abap-local-client 1.0.0

package/snc-auth.mjs

@@ -0,0 +1,194 @@
+/**
+ * SNC Kerberos Authentication Module
+ *
+ * Secure Network Communication via Kerberos/SSPI.
+ * Uses the existing Kerberos ticket from Windows AD (provisioned by Azure AD +
+ * Cloud Trust + Microsoft Authenticator) to open an RFC connection with
+ * SNC_MODE=1.
+ *
+ * How it works:
+ *  1. Detects Windows logged-in user and AD domain
+ *  2. Builds SNC_MYNAME from the user identity (p:CN=user@REALM, ...)
+ *  3. Connects via sapnwrfc.dll with SNC parameters
+ *  4. SSPI transparently handles Kerberos ticket acquisition (including
+ *     Cloud Trust → Azure AD → Authenticator if needed)
+ */
+
+import { execSync } from 'child_process';
+import os from 'os';
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Identity Detection
+// ════════════════════════════════════════════════════════════════════════════
+
+export function getWindowsIdentity() {
+    try {
+        const output = execSync('whoami', { encoding: 'utf8' }).trim();
+        const [domain, user] = output.split('\\');
+        return { domain: domain || '', user: user || output };
+    } catch {
+        return { domain: '', user: os.userInfo().username };
+    }
+}
+
+export function getKerberosRealm() {
+    try {
+        return (process.env.USERDNSDOMAIN || process.env.USERDOMAIN || '').toUpperCase();
+    } catch {
+        return '';
+    }
+}
+
+export function getSNCMyName(opts = {}) {
+    const identity = opts.domain && opts.user
+        ? opts
+        : getWindowsIdentity();
+
+    const realm = opts.realm || getKerberosRealm();
+    const cn = `${identity.user}@${realm}`;
+
+    const parts = [`CN=${cn}`];
+    if (opts.ou) parts.push(`OU=${opts.ou}`);
+    if (realm)  parts.push(`O=${realm}`);
+    else if (opts.organization) parts.push(`O=${opts.organization}`);
+    if (opts.country) parts.push(`C=${opts.country}`);
+    else parts.push('C=BR');
+
+    return `p:${parts.join(', ')}`;
+}
+
+/**
+ * Check if Kerberos tickets are available.
+ * @returns {{ hasTickets: boolean, output: string }}
+ */
+export function checkKerberosTickets() {
+    try {
+        const output = execSync('klist', { encoding: 'utf8' });
+        const hasTickets = output.includes('Tíquetes em Cache') &&
+                          !output.includes('Tíquetes em Cache: (0)');
+        return { hasTickets, output };
+    } catch {
+        return { hasTickets: false, output: '' };
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SNC Config Builder
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Build SNC configuration for SAPRFCClient.
+ *
+ * @param {Object} opts
+ * @param {string} opts.sncPartnerName - SNC name of the SAP server
+ *                                       (e.g. "p:CN=SNC, OU=DITI, O=VALE SA, ...")
+ * @param {string} [opts.sncMyName]     - Auto-detected from Windows identity if not provided
+ * @param {string} [opts.sncQop='3']    - Quality of Protection (1=auth, 2=integrity, 3=privacy)
+ * @param {string} [opts.sncLib]        - Path to sapcrypto.dll (auto-detected if omitted)
+ * @param {string} [opts.user]          - Windows user (auto-detected)
+ * @param {string} [opts.domain]        - Windows domain (auto-detected)
+ * @param {string} [opts.realm]         - Kerberos realm (auto-detected)
+ * @returns {{ sncMode: string, sncMyName: string, sncPartnerName: string, sncQop: string }}
+ */
+export function buildSNCConfig(opts) {
+    const sncMyName = opts.sncMyName || getSNCMyName({
+        user: opts.user,
+        domain: opts.domain,
+        realm: opts.realm,
+    });
+
+    const config = {
+        sncMode:        '1',
+        sncMyName,
+        sncPartnerName: opts.sncPartnerName,
+        sncQop:         opts.sncQop || '3',
+    };
+
+    if (opts.sncLib) {
+        config.sncLib = opts.sncLib;
+    }
+
+    return config;
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SNC Session — wraps SAPRFCClient with SNC
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * SNC Session for RFC access via Kerberos SNC.
+ *
+ * Usage:
+ *   const s = new SNCSession(rfcConfig, sncOpts);
+ *   await s.init();
+ *   const resp = await s.callADT('GET', '/sap/bc/adt/discovery', ...);
+ */
+export class SNCSession {
+    /**
+     * @param {Object} rfcConfig     - RFC connection config (host, sysnr, client, ...)
+     * @param {Object} sncOpts       - SNC options (sncPartnerName, sncMyName, etc.)
+     * @param {Object} [SAPRFCClient] - The SAPRFCClient class (imported)
+     */
+    constructor(rfcConfig, sncOpts, SAPRFCClient) {
+        this.rfcConfig = { ...rfcConfig, password: rfcConfig.password || '' };
+
+        // Merge SNC params into rfcConfig
+        const sncConfig = buildSNCConfig(sncOpts);
+        Object.assign(this.rfcConfig, sncConfig);
+
+        this.SAPRFCClient = SAPRFCClient;
+        this.rfc = null;
+        this.csrfToken = null;
+    }
+
+    /** Initialize RFC connection with SNC. */
+    async init() {
+        const { hasTickets, output } = checkKerberosTickets();
+
+        if (!hasTickets) {
+            console.log('[SNC] No Kerberos tickets found — SSPI will attempt Cloud Trust');
+            console.log('[SNC] If prompted, approve on Microsoft Authenticator');
+        } else {
+            console.log('[SNC] Kerberos tickets found in cache');
+        }
+
+        this.rfc = new this.SAPRFCClient(this.rfcConfig);
+        await this.rfc.connect();
+        console.log('[SNC] RFC connection established with SNC Kerberos');
+
+        // Fetch CSRF token
+        try {
+            await this.rfc.fetchCsrfToken();
+            if (this.rfc.csrfToken) {
+                this.csrfToken = this.rfc.csrfToken;
+                console.log('[SNC] CSRF token obtained');
+            }
+        } catch (err) {
+            console.warn(`[SNC] Could not fetch CSRF token: ${err.message}`);
+        }
+
+        return this.rfc;
+    }
+
+    /** Call ADT endpoint via RFC tunnel. */
+    async callADT(method, uri, headers, body) {
+        return this.rfc.callADT(method, uri, headers, body);
+    }
+
+    /** Call any RFC function module. */
+    async callFM(fm, importing, tables, tableFields) {
+        return this.rfc.callFM(fm, importing, tables, tableFields);
+    }
+
+    /** Close the connection. */
+    disconnect() {
+        if (this.rfc) {
+            this.rfc.disconnect();
+            this.rfc = null;
+        }
+    }
+
+    get isConnected() {
+        return this.rfc && this.rfc.conn;
+    }
+}

package/spnego-auth.mjs

@@ -0,0 +1,362 @@
+/**
+ * SPNego / Kerberos Authentication Module
+ *
+ * Supports two modes:
+ *   HTTP Negotiate  – WWW-Authenticate: Negotiate  (RFC 4559)
+ *   RFC SNC         – Secure Network Communication (X.509 via sapnwrfc)
+ *
+ * Uses the npm `kerberos` package (GSSAPI on Linux/macOS, SSPI on Windows).
+ */
+
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+
+const kerberos = require('kerberos');
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SPNEGO HTTP Negotiate Auth
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Obtain a SPNEGO Negotiate token for a given service principal.
+ *
+ * @param {string} servicePrincipal  e.g. "HTTP@sapserver.example.com"
+ * @param {{ mechOID?: number, user?: string, password?: string }} [opts]
+ * @returns {Promise<string>}  Base64-encoded SPNEGO token (without "Negotiate " prefix)
+ */
+export async function getSPNegoToken(servicePrincipal, opts = {}) {
+    const mechOID = opts.mechOID ?? kerberos.GSS_MECH_OID_SPNEGO;
+
+    const client = await kerberos.initializeClient(servicePrincipal, { mechOID });
+
+    // Step with empty string to obtain initial token
+    const token = await client.step('');
+
+    return token;
+}
+
+/**
+ * Build a complete Authorization header value for HTTP SPNEGO.
+ *
+ * @param {string} servicePrincipal  e.g. "HTTP@sapserver.example.com"
+ * @returns {Promise<string>}  "Negotiate <base64token>"
+ */
+export async function buildSPNegoHeader(servicePrincipal) {
+    const token = await getSPNegoToken(servicePrincipal);
+    return `Negotiate ${token}`;
+}
+
+/**
+ * Build a SPNEGO HTTP Authorization header and return the full headers object.
+ *
+ * @param {string} servicePrincipal  e.g. "HTTP@sapserver.example.com"
+ * @param {Object<string,string>} [extraHeaders]  Additional headers to merge
+ * @returns {Promise<Object<string,string>>}
+ */
+export async function buildSPNegoHeaders(servicePrincipal, extraHeaders = {}) {
+    const auth = await buildSPNegoHeader(servicePrincipal);
+    return { Authorization: auth, ...extraHeaders };
+}
+
+/**
+ * Determine the service principal from SAP host and optional realm.
+ *
+ * @param {string} sapHost   e.g. "sapserver.example.com"
+ * @param {string} [realm]   Kerberos realm (e.g. "EXAMPLE.COM"). If omitted, derived from host.
+ * @returns {Promise<string>}  e.g. "HTTP@sapserver.example.com"
+ */
+export async function resolveServicePrincipal(sapHost, realm) {
+    // Use fully-qualified hostname; realm is auto-resolved by GSSAPI/SSPI.
+    return `HTTP@${sapHost}`;
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SPNEGO-aware HTTP client (axios-compatible wrapper)
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Make an HTTP request with SPNEGO authentication.
+ *
+ * Handles the 401 → Negotiate flow automatically:
+ *  1. Send request without auth
+ *  2. If 401 + WWW-Authenticate: Negotiate → obtain SPNEGO token → retry
+ *
+ * @param {object} axios     - Axios instance
+ * @param {object} config    - Axios request config (url, method, headers, data, ...)
+ * @param {string} sapHost   - SAP server hostname (for service principal)
+ * @returns {Promise<object>} - Axios response
+ */
+export async function spnegoRequest(axios, config, sapHost) {
+    const spn = `HTTP@${sapHost}`;
+
+    // First attempt: no auth
+    let response;
+    try {
+        response = await axios(config);
+        return response;
+    } catch (err) {
+        if (err.response && err.response.status === 401) {
+            const authHeaders = err.response.headers['www-authenticate'] || '';
+            const negotiate = Array.isArray(authHeaders) ? authHeaders.join(',') : authHeaders;
+
+            if (negotiate.toLowerCase().includes('negotiate')) {
+                // Obtain SPNEGO token and retry
+                const token = await getSPNegoToken(spn);
+                const config2 = {
+                    ...config,
+                    headers: {
+                        ...(config.headers || {}),
+                        Authorization: `Negotiate ${token}`,
+                    },
+                };
+                response = await axios(config2);
+                return response;
+            }
+        }
+        throw err;
+    }
+}
+
+/**
+ * SpnegoSession — manages HTTP session with SPNEGO-authenticated cookies.
+ *
+ * Usage:
+ *   const s = new SpnegoSession(axios, sapHost);
+ *   await s.init();              // authenticate → get session cookies
+ *   const r = await s.get('/sap/bc/adt/discovery');
+ *   
+ */
+export class SpnegoSession {
+    /**
+     * @param {object}  axios    - Axios instance (or `import axios from 'axios'`)
+     * @param {string}  sapHost  - SAP server hostname
+     * @param {{ baseUrl?: string, client?: string, language?: string, mechOID?: number }} [opts]
+     */
+    constructor(axios, sapHost, opts = {}) {
+        this.axios = axios;
+        this.sapHost = sapHost;
+        this.baseUrl = opts.baseUrl || `https://${sapHost}:44301`;
+        this.client = opts.client || '100';
+        this.language = opts.language || 'EN';
+        this.mechOID = opts.mechOID ?? kerberos.GSS_MECH_OID_SPNEGO;
+
+        this.cookies = null;       // Cookie jar after successful auth
+        this.csrfToken = null;     // CSRF token for mutations
+        this.authenticated = false;
+    }
+
+    /** Perform initial SPNEGO handshake and store session cookies. */
+    async init() {
+        // Step 1: hit a SAP endpoint that triggers 401 + Negotiate
+        const endpoint = '/sap/bc/adt/discovery';
+        const spn = `HTTP@${this.sapHost}`;
+
+        let response;
+        try {
+            response = await this.axios({
+                method: 'GET',
+                url: `${this.baseUrl}${endpoint}`,
+                headers: {
+                    'Accept': 'application/atomsvc+xml',
+                    'sap-client': this.client,
+                    'sap-language': this.language,
+                },
+                validateStatus: () => true,  // don't throw on 401
+                maxRedirects: 0,
+            });
+        } catch (err) {
+            response = err.response || { status: 500, headers: {} };
+        }
+
+        // Check if we got 401 with Negotiate
+        const wwwAuth = response.headers['www-authenticate'] || '';
+        const isNegotiate = (Array.isArray(wwwAuth) ? wwwAuth.join(',') : wwwAuth)
+            .toLowerCase().includes('negotiate');
+
+        if (isNegotiate || response.status === 401) {
+            // Get SPNEGO token
+            const token = await getSPNegoToken(spn, { mechOID: this.mechOID });
+
+            response = await this.axios({
+                method: 'GET',
+                url: `${this.baseUrl}${endpoint}`,
+                headers: {
+                    'Accept': 'application/atomsvc+xml',
+                    'sap-client': this.client,
+                    'sap-language': this.language,
+                    'Authorization': `Negotiate ${token}`,
+                },
+                validateStatus: () => true,
+                maxRedirects: 0,
+            });
+        }
+
+        if (response.status >= 200 && response.status < 300) {
+            // Store cookies from Set-Cookie
+            const setCookies = response.headers['set-cookie'] || [];
+            const cookieList = Array.isArray(setCookies) ? setCookies : [setCookies];
+            this.cookies = cookieList
+                .map(c => c.split(';')[0])
+                .join('; ');
+
+            // Try to get CSRF token
+            const csrf = response.headers['x-csrf-token'];
+            if (csrf) {
+                this.csrfToken = csrf;
+            } else {
+                // Fetch explicitly
+                try {
+                    const csrfResp = await this.axios({
+                        method: 'GET',
+                        url: `${this.baseUrl}${endpoint}`,
+                        headers: this._headers({ 'X-CSRF-Token': 'Fetch' }),
+                        validateStatus: () => true,
+                    });
+                    if (csrfResp.headers['x-csrf-token']) {
+                        this.csrfToken = csrfResp.headers['x-csrf-token'];
+                    }
+                } catch { /* ignore */ }
+            }
+
+            this.authenticated = true;
+            return response;
+        }
+
+        throw new Error(`SPNEGO authentication failed: HTTP ${response.status}`);
+    }
+
+    /**
+     * Build headers for subsequent requests.
+     * @param {Object} [extra]
+     * @returns {Object}
+     */
+    _headers(extra = {}) {
+        const h = {
+            'sap-client': this.client,
+            'sap-language': this.language,
+            ...extra,
+        };
+        if (this.cookies) {
+            h['Cookie'] = this.cookies;
+        }
+        if (this.csrfToken && !extra['X-CSRF-Token']) {
+            // don't auto-inject CSRF for GET
+        }
+        return h;
+    }
+
+    /** Refresh CSRF token. */
+    async refreshCsrf() {
+        const resp = await this.axios({
+            method: 'GET',
+            url: `${this.baseUrl}/sap/bc/adt/discovery`,
+            headers: this._headers({ 'X-CSRF-Token': 'Fetch', 'Accept': 'application/atomsvc+xml' }),
+        });
+        if (resp.headers['x-csrf-token']) {
+            this.csrfToken = resp.headers['x-csrf-token'];
+        }
+        return this.csrfToken;
+    }
+
+    /** GET request. */
+    async get(path, headers = {}) {
+        return this.axios({
+            method: 'GET',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers(headers),
+        });
+    }
+
+    /** POST request (auto-injects CSRF token). */
+    async post(path, data, headers = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'POST',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+        });
+    }
+
+    /** PUT request (auto-injects CSRF token). */
+    async put(path, data, headers = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'PUT',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+        });
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  RFC SNC Support (X.509-based SNC via sapnwrfc.dll + koffi)
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Build SNC connection parameters for RfcOpenConnection.
+ *
+ * SNC-enabled RFC connection requires:
+ *   SNC_MODE   = 1
+ *   SNC_MYNAME = p:CN=<common_name>, O=<org>, C=<country>
+ *   SNC_PARTNERNAME = p:CN=<sap_snc_name>, O=<org>, C=<country>
+ *   SNC_QOP    = 3  (quality of protection: 1=auth, 2=integrity, 3=privacy)
+ *   SNC_LIB    = path to cryptolib DLL  (e.g. sapcrypto.dll)
+ *
+ * @param {Object} config
+ * @param {string} config.sncMode       - "1" for SNC enabled
+ * @param {string} config.sncMyName     - SNC name of the caller (e.g. "p:CN=myuser, O=MYORG")  
+ * @param {string} config.sncPartnerName - SNC name of the SAP server
+ * @param {string} [config.sncQop]       - Quality of protection (default "3")
+ * @param {string} [config.sncLib]       - Path to CommonCryptoLib (sapcrypto.dll / libsapcrypto.so)
+ * @returns {Array<{name: Buffer, value: Buffer}>}
+ */
+export function buildSNCParams(config) {
+    // Import sapStr from sap-rfc-client.js is not possible (ESM boundary),
+    // so we inline the helper.
+    const sapStr = (s) => {
+        const buf = Buffer.alloc((s.length + 1) * 2, 0);
+        buf.write(s, 0, 'utf16le');
+        return buf;
+    };
+
+    const pairs = [];
+
+    if (config.sncMode)   { pairs.push(['SNC_MODE',   config.sncMode]); }
+    if (config.sncMyName) { pairs.push(['SNC_MYNAME', config.sncMyName]); }
+    if (config.sncQop)    { pairs.push(['SNC_QOP',    config.sncQop]); }
+    if (config.sncLib)    { pairs.push(['SNC_LIB',    config.sncLib]); }
+    if (config.sncPartnerName) {
+        pairs.push(['SNC_PARTNERNAME', config.sncPartnerName]);
+    }
+
+    return pairs.map(([n, v]) => ({ name: sapStr(n), value: sapStr(v) }));
+}
+
+/**
+ * Build SNC name string in SAP format from certificate DN components.
+ *
+ * Format: p:CN=<cn>, O=<org>, C=<country>
+ * 
+ * This matches what SAP expects in STRUST/SU01 SNC tab.
+ *
+ * @param {{ cn?: string, o?: string, c?: string, ou?: string }} dn
+ * @returns {string}
+ */
+export function buildSNCName(dn = {}) {
+    const parts = [];
+    if (dn.cn)  parts.push(`CN=${dn.cn}`);
+    if (dn.ou)  parts.push(`OU=${dn.ou}`);
+    if (dn.o)   parts.push(`O=${dn.o}`);
+    if (dn.c)   parts.push(`C=${dn.c}`);
+    return `p:${parts.join(', ')}`;
+}