snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/auth/saml/idp.go

@@ -0,0 +1,9 @@
+package saml
+
+type (
+	IdpIdentityPayload struct {
+		Name       string
+		Handle     string
+		Identifier string
+	}
+)

server/auth/saml/saml.go

@@ -0,0 +1,57 @@
+package saml
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+
+	"github.com/cortezaproject/corteza/server/auth/settings"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/crewjam/saml"
+	"github.com/crewjam/saml/samlsp"
+)
+
+type (
+	templateProvider struct {
+		Label, Handle, Icon string
+	}
+)
+
+// FetchIDPMetadata loads the idp metadata, usually the url
+// is configured in settings
+func FetchIDPMetadata(ctx context.Context, u url.URL) (*saml.EntityDescriptor, error) {
+	return samlsp.FetchMetadata(ctx, http.DefaultClient, u)
+}
+
+// TemplateProvider adds a wrapper to the button
+// data that is displayed on the login form
+func TemplateProvider(url, name string) templateProvider {
+	if name == "" {
+		name = url
+	}
+
+	return templateProvider{
+		Label:  name,
+		Handle: "saml/init",
+		Icon:   "key",
+	}
+}
+
+// UpdateSettings applies the app settings to the
+// auth specific settings
+func UpdateSettings(source *types.AppSettings, dest *settings.Settings) {
+	saml := source.Auth.External.Saml
+
+	dest.Saml.Enabled = saml.Enabled
+	dest.Saml.Name = saml.Name
+	dest.Saml.Cert = saml.Cert
+	dest.Saml.Key = saml.Key
+	dest.Saml.SignRequests = saml.SignRequests
+	dest.Saml.SignMethod = saml.SignMethod
+	dest.Saml.Binding = saml.Binding
+
+	dest.Saml.IDP.URL = saml.IDP.URL
+	dest.Saml.IDP.IdentName = saml.IDP.IdentName
+	dest.Saml.IDP.IdentHandle = saml.IDP.IdentHandle
+	dest.Saml.IDP.IdentIdentifier = saml.IDP.IdentIdentifier
+}

server/auth/saml/saml_test.go

@@ -0,0 +1,46 @@
+package saml
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_TemplateProvider(t *testing.T) {
+	var (
+		tcc = []struct {
+			name   string
+			url    string
+			expect templateProvider
+		}{
+			{
+				name: "Default SAML provider",
+				url:  "http://example.tld",
+				expect: templateProvider{
+					Label:  "Default SAML provider",
+					Handle: "saml/init",
+					Icon:   "key",
+				},
+			},
+			{
+				name: "",
+				url:  "http://example.tld",
+				expect: templateProvider{
+					Label:  "http://example.tld",
+					Handle: "saml/init",
+					Icon:   "key",
+				},
+			},
+		}
+	)
+
+	for _, tc := range tcc {
+		t.Run(tc.name, func(t *testing.T) {
+			var (
+				req = require.New(t)
+			)
+
+			req.Equal(tc.expect, TemplateProvider(tc.url, tc.name))
+		})
+	}
+}

server/auth/saml/sp.go

@@ -0,0 +1,161 @@
+package saml
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/crewjam/saml"
+	"github.com/crewjam/saml/samlsp"
+	"go.uber.org/zap"
+)
+
+const defaultNameIdentifier = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+
+type (
+	SamlSPService struct {
+		log *zap.Logger
+
+		Enabled bool
+
+		IdpURL      url.URL
+		Host        url.URL
+		IDPUserMeta *IdpIdentityPayload
+		IDPMeta     *saml.EntityDescriptor
+
+		sp      saml.ServiceProvider
+		handler *samlsp.Middleware
+	}
+
+	SamlSPArgs struct {
+		Enabled bool
+
+		AcsURL  string
+		MetaURL string
+		SloURL  string
+
+		SignRequests    bool
+		SignatureMethod string
+
+		Binding string
+
+		// user meta from idp
+		IdentityPayload IdpIdentityPayload
+
+		IdpURL      url.URL
+		Host        url.URL
+		Certificate *x509.Certificate
+		PrivateKey  *rsa.PrivateKey
+		IdpMeta     *saml.EntityDescriptor
+	}
+)
+
+// NewSamlSPService loads the certificates and registers the
+// already fetched IDP metadata into the SAML middleware
+func NewSamlSPService(log *zap.Logger, args SamlSPArgs) (s *SamlSPService, err error) {
+	metadataURL, _ := url.Parse(args.MetaURL)
+	acsURL, _ := url.Parse(args.AcsURL)
+	logoutURL, _ := url.Parse(args.SloURL)
+
+	sp := saml.ServiceProvider{
+		Key:         args.PrivateKey,
+		Certificate: args.Certificate,
+		IDPMetadata: args.IdpMeta,
+
+		MetadataURL: *args.Host.ResolveReference(metadataURL),
+		AcsURL:      *args.Host.ResolveReference(acsURL),
+		SloURL:      *args.Host.ResolveReference(logoutURL),
+	}
+
+	if args.SignRequests {
+		sp.SignatureMethod = args.SignatureMethod
+	}
+
+	// default to GET
+	if args.Binding == "" {
+		args.Binding = saml.HTTPRedirectBinding
+	}
+
+	opts := samlsp.Options{
+		URL:         args.Host,
+		Key:         sp.Key,
+		Certificate: sp.Certificate,
+		IDPMetadata: args.IdpMeta,
+	}
+
+	// internal samlsp service
+	handler, err := samlsp.New(opts)
+	if err != nil {
+		err = fmt.Errorf("could not init SAML SP handler: %w", err)
+		return
+	}
+
+	if log != nil {
+		handler.OnError = func(w http.ResponseWriter, r *http.Request, err error) {
+			log.Error("error", zap.Error(err))
+			samlsp.DefaultOnError(w, r, err)
+		}
+	}
+
+	handler.RequestTracker = samlsp.DefaultRequestTracker(opts, &handler.ServiceProvider)
+	handler.ServiceProvider = sp
+	handler.Binding = args.Binding
+
+	s = &SamlSPService{
+		log: log,
+
+		Enabled: args.Enabled,
+
+		sp:      sp,
+		handler: handler,
+
+		IdpURL:      args.IdpURL,
+		Host:        args.Host,
+		IDPUserMeta: &args.IdentityPayload,
+	}
+
+	return
+}
+
+func (ssp *SamlSPService) NameIdentifier() string {
+	return strings.TrimPrefix(defaultNameIdentifier, "urn:oasis:names:tc:SAML:1.1:nameid-format:")
+}
+
+// GuessIdentifier tries to guess the necessary (email) key
+// for external authentication
+func (ssp *SamlSPService) GuessIdentifier(payload map[string][]string) string {
+	tryValues := []string{
+		ssp.IDPUserMeta.Identifier,
+		ssp.NameIdentifier(),
+		defaultNameIdentifier,
+		"urn:oasis:names:tc:SAML:attribute:subject-id",
+		"email",
+		"mail",
+	}
+
+	for _, v := range tryValues {
+		if _, ok := payload[v]; ok {
+			return payload[v][0]
+		}
+	}
+
+	return ""
+}
+
+func (ssp *SamlSPService) Handler() *samlsp.Middleware {
+	return ssp.handler
+}
+
+// ServeHTTP enables us to use the service directly
+// in the router
+func (ssp *SamlSPService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if ssp.handler == nil {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return
+	}
+
+	ssp.handler.ServeHTTP(w, r)
+}

server/auth/saml/sp_test.go

@@ -0,0 +1,71 @@
+package saml
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	defaultSAMLEmailPayload     = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+	defaultSamlTestEmailPayload = "urn:oasis:names:tc:SAML:attribute:subject-id"
+)
+
+func Test_guessIdentifier(t *testing.T) {
+	var (
+		sp = SamlSPService{
+			IDPUserMeta: &IdpIdentityPayload{
+				Name:       "name_field",
+				Handle:     "handle_field",
+				Identifier: "identifier_field",
+			},
+		}
+
+		tcc = []struct {
+			name    string
+			payload map[string][]string
+			expect  string
+		}{
+			{
+				name:    "default email",
+				payload: map[string][]string{"email": {"test@example.com"}},
+				expect:  "test@example.com",
+			},
+			{
+				name:    "samltest.id email payload",
+				payload: map[string][]string{defaultSamlTestEmailPayload: {"test@example.com"}},
+				expect:  "test@example.com",
+			},
+			{
+				name:    "default SAML emailAddress payload",
+				payload: map[string][]string{defaultSAMLEmailPayload: {"test@example.com"}},
+				expect:  "test@example.com",
+			},
+			{
+				name:    "emailAddress payload",
+				payload: map[string][]string{"emailAddress": {"test@example.com"}},
+				expect:  "test@example.com",
+			},
+			{
+				name:    "missing email payload",
+				payload: map[string][]string{"non-existing-identifier": {"test@example.com"}},
+				expect:  "",
+			},
+			{
+				name:    "default payload as set in settings",
+				payload: map[string][]string{"identifier_field": {"test@example.com"}},
+				expect:  "test@example.com",
+			},
+		}
+	)
+
+	for _, tc := range tcc {
+		t.Run(tc.name, func(t *testing.T) {
+			var (
+				req = require.New(t)
+			)
+
+			req.Equal(tc.expect, sp.GuessIdentifier(tc.payload))
+		})
+	}
+}