@boxyhq/saml-jackson 1.3.12 → 1.5.0

package/dist/controller/oauth.js

@@ -37,55 +37,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthController = void 0;
 const crypto_1 = __importDefault(require("crypto"));
+const jose = __importStar(require("jose"));
 const util_1 = require("util");
 const zlib_1 = require("zlib");
+const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 const openid_client_1 = require("openid-client");
-const jose = __importStar(require("jose"));
-const dbutils = __importStar(require("../db/utils"));
+const utils_1 = require("./utils");
 const metrics = __importStar(require("../opentelemetry/metrics"));
-const saml20_1 = __importDefault(require("@boxyhq/saml20"));
-const claims_1 = __importDefault(require("../saml/claims"));
 const error_1 = require("./error");
 const allowed = __importStar(require("./oauth/allowed"));
 const codeVerifier = __importStar(require("./oauth/code-verifier"));
 const redirect = __importStar(require("./oauth/redirect"));
-const utils_1 = require("./utils");
 const x509_1 = require("../saml/x509");
+const saml_handler_1 = require("./saml-handler");
+const lib_1 = require("../saml/lib");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
-const validateSAMLResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
-    const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
-    if (profile && profile.claims) {
-        // we map claims to our attributes id, email, firstName, lastName where possible. We also map original claims to raw
-        profile.claims = claims_1.default.map(profile.claims);
-        // some providers don't return the id in the assertion, we set it to a sha256 hash of the email
-        if (!profile.claims.id && profile.claims.email) {
-            profile.claims.id = crypto_1.default.createHash('sha256').update(profile.claims.email).digest('hex');
-        }
-        // we'll send a ripemd160 hash of the id, this can be used in the case of email missing it can be used as the local part
-        profile.claims.idHash = dbutils.keyDigest(profile.claims.id);
-    }
-    return profile;
-});
-function getEncodedTenantProduct(param) {
-    try {
-        const sp = new URLSearchParams(param);
-        const tenant = sp.get('tenant');
-        const product = sp.get('product');
-        if (tenant && product) {
-            return {
-                tenant: sp.get('tenant'),
-                product: sp.get('product'),
-            };
-        }
-        return null;
-    }
-    catch (err) {
-        return null;
-    }
-}
-function getScopeValues(scope) {
-    return typeof scope === 'string' ? scope.split(' ').filter((s) => s.length > 0) : [];
-}
 class OAuthController {
     constructor({ connectionStore, sessionStore, codeStore, tokenStore, opts }) {
         this.connectionStore = connectionStore;
@@ -93,53 +59,11 @@ class OAuthController {
         this.codeStore = codeStore;
         this.tokenStore = tokenStore;
         this.opts = opts;
-    }
-    resolveMultipleConnectionMatches(connections, idp_hint, originalParams, isIdpFlow = false) {
-        if (connections.length > 1) {
-            if (idp_hint) {
-                return { resolvedConnection: connections.find(({ clientID }) => clientID === idp_hint) };
-            }
-            else if (this.opts.idpDiscoveryPath) {
-                if (!isIdpFlow) {
-                    // redirect to IdP selection page
-                    const idpList = connections.map(({ idpMetadata, oidcProvider, clientID, name }) => {
-                        var _a;
-                        return JSON.stringify({
-                            provider: (_a = idpMetadata === null || idpMetadata === void 0 ? void 0 : idpMetadata.provider) !== null && _a !== void 0 ? _a : oidcProvider === null || oidcProvider === void 0 ? void 0 : oidcProvider.provider,
-                            clientID,
-                            name,
-                            connectionIsSAML: idpMetadata && typeof idpMetadata === 'object',
-                            connectionIsOIDC: oidcProvider && typeof oidcProvider === 'object',
-                        });
-                    });
-                    return {
-                        redirect_url: redirect.success(this.opts.externalUrl + this.opts.idpDiscoveryPath, Object.assign(Object.assign({}, originalParams), { idp: idpList })),
-                    };
-                }
-                else {
-                    // Relevant to IdP initiated SAML flow
-                    const appList = connections.map(({ product, name, description, clientID }) => ({
-                        product,
-                        name,
-                        description,
-                        clientID,
-                    }));
-                    return {
-                        app_select_form: saml20_1.default.createPostForm(this.opts.idpDiscoveryPath, [
-                            {
-                                name: 'SAMLResponse',
-                                value: originalParams.SAMLResponse,
-                            },
-                            {
-                                name: 'app',
-                                value: encodeURIComponent(JSON.stringify(appList)),
-                            },
-                        ]),
-                    };
-                }
-            }
-        }
-        return {};
+        this.samlHandler = new saml_handler_1.SAMLHandler({
+            connection: connectionStore,
+            session: sessionStore,
+            opts,
+        });
     }
     authorize(body) {
         var _a;
@@ -156,85 +80,58 @@ class OAuthController {
                 throw new error_1.JacksonError('Please specify a redirect URL.', 400);
             }
             let connection;
-            const requestedScopes = getScopeValues(scope);
+            const requestedScopes = (0, utils_1.getScopeValues)(scope);
             const requestedOIDCFlow = requestedScopes.includes('openid');
             if (tenant && product) {
-                const connections = yield this.connectionStore.getByIndex({
-                    name: utils_1.IndexNames.TenantProduct,
-                    value: dbutils.keyFromParts(tenant, product),
-                });
-                if (!connections || connections.length === 0) {
-                    throw new error_1.JacksonError('IdP connection not found.', 403);
-                }
-                connection = connections[0];
-                // Support multiple matches
-                const { resolvedConnection, redirect_url } = this.resolveMultipleConnectionMatches(connections, idp_hint, {
-                    response_type,
-                    client_id,
-                    redirect_uri,
-                    state,
+                const response = yield this.samlHandler.resolveConnection({
                     tenant,
                     product,
-                    access_type,
-                    resource,
-                    scope,
-                    nonce,
-                    code_challenge,
-                    code_challenge_method,
+                    idp_hint,
+                    authFlow: 'oauth',
+                    originalParams: Object.assign({}, body),
                 });
-                if (redirect_url) {
-                    return { redirect_url };
+                if ('redirectUrl' in response) {
+                    return {
+                        redirect_url: response.redirectUrl,
+                    };
                 }
-                if (resolvedConnection) {
-                    connection = resolvedConnection;
+                if ('connection' in response) {
+                    connection = response.connection;
                 }
             }
             else if (client_id && client_id !== '' && client_id !== 'undefined' && client_id !== 'null') {
                 // if tenant and product are encoded in the client_id then we parse it and check for the relevant connection(s)
-                let sp = getEncodedTenantProduct(client_id);
+                let sp = (0, utils_1.getEncodedTenantProduct)(client_id);
                 if (!sp && access_type) {
-                    sp = getEncodedTenantProduct(access_type);
+                    sp = (0, utils_1.getEncodedTenantProduct)(access_type);
                 }
                 if (!sp && resource) {
-                    sp = getEncodedTenantProduct(resource);
+                    sp = (0, utils_1.getEncodedTenantProduct)(resource);
                 }
                 if (!sp && requestedScopes) {
                     const encodedParams = requestedScopes.find((scope) => scope.includes('=') && scope.includes('&')); // for now assume only one encoded param i.e. for tenant/product
                     if (encodedParams) {
-                        sp = getEncodedTenantProduct(encodedParams);
+                        sp = (0, utils_1.getEncodedTenantProduct)(encodedParams);
                     }
                 }
                 if (sp && sp.tenant && sp.product) {
-                    requestedTenant = sp.tenant;
-                    requestedProduct = sp.product;
-                    const connections = yield this.connectionStore.getByIndex({
-                        name: utils_1.IndexNames.TenantProduct,
-                        value: dbutils.keyFromParts(sp.tenant, sp.product),
-                    });
-                    if (!connections || connections.length === 0) {
-                        throw new error_1.JacksonError('IdP connection not found.', 403);
-                    }
-                    connection = connections[0];
-                    // Support multiple matches
-                    const { resolvedConnection, redirect_url } = this.resolveMultipleConnectionMatches(connections, idp_hint, {
-                        response_type,
-                        client_id,
-                        redirect_uri,
-                        state,
+                    const { tenant, product } = sp;
+                    requestedTenant = tenant;
+                    requestedProduct = product;
+                    const response = yield this.samlHandler.resolveConnection({
                         tenant,
                         product,
-                        access_type,
-                        resource,
-                        scope,
-                        nonce,
-                        code_challenge,
-                        code_challenge_method,
+                        idp_hint,
+                        authFlow: 'oauth',
+                        originalParams: Object.assign({}, body),
                     });
-                    if (redirect_url) {
-                        return { redirect_url };
+                    if ('redirectUrl' in response) {
+                        return {
+                            redirect_url: response.redirectUrl,
+                        };
                     }
-                    if (resolvedConnection) {
-                        connection = resolvedConnection;
+                    if ('connection' in response) {
+                        connection = response.connection;
                     }
                 }
                 else {
@@ -286,14 +183,14 @@ class OAuthController {
             // Connection retrieved: Handover to IdP starts here
             let ssoUrl;
             let post = false;
-            const connectionIsSAML = connection.idpMetadata && typeof connection.idpMetadata === 'object';
-            const connectionIsOIDC = connection.oidcProvider && typeof connection.oidcProvider === 'object';
+            const connectionIsSAML = 'idpMetadata' in connection && connection.idpMetadata !== undefined;
+            const connectionIsOIDC = 'oidcProvider' in connection && connection.oidcProvider !== undefined;
             // Init sessionId
             const sessionId = crypto_1.default.randomBytes(16).toString('hex');
             const relayState = utils_1.relayStatePrefix + sessionId;
             // SAML connection: SAML request will be constructed here
             let samlReq;
-            if (connectionIsSAML) {
+            if ('idpMetadata' in connection) {
                 const { sso } = connection.idpMetadata;
                 if ('redirectUrl' in sso) {
                     // HTTP Redirect binding
@@ -342,7 +239,7 @@ class OAuthController {
             }
             // OIDC Connection: Issuer discovery, openid-client init and extraction of authorization endpoint happens here
             let oidcCodeVerifier;
-            if (connectionIsOIDC) {
+            if (connectionIsOIDC && 'oidcProvider' in connection) {
                 if (!this.opts.oidcPath) {
                     return {
                         redirect_url: (0, utils_1.OAuthErrorResponse)({
@@ -473,148 +370,114 @@ class OAuthController {
         });
     }
     samlResponse(body) {
-        var _a, _b;
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const { SAMLResponse, idp_hint } = body;
-            let RelayState = body.RelayState || ''; // RelayState will contain the sessionId from earlier quasi-oauth flow
+            const { SAMLResponse, idp_hint, RelayState = '' } = body;
             const isIdPFlow = !RelayState.startsWith(utils_1.relayStatePrefix);
+            // IdP is disabled so block the request
             if (!this.opts.idpEnabled && isIdPFlow) {
-                // IDP is disabled so block the request
+                // IdP login is disabled so block the request
                 throw new error_1.JacksonError('IdP (Identity Provider) flow has been disabled. Please head to your Service Provider to login.', 403);
             }
-            RelayState = RelayState.replace(utils_1.relayStatePrefix, '');
+            const sessionId = RelayState.replace(utils_1.relayStatePrefix, '');
             const rawResponse = Buffer.from(SAMLResponse, 'base64').toString();
             const issuer = saml20_1.default.parseIssuer(rawResponse);
             if (!issuer) {
                 throw new error_1.JacksonError('Issuer not found.', 403);
             }
-            const samlConnections = yield this.connectionStore.getByIndex({
+            const connections = yield this.connectionStore.getByIndex({
                 name: utils_1.IndexNames.EntityID,
                 value: issuer,
             });
-            if (!samlConnections || samlConnections.length === 0) {
+            if (!connections || connections.length === 0) {
                 throw new error_1.JacksonError('SAML connection not found.', 403);
             }
-            let samlConnection = samlConnections[0];
+            const session = sessionId ? yield this.sessionStore.get(sessionId) : null;
+            if (!isIdPFlow && !session) {
+                throw new error_1.JacksonError('Unable to validate state from the origin request.', 403);
+            }
+            const isSAMLFederated = session && 'samlFederated' in session;
+            const isSPFflow = !isIdPFlow && !isSAMLFederated;
+            let connection;
+            // IdP initiated SSO flow
             if (isIdPFlow) {
-                RelayState = '';
-                const { resolvedConnection, app_select_form } = this.resolveMultipleConnectionMatches(samlConnections, idp_hint, { SAMLResponse }, true);
-                if (app_select_form) {
-                    return { app_select_form };
-                }
-                if (resolvedConnection) {
-                    samlConnection = resolvedConnection;
-                }
-            }
-            let session;
-            if (RelayState !== '') {
-                session = yield this.sessionStore.get(RelayState);
-                if (!session) {
-                    throw new error_1.JacksonError('Unable to validate state from the origin request.', 403);
-                }
-            }
-            if (!isIdPFlow) {
-                // Resolve if there are multiple matches for SP login. TODO: Support multiple matches for IdP login
-                samlConnection =
-                    samlConnections.length === 1
-                        ? samlConnections[0]
-                        : samlConnections.filter((c) => {
-                            var _a, _b, _c;
-                            return (c.clientID === ((_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.client_id) ||
-                                (c.tenant === ((_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.tenant) && c.product === ((_c = session === null || session === void 0 ? void 0 : session.requested) === null || _c === void 0 ? void 0 : _c.product)));
-                        })[0];
-            }
-            if (!samlConnection) {
+                const response = yield this.samlHandler.resolveConnection({
+                    idp_hint,
+                    authFlow: 'idp-initiated',
+                    entityId: issuer,
+                    originalParams: {
+                        SAMLResponse,
+                    },
+                });
+                // Redirect to the product selection page
+                if ('postForm' in response) {
+                    return {
+                        app_select_form: response.postForm,
+                    };
+                }
+                // Found a connection
+                if ('connection' in response) {
+                    connection = response.connection;
+                }
+            }
+            // SP initiated SSO flow
+            // Resolve if there are multiple matches for SP login
+            if (isSPFflow) {
+                connection = connections.filter((c) => {
+                    return (c.clientID === session.requested.client_id ||
+                        (c.tenant === session.requested.tenant && c.product === session.requested.product));
+                })[0];
+            }
+            if (!connection) {
+                connection = connections[0];
+            }
+            if (!connection) {
                 throw new error_1.JacksonError('SAML connection not found.', 403);
             }
-            const { privateKey } = yield (0, x509_1.getDefaultCertificate)();
-            const validateOpts = {
-                thumbprint: samlConnection.idpMetadata.thumbprint,
-                audience: this.opts.samlAudience,
-                privateKey,
-            };
             if (session &&
                 session.redirect_uri &&
-                !allowed.redirect(session.redirect_uri, samlConnection.redirectUrl)) {
+                !allowed.redirect(session.redirect_uri, connection.redirectUrl)) {
                 throw new error_1.JacksonError('Redirect URL is not allowed.', 403);
             }
+            const { privateKey } = yield (0, x509_1.getDefaultCertificate)();
+            const validateOpts = {
+                thumbprint: `${connection.idpMetadata.thumbprint}`,
+                audience: `${this.opts.samlAudience}`,
+                privateKey,
+            };
             if (session && session.id) {
-                validateOpts.inResponseTo = session.id;
+                validateOpts['inResponseTo'] = session.id;
             }
-            let profile;
-            const redirect_uri = (session && session.redirect_uri) || samlConnection.defaultRedirectUrl;
+            const redirect_uri = (session && session.redirect_uri) || connection.defaultRedirectUrl;
+            let profile = null;
             try {
-                profile = yield validateSAMLResponse(rawResponse, validateOpts);
+                profile = yield (0, lib_1.extractSAMLResponseAttributes)(rawResponse, validateOpts);
             }
             catch (err) {
-                // return error to redirect_uri
                 return {
                     redirect_url: (0, utils_1.OAuthErrorResponse)({
                         error: 'access_denied',
                         error_description: (0, utils_1.getErrorMessage)(err),
                         redirect_uri,
-                        state: (_a = session === null || session === void 0 ? void 0 : session.requested) === null || _a === void 0 ? void 0 : _a.state,
+                        state: (_a = session.requested) === null || _a === void 0 ? void 0 : _a.state,
                     }),
                 };
             }
-            // store details against a code
-            const code = crypto_1.default.randomBytes(20).toString('hex');
-            const codeVal = {
-                profile,
-                clientID: samlConnection.clientID,
-                clientSecret: samlConnection.clientSecret,
-                requested: session === null || session === void 0 ? void 0 : session.requested,
-                isIdPFlow,
-            };
-            if (session) {
-                codeVal.session = session;
-            }
-            try {
-                yield this.codeStore.put(code, codeVal);
-            }
-            catch (err) {
-                // return error to redirect_uri
-                return {
-                    redirect_url: (0, utils_1.OAuthErrorResponse)({
-                        error: 'server_error',
-                        error_description: (0, utils_1.getErrorMessage)(err),
-                        redirect_uri,
-                        state: (_b = session === null || session === void 0 ? void 0 : session.requested) === null || _b === void 0 ? void 0 : _b.state,
-                    }),
-                };
+            // This is a federated SAML flow, let's create a new SAMLResponse and POST it to the SP
+            if (isSAMLFederated) {
+                const { responseForm } = yield this.samlHandler.createSAMLResponse({ profile, session });
+                yield this.sessionStore.delete(sessionId);
+                return { responseForm };
             }
+            const code = yield this._buildAuthorizationCode(connection, profile, session, isIdPFlow);
             const params = {
                 code,
             };
             if (session && session.state) {
-                params.state = session.state;
-            }
-            const redirectUrl = redirect.success(redirect_uri, params);
-            // delete the session
-            try {
-                yield this.sessionStore.delete(RelayState);
+                params['state'] = session.state;
             }
-            catch (_err) {
-                // ignore error
-            }
-            return { redirect_url: redirectUrl };
-        });
-    }
-    extractOIDCUserProfile(tokenSet, oidcClient) {
-        var _a, _b, _c, _d, _e;
-        return __awaiter(this, void 0, void 0, function* () {
-            const profile = { claims: {} };
-            const idTokenClaims = tokenSet.claims();
-            const userinfo = yield oidcClient.userinfo(tokenSet);
-            profile.claims.id = idTokenClaims.sub;
-            profile.claims.idHash = dbutils.keyDigest(idTokenClaims.sub);
-            profile.claims.email = (_a = idTokenClaims.email) !== null && _a !== void 0 ? _a : userinfo.email;
-            profile.claims.firstName = (_b = idTokenClaims.given_name) !== null && _b !== void 0 ? _b : userinfo.given_name;
-            profile.claims.lastName = (_c = idTokenClaims.family_name) !== null && _c !== void 0 ? _c : userinfo.family_name;
-            profile.claims.roles = (_d = idTokenClaims.roles) !== null && _d !== void 0 ? _d : userinfo.roles;
-            profile.claims.groups = (_e = idTokenClaims.groups) !== null && _e !== void 0 ? _e : userinfo.groups;
-            profile.claims.raw = userinfo;
-            return profile;
+            yield this.sessionStore.delete(sessionId);
+            return { redirect_url: redirect.success(redirect_uri, params) };
         });
     }
     oidcAuthzResponse(body) {
@@ -668,7 +531,7 @@ class OAuthController {
                 const tokenSet = yield oidcClient.callback(this.opts.externalUrl + this.opts.oidcPath, {
                     code: opCode,
                 }, { code_verifier: session.oidcCodeVerifier });
-                profile = yield this.extractOIDCUserProfile(tokenSet, oidcClient);
+                profile = yield (0, utils_1.extractOIDCUserProfile)(tokenSet, oidcClient);
             }
             catch (err) {
                 if (err) {
@@ -682,48 +545,37 @@ class OAuthController {
                     };
                 }
             }
-            // store details against a code
-            const code = crypto_1.default.randomBytes(20).toString('hex');
-            const codeVal = {
-                profile,
-                clientID: oidcConnection.clientID,
-                clientSecret: oidcConnection.clientSecret,
-                requested: session === null || session === void 0 ? void 0 : session.requested,
-            };
-            if (session) {
-                codeVal.session = session;
-            }
-            try {
-                yield this.codeStore.put(code, codeVal);
-            }
-            catch (err) {
-                // return error to redirect_uri
-                return {
-                    redirect_url: (0, utils_1.OAuthErrorResponse)({
-                        error: 'server_error',
-                        error_description: (0, utils_1.getErrorMessage)(err),
-                        redirect_uri,
-                        state: session.state,
-                    }),
-                };
-            }
+            const code = yield this._buildAuthorizationCode(oidcConnection, profile, session, false);
             const params = {
                 code,
             };
             if (session && session.state) {
-                params.state = session.state;
+                params['state'] = session.state;
             }
             const redirectUrl = redirect.success(redirect_uri, params);
-            // delete the session
-            try {
-                yield this.sessionStore.delete(RelayState);
-            }
-            catch (_err) {
-                // ignore error
-            }
+            yield this.sessionStore.delete(RelayState);
             return { redirect_url: redirectUrl };
         });
     }
+    // Build the authorization code for the session
+    _buildAuthorizationCode(connection, profile, session, isIdPFlow) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Store details against a code
+            const code = crypto_1.default.randomBytes(20).toString('hex');
+            const codeVal = {
+                profile,
+                clientID: connection.clientID,
+                clientSecret: connection.clientSecret,
+                requested: session ? session.requested : null,
+                isIdPFlow,
+            };
+            if (session) {
+                codeVal['session'] = session;
+            }
+            yield this.codeStore.put(code, codeVal);
+            return code;
+        });
+    }
     /**
      * @swagger
      *
@@ -819,7 +671,7 @@ class OAuthController {
             else if (client_id && client_secret) {
                 // check if we have an encoded client_id
                 if (client_id !== 'dummy') {
-                    const sp = getEncodedTenantProduct(client_id);
+                    const sp = (0, utils_1.getEncodedTenantProduct)(client_id);
                     if (!sp) {
                         // OAuth flow
                         if (client_id !== codeVal.clientID || client_secret !== codeVal.clientSecret) {