@ngageoint/mage.service 6.2.2

package/lib/authentication/index.js

@@ -0,0 +1,104 @@
+"use strict";
+const crypto = require('crypto'), verification = require('./verification'), api = require('../api/'), config = require('../config.js'), log = require('../logger'), userTransformer = require('../transformers/user'), authenticationApiAppender = require('../utilities/authenticationApiAppender'), AuthenticationConfiguration = require('../models/authenticationconfiguration'), SecurePropertyAppender = require('../security/utilities/secure-property-appender');
+const JWTService = verification.JWTService;
+const TokenAssertion = verification.TokenAssertion;
+class AuthenticationInitializer {
+    static initialize(app, passport, provision) {
+        AuthenticationInitializer.app = app;
+        AuthenticationInitializer.passport = passport;
+        AuthenticationInitializer.provision = provision;
+        const BearerStrategy = require('passport-http-bearer').Strategy, User = require('../models/user'), Token = require('../models/token');
+        passport.serializeUser(function (user, done) {
+            done(null, user._id);
+        });
+        passport.deserializeUser(function (id, done) {
+            User.getUserById(id, function (err, user) {
+                done(err, user);
+            });
+        });
+        passport.use(new BearerStrategy({
+            passReqToCallback: true
+        }, function (req, token, done) {
+            Token.getToken(token, function (err, credentials) {
+                if (err) {
+                    return done(err);
+                }
+                if (!credentials || !credentials.user) {
+                    return done(null, false);
+                }
+                req.token = credentials.token;
+                if (credentials.token.deviceId) {
+                    req.provisionedDeviceId = credentials.token.deviceId;
+                }
+                return done(null, credentials.user, { scope: 'all' });
+            });
+        }));
+        passport.use('authorization', new BearerStrategy(function (token, done) {
+            const expectation = {
+                assertion: TokenAssertion.Authorized
+            };
+            AuthenticationInitializer.tokenService.verifyToken(token, expectation)
+                .then(payload => {
+                User.getUserById(payload.subject)
+                    .then(user => done(null, user))
+                    .catch(err => done(err));
+            })
+                .catch(err => done(err));
+        }));
+        function authorize(req, res, next) {
+            passport.authenticate('authorization', function (err, user, info = {}) {
+                if (!user)
+                    return res.status(401).send(info.message);
+                req.user = user;
+                next();
+            })(req, res, next);
+        }
+        function provisionDevice(req, res, next) {
+            provision.check(req.user.authentication.authenticationConfiguration.type, req.user.authentication.authenticationConfiguration.name)(req, res, next);
+        }
+        app.post('/auth/token', authorize, provisionDevice, function (req, res, next) {
+            const options = {
+                userAgent: req.headers['user-agent'],
+                appVersion: req.param('appVersion')
+            };
+            new api.User().login(req.user, req.provisionedDevice, options, function (err, token) {
+                if (err)
+                    return next(err);
+                authenticationApiAppender.append(config.api).then(api => {
+                    res.json({
+                        token: token.token,
+                        expirationDate: token.expirationDate,
+                        user: userTransformer.transform(req.user, { path: req.getRoot() }),
+                        device: req.provisionedDevice,
+                        api: api
+                    });
+                }).catch(err => {
+                    next(err);
+                });
+            });
+            req.session = null;
+        });
+        AuthenticationConfiguration.getAllConfigurations().then(configs => {
+            configs.forEach(config => {
+                const strategy = require('../authentication/' + config.type);
+                SecurePropertyAppender.appendToConfig(config).then(appendedConfig => {
+                    strategy.initialize(appendedConfig);
+                }).catch(err => {
+                    log.error(err);
+                });
+            });
+        }).catch(err => {
+            log.warn(err);
+        });
+        //TODO due to a timing issue on startup, local may not yet be configured during setup phase
+        //For now, always load it (even though it may have already be loaded above)
+        require('./local').initialize();
+        require('./anonymous').initialize();
+        return {
+            passport: passport
+        };
+    }
+}
+AuthenticationInitializer.tokenService = new JWTService(crypto.randomBytes(64).toString('hex'), 'urn:mage');
+module.exports = AuthenticationInitializer;
+//# sourceMappingURL=index.js.map

package/lib/authentication/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authentication/index.js"],"names":[],"mappings":";AAAA,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC5B,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,EACxC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EACxB,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,EAChC,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,EAC1B,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,EACjD,yBAAyB,GAAG,OAAO,CAAC,wCAAwC,CAAC,EAC7E,2BAA2B,GAAG,OAAO,CAAC,uCAAuC,CAAC,EAC9E,sBAAsB,GAAG,OAAO,CAAC,gDAAgD,CAAC,CAAC;AAEvF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;AAEnD,MAAM,yBAAyB;IAM7B,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS;QACxC,yBAAyB,CAAC,GAAG,GAAG,GAAG,CAAC;QACpC,yBAAyB,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC9C,yBAAyB,CAAC,SAAS,GAAG,SAAS,CAAC;QAEhD,MAAM,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAC3D,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEvC,QAAQ,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,IAAI;YACzC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,IAAI;YACzC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,GAAG,EAAE,IAAI;gBACtC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC;YAC9B,iBAAiB,EAAE,IAAI;SACxB,EACC,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI;YACxB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,EAAE,WAAW;gBAC9C,IAAI,GAAG,EAAE;oBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;iBAAE;gBAE9B,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;oBACrC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;iBAC1B;gBAED,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;gBAE9B,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAC9B,GAAG,CAAC,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;iBACtD;gBAED,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,CAAC;QAEN,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,cAAc,CAAC,UAAU,KAAK,EAAE,IAAI;YACpE,MAAM,WAAW,GAAG;gBAClB,SAAS,EAAE,cAAc,CAAC,UAAU;aACrC,CAAC;YAEF,yBAAyB,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;iBACnE,IAAI,CAAC,OAAO,CAAC,EAAE;gBACd,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;qBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;qBAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC,CAAC;QAEJ,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;YAC/B,QAAQ,CAAC,YAAY,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;gBACnE,IAAI,CAAC,IAAI;oBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAErD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,SAAS,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;YACrC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtJ,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,aAAa,EACpB,SAAS,EACT,eAAe,EACf,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;YACtB,MAAM,OAAO,GAAG;gBACd,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;gBACpC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;aACpC,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,UAAU,GAAG,EAAE,KAAK;gBACjF,IAAI,GAAG;oBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE1B,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBACtD,GAAG,CAAC,IAAI,CAAC;wBACP,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;wBAClE,MAAM,EAAE,GAAG,CAAC,iBAAiB;wBAC7B,GAAG,EAAE,GAAG;qBACT,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;oBACb,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,CAAC,CACF,CAAC;QAEF,2BAA2B,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAChE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC7D,sBAAsB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;oBAClE,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBACtC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;oBACb,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,2FAA2F;QAC3F,2EAA2E;QAC3E,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO;YACL,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;;AA1HM,sCAAY,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AA6H3F,MAAM,CAAC,OAAO,GAAG,yBAAyB,CAAC"}

package/lib/authentication/ldap.d.ts

@@ -0,0 +1,2 @@
+export function initialize(strategy: any): void;
+//# sourceMappingURL=ldap.d.ts.map

package/lib/authentication/ldap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap.d.ts","sourceRoot":"","sources":["../../src/authentication/ldap.js"],"names":[],"mappings":"AA0FA,gDAqDC"}

package/lib/authentication/ldap.js

@@ -0,0 +1,130 @@
+"use strict";
+const LdapStrategy = require('passport-ldapauth'), log = require('winston'), User = require('../models/user'), Role = require('../models/role'), TokenAssertion = require('./verification').TokenAssertion, api = require('../api'), userTransformer = require('../transformers/user'), { app, passport, tokenService } = require('./index');
+function configure(strategy) {
+    log.info('Configuring ' + strategy.title + ' authentication');
+    passport.use(strategy.name, new LdapStrategy({
+        server: {
+            url: strategy.settings.url,
+            bindDN: strategy.settings.bindDN,
+            bindCredentials: strategy.settings.bindCredentials,
+            searchBase: strategy.settings.searchBase,
+            searchFilter: strategy.settings.searchFilter,
+            searchScope: strategy.settings.searchScope,
+            groupSearchBase: strategy.settings.groupSearchBase,
+            groupSearchFilter: strategy.settings.groupSearchFilter,
+            groupSearchScope: strategy.settings.groupSearchScope,
+            bindProperty: strategy.settings.bindProperty,
+            groupDnProperty: strategy.settings.groupDnProperty
+        }
+    }, function (profile, done) {
+        const username = profile[strategy.settings.profile.id];
+        User.getUserByAuthenticationStrategy(strategy.type, username, function (err, user) {
+            if (err)
+                return done(err);
+            if (!user) {
+                // Create an account for the user
+                Role.getRole('USER_ROLE', function (err, role) {
+                    if (err)
+                        return done(err);
+                    const user = {
+                        username: username,
+                        displayName: profile[strategy.settings.profile.displayName],
+                        email: profile[strategy.settings.profile.email],
+                        active: false,
+                        roleId: role._id,
+                        authentication: {
+                            type: strategy.name,
+                            id: username,
+                            authenticationConfiguration: {
+                                name: strategy.name
+                            }
+                        }
+                    };
+                    new api.User().create(user).then(newUser => {
+                        if (!newUser.authentication.authenticationConfiguration.enabled) {
+                            log.warn(newUser.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                            return done(null, newUser, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+                        }
+                        if (newUser.active) {
+                            done(null, newUser);
+                        }
+                        else {
+                            done(null, newUser, { status: 403 });
+                        }
+                    }).catch(err => done(err));
+                });
+            }
+            else if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn(user.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                return done(null, user, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+            }
+            else {
+                return done(null, user);
+            }
+        });
+    }));
+}
+function setDefaults(strategy) {
+    if (!strategy.settings.profile) {
+        strategy.settings.profile = {};
+    }
+    if (!strategy.settings.profile.displayName) {
+        strategy.settings.profile.displayName = 'givenname';
+    }
+    if (!strategy.settings.profile.email) {
+        strategy.settings.profile.email = 'mail';
+    }
+    if (!strategy.settings.profile.id) {
+        strategy.settings.profile.id = 'cn';
+    }
+}
+function initialize(strategy) {
+    setDefaults(strategy);
+    configure(strategy);
+    const authenticationOptions = {
+        invalidLogonHours: `Not Permitted to login to ${strategy.title} account at this time.`,
+        invalidWorkstation: `Not permited to logon to ${strategy.title} account at this workstation.`,
+        passwordExpired: `${strategy.title} password expired.`,
+        accountDisabled: `${strategy.title} account disabled.`,
+        accountExpired: `${strategy.title} account expired.`,
+        passwordMustChange: `User must reset ${strategy.title} password.`,
+        accountLockedOut: `${strategy.title} user account locked.`,
+        invalidCredentials: `Invalid ${strategy.title} username/password.`
+    };
+    app.post(`/auth/${strategy.name}/signin`, function authenticate(req, res, next) {
+        passport.authenticate(strategy.name, authenticationOptions, function (err, user, info = {}) {
+            if (err)
+                return next(err);
+            if (!user) {
+                return res.status(401).send(info.message);
+            }
+            if (!user.active) {
+                return res.status(info.status || 401).send('User account is not approved, please contact your MAGE administrator to approve your account.');
+            }
+            if (!user.enabled) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is disabled.');
+                return res.status(401).send('Your account has been disabled, please contact a MAGE administrator for assistance.');
+            }
+            if (!user.authentication.authenticationConfigurationId) {
+                log.warn('Failed user login attempt: ' + user.authentication.type + ' is not configured');
+                return res.status(401).send(user.authentication.type + ' authentication is not configured, please contact a MAGE administrator for assistance.');
+            }
+            if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn('Failed user login attempt: Authentication ' + user.authentication.authenticationConfiguration.title + ' is disabled.');
+                return res.status(401).send(user.authentication.authenticationConfiguration.title + ' authentication is disabled, please contact a MAGE administrator for assistance.');
+            }
+            tokenService.generateToken(user._id.toString(), TokenAssertion.Authorized, 60 * 5)
+                .then(token => {
+                res.json({
+                    user: userTransformer.transform(req.user, { path: req.getRoot() }),
+                    token: token
+                });
+            }).catch(err => next(err));
+        })(req, res, next);
+    });
+}
+;
+module.exports = {
+    initialize
+};
+//# sourceMappingURL=ldap.js.map

package/lib/authentication/ldap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldap.js","sourceRoot":"","sources":["../../src/authentication/ldap.js"],"names":[],"mappings":";AAAA,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,EAC7C,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EACxB,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,cAAc,EACzD,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EACvB,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,EACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEzD,SAAS,SAAS,CAAC,QAAQ;IACzB,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,KAAK,GAAG,iBAAiB,CAAC,CAAC;IAE9D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;QAC3C,MAAM,EAAE;YACN,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG;YAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;YAChC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;YAClD,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;YACxC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;YAC5C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;YAC1C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;YAClD,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB;YACtD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB;YACpD,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;YAC5C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;SACnD;KACF,EACC,UAAU,OAAO,EAAE,IAAI;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAE,CAAC;QACxD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,IAAI;YAC/E,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE;gBACT,iCAAiC;gBACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,IAAI;oBAC3C,IAAI,GAAG;wBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBAE1B,MAAM,IAAI,GAAG;wBACX,QAAQ,EAAE,QAAQ;wBAClB,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;wBAC3D,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBAC/C,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc,EAAE;4BACd,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,EAAE,EAAE,QAAQ;4BACZ,2BAA2B,EAAE;gCAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;6BACpB;yBACF;qBACF,CAAC;oBAEF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;4BAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;4BACtG,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;yBACtI;wBACD,IAAI,OAAO,CAAC,MAAM,EAAE;4BAClB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;yBACrB;6BAAM;4BACL,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;yBACtC;oBACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;aACJ;iBAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBACnE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;gBACnG,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;aACnI;iBAAM;gBACL,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACzB;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAQ;IAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC7B,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;KACjC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QACzC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;KACtD;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;KAC3C;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE;QAChC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;KACtC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAQ;IAC1B,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtB,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpB,MAAM,qBAAqB,GAAG;QAC5B,iBAAiB,EAAE,6BAA6B,QAAQ,CAAC,KAAK,wBAAwB;QACtF,kBAAkB,EAAE,4BAA4B,QAAQ,CAAC,KAAK,+BAA+B;QAC7F,eAAe,EAAE,GAAG,QAAQ,CAAC,KAAK,oBAAoB;QACtD,eAAe,EAAE,GAAG,QAAQ,CAAC,KAAK,oBAAoB;QACtD,cAAc,EAAE,GAAG,QAAQ,CAAC,KAAK,mBAAmB;QACpD,kBAAkB,EAAE,mBAAmB,QAAQ,CAAC,KAAK,YAAY;QACjE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,KAAK,uBAAuB;QAC1D,kBAAkB,EAAE,WAAW,QAAQ,CAAC,KAAK,qBAAqB;KACnE,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,IAAI,SAAS,EACtC,SAAS,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAClC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YACxF,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE;gBACT,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC3C;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;aAC7I;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjB,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,CAAC;gBACvF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAA;aACnH;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,EAAE;gBACtD,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,oBAAoB,CAAC,CAAC;gBAC1F,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,wFAAwF,CAAC,CAAA;aACjJ;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAC5D,GAAG,CAAC,IAAI,CAAC,4CAA4C,GAAG,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;gBACjI,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,kFAAkF,CAAC,CAAA;aACxK;YAED,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC/E,IAAI,CAAC,KAAK,CAAC,EAAE;gBACZ,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;oBAClE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC;AAAA,CAAC;AAEF,MAAM,CAAC,OAAO,GAAG;IACf,UAAU;CACX,CAAA"}

package/lib/authentication/local.d.ts

@@ -0,0 +1,2 @@
+export function initialize(): void;
+//# sourceMappingURL=local.d.ts.map

package/lib/authentication/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/authentication/local.js"],"names":[],"mappings":"AAkEA,mCAsBC"}

package/lib/authentication/local.js

@@ -0,0 +1,77 @@
+"use strict";
+const log = require('winston'), moment = require('moment'), LocalStrategy = require('passport-local').Strategy, TokenAssertion = require('./verification').TokenAssertion, User = require('../models/user'), userTransformer = require('../transformers/user'), { app, passport, tokenService } = require('./index'), Authentication = require('../models/authentication');
+function configure() {
+    log.info('Configuring local authentication');
+    passport.use(new LocalStrategy(function (username, password, done) {
+        User.getUserByUsername(username, function (err, user) {
+            if (err) {
+                return done(err);
+            }
+            if (!user) {
+                log.warn('Failed login attempt: User with username ' + username + ' not found');
+                return done(null, false, { message: 'Please check your username and password and try again.' });
+            }
+            if (!user.active) {
+                log.warn('Failed user login attempt: User ' + user.username + ' is not active');
+                return done(null, false, { message: 'User account is not approved, please contact your MAGE administrator to approve your account.' });
+            }
+            if (!user.enabled) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is disabled.');
+                return done(null, false, { message: 'Your account has been disabled, please contact a MAGE administrator for assistance.' });
+            }
+            const settings = user.authentication.security;
+            if (settings && settings.locked && moment().isBefore(moment(settings.lockedUntil))) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is locked until ' + settings.lockedUntil);
+                return done(null, false, { message: 'Your account has been temporarily locked, please try again later or contact a MAGE administrator for assistance.' });
+            }
+            if (!(user.authentication instanceof Authentication.Local)) {
+                log.warn(user.username + " is not a local account");
+                return done(null, false, { message: 'You do not have a local account, please contact a MAGE administrator for assistance.' });
+            }
+            if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn(user.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                return done(null, false, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+            }
+            user.authentication.validatePassword(password, function (err, isValid) {
+                if (err)
+                    return done(err);
+                if (isValid) {
+                    User.validLogin(user)
+                        .then(() => done(null, user))
+                        .catch(err => done(err));
+                }
+                else {
+                    log.warn('Failed login attempt: User with username ' + username + ' provided an invalid password');
+                    User.invalidLogin(user)
+                        .then(() => done(null, false, { message: 'Please check your username and password and try again.' }))
+                        .catch(err => done(err));
+                }
+            });
+        });
+    }));
+}
+function initialize() {
+    configure();
+    app.post('/auth/local/signin', function authenticate(req, res, next) {
+        passport.authenticate('local', function (err, user, info = {}) {
+            if (err)
+                return next(err);
+            if (!user)
+                return res.status(401).send(info.message);
+            tokenService.generateToken(user._id.toString(), TokenAssertion.Authorized, 60 * 5)
+                .then(token => {
+                res.json({
+                    token: token,
+                    user: userTransformer.transform(user, { path: req.getRoot() })
+                });
+            }).catch(err => {
+                next(err);
+            });
+        })(req, res, next);
+    });
+}
+;
+module.exports = {
+    initialize
+};
+//# sourceMappingURL=local.js.map

package/lib/authentication/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/authentication/local.js"],"names":[],"mappings":";AAAA,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EAC1B,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,EAC1B,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAClD,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,cAAc,EACzD,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,EACjD,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,EACpD,cAAc,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAEzD,SAAS,SAAS;IAChB,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAC5B,UAAU,QAAQ,EAAE,QAAQ,EAAE,IAAI;QAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,GAAG,EAAE,IAAI;YAClD,IAAI,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;aAAE;YAE9B,IAAI,CAAC,IAAI,EAAE;gBACT,GAAG,CAAC,IAAI,CAAC,2CAA2C,GAAG,QAAQ,GAAG,YAAY,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;aACjG;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAChB,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;aACxI;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjB,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CAAC,CAAC;gBACvF,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qFAAqF,EAAE,CAAC,CAAC;aAC9H;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE;gBAClF,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,2BAA2B,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAClH,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kHAAkH,EAAE,CAAC,CAAC;aAC3J;YAED,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,YAAY,cAAc,CAAC,KAAK,CAAC,EAAE;gBAC1D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,yBAAyB,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;aAC/H;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;gBACnG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;aACpI;YAED,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,EAAE,OAAO;gBACnE,IAAI,GAAG;oBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE1B,IAAI,OAAO,EAAE;oBACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;yBAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;yBAC5B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5B;qBAAM;oBACL,GAAG,CAAC,IAAI,CAAC,2CAA2C,GAAG,QAAQ,GAAG,+BAA+B,CAAC,CAAC;oBACnG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;yBACpB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;yBACpG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5B;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,SAAS,EAAE,CAAC;IAEZ,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAC3B,SAAS,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAClC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YAC3D,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAErD,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC/E,IAAI,CAAC,KAAK,CAAC,EAAE;gBACZ,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK,EAAE,KAAK;oBACZ,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;iBAC/D,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC;AAAA,CAAC;AAEF,MAAM,CAAC,OAAO,GAAG;IACf,UAAU;CACX,CAAA"}

package/lib/authentication/oauth.d.ts

@@ -0,0 +1,2 @@
+export function initialize(strategy: any): void;
+//# sourceMappingURL=oauth.d.ts.map

package/lib/authentication/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/authentication/oauth.js"],"names":[],"mappings":"AAmJA,gDAuEC"}

package/lib/authentication/oauth.js

@@ -0,0 +1,197 @@
+'use strict';
+const OAuth2Strategy = require('passport-oauth2').Strategy, TokenAssertion = require('./verification').TokenAssertion, base64 = require('base-64'), api = require('../api'), log = require('../logger'), User = require('../models/user'), Role = require('../models/role'), { app, passport, tokenService } = require('./index');
+class OAuth2ProfileStrategy extends OAuth2Strategy {
+    constructor(options, verify) {
+        super(options, verify);
+        if (!options.profileURL) {
+            throw new TypeError('OAuth2Strategy requires a profileURL option');
+        }
+        this._profileURL = options.profileURL;
+        this._oauth2.useAuthorizationHeaderforGET(true);
+    }
+    userProfile(accessToken, done) {
+        this._oauth2.get(this._profileURL, accessToken, function (err, body) {
+            if (err) {
+                return done(new InternalOAuthError('Failed to fetch user profile', err));
+            }
+            try {
+                const json = JSON.parse(body);
+                const profile = {};
+                profile.provider = 'oauth2';
+                profile.raw = body;
+                profile.json = json;
+                done(null, profile);
+            }
+            catch (e) {
+                log.warn('Error parsing oauth profile', e);
+                done(e);
+            }
+        });
+    }
+}
+function configure(strategy) {
+    log.info('Configuring ' + strategy.title + ' authentication');
+    let customHeaders = null;
+    if (strategy.settings.headers) {
+        customHeaders = {};
+        if (strategy.settings.headers.basic) {
+            customHeaders['Authorization'] = `Basic ${base64.encode(`${strategy.settings.clientID}:${strategy.settings.clientSecret}`)}`;
+        }
+    }
+    passport.use(strategy.name, new OAuth2ProfileStrategy({
+        clientID: strategy.settings.clientID,
+        clientSecret: strategy.settings.clientSecret,
+        callbackURL: `/auth/${strategy.name}/callback`,
+        authorizationURL: strategy.settings.authorizationURL,
+        tokenURL: strategy.settings.tokenURL,
+        profileURL: strategy.settings.profileURL,
+        customHeaders: customHeaders,
+        scope: strategy.settings.scope,
+        pkce: strategy.settings.pkce,
+        store: true
+    }, function (accessToken, refreshToken, profileResponse, done) {
+        const profile = profileResponse.json;
+        if (!profile[strategy.settings.profile.id]) {
+            log.warn("JSON: " + JSON.stringify(profile) + " RAW: " + profileResponse.raw);
+            return done(`OAuth2 user profile does not contain id property named ${strategy.settings.profile.id}`);
+        }
+        const profileId = profile[strategy.settings.profile.id];
+        User.getUserByAuthenticationStrategy(strategy.type, profileId, function (err, user) {
+            if (err)
+                return done(err);
+            if (!user) {
+                // Create an account for the user
+                Role.getRole('USER_ROLE', function (err, role) {
+                    if (err)
+                        return done(err);
+                    let email = null;
+                    if (profile[strategy.settings.profile.email]) {
+                        if (Array.isArray(profile[strategy.settings.profile.email])) {
+                            email = profile[strategy.settings.profile.email].find(email => {
+                                email.verified === true;
+                            });
+                        }
+                        else {
+                            email = profile[strategy.settings.profile.email];
+                        }
+                    }
+                    else {
+                        log.warn(`OAuth2 user profile does not contain email property named ${strategy.settings.profile.email}`);
+                        log.debug(JSON.stringify(profile));
+                    }
+                    const user = {
+                        username: profileId,
+                        displayName: profile[strategy.settings.profile.displayName] || profileId,
+                        email: email,
+                        active: false,
+                        roleId: role._id,
+                        authentication: {
+                            type: strategy.type,
+                            id: profileId,
+                            authenticationConfiguration: {
+                                name: strategy.name
+                            }
+                        }
+                    };
+                    new api.User().create(user).then(newUser => {
+                        if (!newUser.authentication.authenticationConfiguration.enabled) {
+                            log.warn(newUser.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                            return done(null, false, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+                        }
+                        return done(null, newUser);
+                    }).catch(err => done(err));
+                });
+            }
+            else if (!user.active) {
+                return done(null, user, { message: "User is not approved, please contact your MAGE administrator to approve your account." });
+            }
+            else if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn(user.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                return done(null, user, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+            }
+            else {
+                return done(null, user);
+            }
+        });
+    }));
+}
+function setDefaults(strategy) {
+    if (!strategy.settings.profile) {
+        strategy.settings.profile = {};
+    }
+    if (!strategy.settings.profile.displayName) {
+        strategy.settings.profile.displayName = 'displayName';
+    }
+    if (!strategy.settings.profile.email) {
+        strategy.settings.profile.email = 'email';
+    }
+    if (!strategy.settings.profile.id) {
+        strategy.settings.profile.id = 'id';
+    }
+}
+function initialize(strategy) {
+    setDefaults(strategy);
+    // TODO lets test with newer geoaxis server to see if this is still needed
+    // If it is, this should be a admin client side option, would also need to modify the
+    // renderer to provide a more generic message
+    strategy.redirect = false;
+    configure(strategy);
+    function authenticate(req, res, next) {
+        passport.authenticate(strategy.name, function (err, user, info = {}) {
+            if (err)
+                return next(err);
+            req.user = user;
+            // For inactive or disabled accounts don't generate an authorization token
+            if (!user.active || !user.enabled) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is inactive or disabled.');
+                return next();
+            }
+            if (!user.authentication.authenticationConfigurationId) {
+                log.warn('Failed user login attempt: ' + user.authentication.type + ' is not configured');
+                return next();
+            }
+            if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn('Failed user login attempt: Authentication ' + user.authentication.authenticationConfiguration.title + ' is disabled.');
+                return next();
+            }
+            tokenService.generateToken(user._id.toString(), TokenAssertion.Authorized, 60 * 5)
+                .then(token => {
+                req.token = token;
+                req.user = user;
+                req.info = info;
+                next();
+            }).catch(err => next(err));
+        })(req, res, next);
+    }
+    app.get(`/auth/${strategy.name}/signin`, function (req, res, next) {
+        passport.authenticate(strategy.name, {
+            scope: strategy.settings.scope,
+            state: req.query.state
+        })(req, res, next);
+    });
+    app.get(`/auth/${strategy.name}/callback`, authenticate, function (req, res) {
+        if (req.query.state === 'mobile') {
+            let uri;
+            if (!req.user.active || !req.user.enabled) {
+                uri = `mage://app/invalid_account?active=${req.user.active}&enabled=${req.user.enabled}`;
+            }
+            else {
+                uri = `mage://app/authentication?token=${req.token}`;
+            }
+            if (strategy.redirect) {
+                res.redirect(uri);
+            }
+            else {
+                res.render('oauth', { uri: uri });
+            }
+        }
+        else {
+            res.render('authentication', { host: req.getRoot(), login: { token: req.token, user: req.user } });
+        }
+    });
+}
+;
+module.exports = {
+    initialize
+};
+//# sourceMappingURL=oauth.js.map

package/lib/authentication/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/authentication/oauth.js"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EACrD,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,cAAc,EACzD,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,EAC3B,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EACvB,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,EAC1B,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAE1D,MAAM,qBAAsB,SAAQ,cAAc;IAC/C,YAAY,OAAO,EAAE,MAAM;QACxB,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;SAAE;QAChG,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,WAAW,CAAC,WAAW,EAAE,IAAI;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,IAAI;YAChE,IAAI,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC,CAAC;aAAE;YAEtF,IAAI;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAE9B,MAAM,OAAO,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;gBACnB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBAEpB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;aACtB;YAAC,OAAO,CAAC,EAAE;gBACT,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,CAAC,CAAC,CAAC;aACV;QACJ,CAAC,CAAC,CAAC;IACN,CAAC;CACH;AAED,SAAS,SAAS,CAAC,QAAQ;IACxB,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,KAAK,GAAG,iBAAiB,CAAC,CAAC;IAE9D,IAAI,aAAa,GAAG,IAAI,CAAC;IAEzB,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC5B,aAAa,GAAG,EAAE,CAAC;QACnB,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;YAClC,aAAa,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;SAC/H;KACH;IAED,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,qBAAqB,CAAC;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;QAC5C,WAAW,EAAE,SAAS,QAAQ,CAAC,IAAI,WAAW;QAC9C,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB;QACpD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;QACxC,aAAa,EAAE,aAAa;QAC5B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;QAC9B,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;QAC5B,KAAK,EAAE,IAAI;KACb,EAAE,UAAU,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI;QAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC;QAErC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,0DAA0D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;SACxG;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,GAAG,EAAE,IAAI;YAC/E,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE;gBACR,iCAAiC;gBACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,IAAI;oBAC1C,IAAI,GAAG;wBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBAE1B,IAAI,KAAK,GAAG,IAAI,CAAC;oBACjB,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;wBAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE;4BAC1D,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gCAC3D,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAA;4BAC1B,CAAC,CAAC,CAAC;yBACL;6BAAM;4BACJ,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;yBACnD;qBACH;yBAAM;wBACJ,GAAG,CAAC,IAAI,CAAC,6DAA6D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;wBACzG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;qBACrC;oBAED,MAAM,IAAI,GAAG;wBACV,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,SAAS;wBACxE,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc,EAAE;4BACb,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,EAAE,EAAE,SAAS;4BACb,2BAA2B,EAAE;gCAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI;6BACrB;yBACH;qBACH,CAAC;oBAEF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;wBACxC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;4BAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;4BACtG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;yBACrI;wBACD,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC9B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9B,CAAC,CAAC,CAAC;aACL;iBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACtB,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;aAChI;iBAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;gBACnG,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;aACpI;iBAAM;gBACJ,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC1B;QACJ,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,WAAW,CAAC,QAAQ;IAC1B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC7B,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;KACjC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QACzC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC;KACxD;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC;KAC5C;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE;QAChC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;KACtC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAQ;IACzB,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEtB,0EAA0E;IAC1E,qFAAqF;IACrF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC;IAC1B,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpB,SAAS,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QACjC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YAChE,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAEhB,0EAA0E;YAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChC,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,mCAAmC,CAAC,CAAC;gBACnG,OAAO,IAAI,EAAE,CAAC;aAChB;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,EAAE;gBACrD,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,oBAAoB,CAAC,CAAC;gBAC1F,OAAO,IAAI,EAAE,CAAC;aAChB;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAC3D,GAAG,CAAC,IAAI,CAAC,4CAA4C,GAAG,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;gBACjI,OAAO,IAAI,EAAE,CAAC;aAChB;YAED,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC9E,IAAI,CAAC,KAAK,CAAC,EAAE;gBACX,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;gBAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,IAAI,EAAE,CAAC;YACV,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,SAAS,EACpC,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACrB,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK;SACxB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,WAAW,EACtC,YAAY,EACZ,UAAU,GAAG,EAAE,GAAG;QACf,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE;YAC/B,IAAI,GAAG,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;gBACxC,GAAG,GAAG,qCAAqC,GAAG,CAAC,IAAI,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;aAC3F;iBAAM;gBACJ,GAAG,GAAG,mCAAmC,GAAG,CAAC,KAAK,EAAE,CAAA;aACtD;YAED,IAAI,QAAQ,CAAC,QAAQ,EAAE;gBACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;aACpB;iBAAM;gBACJ,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;aACpC;SACH;aAAM;YACJ,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACrG;IACJ,CAAC,CACH,CAAC;AACL,CAAC;AAAA,CAAC;AAEF,MAAM,CAAC,OAAO,GAAG;IACd,UAAU;CACZ,CAAA"}

package/lib/authentication/openidconnect.d.ts

@@ -0,0 +1,2 @@
+export function initialize(strategy: any): void;
+//# sourceMappingURL=openidconnect.d.ts.map

package/lib/authentication/openidconnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openidconnect.d.ts","sourceRoot":"","sources":["../../src/authentication/openidconnect.js"],"names":[],"mappings":"AAsJA,gDAYC"}