scimgateway 5.5.0 → 5.5.1

package/README.md

@@ -746,7 +746,7 @@ Example Entra ID (plugin-entra-id) using federated credentials:
 	  }
 	}
 	// Note: Federated credentials defined for the application in Entra ID must match the corresponding `issuer`, `subject`, and `name`
-	// example issuer: "https://scimgateway.my-company.com/oauth" and must be reachable from the internet
+	// example issuer: "https://scimgateway.my-company.com/oauth" and base URL must be reachable from the internet
 	// exampole name: "plugin-entra-id"
 
 
@@ -1491,6 +1491,12 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log
 
+### v5.5.1
+
+[Fixed]
+
+- 401 Unauthorized response did include scim-formatted error message when using `helper-rest` and authentication `PassThrough`. 401 should not include scim-formatted error message
+
 ### v5.5.0
 
 [Improved]
@@ -1518,7 +1524,7 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 		  "options": {
 		    "tenantIdGUID": "11111111-2222-3333-4444-555555555555",
 		    "fedCred": {
-		      "issuer": "https://scimgateway.my-company.com/oauth>",
+		      "issuer": "https://scimgateway.my-company.com/oauth",
 		      "subject": "99999999-8888-7777-6666-555555555555",
 		      "name": "plugin-entra-id"
 		    }
@@ -1529,7 +1535,6 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 	Also note: SCIM Gateway must be reachable from the internet (as defined by the `issuer` URL). This requires allowing inbound internet communication — or alternatively, Azure Relay can be used for outbound-only communication.
 
-
 ### v5.4.4
 
 [Improved]

package/lib/scimgateway.ts

@@ -586,7 +586,7 @@ export class ScimGateway {
       }
 
       if (ctx.response.status && (ctx.response.status < 200 || ctx.response.status > 299)) {
-        if (ctx.response.status === 401 && !ctx.request.headers.get('authorization')) {
+        if (ctx.response.status === 401 && !ctx.request.headers.has('authorization')) {
           logger.warn(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${ellapsed} ${ctx.ip} ${userName} ${ctx.response.status} ${ctx.request.method} ${ctx.request.url} Inbound=${JSON.stringify(ctx.request.body)} Outbound=${outbound}`, { baseEntity: ctx?.routeObj?.baseEntity })
         } else if (ctx.response.status === 404) {
           logger.warn(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] ${ellapsed} ${ctx.ip} ${userName} ${ctx.response.status} ${ctx.request.method} ${ctx.request.url} Inbound=${JSON.stringify(ctx.request.body)} Outbound=${outbound}`, { baseEntity: ctx?.routeObj?.baseEntity })
@@ -597,11 +597,10 @@ export class ScimGateway {
     }
 
     // start auth methods - used by auth
-    const basic = async (baseEntity: string, method: string, authType: string, authToken: string, path: string): Promise<boolean> => {
+    const basic = async (baseEntity: string, method: string, authType: string, authToken: string): Promise<boolean> => {
       return await new Promise((resolve, reject) => { // basic auth
         if (!found.Basic) return resolve(false)
         if (authType !== 'Basic' || !authToken) return resolve(false)
-        if (found.PassThrough && this.authPassThroughAllowed && !path.endsWith('/logger')) return resolve(false) // Auth PassThrough browser logon dialog support
         const [userName, userPassword] = (Buffer.from(authToken, 'base64').toString() || '').split(':')
         if (!userName || !userPassword) return resolve(false)
         const arr = this.config.scimgateway.auth.basic
@@ -819,7 +818,7 @@ export class ScimGateway {
       const obj = this.config.scimgateway.auth.passThrough
       if (obj.baseEntities) {
         if (Array.isArray(obj.baseEntities) && obj.baseEntities.length > 0) {
-          if (!baseEntity || !obj.baseEntities.includes(baseEntity)) throw new Error(`baseEntity=${baseEntity} not allowed for passThrough according to passThrough configuration baseEntitites=${obj.baseEntities}`)
+          if (!obj.baseEntities.includes(baseEntity)) throw new Error(`baseEntity=${baseEntity} not allowed for passThrough according to passThrough configuration baseEntitites=${obj.baseEntities}`)
         }
       }
       if (obj.readOnly === true && method !== 'GET') throw new Error('only allowing readOnly for passThrough according to passThrough configuration readOnly=true')
@@ -834,7 +833,7 @@ export class ScimGateway {
       try {
         // authenticate
         arrResolve = await Promise.all([
-          basic(ctx.routeObj.baseEntity, ctx.request.method, authType, authToken, ctx.path),
+          basic(ctx.routeObj.baseEntity, ctx.request.method, authType, authToken),
           bearerToken(ctx.routeObj.baseEntity, ctx.request.method, authType, authToken),
           bearerJwtAzure(ctx.routeObj.baseEntity, ctx.request.method, authType, authToken),
           bearerJwt(ctx.routeObj.baseEntity, ctx.request.method, authType, authToken),
@@ -1100,11 +1099,12 @@ export class ScimGateway {
           if (pwErrCount < 3) {
             pwErrCount += 1
           } else { // delay brute force attempts
-            logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] ${ctx.origin + ctx.path} ${errDescr} => delaying response with 2 minutes to prevent brute force`)
+            const delay = (this.config.scimgateway.idleTimeout || 120) - 5
+            logger.error(`${gwName}[${pluginName}][${ctx?.routeObj?.baseEntity}] [oauth] ${ctx.origin + ctx.path} ${errDescr} => delaying response with ${delay} seconds to prevent brute force`)
             await new Promise((resolve) => {
               setTimeout(() => {
                 resolve(ctx)
-              }, 1000 * 60 * 2)
+              }, 1000 * delay)
             })
             ctx.response.status = 401
             return
@@ -2766,6 +2766,14 @@ export class ScimGateway {
           if (!ctx.response.body) {
             ctx.response.body = 'Unauthorized'
             ctx.response.headers.set('content-type', 'text/plain')
+          } else {
+            try {
+              const b = JSON.parse(ctx.response.body)
+              if (b.schemas) { // 401 - do not return scim formatted error message e.g., using PassThrough
+                ctx.response.body = 'Unauthorized'
+                ctx.response.headers.set('content-type', 'text/plain')
+              }
+            } catch (err) { void 0 }
           }
           break
         case 403:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "5.5.0",
+  "version": "5.5.1",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",