scimgateway 5.0.9 → 5.0.11

package/README.md

@@ -1111,6 +1111,19 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v5.0.11
+
+[Fixed]
+
+- OAuth token response on error missing error_description in v5
+- HelperRest doRequest() now also includes retry logic on invalid token that has not expired - will renew token 
+
+### v5.0.10
+
+[Improved]
+
+- OAuth token request now accept missing or invalid Content-Type header 
+
 ### v5.0.9
 
 [Improved]

package/lib/helper-rest.ts

@@ -166,13 +166,11 @@ export class HelperRest {
       const response = await this.doRequest(baseEntity, method, tokenUrl, form, ctx, connOpt)
       if (!response.body) {
         const err = new Error(`[${action}] No data retrieved from: ${method} ${tokenUrl}`)
-        this.lock.release()
         throw (err)
       }
       const jbody = response.body
       if (jbody.error) {
         const err = new Error(`[${action}] Error message: ${jbody.error_description}`)
-        this.lock.release()
         throw (err)
       }
       if (this.config_entity[baseEntity]?.connection?.auth?.type === 'token') { // in case response using token instead of access_token
@@ -180,7 +178,6 @@ export class HelperRest {
         else if (jbody.accessToken) jbody.access_token = jbody.accessToken
       }
       if (!jbody.access_token) {
-        this.lock.release()
         const err = new Error(`[${action}] Error message: Retrieved invalid token response`)
         throw (err)
       }
@@ -229,7 +226,7 @@ export class HelperRest {
               this._serviceClient[baseEntity][clientIdentifier].accessToken = accessToken
               this._serviceClient[baseEntity][clientIdentifier].options.headers['Authorization'] = ` Bearer ${accessToken.access_token}`
             } catch (err) {
-              delete this._serviceClient[baseEntity][clientIdentifier]
+              if (this._serviceClient[baseEntity]) delete this._serviceClient[baseEntity][clientIdentifier]
               const newErr = err
               throw newErr
             }
@@ -517,9 +514,6 @@ export class HelperRest {
     } catch (err: any) { // includes failover/retry logic based on config baseUrls array
       let statusCode
       try { statusCode = JSON.parse(err.message).statusCode } catch (e) { void 0 }
-      if (statusCode === 404) { // not logged as error, let caller decide e.g. getUser-manager
-        this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
-      } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
       const clientIdentifier = this.getClientIdentifier(ctx)
       if (err.message.includes('ratelimit')) { // have seen throttling not follow standard 429/retry-after, but instead using 500 and error message only
         if (!retryAfter) retryAfter = 60
@@ -527,13 +521,17 @@ export class HelperRest {
       if (!retryCount) retryCount = 0
       let urlObj
       try { urlObj = new URL(path) } catch (err) { void 0 }
-      if (!urlObj && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ABORT_ERR' || err.code === 'ETIMEDOUT' || retryAfter)) {
+      let isServiceClient = !urlObj && this._serviceClient[baseEntity] && this._serviceClient[baseEntity][clientIdentifier] && !this.lock.isLocked() // !isLocked to avoid retry ongoing doRequest with failing getAccessToken()
+      let oAuthTokeErr = statusCode === 401 && this.config_entity[baseEntity].connection?.auth?.type && this.config_entity[baseEntity].connection.auth.type.startsWith('oauth')
+      if (isServiceClient && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ABORT_ERR' || err.code === 'ETIMEDOUT' || oAuthTokeErr || retryAfter)) {
+        this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
         if (retryAfter) {
           this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} throttle/ratelimit error - awaiting ${retryAfter} seconds before automatic retry`)
           await new Promise(resolve => setTimeout(function () {
             resolve(null)
           }, retryAfter * 1000))
         }
+        if (oAuthTokeErr && this._serviceClient[baseEntity]) delete this._serviceClient[baseEntity][clientIdentifier] // ensure new getAccessToken request - token used should not have been expired, but rejected for other reason e.g. token server restart and no persistent token store?
         if (retryCount < this.config_entity[baseEntity].connection.baseUrls.length) {
           retryCount++
           this.updateServiceClient(baseEntity, clientIdentifier, { baseUrl: this.config_entity[baseEntity].connection.baseUrls[retryCount - 1] })
@@ -541,13 +539,19 @@ export class HelperRest {
           const ret = await this.doRequestHandler(baseEntity, method, path, body, ctx, opt, retryCount) // retry
           return ret // problem fixed
         } else {
+          if (statusCode === 404) { // not logged as error e.g. getUser-manager
+            this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+          } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} 11Error Response = ${err.message}`)
           throw err
         }
       } else {
+        if (statusCode === 404) { // not logged as error e.g. getUser-manager
+          this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+        } else this.scimgateway.logError(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
         if (statusCode === 401 && this._serviceClient[baseEntity]) {
           delete this._serviceClient[baseEntity][clientIdentifier]
         }
-        throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
+        throw err // Symantec IM retries getUser 6 times on ECONNREFUSED
       }
     }
   }

package/lib/scimgateway.ts

@@ -698,7 +698,6 @@ export class ScimGateway {
           }
           if (tokenObj.baseEntities) {
             if (Array.isArray(tokenObj.baseEntities) && tokenObj.baseEntities.length > 0) {
-              if (!baseEntity) return reject(new Error(`baseEntity=${baseEntity} not allowed for this bearerOAuth according to bearerOAuth configuration baseEntitites=${tokenObj.baseEntities}`))
               if (!tokenObj.baseEntities.includes(baseEntity)) return reject(new Error(`baseEntity=${baseEntity} not allowed for this bearerOAuth according to bearerOAuth configuration baseEntitites=${tokenObj.baseEntities}`))
             }
           }
@@ -706,7 +705,11 @@ export class ScimGateway {
           return resolve(true)
         } else {
           for (let i = 0; i < arr.length; i++) { // resolve if token memory store have been cleared because of a gateway restart
-            if (utils.getEncrypted(authToken, arr[i].client_secret) === arr[i].client_secret && !arr[i].isTokenRequested) {
+            if (arr[i].isTokenRequested || !arr[i].clientSecret) continue
+            if (arr[i].baseEntities && Array.isArray(arr[i].baseEntities) && arr[i].baseEntities.length > 0) {
+              if (!arr[i].baseEntities.includes(baseEntity)) continue
+            }
+            if (utils.getEncrypted(authToken, arr[i].clientSecret) === arr[i].clientSecret) {
               arr[i].isTokenRequested = true // flagged as true to not allow repeated resolvements because token will also be cleared when expired
               const baseEntities = utils.copyObj(arr[i].baseEntities)
               let expires
@@ -774,8 +777,21 @@ export class ScimGateway {
         if (ctx.request.url !== '/favicon.ico') logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${err.message}`)
         return false
       } catch (err: any) {
-        if (authType === 'Bearer') ctx.response.headers.set('WWW-Authenticate', 'Bearer realm=""')
-        else ctx.response.headers.set('WWW-Authenticate', 'Basic realm=""')
+        if (authType === 'Bearer') {
+          let str = 'realm=""'
+          if (err?.name === 'invalid_token') {
+            str += `, error="${err.name}"`
+            if (err.message) {
+              str += `, error_description="${err.message}"`
+              const errMsg = {
+                error: err.name,
+                error_description: err.message,
+              }
+              ctx.response.body = JSON.stringify(errMsg)
+            }
+          }
+          ctx.response.headers.set('WWW-Authenticate', `Bearer ${str}`)
+        } else ctx.response.headers.set('WWW-Authenticate', 'Basic realm=""')
         if (pwErrCount < 3) {
           pwErrCount += 1
           logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${ctx.request.url} ${err.message}`)
@@ -830,7 +846,20 @@ export class ScimGateway {
       let jsonBody = ctx.request.body
       try {
         if (!jsonBody) throw new Error('missing body')
-        if (typeof jsonBody !== 'object') throw new Error('body is not JSON')
+        if (typeof jsonBody !== 'object') { // might have application/x-www-form-urlencoded body, but incorrect Content-Type header
+          logger.debug(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] continue request validation even though incorrect body vs header Content-Type: ${ctx.request.headers.get('content-type')}`)
+          const arr = jsonBody.split('&')
+          const body: Record<string, any> = {}
+          arr.forEach((kv: string) => {
+            const a = kv.split('=')
+            if (a.length === 2) {
+              body[a[0]] = decodeURIComponent(a[1])
+            }
+          })
+          if (Object.keys(body).length < 1) throw new Error('body is not JSON nor application/x-www-form-urlencoded')
+          ctx.request.body = body // now json - ensure final info log will be masked
+          jsonBody = body
+        }
         jsonBody = utils.copyObj(jsonBody) // no changes to original
       } catch (err: any) {
         logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] token request error: ${err.message}`)
@@ -875,7 +904,7 @@ export class ScimGateway {
         }
         if (!token) {
           err = 'invalid_client'
-          errDescr = 'incorrect or missing clientId/clientSecret'
+          errDescr = 'incorrect or missing client_id/client_secret'
           if (pwErrCount < 3) {
             pwErrCount += 1
           } else { // delay brute force attempts
@@ -1008,7 +1037,6 @@ export class ScimGateway {
           }
         }
 
-        userObj = utilsScim.addPrimaryAttrs(userObj)
         scimdata = utils.stripObj(userObj, ctx.query.attributes, ctx.query.excludedAttributes)
         scimdata = utilsScim.addSchemas(scimdata, isScimv2, handle.description, undefined)
 
@@ -1259,7 +1287,6 @@ export class ScimGateway {
         if (this.config.scimgateway.scim.skipMetaLocation) location = undefined
         else if (ctx.query.attributes || (ctx.query.excludedAttributes && ctx.query.excludedAttributes.includes('meta'))) location = undefined
         for (let i = 0; i < scimdata.Resources.length; i++) {
-          scimdata.Resources[i] = utilsScim.addPrimaryAttrs(scimdata.Resources[i])
           scimdata.Resources[i] = utils.stripObj(scimdata.Resources[i], ctx.query.attributes, ctx.query.excludedAttributes)
         }
         scimdata = utilsScim.addResources(scimdata, ctx.query.startIndex, ctx.query.sortBy, ctx.query.sortOrder)
@@ -1440,7 +1467,6 @@ export class ScimGateway {
           ctx.response.headers.set('Location', location)
         }
         delete jsonBody.password
-        jsonBody = utilsScim.addPrimaryAttrs(jsonBody)
         jsonBody = utilsScim.addSchemas(jsonBody, isScimv2, handle.description, undefined)
         ctx.response.status = 201
         ctx.response.body = JSON.stringify(jsonBody)
@@ -1658,7 +1684,7 @@ export class ScimGateway {
           const location = ctx.origin + ctx.path
           ctx.response.headers.set('Location', location)
         }
-        const userObj = utilsScim.addPrimaryAttrs(scimdata.Resources[0])
+        const userObj = scimdata.Resources[0]
         scimdata = utils.stripObj(userObj, ctx.query.attributes, ctx.query.excludedAttributes)
         scimdata = utilsScim.addSchemas(scimdata, isScimv2, handle.description, undefined)
         ctx.response.status = 200
@@ -2283,13 +2309,13 @@ export class ScimGateway {
         body = JSON.parse(bodyString)
       } catch (err: any) {
         const contentType = request.headers.get('content-type')
-        if (contentType && contentType.toLowerCase() === 'application/x-www-form-urlencoded') {
+        if (contentType && contentType.toLowerCase().startsWith('application/x-www-form-urlencoded')) {
           const arr = bodyString.split('&') // "grant_type=client_credentials&client_id=id&client_secret=secret"
           body = {}
           arr.forEach((kv: string) => {
             const a = kv.split('=')
             if (a.length === 2) {
-              body[a[0]] = a[1]
+              body[a[0]] = decodeURIComponent(a[1])
             }
           })
         } else if (bodyString) body = bodyString

package/lib/utils-scim.ts

@@ -793,7 +793,19 @@ export function addSchemas(data: Record<string, any>, isScimv2: boolean, type?:
         } else if (key === 'password') delete data.Resources[i].password // exclude password, null and empty object/array
         else if (data.Resources[i][key] === null) delete data.Resources[i][key]
         else if (JSON.stringify(data.Resources[i][key]) === '{}') delete data.Resources[i][key]
-        else if (Array.isArray(data.Resources[i][key]) && data.Resources[i][key].length < 1) delete data.Resources[i][key]
+        else if (Array.isArray(data.Resources[i][key])) {
+          if (data.Resources[i][key].length < 1) delete data.Resources[i][key]
+          else if (key !== 'members' && key !== 'groups') { // any primary attribute should be boolean
+            for (let j = 0; j < data.Resources[i][key].length; j++) {
+              let el = data.Resources[i][key][j]
+              if (typeof el !== 'object') break
+              if (el.type && el.primary && typeof el.primary === 'string') {
+                if (el.primary.toLowerCase() === 'true') el.primary = true
+                else if (el.primary.toLowerCase() === 'false') el.primary = false
+              }
+            }
+          }
+        }
       }
       if (Object.keys(data.Resources[i]).length === 0) {
         data.Resources.splice(i, 1) // delete
@@ -827,37 +839,25 @@ export function addSchemas(data: Record<string, any>, isScimv2: boolean, type?:
       } else if (key === 'password') delete data.password // exclude password, null and empty object/array
       else if (data[key] === null) delete data[key]
       else if (JSON.stringify(data[key]) === '{}') delete data[key]
-      else if (Array.isArray(data[key]) && data[key].length < 1) delete data[key]
+      else if (Array.isArray(data[key])) {
+        if (data[key].length < 1) delete data[key]
+        else if (key !== 'members' && key !== 'groups') { // any primary attribute should be boolean
+          for (let j = 0; j < data[key].length; j++) {
+            let el = data[key][j]
+            if (typeof el !== 'object') break
+            if (el.type && el.primary && typeof el.primary === 'string') {
+              if (el.primary.toLowerCase() === 'true') el.primary = true
+              else if (el.primary.toLowerCase() === 'false') el.primary = false
+            }
+          }
+        }
+      }
     }
   }
 
   return data
 }
 
-// addPrimaryAttrs cheks for primary attributes (only for roles) and add them as standalone attributes
-// some IdP's may check for these e.g. Azure
-// e.g. {roles: [{value: "val1", primary: "True"}]}
-// gives:
-// { roles: [{value: "val1", primary: "True"}],
-//   roles[primary eq "True"].value: "val1",
-//   roles[primary eq "True"].primary: "True"}]
-// }
-export function addPrimaryAttrs(obj: Record<string, any>) {
-  const key = 'roles'
-  if (!obj || typeof obj !== 'object') return obj
-  if (!obj[key] || !Array.isArray(obj[key])) return obj
-  const o = utils.copyObj(obj)
-  const index = o[key].findIndex((el: Record<string, any>) => (el.primary === true || (typeof el.primary === 'string' && el.primary.toLowerCase() === 'true')))
-  if (index >= 0) {
-    const prim = o[key][index]
-    for (const k in prim) {
-      const primKey = `${key}[primary eq ${typeof prim.primary === 'string' ? `"${prim.primary}"` : prim.primary}].${k}` // roles[primary eq true].value / roles[primary eq "True"].value``
-      o[primKey] = prim[k] // { roles[primary eq true].value : "some-value" }
-    }
-  }
-  return o
-}
-
 //
 // SCIM error formatting
 //
@@ -900,7 +900,7 @@ export function jsonErr(scimVersion: string | number, pluginName: string, htmlEr
 
   if (scimVersion !== '2.0' && scimVersion !== 2) { // v1.1
     errJson
-    = {
+      = {
         Errors: [
           {
             description: msg,
@@ -910,7 +910,7 @@ export function jsonErr(scimVersion: string | number, pluginName: string, htmlEr
       }
   } else { // v2.0
     errJson
-    = {
+      = {
         schemas: ['urn:ietf:params:scim:api:messages:2.0:Error'],
         scimType,
         detail: msg,

package/lib/utils.ts

@@ -14,18 +14,20 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { EventEmitter } from 'node:events'
 
-// mutual exclusion ref: https://thecodebarbarian.com/mutual-exclusion-patterns-with-node-promises
+/** Lock implements mutual exclusion
+ *  reference: https://thecodebarbarian.com/mutual-exclusion-patterns-with-node-promises
+ */
 export class Lock {
-  private _locked: boolean
+  private _locked = false
   private _ee: any
   constructor() {
     this._locked = false
     this._ee = new EventEmitter()
   }
 
+  /** If nobody has the lock, take it and resolve immediately else wait until released */
   acquire() {
     return new Promise((resolve) => {
-      // If nobody has the lock, take it and resolve immediately
       if (!this._locked) {
         // Safe because JS doesn't interrupt you on synchronous operations,
         // so no need for compare-and-swap or anything like that.
@@ -45,11 +47,16 @@ export class Lock {
     })
   }
 
+  /** Release the lock immediately */
   release() {
-    // Release the lock immediately
     this._locked = false
     setImmediate(() => this._ee.emit('release'))
   }
+
+  /** Return status of lock true/false */
+  isLocked(): boolean {
+    return this._locked
+  }
 }
 
 export const getSecret = function (dotNotationAttr: string, configFile: string) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "5.0.9",
+  "version": "5.0.11",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",