|
|
|
@ -3,6 +3,8 @@ use std::{sync::LazyLock, time::Duration}; |
|
|
|
use chrono::Utc; |
|
|
|
use derive_more::{AsRef, Deref, Display, From, Into}; |
|
|
|
use regex::Regex; |
|
|
|
use serde::de::DeserializeOwned; |
|
|
|
use serde_with::{serde_as, DefaultOnError}; |
|
|
|
use url::Url; |
|
|
|
|
|
|
|
use crate::{ |
|
|
|
@ -10,10 +12,10 @@ use crate::{ |
|
|
|
auth, |
|
|
|
auth::{AuthMethod, AuthTokens, TokenWrapper, BW_EXPIRATION, DEFAULT_REFRESH_VALIDITY}, |
|
|
|
db::{ |
|
|
|
models::{Device, OIDCAuthenticatedUser, OIDCCodeWrapper, SsoAuth, SsoUser, User}, |
|
|
|
models::{Device, EventType, OIDCAuthenticatedUser, OIDCCodeWrapper, SsoAuth, SsoUser, User}, |
|
|
|
DbConn, |
|
|
|
}, |
|
|
|
sso_client::Client, |
|
|
|
sso_client::{AllAdditionalClaims, Client}, |
|
|
|
CONFIG, |
|
|
|
}; |
|
|
|
|
|
|
|
@ -234,6 +236,66 @@ impl OIDCIdentifier { |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
#[derive(Debug)] |
|
|
|
struct AdditionalClaims { |
|
|
|
role: Option<UserRole>, |
|
|
|
} |
|
|
|
|
|
|
|
impl AdditionalClaims { |
|
|
|
pub fn is_admin(&self) -> bool { |
|
|
|
self.role.as_ref().is_some_and(|x| x == &UserRole::Admin) |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
#[derive(Clone, Debug, Ord, PartialOrd, Eq, PartialEq, Serialize, Deserialize)] |
|
|
|
#[serde(rename_all = "lowercase")] |
|
|
|
pub enum UserRole { |
|
|
|
Admin, |
|
|
|
User, |
|
|
|
} |
|
|
|
|
|
|
|
#[serde_as] |
|
|
|
#[derive(Deserialize)] |
|
|
|
struct UserRoles<T: DeserializeOwned>(#[serde_as(as = "Vec<DefaultOnError>")] Vec<Option<T>>); |
|
|
|
|
|
|
|
// Errors are logged but will return None
|
|
|
|
// Return the top most defined Role (https://doc.rust-lang.org/std/cmp/trait.PartialOrd.html#derivable)
|
|
|
|
fn role_claim<T: DeserializeOwned + Ord>(email: &str, token: &serde_json::Value, source: &str) -> Option<T> { |
|
|
|
use crate::serde::Deserialize; |
|
|
|
if let Some(json_roles) = token.pointer(&CONFIG.sso_roles_token_path()) { |
|
|
|
match UserRoles::<T>::deserialize(json_roles) { |
|
|
|
Ok(UserRoles(mut roles)) => { |
|
|
|
roles.sort(); |
|
|
|
roles.into_iter().find(|r| r.is_some()).flatten() |
|
|
|
} |
|
|
|
Err(err) => { |
|
|
|
debug!("Failed to parse {email} roles from {source}: {err}"); |
|
|
|
None |
|
|
|
} |
|
|
|
} |
|
|
|
} else { |
|
|
|
debug!("No roles in {email} {source} at {}", &CONFIG.sso_roles_token_path()); |
|
|
|
None |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
// All claims are read as Value.
|
|
|
|
fn additional_claims(email: &str, sources: Vec<(&AllAdditionalClaims, &str)>) -> ApiResult<AdditionalClaims> { |
|
|
|
let mut role: Option<UserRole> = None; |
|
|
|
|
|
|
|
if CONFIG.sso_roles_enabled() { |
|
|
|
for (ac, source) in sources { |
|
|
|
if CONFIG.sso_roles_enabled() { |
|
|
|
role = role.or_else(|| role_claim(email, &ac.claims, source)) |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
Ok(AdditionalClaims { |
|
|
|
role, |
|
|
|
}) |
|
|
|
} |
|
|
|
|
|
|
|
// During the 2FA flow we will
|
|
|
|
// - retrieve the user information and then only discover he needs 2FA.
|
|
|
|
// - second time we will rely on `SsoAuth.auth_response` since the `code` has already been exchanged.
|
|
|
|
@ -285,6 +347,21 @@ pub async fn exchange_code( |
|
|
|
|
|
|
|
let user_name = id_claims.preferred_username().map(|un| un.to_string()); |
|
|
|
|
|
|
|
let additional_claims = additional_claims( |
|
|
|
&email, |
|
|
|
vec![(id_claims.additional_claims(), "id_token"), (user_info.additional_claims(), "user_info")], |
|
|
|
)?; |
|
|
|
|
|
|
|
if CONFIG.sso_roles_enabled() && !CONFIG.sso_roles_default_to_user() && additional_claims.role.is_none() { |
|
|
|
info!("User {email} failed to login due to missing/invalid role"); |
|
|
|
err!( |
|
|
|
"Invalid user role. Contact your administrator", |
|
|
|
ErrorEvent { |
|
|
|
event: EventType::UserFailedLogIn |
|
|
|
} |
|
|
|
) |
|
|
|
} |
|
|
|
|
|
|
|
let refresh_token = token_response.refresh_token().map(|t| t.secret()); |
|
|
|
if refresh_token.is_none() && CONFIG.sso_scopes_vec().contains(&"offline_access".to_string()) { |
|
|
|
error!("Scope offline_access is present but response contain no refresh_token"); |
|
|
|
@ -300,6 +377,7 @@ pub async fn exchange_code( |
|
|
|
email: email.clone(), |
|
|
|
email_verified, |
|
|
|
user_name: user_name.clone(), |
|
|
|
role: additional_claims.role, |
|
|
|
}; |
|
|
|
|
|
|
|
debug!("Authenticated user {authenticated_user:?}"); |
|
|
|
@ -343,7 +421,8 @@ pub async fn redeem( |
|
|
|
let access_claims = |
|
|
|
auth::LoginJwtClaims::new(device, user, ap_nbf, ap_exp, AuthMethod::Sso.scope_vec(), client_id, now); |
|
|
|
|
|
|
|
_create_auth_tokens(device, auth_user.refresh_token, access_claims, auth_user.access_token) |
|
|
|
let is_admin = auth_user.is_admin(); |
|
|
|
_create_auth_tokens(device, auth_user.refresh_token, access_claims, auth_user.access_token, is_admin) |
|
|
|
} else { |
|
|
|
Ok(AuthTokens::new(device, user, AuthMethod::Sso, client_id)) |
|
|
|
} |
|
|
|
@ -358,6 +437,7 @@ pub fn create_auth_tokens( |
|
|
|
refresh_token: Option<String>, |
|
|
|
access_token: String, |
|
|
|
expires_in: Option<Duration>, |
|
|
|
is_admin: bool, |
|
|
|
) -> ApiResult<AuthTokens> { |
|
|
|
if !CONFIG.sso_auth_only_not_session() { |
|
|
|
let now = Utc::now(); |
|
|
|
@ -371,7 +451,7 @@ pub fn create_auth_tokens( |
|
|
|
let access_claims = |
|
|
|
auth::LoginJwtClaims::new(device, user, ap_nbf, ap_exp, AuthMethod::Sso.scope_vec(), client_id, now); |
|
|
|
|
|
|
|
_create_auth_tokens(device, refresh_token, access_claims, access_token) |
|
|
|
_create_auth_tokens(device, refresh_token, access_claims, access_token, is_admin) |
|
|
|
} else { |
|
|
|
Ok(AuthTokens::new(device, user, AuthMethod::Sso, client_id)) |
|
|
|
} |
|
|
|
@ -382,6 +462,7 @@ fn _create_auth_tokens( |
|
|
|
refresh_token: Option<String>, |
|
|
|
access_claims: auth::LoginJwtClaims, |
|
|
|
access_token: String, |
|
|
|
is_admin: bool, |
|
|
|
) -> ApiResult<AuthTokens> { |
|
|
|
let (nbf, exp, token) = if let Some(rt) = refresh_token { |
|
|
|
match decode_token_claims("refresh_token", &rt) { |
|
|
|
@ -413,6 +494,7 @@ fn _create_auth_tokens( |
|
|
|
Ok(AuthTokens { |
|
|
|
refresh_claims, |
|
|
|
access_claims, |
|
|
|
is_admin, |
|
|
|
}) |
|
|
|
} |
|
|
|
|
|
|
|
@ -420,25 +502,35 @@ fn _create_auth_tokens( |
|
|
|
// - the session is close to expiration we will try to extend it
|
|
|
|
// - the user is going to make an action and we check that the session is still valid
|
|
|
|
pub async fn exchange_refresh_token( |
|
|
|
device: &Device, |
|
|
|
user: &User, |
|
|
|
device: &Device, |
|
|
|
client_id: Option<String>, |
|
|
|
refresh_claims: auth::RefreshJwtClaims, |
|
|
|
) -> ApiResult<AuthTokens> { |
|
|
|
let exp = refresh_claims.exp; |
|
|
|
match refresh_claims.token { |
|
|
|
Some(TokenWrapper::Refresh(refresh_token)) => { |
|
|
|
let client = Client::cached().await?; |
|
|
|
let mut is_admin = false; |
|
|
|
|
|
|
|
// Use new refresh_token if returned
|
|
|
|
let (new_refresh_token, access_token, expires_in) = |
|
|
|
Client::exchange_refresh_token(refresh_token.clone()).await?; |
|
|
|
client.exchange_refresh_token(refresh_token.clone()).await?; |
|
|
|
|
|
|
|
if CONFIG.sso_roles_enabled() { |
|
|
|
let user_info = client.user_info(access_token.clone()).await?; |
|
|
|
let ac = additional_claims(&user.email, vec![(user_info.additional_claims(), "user_info")])?; |
|
|
|
is_admin = ac.is_admin(); |
|
|
|
} |
|
|
|
|
|
|
|
create_auth_tokens( |
|
|
|
device, |
|
|
|
user, |
|
|
|
client_id, |
|
|
|
new_refresh_token.or(Some(refresh_token)), |
|
|
|
access_token, |
|
|
|
access_token.into_secret(), |
|
|
|
expires_in, |
|
|
|
is_admin, |
|
|
|
) |
|
|
|
} |
|
|
|
Some(TokenWrapper::Access(access_token)) => { |
|
|
|
@ -461,7 +553,7 @@ pub async fn exchange_refresh_token( |
|
|
|
now, |
|
|
|
); |
|
|
|
|
|
|
|
_create_auth_tokens(device, None, access_claims, access_token) |
|
|
|
_create_auth_tokens(device, None, access_claims, access_token, false) |
|
|
|
} |
|
|
|
None => err!("No token present while in SSO"), |
|
|
|
} |
|
|
|
|
Timshel
2 weeks ago
GitHub