' must be configured as either 'local' or 'remote'" unless ['local','remote'].include?(@configuration['mode'])
-      if 'remote' == @configuration['mode']
-        raise "'validator-url' must be configured in remote mode" unless @configuration['validator-url']
-      else
-        raise "'public_key' must be configured in local mode" unless @configuration['public_key']
-        raise "'expiry' must be configured in local mode" unless @configuration['expiry']
-        raise "'expiry' must be an integer" unless Integer(@configuration['expiry'])
-      end
+      raise "'mode' must be configured as either 'local', 'remote' or 'static'" unless ['local','remote', 'static'].include?(@configuration['mode'])
+      validate_remote_configuration if 'remote' == @configuration['mode']
+      validate_local_configuration  if 'local' == @configuration['mode']
+      validate_static_configuration if 'static' == @configuration['mode']
+    end
+
+    def validate_remote_configuration
+      raise "'validator-url' must be configured in remote mode" unless @configuration['validator-url']
+    end
+
+    def validate_local_configuration
+      raise "'public_key' must be configured in local mode" unless @configuration['public_key']
+      raise "'expiry' must be configured in local mode" unless @configuration['expiry']
+      raise "'expiry' must be an integer" unless Integer(@configuration['expiry'])
+    end
+
+    def validate_static_configuration
+      raise "'static_tokens' must be configured in local mode" unless @configuration['static_tokens']
     end
 
     def merge_with_default_configuration(configuration)
@@ -101,7 +138,7 @@ module SoarAuthenticationToken
     end
 
     def token_expired?(meta)
-      Time.parse(meta['token_expiry_time']) < Time.now
+      Time.parse(meta['token_expiry_time'].to_s) < Time.now
     end
 
     def token_exist_in_store?(meta)
@@ -111,5 +148,13 @@ module SoarAuthenticationToken
         token_issue_time:         meta['token_issue_time'],
         token_expiry_time:        meta['token_expiry_time'])
     end
+
+    def rejection_result(reason:)
+      [false, nil, reason]
+    end
+
+    def success_result(token_meta:)
+      [true, token_meta, "Valid token for <#{token_meta['authenticated_identifier']}>" ]
+    end
   end
 end

data/lib/soar_authentication_token/version.rb

@@ -1,3 +1,3 @@
 module SoarAuthenticationToken
-  VERSION = '2.0.3'
+  VERSION = '3.0.0'
 end

data/spec/token_validator_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 require 'yaml'
 
 describe SoarAuthenticationToken::TokenValidator do
+  subject { SoarAuthenticationToken::TokenValidator }
   before :all do
     @test_store = AuthTokenStoreProvider::StubClient.new
     keypair_generator = SoarAuthenticationToken::KeypairGenerator.new
@@ -16,6 +17,36 @@ describe SoarAuthenticationToken::TokenValidator do
       'mode' => 'local',
       'private_key' => @invalid_private_key
     }
+
+    @token_for_client_service_1         = 'some_secret_token_string_1111'
+    @token_for_client_service_2         = 'some_secret_token_string_2222'
+    @token_for_client_service_3_expired = 'some_secret_token_string_3333_expired'
+    @token_for_client_service_3_unknown = 'some_secret_token_string_3333_unknown'
+
+    current_time = Time.now
+    @static_validator_configuration = {
+      'mode' => 'static',
+      'static_tokens' => [
+        {
+          'token'                    => 'some_secret_token_string_1111',
+          'authenticated_identifier' => 'calling_client_service_1',
+          'token_issue_time'         =>  current_time.utc.iso8601(3),
+          'token_expiry_time'        => (current_time + 100).utc.iso8601(3)
+        },
+        {
+          'token'                    => 'some_secret_token_string_2222',
+          'authenticated_identifier' => 'calling_client_service_2',
+          'token_issue_time'         =>  current_time.utc.iso8601(3),
+          'token_expiry_time'        => (current_time + 100).utc.iso8601(3)
+        },
+        {
+          'token'                    => 'some_secret_token_string_3333_expired',
+          'authenticated_identifier' => 'calling_client_service_3',
+          'token_issue_time'         => (current_time - 100).utc.iso8601(3),
+          'token_expiry_time'        => (current_time - 50).utc.iso8601(3)
+        }
+      ]
+    }
     @local_validator_configuration = {
       'mode' => 'local',
       'public_key' => @valid_public_key
@@ -39,6 +70,8 @@ describe SoarAuthenticationToken::TokenValidator do
     @iut_local  = SoarAuthenticationToken::TokenValidator.new(@local_validator_configuration)
     @iut_local.inject_store_provider(@test_store)
     @iut_remote = SoarAuthenticationToken::TokenValidator.new(@remote_validator_configuration)
+
+    @iut_static = SoarAuthenticationToken::TokenValidator.new(@static_validator_configuration)
   end
 
   after :each do
@@ -48,31 +81,35 @@ describe SoarAuthenticationToken::TokenValidator do
     expect(SoarAuthenticationToken::VERSION).not_to be nil
   end
 
+
   context "when validating a token locally using the configured public key" do
     it 'should indicate valid if the token is valid' do
       token, token_generator_meta = @local_valid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_local.validate(authentication_token: token)
       expect(token_validity).to eq true
     end
 
-    it 'should indicate invalid if the token is invalid' do
+    it 'should indicate invalid if the token is not valid' do
       token, token_generator_meta = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_local.validate(authentication_token: token)
       expect(token_validity).to eq false
     end
 
-    it 'should provide the authenticated_identifier if the token is valid' do
+    it 'should provide the token meta if the token is valid' do
       token, token_generator_meta = @local_valid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_local.validate(authentication_token: token)
       expect(token_meta['authenticated_identifier']).to eq @test_identifier
     end
 
-    it 'should not provide the authenticated_identifier if the token is invalid' do
+    it 'should not provide the token meta if the token is invalid' do
       token, token_generator_meta = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_local.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_local.validate(authentication_token: token)
       expect(token_meta).to eq nil
     end
 
+    it 'should provide a message indicating that that token is valid if the token is valid' do
+    end
+
     it 'should indicate as invalid tokens that are older than the configured expiry time' do
       #TODO
       #expect(true).to eq false
@@ -82,30 +119,97 @@ describe SoarAuthenticationToken::TokenValidator do
       #TODO
       #expect(true).to eq false
     end
+
+    it 'should indicate as invalid tokens that are not in the token store' do
+    end
+  end
+
+
+  describe "#validate" do
+    context "given that the validator is configured for static tokens" do
+      let(:iut) { subject.new(@static_validator_configuration) }
+      context "given a token that is in the list of static tokens and not expired" do
+        let(:response)       { iut.validate(authentication_token: @token_for_client_service_1) }
+        let(:token_validity) { response[0] }
+        let(:token_meta)     { response[1] }
+        let(:message)        { response[2] }
+
+        it 'should respond with true indicating token is valid' do
+          expect(token_validity).to eq true
+        end
+
+        it 'should respond with token meta' do
+          expect(token_meta).to_not eq nil
+        end
+
+        it 'should respond with a message indicating that the token is valid' do
+          expect(message).to eq 'Valid token for <calling_client_service_1>'
+        end
+      end
+
+      context "the token is in the list of static tokens and expired" do
+        let(:response)       { @iut_static.validate(authentication_token: @token_for_client_service_3_expired) }
+        let(:token_validity) { response[0] }
+        let(:token_meta)     { response[1] }
+        let(:message)        { response[2] }
+
+        it 'should respond with false indicating token is invalid' do
+          expect(token_validity).to eq false
+        end
+
+        it 'should respond with nil token meta' do
+          expect(token_meta).to eq nil
+        end
+
+        it 'should respond with a message indicating that the token is expired' do
+          expect(message).to match /Expired token/
+        end
+      end
+
+      context "given a token that is not in the list of static tokens" do
+        let(:response)       { @iut_static.validate(authentication_token: @token_for_client_service_3_unknown) }
+        let(:token_validity) { response[0] }
+        let(:token_meta)     { response[1] }
+        let(:message)        { response[2] }
+
+        it 'should respond with false indicating token is invalid' do
+          expect(token_validity).to eq false
+        end
+
+        it 'should respond with no token meta' do
+          expect(token_meta).to eq nil
+        end
+
+        it 'should respond with a message indicating that the token is valid' do
+          expect(message).to match /Unknown static token/
+        end
+      end
+    end
   end
 
+
   context "when validating a token remotely using the configured url" do
     it 'should indicate valid if the token is valid' do
       token, token_generator_meta = @remote_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_remote.validate(authentication_token: token)
       expect(token_validity).to eq true
     end
 
     it 'should indicate invalid if the token is invalid' do
       token, token_generator_meta = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_remote.validate(authentication_token: token)
       expect(token_validity).to eq false
     end
 
     it 'should provide the authenticated_identifier if the token is valid' do
       token, token_generator_meta = @remote_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_remote.validate(authentication_token: token)
       expect(token_meta['authenticated_identifier']).to eq @test_identifier
     end
 
     it 'should not provide the authenticated_identifier if the token is invalid' do
       token, token_generator_meta = @local_invalid_generator.generate(authenticated_identifier: @test_identifier)
-      token_validity, token_meta = @iut_remote.validate(authentication_token: token)
+      token_validity, token_meta, message = @iut_remote.validate(authentication_token: token)
       expect(token_meta).to eq nil
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: soar_authentication_token
 version: !ruby/object:Gem::Version
-  version: 2.0.3
+  version: 3.0.0
 platform: ruby
 authors:
 - Barney de Villiers
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-16 00:00:00.000000000 Z
+date: 2017-01-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: soar_xt