scimgateway 5.0.10 → 5.0.11

package/README.md

@@ -1111,6 +1111,13 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v5.0.11
+
+[Fixed]
+
+- OAuth token response on error missing error_description in v5
+- HelperRest doRequest() now also includes retry logic on invalid token that has not expired - will renew token 
+
 ### v5.0.10
 
 [Improved]

package/lib/helper-rest.ts

@@ -166,13 +166,11 @@ export class HelperRest {
       const response = await this.doRequest(baseEntity, method, tokenUrl, form, ctx, connOpt)
       if (!response.body) {
         const err = new Error(`[${action}] No data retrieved from: ${method} ${tokenUrl}`)
-        this.lock.release()
         throw (err)
       }
       const jbody = response.body
       if (jbody.error) {
         const err = new Error(`[${action}] Error message: ${jbody.error_description}`)
-        this.lock.release()
         throw (err)
       }
       if (this.config_entity[baseEntity]?.connection?.auth?.type === 'token') { // in case response using token instead of access_token
@@ -180,7 +178,6 @@ export class HelperRest {
         else if (jbody.accessToken) jbody.access_token = jbody.accessToken
       }
       if (!jbody.access_token) {
-        this.lock.release()
         const err = new Error(`[${action}] Error message: Retrieved invalid token response`)
         throw (err)
       }
@@ -229,7 +226,7 @@ export class HelperRest {
               this._serviceClient[baseEntity][clientIdentifier].accessToken = accessToken
               this._serviceClient[baseEntity][clientIdentifier].options.headers['Authorization'] = ` Bearer ${accessToken.access_token}`
             } catch (err) {
-              delete this._serviceClient[baseEntity][clientIdentifier]
+              if (this._serviceClient[baseEntity]) delete this._serviceClient[baseEntity][clientIdentifier]
               const newErr = err
               throw newErr
             }
@@ -517,9 +514,6 @@ export class HelperRest {
     } catch (err: any) { // includes failover/retry logic based on config baseUrls array
       let statusCode
       try { statusCode = JSON.parse(err.message).statusCode } catch (e) { void 0 }
-      if (statusCode === 404) { // not logged as error, let caller decide e.g. getUser-manager
-        this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
-      } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
       const clientIdentifier = this.getClientIdentifier(ctx)
       if (err.message.includes('ratelimit')) { // have seen throttling not follow standard 429/retry-after, but instead using 500 and error message only
         if (!retryAfter) retryAfter = 60
@@ -527,13 +521,17 @@ export class HelperRest {
       if (!retryCount) retryCount = 0
       let urlObj
       try { urlObj = new URL(path) } catch (err) { void 0 }
-      if (!urlObj && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ABORT_ERR' || err.code === 'ETIMEDOUT' || retryAfter)) {
+      let isServiceClient = !urlObj && this._serviceClient[baseEntity] && this._serviceClient[baseEntity][clientIdentifier] && !this.lock.isLocked() // !isLocked to avoid retry ongoing doRequest with failing getAccessToken()
+      let oAuthTokeErr = statusCode === 401 && this.config_entity[baseEntity].connection?.auth?.type && this.config_entity[baseEntity].connection.auth.type.startsWith('oauth')
+      if (isServiceClient && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ABORT_ERR' || err.code === 'ETIMEDOUT' || oAuthTokeErr || retryAfter)) {
+        this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
         if (retryAfter) {
           this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} throttle/ratelimit error - awaiting ${retryAfter} seconds before automatic retry`)
           await new Promise(resolve => setTimeout(function () {
             resolve(null)
           }, retryAfter * 1000))
         }
+        if (oAuthTokeErr && this._serviceClient[baseEntity]) delete this._serviceClient[baseEntity][clientIdentifier] // ensure new getAccessToken request - token used should not have been expired, but rejected for other reason e.g. token server restart and no persistent token store?
         if (retryCount < this.config_entity[baseEntity].connection.baseUrls.length) {
           retryCount++
           this.updateServiceClient(baseEntity, clientIdentifier, { baseUrl: this.config_entity[baseEntity].connection.baseUrls[retryCount - 1] })
@@ -541,13 +539,19 @@ export class HelperRest {
           const ret = await this.doRequestHandler(baseEntity, method, path, body, ctx, opt, retryCount) // retry
           return ret // problem fixed
         } else {
+          if (statusCode === 404) { // not logged as error e.g. getUser-manager
+            this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+          } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} 11Error Response = ${err.message}`)
           throw err
         }
       } else {
+        if (statusCode === 404) { // not logged as error e.g. getUser-manager
+          this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+        } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
         if (statusCode === 401 && this._serviceClient[baseEntity]) {
           delete this._serviceClient[baseEntity][clientIdentifier]
         }
-        throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
+        throw err // Symantec IM retries getUser 6 times on ECONNREFUSED
       }
     }
   }

package/lib/scimgateway.ts

@@ -698,7 +698,6 @@ export class ScimGateway {
           }
           if (tokenObj.baseEntities) {
             if (Array.isArray(tokenObj.baseEntities) && tokenObj.baseEntities.length > 0) {
-              if (!baseEntity) return reject(new Error(`baseEntity=${baseEntity} not allowed for this bearerOAuth according to bearerOAuth configuration baseEntitites=${tokenObj.baseEntities}`))
               if (!tokenObj.baseEntities.includes(baseEntity)) return reject(new Error(`baseEntity=${baseEntity} not allowed for this bearerOAuth according to bearerOAuth configuration baseEntitites=${tokenObj.baseEntities}`))
             }
           }
@@ -706,7 +705,11 @@ export class ScimGateway {
           return resolve(true)
         } else {
           for (let i = 0; i < arr.length; i++) { // resolve if token memory store have been cleared because of a gateway restart
-            if (utils.getEncrypted(authToken, arr[i].client_secret) === arr[i].client_secret && !arr[i].isTokenRequested) {
+            if (arr[i].isTokenRequested || !arr[i].clientSecret) continue
+            if (arr[i].baseEntities && Array.isArray(arr[i].baseEntities) && arr[i].baseEntities.length > 0) {
+              if (!arr[i].baseEntities.includes(baseEntity)) continue
+            }
+            if (utils.getEncrypted(authToken, arr[i].clientSecret) === arr[i].clientSecret) {
               arr[i].isTokenRequested = true // flagged as true to not allow repeated resolvements because token will also be cleared when expired
               const baseEntities = utils.copyObj(arr[i].baseEntities)
               let expires
@@ -774,8 +777,21 @@ export class ScimGateway {
         if (ctx.request.url !== '/favicon.ico') logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${err.message}`)
         return false
       } catch (err: any) {
-        if (authType === 'Bearer') ctx.response.headers.set('WWW-Authenticate', 'Bearer realm=""')
-        else ctx.response.headers.set('WWW-Authenticate', 'Basic realm=""')
+        if (authType === 'Bearer') {
+          let str = 'realm=""'
+          if (err?.name === 'invalid_token') {
+            str += `, error="${err.name}"`
+            if (err.message) {
+              str += `, error_description="${err.message}"`
+              const errMsg = {
+                error: err.name,
+                error_description: err.message,
+              }
+              ctx.response.body = JSON.stringify(errMsg)
+            }
+          }
+          ctx.response.headers.set('WWW-Authenticate', `Bearer ${str}`)
+        } else ctx.response.headers.set('WWW-Authenticate', 'Basic realm=""')
         if (pwErrCount < 3) {
           pwErrCount += 1
           logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${ctx.request.url} ${err.message}`)

package/lib/utils.ts

@@ -14,18 +14,20 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { EventEmitter } from 'node:events'
 
-// mutual exclusion ref: https://thecodebarbarian.com/mutual-exclusion-patterns-with-node-promises
+/** Lock implements mutual exclusion
+ *  reference: https://thecodebarbarian.com/mutual-exclusion-patterns-with-node-promises
+ */
 export class Lock {
-  private _locked: boolean
+  private _locked = false
   private _ee: any
   constructor() {
     this._locked = false
     this._ee = new EventEmitter()
   }
 
+  /** If nobody has the lock, take it and resolve immediately else wait until released */
   acquire() {
     return new Promise((resolve) => {
-      // If nobody has the lock, take it and resolve immediately
       if (!this._locked) {
         // Safe because JS doesn't interrupt you on synchronous operations,
         // so no need for compare-and-swap or anything like that.
@@ -45,11 +47,16 @@ export class Lock {
     })
   }
 
+  /** Release the lock immediately */
   release() {
-    // Release the lock immediately
     this._locked = false
     setImmediate(() => this._ee.emit('release'))
   }
+
+  /** Return status of lock true/false */
+  isLocked(): boolean {
+    return this._locked
+  }
 }
 
 export const getSecret = function (dotNotationAttr: string, configFile: string) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "5.0.10",
+  "version": "5.0.11",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",