sso 0.1.0.alpha7 → 0.1.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8009db0ae10bdd4fd77e5b09c1e59919f3eaed12
-  data.tar.gz: c419f2355fe41f34d7828dcc91f11fc5f3dd3512
+  metadata.gz: 68585960729029037de661b49771b7766ae1c2c5
+  data.tar.gz: 74381326cc5605fdd6b8b3a1d044bf65fc4915e0
 SHA512:
-  metadata.gz: 1cc76c2bee474ee034e978ea0a9e29cf73ff124495cf8565773081654b59f8ad48d87fce7f2e60669073406350222ef56d7abf0ec9a12e3f8714af39820efe69
-  data.tar.gz: aedea34649873d4b0b03417089a58e2a60aadfea1ab5b92653dfc0ccba7a705f93fdfbd1e1411c344aa277e49ac3007614a48600ac57faef36d5990bffa13638
+  metadata.gz: c8ae9e8fa88060efe6c39e36f5bce7750d739c382e9137c9ba409dfe3587674774a16bd491369fb7fd6e05ccf00e5366f7eed4a06435807b7ff00be6c9f6a473
+  data.tar.gz: be505aafa56fe22050682280c7c09a53ceddb25044a01ee4ee7479eb77e992cb349151adc4f7becec0519c43b595b63872f86df31b3cd93e1c24e80e821ff834

data/lib/sso/client/authentications/passport.rb

@@ -51,10 +51,9 @@ module SSO
         end
 
         def check_request_signature
-          debug { "Verifying request signature using Passport secret #{passport_secret.inspect}" }
+          debug { "Verifying request signature using Passport secret #{chip_passport_secret.inspect}" }
           signature_request.authenticate do |passport_id|
-            @passport_id = passport_id
-            Signature::Token.new passport_id, passport_secret
+            Signature::Token.new passport_id, chip_passport_secret
           end
           debug { 'Signature looks legit.' }
           Operations.success :passport_signature_valid
@@ -65,7 +64,7 @@ module SSO
         end
 
         def verifier
-          ::SSO::Client::PassportVerifier.new passport_id: passport_id, passport_state: 'refresh', passport_secret: passport_secret, user_ip: ip, user_agent: agent, device_id: device_id
+          ::SSO::Client::PassportVerifier.new passport_id: passport_id, passport_state: 'refresh', passport_secret: chip_passport_secret, user_ip: ip, user_agent: agent, device_id: device_id
         end
 
         def verification
@@ -82,8 +81,14 @@ module SSO
           ::Signature::Request.new request.request_method, request.path, request.params
         end
 
-        def check_chip
-          Operations.success :chip_syntax_valid
+        def passport_id
+          return @passport_id if @passport_id
+          signature_request.authenticate do |auth_key|
+            return @passport_id = auth_key
+          end
+
+        rescue ::Signature::AuthenticationError
+          nil
         end
 
         def chip_decryption
@@ -91,6 +96,7 @@ module SSO
           yield Operations.failure(:missing_chip, object: params) if chip.blank?
           yield Operations.failure(:missing_chip_key) unless chip_key
           yield Operations.failure(:missing_chip_iv) unless chip_iv
+          yield Operations.failure(:chip_does_not_belong_to_passport) unless chip_belongs_to_passport?
           Operations.success :here_is_your_chip_plaintext, object: decrypt_chip
 
         rescue OpenSSL::Cipher::CipherError => exception
@@ -113,8 +119,32 @@ module SSO
           end
         end
 
-        def passport_secret
-          decrypt_chip
+        def chip_passport_secret
+          decrypt_chip.to_s.split('|').last
+        end
+
+        def chip_passport_id
+          decrypt_chip.to_s.split('|').first
+        end
+
+        def chip_belongs_to_passport?
+          unless passport_id
+            debug { "Unknown passport_id" }
+            return false
+          end
+
+          unless chip_passport_id
+            debug { "Unknown passport_id" }
+            return false
+          end
+
+          if passport_id.to_s == chip_passport_id
+            debug { "The chip on passport #{passport_id.inspect} appears to belong to it." }
+            true
+          else
+            info { "The passport with ID #{passport_id.inspect} has a chip with the wrong ID #{chip_passport_id.inspect}" }
+            false
+          end
         end
 
         def chip_key

data/lib/sso/client/passport.rb

@@ -2,7 +2,8 @@ module SSO
   module Client
     class Passport
 
-      attr_reader :id, :secret, :state, :user, :chip
+      attr_reader :id, :secret, :chip
+      attr_accessor :state, :user
 
       def initialize(id:, secret:, state:, user:, chip: nil)
         @id     = id
@@ -24,6 +25,22 @@ module SSO
         !verified?
       end
 
+      def modified!
+        @modified = true
+      end
+
+      def modified?
+        @modified == true
+      end
+
+      def unmodified?
+        !modified?
+      end
+
+      def delta
+        { state: state, user: user }
+      end
+
     end
   end
 end

data/lib/sso/client/warden/hooks/after_fetch.rb

@@ -63,15 +63,18 @@ module SSO
             when :server_response_missing_success_flag! then server_response_missing_success_flag!
             when :server_response_unsuccessful!         then server_response_unsuccessful!
             when :passport_valid                        then passport_valid!
-            when :passport_valid_and_modified           then passport_valid_and_modified!
+            when :passport_valid_and_modified           then passport_valid_and_modified!(verification.object)
             when :passport_invalid                      then passport_invalid!
             else                                             unexpected_server_response_status!
             end
           end
 
-          def passport_valid_and_modified!
+          def passport_valid_and_modified!(modified_passport)
             debug { 'Valid passport, but state changed' }
             passport.verified!
+            passport.modified!
+            passport.user = modified_passport.user
+            passport.state = modified_passport.state
             # meter status: :valid, passport_id: user.passport_id
           end
 

data/lib/sso/client/warden/strategies/passport.rb

@@ -17,7 +17,7 @@ module SSO
             authentication = passport_authentication
 
             if authentication.success?
-              debug { 'Authentication from Passport successful.' }
+              debug { 'Authentication on Client from Passport successful.' }
               debug { "Persisting trusted Passport #{authentication.object.inspect}" }
               success! authentication.object
             else

data/lib/sso/server/authentications/passport.rb

@@ -38,6 +38,7 @@ module SSO
           passport.load_user!
 
           if passport.state == state
+            debug { "The current user state #{passport.state.inspect} did not change." }
             Operations.success :signature_approved_no_changes, object: success_same_state_rack_array
           else
             debug { "The current user state #{passport.state.inspect} does not match the provided state #{state.inspect}" }

data/lib/sso/server/passport.rb

@@ -46,9 +46,11 @@ module SSO
       end
 
       def state!
-        benchmark 'Passport user state calculation' do
+        result = benchmark 'Passport user state calculation' do
           OpenSSL::HMAC.hexdigest user_state_digest, user_state_key, user_state_base
         end
+        debug { "The user state is #{result.inspect}" }
+        result
       end
 
       def load_user!
@@ -89,7 +91,7 @@ module SSO
 
       # Don't get confused, the chip plaintext is the passport secret
       def chip_plaintext
-        secret
+        [id, secret].join '|'
       end
 
       def user_state_key

data/lib/sso/server/warden/strategies/passport.rb

@@ -16,7 +16,7 @@ module SSO
             authentication = passport_authentication
 
             if authentication.success?
-              debug { 'Authentication from Passport successful.' }
+              debug { 'Authentication on Server from Passport successful.' }
               debug { "Responding with #{authentication.object}" }
               custom! authentication.object
             else

data/spec/dummy/app/models/user.rb

@@ -1,9 +1,19 @@
 class User < ActiveRecord::Base
+  include ::SSO::Logging
 
   # This is a test implementation only, do not try this at home.
+  #
   def self.authenticate(username, password)
     Rails.logger.debug('User') { "Checking password of user #{username.inspect}..." }
     where(email: username, password: password).first
   end
 
+  # Don't try this at home, you should include the *encrypted* password, not the plaintext here.
+  #
+  def state_base
+    result = [email.to_s, password.to_s, tags.map(&:to_s).sort].join
+    debug { "The user state base is #{result.inspect}" }
+    result
+  end
+
 end

data/spec/dummy/config/initializers/sso.rb

@@ -30,7 +30,7 @@ SSO.configure do |config|
   config.user_state_base = proc do |user|
     # Include the end-user credentials to force all OAuth client apps to refetch the end-user Passports.
     # This way you can revoke all relevant Passports on SSO-logout and the OAuth client apps are immediately aware of it.
-    [user.email, user.password, user.tags.map(&:to_s).sort].join
+    user.state_base
   end
 
   # This is a rather static key used to calculate whether a user state changed and needs to be propagated to the OAuth clients.

data/spec/lib/sso/client/warden/hooks/after_fetch_spec.rb

@@ -4,11 +4,11 @@ RSpec.describe SSO::Client::Warden::Hooks::AfterFetch, type: :request, db: true
 
   # Client side
   let(:warden_env)      { {} }
-  let(:client_params)   { { udid: 'unique device identifier' } }
+  let(:client_params)   { { device_id: 'unique device identifier' } }
   let(:warden_request)  { double :warden_request, ip: ip, user_agent: agent, params: client_params, env: warden_env }
   let(:warden)          { double :warden, request: warden_request }
   let(:hook)            { described_class.new passport: client_passport, warden: warden, options: {} }
-  let(:client_user)     { double :client_user }
+  let(:client_user)     { double :client_user, name: 'Good old client user' }
   let(:client_passport) { ::SSO::Client::Passport.new id: passport_id, secret: passport_secret, state: passport_state, user: client_user }
 
   # Shared
@@ -20,24 +20,79 @@ RSpec.describe SSO::Client::Warden::Hooks::AfterFetch, type: :request, db: true
   let(:agent)           { 'IE7' }
 
   # Server side
-  let!(:server_user)     { create :user }
+  let!(:server_user)     { create :user, tags: %w(wears_glasses never_gives_up) }
   let!(:server_passport) { create :passport, user: server_user, owner_id: server_user.id, ip: ip, agent: agent }
 
-  context 'no changes' do
+  before do
+    # The server dynamically injects some tags. In order to calculate the user state correctly in our test setup,
+    # We need to "simulate" what the tags will look like once the server modified them. No big problem.
+    allow(server_user).to receive(:tags).and_return %w(wears_glasses is_working_from_home never_gives_up)
+  end
+
+  context 'user does not change' do
     it 'verifies the passport' do
-      expect(client_passport).to receive(:verified!)
+      expect(client_passport).to_not be_verified
+      hook.call
+      expect(client_passport).to be_verified
+    end
+
+    it 'does not modify the passport' do
+      expect(client_passport).to_not be_modified
+      hook.call
+      expect(client_passport).to_not be_modified
+    end
+
+    it 'does not modify the encapsulated user' do
       hook.call
+      expect(client_passport.user.name).to eq 'Good old client user'
     end
   end
 
-  context 'a user attribute changed which is not included in the state digest' do
+  context 'user attribute changed which is not included in the state digest' do
     before do
+      hook
       server_user.update_attribute :name, 'Something new'
     end
 
     it 'verifies the passport' do
-      expect(client_passport).to receive(:verified!)
+      expect(client_passport).to_not be_verified
+      hook.call
+      expect(client_passport).to be_verified
+    end
+
+    it 'does not modify the passport' do
+      expect(client_passport).to_not be_modified
+      hook.call
+      expect(client_passport).to_not be_modified
+    end
+
+    it 'does not modify the encapsulated user' do
+      hook.call
+      expect(client_passport.user.name).to eq 'Good old client user'
+    end
+  end
+
+  context 'user attribute changed which results in a new state digest' do
+    before do
+      hook
+      server_user.update_attribute :email, 'brand-new@example.com'
+    end
+
+    it 'verifies the passport' do
+      expect(client_passport).to_not be_verified
+      hook.call
+      expect(client_passport).to be_verified
+    end
+
+    it 'modifies the passport' do
+      expect(client_passport).to_not be_modified
+      hook.call
+      expect(client_passport).to be_modified
+    end
+
+    it 'updates the client user to reflect the server user' do
       hook.call
+      expect(client_passport.user['name']).to eq server_user.name
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sso
 version: !ruby/object:Gem::Version
-  version: 0.1.0.alpha7
+  version: 0.1.0.beta1
 platform: ruby
 authors:
 - halo