sso 0.1.0.alpha1 → 0.1.0.alpha2

data/lib/sso/server/README.md

@@ -0,0 +1,13 @@
+# Setting up an SSO server
+
+### Assumptions
+
+* You use doorkeeper as a Rails OAuth server.
+* You want to provide single-sign-on for the end-users.
+* All OAuth clients ("consumers") are developed by you. You have full control over them and can automatically trust them (i.e. you can set `skip_authorization { true }` in your doorkeeper.rb initializer). This makes sense, because why would you ask the end-user for permission to login to another subsystem of your SSO world? The whole idea with SSO is that your users don't need to notice switching between the OAuth clients.
+* The SSO session is to be browser-wide and app-wide. If you click on "login" you will be logged in on every client web app in that browser. If you click on "logout" you will be logged out of every client web app in that browser.
+* You use warden to login at the SSO server, it is, however, **not** okay to use scopes here. That's an assumption which makes this gem dramatically more simple and I didn't find a downside yet (Warden scopes are not really an ideal authorization solution anyway).
+
+### Setup
+
+For now, see [these point of interests](https://github.com/halo/sso/search?q=POI) to see how exactly a rails app can be setup.

data/lib/sso/server/authentications/passport.rb

@@ -0,0 +1,170 @@
+module SSO
+  module Server
+    module Authentications
+      class Passport
+        include ::SSO::Logging
+
+        def initialize(request)
+          @request = request
+        end
+
+        def authenticate
+          result = authenticate!
+
+          if result.success?
+            result
+          else
+            # TODO: Prevent Flooding here.
+            debug { "The Passport authentication failed: #{result.code}" }
+            Operations.failure :passport_authentication_failed, object: failure_rack_array
+          end
+        end
+
+        private
+
+        attr_reader :request
+
+        def authenticate!
+          check_arguments { |failure| return failure }
+
+          unless valid_signature?
+            warn { 'I found the corresponding passport, but the request was not properly signed with it.' }
+            return Operations.failure :invalid_signature, object: failure_rack_array
+          end
+
+          debug { 'The request was properly signed, I found the corresponding passport.' }
+          update_passport
+
+          if passport.state == state
+            Operations.success :signature_approved_no_changes, object: success_same_state_rack_array
+          else
+            debug { "The current user state #{passport.state.inspect} does not match the provided state #{state.inspect}" }
+            Operations.success :signature_approved_state_changed, object: success_new_state_rack_array
+          end
+        end
+
+        def check_arguments
+          yield Operations.failure :missing_verb         if verb.blank?
+          yield Operations.failure :missing_passport_id  if passport_id.blank?
+          yield Operations.failure :missing_state        if state.blank?
+          yield Operations.failure :passport_not_found   if passport.blank?
+          yield Operations.failure :passport_revoked     if passport.invalid?
+          # yield Operations.failure :user_not_encapsulated if passport.user.blank?
+          Operations.success :arguments_are_valid
+        end
+
+        def success_new_state_rack_array
+          payload = { success: true, code: :passport_changed, passport: passport.export }
+          [200, { 'Content-Type' => 'application/json' }, [payload.to_json]]
+        end
+
+        def success_same_state_rack_array
+          payload = { success: true, code: :passpord_unmodified }
+          [200, { 'Content-Type' => 'application/json' }, [payload.to_json]]
+        end
+
+        # You might be wondering why we don't simply return a 401 or 404 status code.
+        # The reason is that the receiving end would have no way to determine whether that reply is due to a
+        # nginx configuration error or because the passport is actually invalid. We don't want to revoke
+        # all passports simply because a load balancer is pointing to the wrong Rails application or something.
+        #
+        def failure_rack_array
+          payload = { success: true, code: :passport_invalid }
+          [200, { 'Content-Type' => 'application/json' }, [payload.to_json]]
+        end
+
+        def passport
+          @passport ||= backend.find_by_id passport_id
+        end
+
+        def passport_id
+          signature_request.authenticate { |passport_id| return passport_id }
+        rescue Signature::AuthenticationError
+          nil
+        end
+
+        def valid_signature?
+          signature_request.authenticate { Signature::Token.new passport_id, passport.secret }
+          true
+        rescue Signature::AuthenticationError
+          debug { 'It looks like the API signature for the passport verification was incorrect.' }
+          false
+        end
+
+        def signature_request
+          @signature_request ||= Signature::Request.new verb, path, params
+        end
+
+        def update_passport
+          debug { "Will update activity of Passport #{passport.id} if neccesary..." }
+          if passport.ip.to_s == ip.to_s && passport.agent.to_s == user_agent.to_s
+            debug { "No changes in IP or User Agent so I won't perform an update now..." }
+            Operations.success :already_up_to_date
+          else
+            debug { "Yes, it is necessary, updating activity of Passport #{passport.id}" }
+            passport.update_attributes ip: ip.to_s, agent: user_agent, activity_at: Time.now
+            Operations.success :passport_metadata_updated
+          end
+        end
+
+        def application
+          passport.application
+        end
+
+        def app_scopes
+          application.scopes
+        end
+
+        def insider?
+          if app_scopes.empty?
+            warn { "Doorkeeper::Application #{application.name} with ID #{application.id} has no scope restrictions. Assuming 'outsider' for now." }
+            return false
+          end
+
+          app_scopes.has_scopes? [:insider]
+        end
+
+        def ip
+          if insider?
+            params['ip']
+          else
+            request_ip
+          end
+        end
+
+        def user_agent
+          if insider?
+            params['user_agent']
+          else
+            request.user_agent
+          end
+        end
+
+        def request_ip
+          request.env['action_dispatch.remote_ip'] || fail('Whoops, I thought you were using Rails, but action_dispatch.remote_ip is empty!')
+        end
+
+        def verb
+          request.request_method
+        end
+
+        def path
+          request.path
+        end
+
+        def params
+          request.params
+        end
+
+        def state
+          params['state']
+        end
+
+        def backend
+          ::SSO::Server::Passport
+        end
+
+      end
+    end
+  end
+end

data/lib/sso/server/configuration.rb

@@ -0,0 +1,80 @@
+require 'logger'
+
+module SSO
+  class Configuration
+
+    def human_readable_location_for_ip
+      @human_readable_location_for_ip || default_human_readable_location_for_ip
+    end
+    attr_writer :human_readable_location_for_ip
+
+    def exception_handler
+      @exception_handler || default_exception_handler
+    end
+    attr_writer :exception_handler
+
+    def user_state_base
+      @user_state_base || fail('You need to configure user_state_base, see SSO::Configuration for more info.')
+    end
+    attr_writer :user_state_base
+
+    def find_user_for_passport
+      @find_user_for_passport || fail('You need to configure find_user_for_passport, see SSO::Configuration for more info.')
+    end
+    attr_writer :find_user_for_passport
+
+    def user_state_key
+      @user_state_key || fail('You need to configure a secret user_state_key, see SSO::Configuration for more info.')
+    end
+    attr_writer :user_state_key
+
+    def logger
+      @logger ||= default_logger
+    end
+    attr_writer :logger
+
+    def environment
+      @environment ||= default_environment
+    end
+    attr_writer :environment
+
+    private
+
+    def default_logger
+      return ::Rails.logger if defined?(::Rails)
+      instance = ::Logger.new STDOUT
+      instance.level = default_log_level
+      instance
+    end
+
+    def default_log_level
+      case environment
+      when 'production' then ::Logger::WARN
+      when 'test'       then ::Logger::UNKNOWN
+      else                   ::Logger::DEBUG
+      end
+    end
+
+    def default_environment
+      return ::Rails.env if defined?(::Rails)
+      return ENV['RACK_ENV'].to_s if ENV['RACK_ENV'].to_s != ''
+      'unknown'
+    end
+
+    def default_exception_handler
+      proc do
+        return unless ::SSO.config.logger
+        ::SSO.config.logger.error(self.class) do
+          "An internal error occured #{exception.class.name} #{exception.message} #{exception.backtrace[0..5].join(' ') if exception.backtrace}"
+        end
+      end
+    end
+
+    def default_human_readable_location_for_ip
+      proc do
+        'Unknown'
+      end
+    end
+
+  end
+end

data/lib/sso/server/configure.rb

@@ -0,0 +1,15 @@
+module SSO
+
+  # Public: Lazy-loads and returns the the configuration instance.
+  #
+  def self.config
+    @config ||= ::SSO::Configuration.new
+  end
+
+  # Public: Yields the configuration instance.
+  #
+  def self.configure
+    yield config
+  end
+
+end

data/lib/sso/server/doorkeeper/access_token_marker.rb

@@ -0,0 +1,111 @@
+module SSO
+  module Server
+    module Doorkeeper
+      class AccessTokenMarker
+        include ::SSO::Logging
+
+        attr_reader :request, :response
+        delegate :params, to: :request
+
+        def initialize(app)
+          @app = app
+        end
+
+        def call(env)
+          @env = env
+          @request = ::ActionDispatch::Request.new @env
+          @response = @app.call @env
+
+          return response unless applicable?
+
+          if authorization_grant_flow?
+            handle_authorization_grant_flow
+          elsif password_flow?
+            handle_password_flow
+          else
+            fail NotImplementedError
+          end
+
+          response
+        end
+
+        def applicable?
+          request.method == 'POST' &&
+            (authorization_grant_flow? || password_flow?) &&
+            response_code == 200 &&
+            response_body &&
+            outgoing_access_token
+        end
+
+        def handle_authorization_grant_flow
+          # We cannot rely on session[:passport_id] here because the end-user might have cookies disabled.
+          # The only thing we can rely on to identify the user/Passport is the incoming grant token.
+          debug { %(Detected outgoing "Access Token" #{outgoing_access_token.inspect} of the "Authorization Code Grant" flow) }
+          debug { %(This Access Token belongs to "Authorization Grant Token" #{grant_token.inspect}. Augmenting related Passport with it...) }
+          registration = ::SSO::Server::Passports.register_access_token_from_grant grant_token: grant_token, access_token: outgoing_access_token
+
+          return if registration.success?
+          warn { 'The passport could not be augmented. Destroying warden session.' }
+          warden.logout
+        end
+
+        def handle_password_flow
+          local_passport_id = session[:passport_id] # <- We know this is always set because it was set in this very response
+          debug { %(Detected outgoing "Access Token" #{outgoing_access_token.inspect} of the "Resource Owner Password Credentials Grant" flow.) }
+          debug { %(Augmenting local Passport #{local_passport_id.inspect} with this outgoing Access Token...) }
+          generation = ::SSO::Server::Passports.register_access_token passport_id: local_passport_id, access_token: outgoing_access_token
+
+          return if generation.success?
+          warn { 'The passport could not be generated. Destroying warden session.' }
+          warden.logout
+        end
+
+        def response_body
+          response.last.first.presence
+        end
+
+        def response_code
+          response.first
+        end
+
+        def parsed_response_body
+          return unless response_body
+          ::JSON.parse response_body
+        rescue JSON::ParserError => exception
+          Trouble.notify exception
+          nil
+        end
+
+        def outgoing_access_token
+          return unless parsed_response_body
+          parsed_response_body['access_token']
+        end
+
+        def warden
+          request.env['warden']
+        end
+
+        def authorization_grant_flow?
+          grant_token.present?
+        end
+
+        def password_flow?
+          grant_type == 'password'
+        end
+
+        def grant_token
+          params['code']
+        end
+
+        def grant_type
+          params['grant_type']
+        end
+
+        def session
+          @env['rack.session']
+        end
+
+      end
+    end
+  end
+end

data/lib/sso/server/doorkeeper/grant_marker.rb

@@ -0,0 +1,85 @@
+module SSO
+  module Server
+    module Doorkeeper
+      class GrantMarker
+        include ::SSO::Logging
+
+        attr_reader :response
+        delegate :session, to: :request
+
+        def initialize(app)
+          @app = app
+        end
+
+        def call(env)
+          @env = env
+          @response = @app.call @env
+
+          return response unless outgoing_grant_token
+
+          if passport_id
+            debug { %(Detected outgoing "Authorization Grant Token" #{outgoing_grant_token.inspect} of the "Authorization Code Grant" flow.) }
+            debug { %(Augmenting Passport #{passport_id.inspect} with this outgoing Grant Token...) }
+            registration = ::SSO::Server::Passports.register_authorization_grant passport_id: passport_id, token: outgoing_grant_token
+
+            if registration.failure?
+              warn { 'The passport could not be augmented. Destroying warden session.' }
+              warden.logout
+            end
+          end
+
+          response
+        end
+
+        def request
+          ::ActionDispatch::Request.new @env
+        end
+
+        def code
+          response.first
+        end
+
+        def warden
+          request.env['warden']
+        end
+
+        def passport_id
+          session['passport_id']
+        end
+
+        def location_header
+          unless code == 302
+            # debug { "Uninteresting response, because it is not a redirect" }
+            return
+          end
+
+          response.second['Location']
+        end
+
+        def redirect_uri
+          unless location_header
+            # debug { "Uninteresting response, because there is no Location header" }
+            return
+          end
+
+          ::URI.parse location_header
+        end
+
+        def redirect_uri_params
+          return unless redirect_uri
+          ::Rack::Utils.parse_query redirect_uri.query
+        end
+
+        def outgoing_grant_token
+          unless redirect_uri_params && redirect_uri_params['code']
+            # debug { "Uninteresting response, because there is no code parameter sent" }
+            return
+          end
+
+          redirect_uri_params['code']
+        end
+
+      end
+    end
+  end
+end