From 27e391f7e0969e07f541206b14e30a2909d4564a Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 14 Jan 2025 21:02:41 +0800 Subject: [PATCH 1/3] misc: add oidc saml handling for login check --- backend/src/server/routes/index.ts | 1 + .../super-admin/super-admin-service.ts | 42 +++++++++++++------ 2 files changed, 31 insertions(+), 12 deletions(-) diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 50b0d94fc..9ed38a7e3 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -608,6 +608,7 @@ export const registerRoutes = async ( }); const superAdminService = superAdminServiceFactory({ userDAL, + userAliasDAL, authService: loginService, serverCfgDAL: superAdminDAL, kmsRootConfigDAL, diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts index 8ef998ac3..265172a28 100644 --- a/backend/src/services/super-admin/super-admin-service.ts +++ b/backend/src/services/super-admin/super-admin-service.ts @@ -16,12 +16,15 @@ import { TKmsServiceFactory } from "../kms/kms-service"; import { RootKeyEncryptionStrategy } from "../kms/kms-types"; import { TOrgServiceFactory } from "../org/org-service"; import { TUserDALFactory } from "../user/user-dal"; +import { TUserAliasDALFactory } from "../user-alias/user-alias-dal"; +import { UserAliasType } from "../user-alias/user-alias-types"; import { TSuperAdminDALFactory } from "./super-admin-dal"; import { LoginMethod, TAdminGetUsersDTO, TAdminSignUpDTO } from "./super-admin-types"; type TSuperAdminServiceFactoryDep = { serverCfgDAL: TSuperAdminDALFactory; userDAL: TUserDALFactory; + userAliasDAL: Pick; authService: Pick; kmsService: Pick; kmsRootConfigDAL: TKmsRootConfigDALFactory; @@ -48,6 +51,7 @@ const ADMIN_CONFIG_DB_UUID = "00000000-0000-0000-0000-000000000000"; export const superAdminServiceFactory = ({ serverCfgDAL, userDAL, + userAliasDAL, authService, orgService, keyStore, @@ -104,29 +108,43 @@ export const superAdminServiceFactory = ({ if (data.enabledLoginMethods) { const superAdminUser = await userDAL.findById(userId); + const isSamlConfiguredForUser = Boolean( + await userAliasDAL.findOne({ + userId, + aliasType: UserAliasType.SAML + }) + ); + + const isUserSamlAccessEnabled = isSamlConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.SAML); + const isOidcConfiguredForUser = Boolean( + await userAliasDAL.findOne({ + userId, + aliasType: UserAliasType.OIDC + }) + ); + + const isUserOidcAccessEnabled = isOidcConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.OIDC); + const loginMethodToAuthMethod = { [LoginMethod.EMAIL]: [AuthMethod.EMAIL], [LoginMethod.GOOGLE]: [AuthMethod.GOOGLE], [LoginMethod.GITLAB]: [AuthMethod.GITLAB], [LoginMethod.GITHUB]: [AuthMethod.GITHUB], [LoginMethod.LDAP]: [AuthMethod.LDAP], - [LoginMethod.OIDC]: [AuthMethod.OIDC], - [LoginMethod.SAML]: [ - AuthMethod.AZURE_SAML, - AuthMethod.GOOGLE_SAML, - AuthMethod.JUMPCLOUD_SAML, - AuthMethod.KEYCLOAK_SAML, - AuthMethod.OKTA_SAML - ] + [LoginMethod.SAML]: [], + [LoginMethod.OIDC]: [] }; - if ( - !data.enabledLoginMethods.some((loginMethod) => + const canServerAdminAccessAfterApply = + data.enabledLoginMethods.some((loginMethod) => loginMethodToAuthMethod[loginMethod as LoginMethod].some( (authMethod) => superAdminUser.authMethods?.includes(authMethod) ) - ) - ) { + ) || + isUserSamlAccessEnabled || + isUserOidcAccessEnabled; + + if (!canServerAdminAccessAfterApply) { throw new BadRequestError({ message: "You must configure at least one auth method to prevent account lockout" }); From 80f72e8040e51ac0fe500f7a7105904648f3c9c8 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 15 Jan 2025 00:48:19 +0800 Subject: [PATCH 2/3] misc: added context --- backend/src/services/super-admin/super-admin-service.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts index 265172a28..eea6c63bd 100644 --- a/backend/src/services/super-admin/super-admin-service.ts +++ b/backend/src/services/super-admin/super-admin-service.ts @@ -115,6 +115,8 @@ export const superAdminServiceFactory = ({ }) ); + // We do this because we do not store SAML and OIDC auth values in the user + // authMethods field and so we infer this from the user aliases const isUserSamlAccessEnabled = isSamlConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.SAML); const isOidcConfiguredForUser = Boolean( await userAliasDAL.findOne({ From 5ad419c079137c14ad48af655c6690bb1f20f56b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 15 Jan 2025 00:49:53 +0800 Subject: [PATCH 3/3] misc: updated comment --- backend/src/services/super-admin/super-admin-service.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts index eea6c63bd..b0fdd9c5c 100644 --- a/backend/src/services/super-admin/super-admin-service.ts +++ b/backend/src/services/super-admin/super-admin-service.ts @@ -115,8 +115,8 @@ export const superAdminServiceFactory = ({ }) ); - // We do this because we do not store SAML and OIDC auth values in the user - // authMethods field and so we infer this from the user aliases + // We do not store SAML and OIDC auth values in the user authMethods field + // and so we infer its usage from the user's aliases const isUserSamlAccessEnabled = isSamlConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.SAML); const isOidcConfiguredForUser = Boolean( await userAliasDAL.findOne({