scimgateway 4.2.5 → 4.2.6

package/README.md

@@ -1165,6 +1165,12 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v4.2.6  
+
+[Fixed] 
+
+- cosmetics related to 401 error handling introduced in v4.2.4  
+
 ### v4.2.5  
 
 [Fixed] 

package/lib/plugin-api.js

@@ -434,15 +434,7 @@ const doRequest = async (baseEntity, method, path, body, ctx, opt, retryCount) =
         throw newerr
       }
     } else {
-      if (statusCode === 401) {
-        if (_serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
-        err.message = JSON.stringify( // don't reveal original message
-          {
-            statusCode: 401,
-            error: 'Access denied'
-          }
-        )
-      }
+      if (statusCode === 401 && _serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
       throw err // CA IM retries getUsers failure once (retry 6 times on ECONNREFUSED)
     }
   }

package/lib/plugin-azure-ad.js

@@ -1160,15 +1160,7 @@ const doRequest = async (baseEntity, method, path, body, ctx, opt, retryCount) =
         throw newerr
       }
     } else {
-      if (statusCode === 401) {
-        if (_serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
-        err.message = JSON.stringify( // don't reveal original message
-          {
-            statusCode: 401,
-            error: 'Access denied'
-          }
-        )
-      }
+      if (statusCode === 401 && _serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
       throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
     }
   }

package/lib/plugin-scim.js

@@ -773,15 +773,7 @@ const doRequest = async (baseEntity, method, path, body, ctx, opt, retryCount) =
         throw newerr
       }
     } else {
-      if (statusCode === 401) {
-        if (_serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
-        err.message = JSON.stringify( // don't reveal original message
-          {
-            statusCode: 401,
-            error: 'Access denied'
-          }
-        )
-      }
+      if (statusCode === 401 && _serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
       throw err // CA IM retries getUsers failure once (retry 6 times on ECONNREFUSED)
     }
   }

package/lib/scimgateway.js

@@ -318,11 +318,27 @@ const ScimGateway = function () {
     if (!userName && authType === 'Bearer') userName = 'token'
     if (ctx.request.url !== '/favicon.ico') {
       if (ctx.response.status < 200 || ctx.response.status > 299) {
+        let isEndpointAccessDenied = false
+        if (res.body.detail) {
+          if (res.body.detail.includes('\"statusCode\":401')) isEndpointAccessDenied= true // eslint-disable-line
+        } else if (res.body.Errors) {
+          if (Array.isArray(res.body.Errors) && res.body.Errors[0].description && res.body.Errors[0].description.includes('\"statusCode\":401')) { // eslint-disable-line
+            isEndpointAccessDenied = true
+          }
+        }
+        if (isEndpointAccessDenied) { // don't reveal original SCIM error message details related to access denied (e.g. using Auth PassThrough)
+          ctx.response.set('Content-Type', 'application/json; charset=utf-8')
+          ctx.response.status = 401 // ctx.response.message becomes default 'Unauthorized'
+          ctx.response.body = { error: 'Access denied' }
+          res.statusCode = ctx.response.status
+          res.statusMessage = ctx.response.message
+          res.body = ctx.response.body
+        }
         logger.error(`${gwName}[${pluginName}] ${ellapsed} ${ctx.request.ipcli} ${userName} ${ctx.request.method} ${ctx.request.href} Inbound = ${JSON.stringify(ctx.request.body)} Outbound = ${JSON.stringify(res)}${(config.log.loglevel.file === 'debug' && ctx.request.url !== '/ping') ? '\n' : ''}`)
       } else logger.info(`${gwName}[${pluginName}] ${ellapsed} ${ctx.request.ipcli} ${userName} ${ctx.request.method} ${ctx.request.href} Inbound = ${JSON.stringify(ctx.request.body)} Outbound = ${JSON.stringify(res)}${(config.log.loglevel.file === 'debug' && ctx.request.url !== '/ping') ? '\n' : ''}`)
       requestCounter += 1 // logged on exit (not win process termination)
     }
-    if (ctx.response.body && typeof ctx.response.body === 'object') ctx.set('Content-Type', 'application/scim+json; charset=utf-8')
+    if (ctx.response.body && typeof ctx.response.body === 'object' && ctx.response.status !== 401) ctx.set('Content-Type', 'application/scim+json; charset=utf-8')
   }
 
   // start auth methods - used by auth

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "4.2.5",
+  "version": "4.2.6",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",
   "homepage": "https://elshaug.xyz",