awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 07:35:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adjust SCIM and SAML impl to use username / nameID, patch LDAP edge-cases

Browse Source
This commit is contained in:
Tuan Dang
2024-02-25 18:16:26 -08:00
parent 8c31566e17
commit a33c50b75a
15 changed files with 136 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/ldap-config/ldap-config-service.ts
+41 -28
View File
@@ -13,6 +13,7 @@ import {
infisicalSymmetricEncypt
} from "@app/lib/crypto/encryption";
import { BadRequestError } from "@app/lib/errors";
import { logger } from "@app/lib/logger";
import { TOrgPermission } from "@app/lib/types";
import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
@@ -204,8 +205,8 @@ export const ldapConfigServiceFactory = ({
return ldapConfig;
};
const getLdapCfg2 = async (orgId: string) => {
const ldapConfig = await ldapConfigDAL.findOne({ orgId });
const getLdapCfg = async (filter: { orgId: string; isActive?: boolean }) => {
const ldapConfig = await ldapConfigDAL.findOne(filter);
if (!ldapConfig) throw new BadRequestError({ message: "Failed to find organization LDAP data" });
const orgBot = await orgBotDAL.findOne({ orgId: ldapConfig.orgId });
@@ -272,44 +273,55 @@ export const ldapConfigServiceFactory = ({
};
};
const getLdapCfg = async ({ actor, actorId, orgId, actorOrgId }: TOrgPermission) => {
const getLdapCfgWithPermissionCheck = async ({ actor, actorId, orgId, actorOrgId }: TOrgPermission) => {
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorOrgId);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
return getLdapCfg2(orgId);
return getLdapCfg({
orgId
});
};
// eslint-disable-next-line
const getLDAPConfiguration = (req: FastifyRequest, callback: any) => {
const getLdapPassportOpts = (req: FastifyRequest, done: any) => {
const { organizationSlug } = req.body as {
organizationSlug: string;
};
const boot = async () => {
const organization = await orgDAL.findOne({ slug: organizationSlug });
const ldapConfig = await getLdapCfg2(organization.id); // repeat?
req.ldapConfig = ldapConfig;
try {
const organization = await orgDAL.findOne({ slug: organizationSlug });
const ldapConfig = await getLdapCfg({
orgId: organization.id,
isActive: true
});
req.ldapConfig = ldapConfig;
const opts = {
server: {
url: ldapConfig.url,
bindDN: ldapConfig.bindDN,
bindCredentials: ldapConfig.bindPass,
searchBase: ldapConfig.searchBase,
searchFilter: "(uid={{username}})",
searchAttributes: ["uid", "givenName", "sn"],
...(ldapConfig.caCert !== ""
? {
tlsOptions: {
ca: [ldapConfig.caCert]
const opts = {
server: {
url: ldapConfig.url,
bindDN: ldapConfig.bindDN,
bindCredentials: ldapConfig.bindPass,
searchBase: ldapConfig.searchBase,
searchFilter: "(uid={{username}})",
searchAttributes: ["uid", "givenName", "sn"],
...(ldapConfig.caCert !== ""
? {
tlsOptions: {
ca: [ldapConfig.caCert]
}
}
}
: {})
},
passReqToCallback: true
};
: {})
},
passReqToCallback: true
};
// eslint-disable-next-line
callback(null, opts);
// eslint-disable-next-line
done(null, opts);
} catch (err) {
logger.error(err);
// eslint-disable-next-line
done(err as Error);
}
};
process.nextTick(async () => {
@@ -403,8 +415,9 @@ export const ldapConfigServiceFactory = ({
return {
createLdapCfg,
updateLdapCfg,
getLdapCfgWithPermissionCheck,
getLdapCfg,
getLDAPConfiguration,
getLdapPassportOpts,
ldapLogin
};
};
backend/src/ee/services/license/__mocks__/licence-fns.ts
+2 -1
View File
@@ -17,7 +17,8 @@ export const getDefaultOnPremFeatures = () => {
customAlerts: false,
auditLogs: false,
auditLogsRetentionDays: 0,
samlSSO: false,
samlSSO: true,
scim: true,
status: null,
trial_end: null,
has_used_trial: true,
backend/src/ee/services/license/licence-fns.ts
+2 -2
View File
@@ -23,8 +23,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
customAlerts: false,
auditLogs: false,
auditLogsRetentionDays: 0,
samlSSO: false,
scim: false,
samlSSO: true,
scim: true,
ldap: true,
status: null,
trial_end: null,
backend/src/ee/services/license/license-types.ts
+2 -2
View File
@@ -24,8 +24,8 @@ export type TFeatureSet = {
customAlerts: false;
auditLogs: false;
auditLogsRetentionDays: 0;
samlSSO: false;
scim: false;
samlSSO: true;
scim: true;
ldap: true;
status: null;
trial_end: null;
backend/src/ee/services/saml-config/saml-config-service.ts
+20 -5
View File
@@ -5,6 +5,7 @@ import {
OrgMembershipRole,
OrgMembershipStatus,
SecretKeyEncoding,
TableName,
TSamlConfigs,
TSamlConfigsUpdate
} from "@app/db/schemas";
@@ -31,7 +32,7 @@ import { TCreateSamlCfgDTO, TGetSamlCfgDTO, TSamlLoginDTO, TUpdateSamlCfgDTO } f
type TSamlConfigServiceFactoryDep = {
samlConfigDAL: TSamlConfigDALFactory;
userDAL: Pick<TUserDALFactory, "create" | "findUserByEmail" | "transaction" | "updateById">;
userDAL: Pick<TUserDALFactory, "create" | "findOne" | "transaction" | "updateById">;
orgDAL: Pick<
TOrgDALFactory,
"createMembership" | "updateMembershipById" | "findMembership" | "findOrgById" | "findOne" | "updateById"
@@ -299,16 +300,30 @@ export const samlConfigServiceFactory = ({
};
};
const samlLogin = async ({ firstName, email, lastName, authProvider, orgId, relayState }: TSamlLoginDTO) => {
const samlLogin = async ({
username,
email,
firstName,
lastName,
authProvider,
orgId,
relayState
}: TSamlLoginDTO) => {
const appCfg = getConfig();
let user = await userDAL.findUserByEmail(email);
let user = await userDAL.findOne({ username });
const organization = await orgDAL.findOrgById(orgId);
if (!organization) throw new BadRequestError({ message: "Org not found" });
if (user) {
await userDAL.transaction(async (tx) => {
const [orgMembership] = await orgDAL.findMembership({ userId: user.id, orgId }, { tx });
const [orgMembership] = await orgDAL.findMembership(
{
userId: user.id,
[`${TableName.OrgMembership}.orgId` as "id"]: orgId
},
{ tx }
);
if (!orgMembership) {
await orgDAL.createMembership(
{
@@ -334,7 +349,7 @@ export const samlConfigServiceFactory = ({
user = await userDAL.transaction(async (tx) => {
const newUser = await userDAL.create(
{
username: email,
username,
email,
firstName,
lastName,
backend/src/ee/services/saml-config/saml-config-types.ts
+2 -1
View File
@@ -36,7 +36,8 @@ export type TGetSamlCfgDTO =
};
export type TSamlLoginDTO = {
email: string;
username: string;
email?: string;
firstName: string;
lastName?: string;
authProvider: string;
backend/src/ee/services/scim/scim-fns.ts
+13 -9
View File
@@ -28,12 +28,12 @@ export const buildScimUser = ({
}: {
userId: string;
username: string;
email: string;
email?: string | null;
firstName: string;
lastName: string;
active: boolean;
}): TScimUser => {
return {
const scimUser = {
schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"],
id: userId,
userName: username,
@@ -43,13 +43,15 @@ export const buildScimUser = ({
middleName: null,
familyName: lastName
},
emails: [
{
primary: true,
value: email,
type: "work"
}
],
emails: email
? [
{
primary: true,
value: email,
type: "work"
}
]
: [],
active,
groups: [],
meta: {
@@ -57,4 +59,6 @@ export const buildScimUser = ({
location: null
}
};
return scimUser;
};
backend/src/ee/services/scim/scim-service.ts
+20 -15
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import jwt from "jsonwebtoken";
import { OrgMembershipRole, OrgMembershipStatus } from "@app/db/schemas";
import { OrgMembershipRole, OrgMembershipStatus, TableName } from "@app/db/schemas";
import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, ScimRequestError, UnauthorizedError } from "@app/lib/errors";
@@ -146,7 +146,7 @@ export const scimServiceFactory = ({
const users = await orgDAL.findMembership(
{
orgId,
[`${TableName.OrgMembership}.orgId` as "id"]: orgId,
...parseFilter(filter)
},
findOpts
@@ -155,10 +155,10 @@ export const scimServiceFactory = ({
const scimUsers = users.map(({ userId, username, firstName, lastName, email }) =>
buildScimUser({
userId: userId ?? "",
username: username ?? "",
username,
firstName: firstName ?? "",
lastName: lastName ?? "",
email: email ?? "",
email,
active: true
})
);
@@ -174,7 +174,7 @@ export const scimServiceFactory = ({
const [membership] = await orgDAL
.findMembership({
userId,
orgId
[`${TableName.OrgMembership}.orgId` as "id"]: orgId
})
.catch(() => {
throw new ScimRequestError({
@@ -205,8 +205,7 @@ export const scimServiceFactory = ({
});
};
// TODO: update SCIM endpoints to add username
const createScimUser = async ({ firstName, lastName, email, orgId }: TCreateScimUserDTO) => {
const createScimUser = async ({ username, email, firstName, lastName, orgId }: TCreateScimUserDTO) => {
const org = await orgDAL.findById(orgId);
if (!org)
@@ -222,12 +221,18 @@ export const scimServiceFactory = ({
});
let user = await userDAL.findOne({
email
username
});
if (user) {
await userDAL.transaction(async (tx) => {
const [orgMembership] = await orgDAL.findMembership({ userId: user.id, orgId }, { tx });
const [orgMembership] = await orgDAL.findMembership(
{
userId: user.id,
[`${TableName.OrgMembership}.orgId` as "id"]: orgId
},
{ tx }
);
if (orgMembership)
throw new ScimRequestError({
detail: "User already exists in the database",
@@ -251,7 +256,7 @@ export const scimServiceFactory = ({
user = await userDAL.transaction(async (tx) => {
const newUser = await userDAL.create(
{
username: email,
username,
email,
firstName,
lastName,
@@ -279,7 +284,7 @@ export const scimServiceFactory = ({
await smtpService.sendMail({
template: SmtpTemplates.ScimUserProvisioned,
subjectLine: "Infisical organization invitation",
recipients: [email],
recipients: email ? [email] : [],
substitutions: {
organizationName: org.name,
callback_url: `${appCfg.SITE_URL}/api/v1/sso/redirect/saml2/organizations/${org.slug}`
@@ -300,7 +305,7 @@ export const scimServiceFactory = ({
const [membership] = await orgDAL
.findMembership({
userId,
orgId
[`${TableName.OrgMembership}.orgId` as "id"]: orgId
})
.catch(() => {
throw new ScimRequestError({
@@ -348,7 +353,7 @@ export const scimServiceFactory = ({
return buildScimUser({
userId: membership.userId as string,
username: membership.username,
email: membership.email ?? "",
email: membership.email,
firstName: membership.firstName as string,
lastName: membership.lastName as string,
active
@@ -359,7 +364,7 @@ export const scimServiceFactory = ({
const [membership] = await orgDAL
.findMembership({
userId,
orgId
[`${TableName.OrgMembership}.orgId` as "id"]: orgId
})
.catch(() => {
throw new ScimRequestError({
@@ -394,7 +399,7 @@ export const scimServiceFactory = ({
return buildScimUser({
userId: membership.userId as string,
username: membership.username,
email: membership.email ?? "",
email: membership.email,
firstName: membership.firstName as string,
lastName: membership.lastName as string,
active
backend/src/ee/services/scim/scim-types.ts
+2 -1
View File
@@ -32,7 +32,8 @@ export type TGetScimUserDTO = {
};
export type TCreateScimUserDTO = {
email: string;
username: string;
email?: string;
firstName: string;
lastName: string;
orgId: string;