scimgateway 5.0.9 → 5.0.10

package/README.md

@@ -1111,6 +1111,12 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v5.0.10
+
+[Improved]
+
+- OAuth token request now accept missing or invalid Content-Type header 
+
 ### v5.0.9
 
 [Improved]

package/lib/scimgateway.ts

@@ -830,7 +830,20 @@ export class ScimGateway {
       let jsonBody = ctx.request.body
       try {
         if (!jsonBody) throw new Error('missing body')
-        if (typeof jsonBody !== 'object') throw new Error('body is not JSON')
+        if (typeof jsonBody !== 'object') { // might have application/x-www-form-urlencoded body, but incorrect Content-Type header
+          logger.debug(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] continue request validation even though incorrect body vs header Content-Type: ${ctx.request.headers.get('content-type')}`)
+          const arr = jsonBody.split('&')
+          const body: Record<string, any> = {}
+          arr.forEach((kv: string) => {
+            const a = kv.split('=')
+            if (a.length === 2) {
+              body[a[0]] = decodeURIComponent(a[1])
+            }
+          })
+          if (Object.keys(body).length < 1) throw new Error('body is not JSON nor application/x-www-form-urlencoded')
+          ctx.request.body = body // now json - ensure final info log will be masked
+          jsonBody = body
+        }
         jsonBody = utils.copyObj(jsonBody) // no changes to original
       } catch (err: any) {
         logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] token request error: ${err.message}`)
@@ -875,7 +888,7 @@ export class ScimGateway {
         }
         if (!token) {
           err = 'invalid_client'
-          errDescr = 'incorrect or missing clientId/clientSecret'
+          errDescr = 'incorrect or missing client_id/client_secret'
           if (pwErrCount < 3) {
             pwErrCount += 1
           } else { // delay brute force attempts
@@ -1008,7 +1021,6 @@ export class ScimGateway {
           }
         }
 
-        userObj = utilsScim.addPrimaryAttrs(userObj)
         scimdata = utils.stripObj(userObj, ctx.query.attributes, ctx.query.excludedAttributes)
         scimdata = utilsScim.addSchemas(scimdata, isScimv2, handle.description, undefined)
 
@@ -1259,7 +1271,6 @@ export class ScimGateway {
         if (this.config.scimgateway.scim.skipMetaLocation) location = undefined
         else if (ctx.query.attributes || (ctx.query.excludedAttributes && ctx.query.excludedAttributes.includes('meta'))) location = undefined
         for (let i = 0; i < scimdata.Resources.length; i++) {
-          scimdata.Resources[i] = utilsScim.addPrimaryAttrs(scimdata.Resources[i])
           scimdata.Resources[i] = utils.stripObj(scimdata.Resources[i], ctx.query.attributes, ctx.query.excludedAttributes)
         }
         scimdata = utilsScim.addResources(scimdata, ctx.query.startIndex, ctx.query.sortBy, ctx.query.sortOrder)
@@ -1440,7 +1451,6 @@ export class ScimGateway {
           ctx.response.headers.set('Location', location)
         }
         delete jsonBody.password
-        jsonBody = utilsScim.addPrimaryAttrs(jsonBody)
         jsonBody = utilsScim.addSchemas(jsonBody, isScimv2, handle.description, undefined)
         ctx.response.status = 201
         ctx.response.body = JSON.stringify(jsonBody)
@@ -1658,7 +1668,7 @@ export class ScimGateway {
           const location = ctx.origin + ctx.path
           ctx.response.headers.set('Location', location)
         }
-        const userObj = utilsScim.addPrimaryAttrs(scimdata.Resources[0])
+        const userObj = scimdata.Resources[0]
         scimdata = utils.stripObj(userObj, ctx.query.attributes, ctx.query.excludedAttributes)
         scimdata = utilsScim.addSchemas(scimdata, isScimv2, handle.description, undefined)
         ctx.response.status = 200
@@ -2283,13 +2293,13 @@ export class ScimGateway {
         body = JSON.parse(bodyString)
       } catch (err: any) {
         const contentType = request.headers.get('content-type')
-        if (contentType && contentType.toLowerCase() === 'application/x-www-form-urlencoded') {
+        if (contentType && contentType.toLowerCase().startsWith('application/x-www-form-urlencoded')) {
           const arr = bodyString.split('&') // "grant_type=client_credentials&client_id=id&client_secret=secret"
           body = {}
           arr.forEach((kv: string) => {
             const a = kv.split('=')
             if (a.length === 2) {
-              body[a[0]] = a[1]
+              body[a[0]] = decodeURIComponent(a[1])
             }
           })
         } else if (bodyString) body = bodyString

package/lib/utils-scim.ts

@@ -793,7 +793,19 @@ export function addSchemas(data: Record<string, any>, isScimv2: boolean, type?:
         } else if (key === 'password') delete data.Resources[i].password // exclude password, null and empty object/array
         else if (data.Resources[i][key] === null) delete data.Resources[i][key]
         else if (JSON.stringify(data.Resources[i][key]) === '{}') delete data.Resources[i][key]
-        else if (Array.isArray(data.Resources[i][key]) && data.Resources[i][key].length < 1) delete data.Resources[i][key]
+        else if (Array.isArray(data.Resources[i][key])) {
+          if (data.Resources[i][key].length < 1) delete data.Resources[i][key]
+          else if (key !== 'members' && key !== 'groups') { // any primary attribute should be boolean
+            for (let j = 0; j < data.Resources[i][key].length; j++) {
+              let el = data.Resources[i][key][j]
+              if (typeof el !== 'object') break
+              if (el.type && el.primary && typeof el.primary === 'string') {
+                if (el.primary.toLowerCase() === 'true') el.primary = true
+                else if (el.primary.toLowerCase() === 'false') el.primary = false
+              }
+            }
+          }
+        }
       }
       if (Object.keys(data.Resources[i]).length === 0) {
         data.Resources.splice(i, 1) // delete
@@ -827,37 +839,25 @@ export function addSchemas(data: Record<string, any>, isScimv2: boolean, type?:
       } else if (key === 'password') delete data.password // exclude password, null and empty object/array
       else if (data[key] === null) delete data[key]
       else if (JSON.stringify(data[key]) === '{}') delete data[key]
-      else if (Array.isArray(data[key]) && data[key].length < 1) delete data[key]
+      else if (Array.isArray(data[key])) {
+        if (data[key].length < 1) delete data[key]
+        else if (key !== 'members' && key !== 'groups') { // any primary attribute should be boolean
+          for (let j = 0; j < data[key].length; j++) {
+            let el = data[key][j]
+            if (typeof el !== 'object') break
+            if (el.type && el.primary && typeof el.primary === 'string') {
+              if (el.primary.toLowerCase() === 'true') el.primary = true
+              else if (el.primary.toLowerCase() === 'false') el.primary = false
+            }
+          }
+        }
+      }
     }
   }
 
   return data
 }
 
-// addPrimaryAttrs cheks for primary attributes (only for roles) and add them as standalone attributes
-// some IdP's may check for these e.g. Azure
-// e.g. {roles: [{value: "val1", primary: "True"}]}
-// gives:
-// { roles: [{value: "val1", primary: "True"}],
-//   roles[primary eq "True"].value: "val1",
-//   roles[primary eq "True"].primary: "True"}]
-// }
-export function addPrimaryAttrs(obj: Record<string, any>) {
-  const key = 'roles'
-  if (!obj || typeof obj !== 'object') return obj
-  if (!obj[key] || !Array.isArray(obj[key])) return obj
-  const o = utils.copyObj(obj)
-  const index = o[key].findIndex((el: Record<string, any>) => (el.primary === true || (typeof el.primary === 'string' && el.primary.toLowerCase() === 'true')))
-  if (index >= 0) {
-    const prim = o[key][index]
-    for (const k in prim) {
-      const primKey = `${key}[primary eq ${typeof prim.primary === 'string' ? `"${prim.primary}"` : prim.primary}].${k}` // roles[primary eq true].value / roles[primary eq "True"].value``
-      o[primKey] = prim[k] // { roles[primary eq true].value : "some-value" }
-    }
-  }
-  return o
-}
-
 //
 // SCIM error formatting
 //
@@ -900,7 +900,7 @@ export function jsonErr(scimVersion: string | number, pluginName: string, htmlEr
 
   if (scimVersion !== '2.0' && scimVersion !== 2) { // v1.1
     errJson
-    = {
+      = {
         Errors: [
           {
             description: msg,
@@ -910,7 +910,7 @@ export function jsonErr(scimVersion: string | number, pluginName: string, htmlEr
       }
   } else { // v2.0
     errJson
-    = {
+      = {
         schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
         scimType,
         detail: msg,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "5.0.9",
+  "version": "5.0.10",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",