Add Okta users driver and name resolver
The driver lists GET /api/v1/users (limit=200) on the customer's org
host and follows the RFC 5988 Link header, pinning pagination to the
configured host so a response cannot redirect the crawl off-tenant.
User status maps to the three-valued Active flag (SUSPENDED and
DEPROVISIONED are inactive); ExternalID is the stable Okta user id.
The name resolver reads /api/v1/org and returns ("", nil) on any
non-2xx so a read-only token lacking org-settings read does not loop
the source-name worker.
The org domain is operator-supplied and feeds the URL host, so it is
the one SSRF-sensitive input: NormalizeOktaDomain validates and
strips it on the write path and IsValidOktaDomain re-checks it at
driver construction, on top of the transport's SSRF protection.
Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
87
pkg/connector/okta.go
Normal file
87
pkg/connector/okta.go
Normal file
@@ -0,0 +1,87 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package connector
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const OktaProvider = "OKTA"
|
||||
|
||||
// oktaDomainRe matches a dotted DNS hostname (at least two labels; each
|
||||
// label 1-63 chars of [a-z0-9-], not starting or ending with a hyphen).
|
||||
// Okta supports both *.okta.com / *.oktapreview.com orgs and fully custom
|
||||
// domains, so the suffix is intentionally unrestricted — the host shape and
|
||||
// the IP-literal rejection below, plus the transport's SSRF protection, are
|
||||
// the guards.
|
||||
var oktaDomainRe = regexp.MustCompile(`^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$`)
|
||||
|
||||
// NormalizeOktaDomain extracts and validates the bare Okta org host from
|
||||
// operator input. It accepts either a bare host ("acme.okta.com") or a full
|
||||
// URL ("https://acme.okta.com/"), strips any scheme/path, lowercases, and
|
||||
// rejects explicit ports, IP literals, and malformed hostnames. The returned
|
||||
// host is what the driver and name resolver interpolate into the per-org API
|
||||
// host (https://<host>/api/v1/...), so it is the single SSRF-sensitive input
|
||||
// and must be validated here on the write path.
|
||||
func NormalizeOktaDomain(raw string) (string, error) {
|
||||
s := strings.TrimSpace(raw)
|
||||
if s == "" {
|
||||
return "", fmt.Errorf("cannot normalize okta domain: empty")
|
||||
}
|
||||
|
||||
// url.Parse needs a scheme to populate Host; add a placeholder for bare
|
||||
// hosts. The scheme itself is discarded — only the hostname is kept.
|
||||
if !strings.Contains(s, "://") {
|
||||
s = "https://" + s
|
||||
}
|
||||
|
||||
u, err := url.Parse(s)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("cannot normalize okta domain: invalid")
|
||||
}
|
||||
|
||||
if u.Port() != "" {
|
||||
return "", fmt.Errorf("cannot normalize okta domain: ports are not allowed")
|
||||
}
|
||||
|
||||
host := strings.ToLower(u.Hostname())
|
||||
if !IsValidOktaDomain(host) {
|
||||
return "", fmt.Errorf("cannot normalize okta domain: invalid host")
|
||||
}
|
||||
|
||||
return host, nil
|
||||
}
|
||||
|
||||
// IsValidOktaDomain reports whether host is a syntactically valid Okta org
|
||||
// domain (a dotted DNS hostname, not an IP literal). It re-validates the
|
||||
// stored domain at driver/name-resolver construction time as defense in
|
||||
// depth, regardless of how the connector row was populated.
|
||||
func IsValidOktaDomain(host string) bool {
|
||||
if host == "" || len(host) > 253 {
|
||||
return false
|
||||
}
|
||||
|
||||
// Reject IP literals: an Okta org is always a DNS name, and an IP host
|
||||
// would sidestep the hostname shape check below.
|
||||
if net.ParseIP(host) != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
return oktaDomainRe.MatchString(host)
|
||||
}
|
||||
87
pkg/connector/okta_test.go
Normal file
87
pkg/connector/okta_test.go
Normal file
@@ -0,0 +1,87 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package connector_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"go.probo.inc/probo/pkg/connector"
|
||||
)
|
||||
|
||||
func TestNormalizeOktaDomain(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run("valid inputs normalize to the bare host", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
cases := map[string]string{
|
||||
"acme.okta.com": "acme.okta.com",
|
||||
" acme.okta.com ": "acme.okta.com",
|
||||
"https://acme.okta.com": "acme.okta.com",
|
||||
"https://acme.okta.com/": "acme.okta.com",
|
||||
"http://acme.okta.com/sso/saml": "acme.okta.com",
|
||||
"ACME.OKTA.COM": "acme.okta.com",
|
||||
"dev-12345.okta.com": "dev-12345.okta.com",
|
||||
"login.acme.com": "login.acme.com",
|
||||
"acme.oktapreview.com": "acme.oktapreview.com",
|
||||
}
|
||||
|
||||
for input, want := range cases {
|
||||
got, err := connector.NormalizeOktaDomain(input)
|
||||
require.NoErrorf(t, err, "input %q", input)
|
||||
assert.Equalf(t, want, got, "input %q", input)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("invalid inputs are rejected", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
inputs := []string{
|
||||
"",
|
||||
" ",
|
||||
"localhost",
|
||||
"okta",
|
||||
"acme.okta.com:8080",
|
||||
"https://acme.okta.com:443",
|
||||
"127.0.0.1",
|
||||
"169.254.169.254",
|
||||
"::1",
|
||||
"acme .okta.com",
|
||||
"-acme.okta.com",
|
||||
}
|
||||
|
||||
for _, input := range inputs {
|
||||
_, err := connector.NormalizeOktaDomain(input)
|
||||
assert.Errorf(t, err, "input %q should be rejected", input)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestIsValidOktaDomain(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.True(t, connector.IsValidOktaDomain("acme.okta.com"))
|
||||
assert.True(t, connector.IsValidOktaDomain("dev-12345.okta.com"))
|
||||
assert.True(t, connector.IsValidOktaDomain("login.acme.co.uk"))
|
||||
|
||||
assert.False(t, connector.IsValidOktaDomain(""))
|
||||
assert.False(t, connector.IsValidOktaDomain("localhost"))
|
||||
assert.False(t, connector.IsValidOktaDomain("192.168.0.1"))
|
||||
assert.False(t, connector.IsValidOktaDomain("acme.okta.com:443"))
|
||||
assert.False(t, connector.IsValidOktaDomain("ACME.OKTA.COM"))
|
||||
}
|
||||
Reference in New Issue
Block a user