@oneidentity/safeguard 1.0.5 → 7.4.0

package/README.md

@@ -47,7 +47,7 @@ A simple code example for calling the Safeguard API for authentication through t
 // Browser Example
 SafeguardJs.connectRsts('safeguard.sample.corp', `${window.location.protocol}//${window.location.host}${window.location.pathname}`)
 .then((connection) => {
-    connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.GET, 'v3/Me')
+    connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.GET, 'v4/Me')
     .then((results) => {
         console.log(results);
     });
@@ -197,7 +197,7 @@ Sample can be found <a href="samples\Browser\Promises\AnonymousExample">here</a>
 // Browser Example
 SafeguardJs.connectAnonymous('safeguard.sample.corp', saveConnectionCallback)
 .then((connection) => { 
-    connection.invoke(SafeguardJs.Services.NOTIFICATION, SafeguardJs.HttpMethods.GET, 'v3/Status')
+    connection.invoke(SafeguardJs.Services.NOTIFICATION, SafeguardJs.HttpMethods.GET, 'v4/Status')
     .then((results) => { 
         console.log(results);
     });
@@ -211,7 +211,7 @@ Sample can be found <a href="samples\Node.JS\anonymousExample.js">here</a>.
 let localStorage = new require('src/LocalStorage').LocalStorage;
 SafeguardJs.addCAFromFile(caFile);
 let connection = await SafeguardJs.connectAnonymous(hostName, null, localStorage);
-let result = await connection.invoke(SafeguardJs.Services.NOTIFICATION, SafeguardJs.HttpMethods.GET, 'v3/Status');
+let result = await connection.invoke(SafeguardJs.Services.NOTIFICATION, SafeguardJs.HttpMethods.GET, 'v4/Status');
 console.log(result);
 ```
 
@@ -270,10 +270,10 @@ let password = 'MyNewUser123';
 
 SafeguardJs.connectRsts('safeguard.sample.corp', `${window.location.protocol}//${window.location.host}${window.location.pathname}`)
 .then((connection) => {
-    connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.POST, 'v3/Users', user)
+    connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.POST, 'v4/Users', user)
     .then((results) => {
         let newUser = JSON.parse(results);
-        connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.PUT, `v3/Users/${newUser.Id}/Password`, `"${password}"`);
+        connection.invoke(SafeguardJs.Services.CORE, SafeguardJs.HttpMethods.PUT, `v4/Users/${newUser.Id}/Password`, `"${password}"`);
     });
 });
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneidentity/safeguard",
-  "version": "1.0.5",
+  "version": "7.4.0",
   "description": "One Identity Safeguard JavaScript SDK",
   "main": "src/safeguard.js",
   "browser": {
@@ -34,7 +34,8 @@
   "dependencies": {
     "@microsoft/signalr": "^5.0.4",
     "axios": "^0.21.1",
-    "ssl-root-cas": "^1.3.1"
+    "ssl-root-cas": "^1.3.1",
+    "crypto-js": "~4.1.1"
   },
   "devDependencies": {
     "browserify": "^17.0.0",

package/src/SessionStorage.js

@@ -14,7 +14,12 @@ class SessionStorage {
     SessionStorageKeys = {
         ACCESSTOKEN: 'AccessToken',
         USERTOKEN:   'UserToken',
-        HOSTNAME:    'HostName'
+        HOSTNAME:    'HostName',
+        CODEVERIFIER: 'CodeVerifier',
+        RANDOMSTATE: 'RandomState',
+        CODE: 'Code',
+        STATE: 'State',
+        NEWLOGIN: 'NewLogin'
     }
 
     /**
@@ -25,6 +30,38 @@ class SessionStorage {
         return sessionStorage.getItem(this.SessionStorageKeys.ACCESSTOKEN);
     }
 
+    /**
+     * Gets the access pkce code from storage.
+     * @returns {string} The pkce code.
+     */
+    getCode() {
+        return sessionStorage.getItem(this.SessionStorageKeys.CODE);
+    }
+
+    /**
+     * Gets the access pkce code verifier from storage.
+     * @returns {string} The pkce verifier code.
+     */
+    getCodeVerifier() {
+        return sessionStorage.getItem(this.SessionStorageKeys.CODEVERIFIER);
+    }
+
+    /**
+     * Gets the access random state from storage.
+     * @returns {string} The random state.
+     */
+    getRandomState() {
+        return sessionStorage.getItem(this.SessionStorageKeys.RANDOMSTATE);
+    }
+
+    /**
+     * Gets the access pkce  state from storage.
+     * @returns {string} The pkce state.
+     */
+    getState() {
+        return sessionStorage.getItem(this.SessionStorageKeys.STATE);
+    }
+
     /**
      * Gets the user token from storage.
      * @returns {string} The user token.
@@ -41,6 +78,14 @@ class SessionStorage {
         return sessionStorage.getItem(this.SessionStorageKeys.HOSTNAME);
     }
 
+    /**
+     * Gets the new login flag from storage.
+     * @returns {string} The new login flag.
+     */
+    getNewLogin(){
+        return sessionStorage.getItem(this.SessionStorageKeys.NEWLOGIN);
+    }
+
     /**
      * Writes the access token to storage.
      */
@@ -48,6 +93,34 @@ class SessionStorage {
         sessionStorage.setItem(this.SessionStorageKeys.ACCESSTOKEN, accessToken);
     }
 
+    /**
+     * Writes the access pkce code to storage.
+     */
+    setCode(code) {
+        sessionStorage.setItem(this.SessionStorageKeys.CODE, code);
+    }
+
+    /**
+     * Writes the access pkce code verifier to storage.
+     */
+    setCodeVerifier(codeVerifier) {
+        sessionStorage.setItem(this.SessionStorageKeys.CODEVERIFIER, codeVerifier);
+    }
+
+    /**
+     * Writes the access random state to storage.
+     */
+    setRandomState(state) {
+        sessionStorage.setItem(this.SessionStorageKeys.RANDOMSTATE, state);
+    }
+
+    /**
+     * Writes the access pkce  state to storage.
+     */
+    setState(state) {
+        sessionStorage.setItem(this.SessionStorageKeys.STATE, state);
+    }
+
     /**
      * Writes the user token to storage.
      */
@@ -62,28 +135,35 @@ class SessionStorage {
         sessionStorage.setItem(this.SessionStorageKeys.HOSTNAME, hostName);
     }
 
+    /**
+     * Writes the new login flag to storage.
+     */
+    setNewLogin(newLogin) {
+        sessionStorage.setItem(this.SessionStorageKeys.NEWLOGIN, newLogin);
+    }
+
+     /**
+      * Clears code and state from storage.
+      */
+     clearPKCEStorage() {
+        sessionStorage.removeItem(this.SessionStorageKeys.CODE);
+        sessionStorage.removeItem(this.SessionStorageKeys.STATE);
+        sessionStorage.removeItem(this.SessionStorageKeys.CODEVERIFIER);
+        sessionStorage.removeItem(this.SessionStorageKeys.RANDOMSTATE);
+    }
+
     /**
      * Clears all values from storage.
      */
     clearStorage() {
-        let userToken = this.getUserToken();
-        let accessToken = this.getAccessToken();
-        let sessionHostName = this.getHostName();
-
-        if (userToken)
-        {
-            this.setUserToken('');
-        }
-
-        if (accessToken)
-        {
-            this.setAccessToken('');
-        }
-
-        if (sessionHostName)
-        {
-            this.setHostName('');
-        }
+        sessionStorage.removeItem(this.SessionStorageKeys.USERTOKEN);
+        sessionStorage.removeItem(this.SessionStorageKeys.ACCESSTOKEN);
+        sessionStorage.removeItem(this.SessionStorageKeys.HOSTNAME);
+        sessionStorage.removeItem(this.SessionStorageKeys.CODE);
+        sessionStorage.removeItem(this.SessionStorageKeys.CODEVERIFIER);
+        sessionStorage.removeItem(this.SessionStorageKeys.STATE);
+        sessionStorage.removeItem(this.SessionStorageKeys.RANDOMSTATE);
+        sessionStorage.removeItem(this.SessionStorageKeys.NEWLOGIN);
     }
 }
 

package/src/safeguard.js

@@ -4,6 +4,7 @@ const AXIOS = require('axios');
 const HTTPS = require('https');
 const LS = require('./LocalStorage');
 const SS = require('./SessionStorage');
+const CryptoJS = require('crypto-js');
 
 /**
  *  SafeguardJs
@@ -77,6 +78,30 @@ const SafeguardJs = {
         }
     },
 
+    /**
+     * (Internal) Saves the access token to storage.
+     *
+     * @param {string}              data    String representation of JSON object returned from the
+     *                                      Safeguard appliance containing the access token.
+     */
+    _saveAccessToken: (err, data) => {
+        if (err) {
+            throw new Error('Failed to save access token.');
+        }
+
+        try {
+            let obj = JSON.parse(data);
+            if (obj.success) {
+                SafeguardJs.Storage.setAccessToken(obj.access_token);
+            } else {
+                throw new Error('Failed to save access token.');
+            }
+        }
+        catch(ex) {
+            throw new Error('Failed to save access token.');
+        }
+    },
+
     /**
      * (Internal) Executes an HTTP request.
      *
@@ -181,50 +206,34 @@ const SafeguardJs = {
     },
 
     /**
-     * (Internal) Gets the provider id for a given provider.
+     * (Internal) Gets the provider scope for a given provider.
      *
      * @param {string}              hostName        (Required) The name or ip of the safeguard appliance.
      * @param {string}              defaultProvider (Required) The id of the default provider.
      * @param {string}              provider        (Optional) The name or id of the provider to use. Default is local.
      */
-    _getProviderId: async (hostName, defaultProvider, provider) => {
+    _getProviderScope: async (hostName, defaultProvider, provider) => {
         if (provider == null || provider === "" || provider.toUpperCase() == "LOCAL" || provider.toUpperCase() == "CERTIFICATE") {
             return defaultProvider;
         }
-        
-        let headers = {
-            "accept": "application/json",
-            "content-type": "application/x-www-form-urlencoded"
-        }
-
-        let bodyData = {
-            "RelayState" : ""
-        };
 
-        let result = null;
+        let results = null;
 
-        try
-        {
-            result = await SafeguardJs._executePromise(`https://${hostName}/RSTS/UserLogin/LoginController?response_type=token&redirect_uri=urn:InstalledApplication&loginRequestStep=1`, SafeguardJs.HttpMethods.POST, bodyData, 'json', headers);
-            result = JSON.parse(result);
+        try {
+            results = await SafeguardJs._executePromise(`https://${hostName}/service/core/v4/AuthenticationProviders`, SafeguardJs.HttpMethods.GET, null, 'json', null, null, null);
+            results = JSON.parse(results);
         } catch (err) {
-            try {
-                // Retry as a GET
-                result = await SafeguardJs._executePromise(`https://${hostName}/RSTS/UserLogin/LoginController?response_type=token&redirect_uri=urn:InstalledApplication&loginRequestStep=1`, SafeguardJs.HttpMethods.GET, bodyData, 'json', headers);
-                result = JSON.parse(result);
-            } catch (err) {
-                throw new Error(`Could not find the provider: '${provider}'. ${err}`);
-            }
+            throw new Error(`Could not find the provider: '${provider}'. ${err}`);
         }
 
         try {
-            for (const p of result.Providers) {
-                if (provider.toUpperCase() == p.DisplayName.toUpperCase()) {
-                    return p.Id;
-                } else if (provider.toUpperCase() == p.Id.toUpperCase()) {
-                    return p.Id;
-                } else if (p.Id.toUpperCase().includes(provider.toUpperCase())) {
-                    return p.Id;
+            for (const p of results) {
+                if (provider.toUpperCase() == p.Name.toUpperCase()) {
+                    return p.RstsProviderScope;
+                } else if (provider.toUpperCase() == p.RstsProviderId.toUpperCase()) {
+                    return p.RstsProviderScope;
+                } else if (p.RstsProviderId.toUpperCase().includes(provider.toUpperCase())) {
+                    return p.RstsProviderScope;
                 }
             }
         } catch (err) {
@@ -234,6 +243,18 @@ const SafeguardJs = {
         throw new Error(`Could not find the provider: '${provider}'`);
     },
 
+    oAuthCodeVerifier: () => {
+        return SafeguardJs.toBase64Url(CryptoJS.lib.WordArray.random(30));
+    },
+    
+    oAuthCodeChallenge: (codeVerifier) => {
+        return SafeguardJs.toBase64Url(CryptoJS.SHA256(codeVerifier));
+    },
+    
+    toBase64Url: (data) => {
+        return CryptoJS.enc.Base64.stringify(data).replace(/[=]/gi, '').replace(/[+]/gi, '-').replace(/[/]/gi, '_');
+    },
+
     /**
      * (Internal) Gets the RSTS URL with a given redirect.
      *
@@ -241,14 +262,20 @@ const SafeguardJs = {
      * @param {string} redirectTo   The redirect URL to be used after successful authentication.
      */
     _loginUrl: (hostName, redirectTo) => {
-        return `https://${hostName}/RSTS/Login?response_type=token&redirect_uri=${encodeURIComponent(redirectTo)}`;
+        var codeVerifier = SafeguardJs.oAuthCodeVerifier();
+        var randomState = SafeguardJs.oAuthCodeVerifier();
+
+        SafeguardJs.Storage.setCodeVerifier(codeVerifier);
+        SafeguardJs.Storage.setRandomState(randomState);
+
+        return `https://${hostName}/RSTS/Login?response_type=code&code_challenge_method=S256&code_challenge=${SafeguardJs.oAuthCodeChallenge(codeVerifier)}&state=${randomState}&redirect_uri=${encodeURIComponent(redirectTo)}`;
     },
 
     /**
      * (Internal) Redirects the current window to the login page.
      *
-     * @param {string} hostName     The name or ip of the safeguard appliance.
-     * @param {string} redirectTo   The redirect URL to be used after successful authentication.
+     * @param {string}  hostName     The name or ip of the safeguard appliance.
+     * @param {string}  redirectTo   The redirect URL to be used after successful authentication.
      */
     _goToLogin: (hostName, redirectTo) => {
         window.location = SafeguardJs._loginUrl(hostName, redirectTo);
@@ -257,16 +284,37 @@ const SafeguardJs = {
     /**
      * (Internal) Contacts the safeguard appliance to trade an access token for a user token.
      *
-     * @param {string}              accessToken The access token to trade.
-     * @param {string}              hostName    The name or ip of the safeguard appliance.
+     * @param {string}  accessToken The access token to trade.
+     * @param {string}  hostName    The name or ip of the safeguard appliance.
      */
     _tradeForUserToken: (accessToken, hostName) => {
-        let url = `https://${hostName}/service/core/v3/Token/LoginResponse`;
+        let url = `https://${hostName}/service/core/v4/Token/LoginResponse`;
         body = {
             "StsAccessToken" : accessToken
         }
 
-        SafeguardJs._executePromise(url, SafeguardJs.HttpMethods.POST, body, 'json', null, SafeguardJs._saveUserToken);
+        return SafeguardJs._executePromise(url, SafeguardJs.HttpMethods.POST, body, 'json', null, SafeguardJs._saveUserToken);
+    },
+
+    /**
+     * (Internal) Contacts the rsts to trade a code for an access token.
+     *
+     * @param {string}  code            The code to trade.
+     * @param {string}  codeVerifier    The code verifier.
+     * @param {string}  hostName        The name or ip of the safeguard appliance.
+     */
+    _tradeForAccessToken: (code, codeVerifier, hostName) => {
+        let url = `https://${hostName}/RSTS/oauth2/token`;
+        body = new URLSearchParams({
+            grant_type: "authorization_code",
+            code: code,
+            code_verifier: codeVerifier
+        });
+        let headers = {
+            "content-type": "application/x-www-form-urlencoded"
+        }
+
+        return SafeguardJs._executePromise(url, SafeguardJs.HttpMethods.POST, body, 'json', headers, SafeguardJs._saveAccessToken);
     },
 
     /**
@@ -303,6 +351,8 @@ const SafeguardJs = {
 
         let userToken = SafeguardJs.Storage.getUserToken();
         let accessToken = SafeguardJs.Storage.getAccessToken();
+        let code = SafeguardJs.Storage.getCode();
+        let state = SafeguardJs.Storage.getState();
 
         if (userToken) {
             let connection = new SafeguardJs.SafeguardConnection(hostName);
@@ -310,6 +360,7 @@ const SafeguardJs = {
                 callback(connection);                
             }
             return connection;
+
         } else if (accessToken) {
             SafeguardJs._tradeForUserToken(accessToken, hostName);
             let connection = new SafeguardJs.SafeguardConnection(hostName);
@@ -317,6 +368,25 @@ const SafeguardJs = {
                 callback(connection);
             }
             return connection;
+
+        } else if (code && state) {
+            let codeVerifier = SafeguardJs.Storage.getCodeVerifier();
+            let randomState = SafeguardJs.Storage.getRandomState();
+
+            SafeguardJs.Storage.clearPKCEStorage();
+
+            if (state == randomState) {
+                SafeguardJs._tradeForAccessToken(code, codeVerifier, hostName)
+                .then(() => {
+                    accessToken = SafeguardJs.Storage.getAccessToken();
+                    SafeguardJs._tradeForUserToken(accessToken, hostName);
+                    let connection = new SafeguardJs.SafeguardConnection(hostName);
+                    if (callback) {
+                        callback(connection);
+                    }
+                    return connection;
+                });
+            }
         } else {
             getAccessToken();
         }
@@ -396,7 +466,7 @@ const SafeguardJs = {
             throw new Error('password may not be null or empty');
         }
 
-        let providerId = await SafeguardJs._getProviderId(hostName, 'local', provider);
+        let providerScope = await SafeguardJs._getProviderScope(hostName, 'local', provider);
 
         if (storage) {
             SafeguardJs.Storage = storage;
@@ -411,7 +481,7 @@ const SafeguardJs = {
                 "grant_type" : "password",
                 "username" : userName,
                 "password" : password,
-                "scope" : `rsts:sts:primaryproviderid:${providerId}`
+                "scope" : providerScope
             };
                           
             let accessToken = await SafeguardJs._executePromise(`https://${hostName}/RSTS/oauth2/token`, SafeguardJs.HttpMethods.POST, bodyData, 'json', null, null, null);
@@ -421,7 +491,7 @@ const SafeguardJs = {
                 "StsAccessToken" : SafeguardJs.Storage.getAccessToken()
               };
     
-            let stsToken = await SafeguardJs._executePromise(`https://${hostName}/service/core/v3/Token/LoginResponse`, SafeguardJs.HttpMethods.POST, bodyData, 'json', null, null, null);
+            let stsToken = await SafeguardJs._executePromise(`https://${hostName}/service/core/v4/Token/LoginResponse`, SafeguardJs.HttpMethods.POST, bodyData, 'json', null, null, null);
             SafeguardJs.Storage.setUserToken(JSON.parse(stsToken).UserToken);
             
             let connection = new SafeguardJs.SafeguardConnection(hostName);
@@ -462,7 +532,7 @@ const SafeguardJs = {
             throw new Error('passphrase may not be null or empty');
         }
 
-        let providerId = await SafeguardJs._getProviderId(hostName, 'certificate', provider);
+        let providerScope = await SafeguardJs._getProviderScope(hostName, 'certificate', provider);
         
         if (storage) {
             SafeguardJs.Storage = storage;
@@ -475,7 +545,7 @@ const SafeguardJs = {
         try {
             let bodyData = {
                 "grant_type" : "client_credentials",
-                "scope" : `rsts:sts:primaryproviderid:${providerId}`
+                "scope" : providerScope
               };
 
             let httpsAgent = new HTTPS.Agent({
@@ -493,7 +563,7 @@ const SafeguardJs = {
                 "StsAccessToken" : SafeguardJs.Storage.getAccessToken()
               };
     
-            let stsToken = await SafeguardJs._executePromise(`https://${hostName}/service/core/v3/Token/LoginResponse`, SafeguardJs.HttpMethods.POST, bodyData, 'json');
+            let stsToken = await SafeguardJs._executePromise(`https://${hostName}/service/core/v4/Token/LoginResponse`, SafeguardJs.HttpMethods.POST, bodyData, 'json');
             SafeguardJs.Storage.setUserToken(JSON.parse(stsToken).UserToken);
             
             let connection = new SafeguardJs.SafeguardConnection(hostName);
@@ -611,7 +681,7 @@ const SafeguardJs = {
                 'authorization': `A2A ${apiKey}`
             }
 
-            let credential = await SafeguardJs._executePromise(`https://${hostName}/service/a2a/v3/Credentials?type=${type}&keyFormat=${keyFormat}`, SafeguardJs.HttpMethods.GET, null, 'json', additionalHeaders, null, null, httpsAgent);
+            let credential = await SafeguardJs._executePromise(`https://${hostName}/service/a2a/v4/Credentials?type=${type}&keyFormat=${keyFormat}`, SafeguardJs.HttpMethods.GET, null, 'json', additionalHeaders, null, null, httpsAgent);
             
             // Remove any leading or trailing quotes that were added from string conversion
             if (credential.slice(0, 1) === '"') {
@@ -711,19 +781,14 @@ const SafeguardJs = {
             switch(service) {
                 case SafeguardJs.Services.CORE:
                     return `${baseUrl}core/${relativeUrl}`;
-                    break;
                 case SafeguardJs.Services.APPLIANCE:
                     return `${baseUrl}appliance/${relativeUrl}`;
-                    break;
                 case SafeguardJs.Services.NOTIFICATION:
                     return `${baseUrl}notification/${relativeUrl}`;
-                    break;
                 case SafeguardJs.Services.A2A:
                     return `${baseUrl}a2a/${relativeUrl}`;
-                    break;
                 default:
                     throw new Error(`Unsupported service requested: '${service}'.`);
-                    break;
             }
         }
 
@@ -748,7 +813,7 @@ const SafeguardJs = {
          */
         async getAccessTokenLifetimeRemaining(callback) {
             let bearerToken = this._getBearerToken();
-            let url = this._constructUrl(SafeguardJs.Services.CORE, 'v3/LoginMessage', null);
+            let url = this._constructUrl(SafeguardJs.Services.CORE, 'v4/LoginMessage', null);
             let additionalHeaders = {
                 'authorization': bearerToken,
                 'X-TokenLifetimeRemaining': ''
@@ -769,7 +834,7 @@ const SafeguardJs = {
          */
         async logout(callback) {
             let bearerToken = this._getBearerToken();
-            let url = this._constructUrl(SafeguardJs.Services.CORE, 'v3/Token/Logout', null);
+            let url = this._constructUrl(SafeguardJs.Services.CORE, 'v4/Token/Logout', null);
             let additionalHeaders = {
                 'authorization': bearerToken
             }