@boxyhq/saml-jackson 0.1.5-beta.125 → 0.1.5-beta.138

package/README.md

@@ -130,7 +130,7 @@ Please follow the instructions [here](https://docs.google.com/document/d/1fk---Z
 
 ### 1.1 SAML profile/claims/attributes mapping
 
-As outlined in the guide above we try and support 4 attributes in the SAML claims - `id`, `email`, `firstName`, `lastName`. This is how the common SAML aattributes map over for most providers, but some providers have custom mappings. Please refer to the documentation on Identity Provider to understand the exact mapping.
+As outlined in the guide above we try and support 4 attributes in the SAML claims - `id`, `email`, `firstName`, `lastName`. This is how the common SAML attributes map over for most providers, but some providers have custom mappings. Please refer to the documentation on Identity Provider to understand the exact mapping.
 
 | SAML Attribute                                                       | Jackson mapping |
 | -------------------------------------------------------------------- | --------------- |
@@ -164,7 +164,29 @@ curl --location --request POST 'http://localhost:6000/api/v1/saml/config' \
 - tenant: Jackson supports a multi-tenant architecture, this is a unique identifier you set from your side that relates back to your customer's tenant. This is normally an email, domain, an account id, or user-id
 - product: Jackson support multiple products, this is a unique identifier you set from your side that relates back to the product your customer is using
 
-The response returns a JSON with `client_id` and `client_secret` that can be stored against your tenant and product for a more secure OAuth 2.0 flow. If you do not want to store the `client_id` and `client_secret` you can alternatively use `client_id=tenant=<tenantID>&product=<productID>` and any arbitrary value for `client_secret` when setting up the OAuth 2.0 flow.
+The response returns a JSON with `client_id` and `client_secret` that can be stored against your tenant and product for a more secure OAuth 2.0 flow. If you do not want to store the `client_id` and `client_secret` you can alternatively use `client_id=tenant=<tenantID>&product=<productID>` and any arbitrary value for `client_secret` when setting up the OAuth 2.0 flow. Additionally a `provider` attribute is also returned which indicates the domain of your Identity Provider.
+
+#### 2.1 SAML GET config API
+
+This endpoint can be used to return metadata about an existing SAML config. This can be used to check and display the details to your customers. You can use either `clientID` and `clientSecret` combination or `tenant` and `product` combination.
+
+```
+curl --location --request GET 'http://localhost:6000/api/v1/saml/config' \
+--header 'Authorization: Api-Key <Jackson API Key>' \
+--header 'Content-Type: application/x-www-form-urlencoded' \
+--data-urlencode 'tenant=boxyhq.com' \
+--data-urlencode 'product=demo'
+```
+
+```
+curl --location --request GET 'http://localhost:6000/api/v1/saml/config' \
+--header 'Authorization: Api-Key <Jackson API Key>' \
+--header 'Content-Type: application/x-www-form-urlencoded' \
+--data-urlencode 'clientID=<Client ID>' \
+--data-urlencode 'clientSecret=<Client Secret>'
+```
+
+The response returns a JSON with `provider` indicating the domain of your Identity Provider. If an empty JSON payload is returned then we do not have any configuration stored for the attributes you requested.
 
 ### 3. OAuth 2.0 Flow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "0.1.5-beta.125",
+  "version": "0.1.5-beta.138",
   "license": "Apache 2.0",
   "description": "SAML 2.0 service",
   "main": "src/index.js",
@@ -20,7 +20,8 @@
     "mongo": "cross-env DB_ENGINE=mongo DB_URL=mongodb://localhost:27017/jackson nodemon src/jackson.js",
     "pre-loaded": "cross-env DB_ENGINE=mem PRE_LOADED_CONFIG='./_config' nodemon src/jackson.js",
     "test": "tap --timeout=100 src/**/*.test.js",
-    "dev-dbs": "docker-compose -f ./_dev/docker-compose.yml up -d"
+    "dev-dbs": "docker-compose -f ./_dev/docker-compose.yml up -d",
+    "dev-dbs-destroy": "docker-compose -f ./_dev/docker-compose.yml down --volumes --remove-orphans"
   },
   "tap": {
     "coverage-map": "map.js",

package/src/controller/api.js

@@ -7,11 +7,33 @@ const crypto = require('crypto');
 
 let configStore;
 
+const extractHostName = (url) => {
+  try {
+    const pUrl = new URL(url);
+    if(pUrl.hostname.startsWith('www.')) {
+      return pUrl.hostname.substring(4);
+    }
+    return pUrl.hostname;
+  } catch (err) {
+    return null;
+  }
+};
+
 const config = async (body) => {
   const { rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product } =
     body;
   const idpMetadata = await saml.parseMetadataAsync(rawMetadata);
 
+  // extract provider
+  let providerName = extractHostName(idpMetadata.entityID);
+  if (!providerName) {
+    providerName = extractHostName(
+      idpMetadata.sso.redirectUrl || idpMetadata.sso.postUrl
+    );
+  }
+
+  idpMetadata.provider = providerName ? providerName : 'Unknown';
+
   let clientID = dbutils.keyDigest(
     dbutils.keyFromParts(tenant, product, idpMetadata.entityID)
   );
@@ -56,12 +78,37 @@ const config = async (body) => {
   return {
     client_id: clientID,
     client_secret: clientSecret,
+    provider: idpMetadata.provider,
   };
 };
 
+const getConfig = async (body) => {
+  const { clientID, clientSecret, tenant, product } = body;
+
+  if (clientID && clientSecret) {
+    const samlConfig = await configStore.get(clientID);
+    if (!samlConfig) {
+      return {};
+    }
+
+    return { provider: samlConfig.idpMetadata.provider };
+  } else {
+    const samlConfigs = await configStore.getByIndex({
+      name: indexNames.tenantProduct,
+      value: dbutils.keyFromParts(tenant, product),
+    });
+    if (!samlConfigs || !samlConfigs.length) {
+      return {};
+    }
+
+    return { provider: samlConfigs[0].idpMetadata.provider };
+  }
+};
+
 module.exports = (opts) => {
   configStore = opts.configStore;
   return {
     config,
+    getConfig,
   };
 };

package/src/jackson.js

@@ -87,6 +87,22 @@ internalApp.post(apiPath + '/config', async (req, res) => {
   }
 });
 
+internalApp.get(apiPath + '/config', async (req, res) => {
+  try {
+    const apiKey = extractAuthToken(req);
+    if (!validateApiKey(apiKey)) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    res.json(await apiController.getConfig(req.body));
+  } catch (err) {
+    res.status(500).json({
+      error: err.message,
+    });
+  }
+});
+
 let internalServer = server;
 if (env.useInternalServer) {
   internalServer = internalApp.listen(env.internalHostPort, async () => {