Bryan Frimin
585
pkg/auth/saml_service.go
Normal file
585
pkg/auth/saml_service.go
Normal file
@@ -0,0 +1,585 @@
|
||||
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/pem"
|
||||
"encoding/xml"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/crewjam/saml"
|
||||
"github.com/getprobo/probo/pkg/coredata"
|
||||
"github.com/getprobo/probo/pkg/crypto/cipher"
|
||||
"github.com/getprobo/probo/pkg/gid"
|
||||
"go.gearno.de/kit/log"
|
||||
"go.gearno.de/kit/pg"
|
||||
)
|
||||
|
||||
type (
|
||||
SAMLService struct {
|
||||
pg *pg.Client
|
||||
encryptionKey cipher.EncryptionKey
|
||||
baseURL string
|
||||
sessionDuration time.Duration
|
||||
cookieName string
|
||||
cookieSecret string
|
||||
certificate *x509.Certificate
|
||||
privateKey *rsa.PrivateKey
|
||||
logger *log.Logger
|
||||
}
|
||||
|
||||
ErrSPCertificateNotConfigured struct{}
|
||||
|
||||
ErrSAMLConfigurationNotFound struct {
|
||||
OrganizationID gid.GID
|
||||
}
|
||||
|
||||
ErrSAMLDisabled struct {
|
||||
OrganizationID gid.GID
|
||||
}
|
||||
|
||||
ErrInvalidIdPCertificate struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrInvalidURL struct {
|
||||
Field string
|
||||
URL string
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotCreateServiceProvider struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotCreateAuthRequest struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotGenerateRedirectURL struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotParseSAMLResponse struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotValidateAssertion struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotExtractUserAttributes struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrCannotMapRole struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
ErrReplayAttackDetected struct {
|
||||
AssertionID string
|
||||
Err error
|
||||
}
|
||||
)
|
||||
|
||||
func (e ErrSPCertificateNotConfigured) Error() string {
|
||||
return "SP certificate and private key are not configured"
|
||||
}
|
||||
|
||||
func (e ErrSAMLConfigurationNotFound) Error() string {
|
||||
return fmt.Sprintf("SAML configuration not found for organization %s", e.OrganizationID)
|
||||
}
|
||||
|
||||
func (e ErrSAMLDisabled) Error() string {
|
||||
return fmt.Sprintf("SAML is disabled for organization %s", e.OrganizationID)
|
||||
}
|
||||
|
||||
func (e ErrInvalidIdPCertificate) Error() string {
|
||||
return fmt.Sprintf("cannot parse IdP certificate: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrInvalidURL) Error() string {
|
||||
return fmt.Sprintf("cannot parse %s URL %q: %v", e.Field, e.URL, e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotCreateServiceProvider) Error() string {
|
||||
return fmt.Sprintf("cannot create service provider: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotCreateAuthRequest) Error() string {
|
||||
return fmt.Sprintf("cannot create AuthnRequest: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotGenerateRedirectURL) Error() string {
|
||||
return fmt.Sprintf("cannot generate redirect URL: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotParseSAMLResponse) Error() string {
|
||||
return fmt.Sprintf("cannot parse SAML response: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotValidateAssertion) Error() string {
|
||||
return fmt.Sprintf("cannot validate assertion: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotExtractUserAttributes) Error() string {
|
||||
return fmt.Sprintf("cannot extract user attributes: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrCannotMapRole) Error() string {
|
||||
return fmt.Sprintf("cannot map role: %v", e.Err)
|
||||
}
|
||||
|
||||
func (e ErrReplayAttackDetected) Error() string {
|
||||
return fmt.Sprintf("replay attack detected for assertion %s: %v", e.AssertionID, e.Err)
|
||||
}
|
||||
|
||||
func NewSAMLService(
|
||||
pg *pg.Client,
|
||||
encryptionKey cipher.EncryptionKey,
|
||||
baseURL string,
|
||||
sessionDuration time.Duration,
|
||||
cookieName string,
|
||||
cookieSecret string,
|
||||
certificatePEM string,
|
||||
privateKeyPEM string,
|
||||
logger *log.Logger,
|
||||
) (*SAMLService, error) {
|
||||
var certificate *x509.Certificate
|
||||
var privateKey *rsa.PrivateKey
|
||||
|
||||
if certificatePEM != "" {
|
||||
block, _ := pem.Decode([]byte(certificatePEM))
|
||||
if block == nil || block.Type != "CERTIFICATE" {
|
||||
return nil, fmt.Errorf("invalid certificate PEM format")
|
||||
}
|
||||
|
||||
cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot parse certificate: %w", err)
|
||||
}
|
||||
certificate = cert
|
||||
}
|
||||
|
||||
if privateKeyPEM != "" {
|
||||
block, _ := pem.Decode([]byte(privateKeyPEM))
|
||||
if block == nil {
|
||||
return nil, fmt.Errorf("invalid private key PEM format")
|
||||
}
|
||||
|
||||
var key *rsa.PrivateKey
|
||||
var err error
|
||||
switch block.Type {
|
||||
case "RSA PRIVATE KEY":
|
||||
key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot parse PKCS1 private key: %w", err)
|
||||
}
|
||||
case "PRIVATE KEY":
|
||||
parsedKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot parse PKCS8 private key: %w", err)
|
||||
}
|
||||
var ok bool
|
||||
key, ok = parsedKey.(*rsa.PrivateKey)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("private key is not RSA")
|
||||
}
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported private key type: %s", block.Type)
|
||||
}
|
||||
privateKey = key
|
||||
}
|
||||
|
||||
return &SAMLService{
|
||||
pg: pg,
|
||||
encryptionKey: encryptionKey,
|
||||
baseURL: baseURL,
|
||||
sessionDuration: sessionDuration,
|
||||
cookieName: cookieName,
|
||||
cookieSecret: cookieSecret,
|
||||
certificate: certificate,
|
||||
privateKey: privateKey,
|
||||
logger: logger,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (s *SAMLService) GetEntityID() string {
|
||||
return fmt.Sprintf("%s/auth/saml/metadata", s.baseURL)
|
||||
}
|
||||
|
||||
func (s *SAMLService) GetAcsURL() string {
|
||||
return fmt.Sprintf("%s/auth/saml/consume", s.baseURL)
|
||||
}
|
||||
|
||||
func parseRawSAMLResponse(encodedResponse string) (*saml.Assertion, error) {
|
||||
rawResponseBuf, err := base64.StdEncoding.DecodeString(encodedResponse)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot decode base64: %w", err)
|
||||
}
|
||||
|
||||
var response saml.Response
|
||||
if err := xml.Unmarshal(rawResponseBuf, &response); err != nil {
|
||||
return nil, fmt.Errorf("cannot unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
if response.Assertion == nil {
|
||||
if response.EncryptedAssertion != nil {
|
||||
return nil, fmt.Errorf("response contains encrypted assertion which cannot be parsed without SP private key")
|
||||
}
|
||||
return nil, fmt.Errorf("response contains no assertion")
|
||||
}
|
||||
|
||||
return response.Assertion, nil
|
||||
}
|
||||
|
||||
func (s *SAMLService) GetServiceProvider(
|
||||
ctx context.Context,
|
||||
config *coredata.SAMLConfiguration,
|
||||
) (*saml.ServiceProvider, error) {
|
||||
if s.certificate == nil || s.privateKey == nil {
|
||||
return nil, ErrSPCertificateNotConfigured{}
|
||||
}
|
||||
|
||||
idpCert, err := ParseIdPCertificate(config.IdPCertificate)
|
||||
if err != nil {
|
||||
return nil, ErrInvalidIdPCertificate{Err: err}
|
||||
}
|
||||
|
||||
acsURL, err := url.Parse(s.GetAcsURL())
|
||||
if err != nil {
|
||||
return nil, ErrInvalidURL{Field: "ACS", URL: s.GetAcsURL(), Err: err}
|
||||
}
|
||||
|
||||
idpSSOURL, err := url.Parse(config.IdPSsoURL)
|
||||
if err != nil {
|
||||
return nil, ErrInvalidURL{Field: "IdP SSO", URL: config.IdPSsoURL, Err: err}
|
||||
}
|
||||
|
||||
sp := &saml.ServiceProvider{
|
||||
EntityID: s.GetEntityID(),
|
||||
Key: s.privateKey,
|
||||
Certificate: s.certificate,
|
||||
MetadataURL: *acsURL,
|
||||
AcsURL: *acsURL,
|
||||
SloURL: *acsURL,
|
||||
IDPMetadata: &saml.EntityDescriptor{
|
||||
EntityID: config.IdPEntityID,
|
||||
IDPSSODescriptors: []saml.IDPSSODescriptor{
|
||||
{
|
||||
SSODescriptor: saml.SSODescriptor{
|
||||
RoleDescriptor: saml.RoleDescriptor{
|
||||
ProtocolSupportEnumeration: "urn:oasis:names:tc:SAML:2.0:protocol",
|
||||
KeyDescriptors: []saml.KeyDescriptor{
|
||||
{
|
||||
Use: "signing",
|
||||
KeyInfo: saml.KeyInfo{
|
||||
X509Data: saml.X509Data{
|
||||
X509Certificates: []saml.X509Certificate{
|
||||
{Data: base64.StdEncoding.EncodeToString(idpCert.Raw)},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
SingleSignOnServices: []saml.Endpoint{
|
||||
{
|
||||
Binding: saml.HTTPRedirectBinding,
|
||||
Location: idpSSOURL.String(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
return sp, nil
|
||||
}
|
||||
|
||||
func (s *SAMLService) InitiateSAMLLogin(
|
||||
ctx context.Context,
|
||||
organizationID gid.GID,
|
||||
tenantID gid.TenantID,
|
||||
emailDomain string,
|
||||
) (string, error) {
|
||||
var config coredata.SAMLConfiguration
|
||||
scope := coredata.NewScope(tenantID)
|
||||
|
||||
err := s.pg.WithConn(
|
||||
ctx,
|
||||
func(conn pg.Conn) error {
|
||||
return config.LoadByOrganizationIDAndEmailDomain(ctx, conn, scope, organizationID, emailDomain)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return "", ErrSAMLConfigurationNotFound{OrganizationID: organizationID}
|
||||
}
|
||||
|
||||
if !config.Enabled {
|
||||
return "", ErrSAMLDisabled{OrganizationID: organizationID}
|
||||
}
|
||||
|
||||
sp, err := s.GetServiceProvider(ctx, &config)
|
||||
if err != nil {
|
||||
return "", ErrCannotCreateServiceProvider{Err: err}
|
||||
}
|
||||
|
||||
authReq, err := sp.MakeAuthenticationRequest(
|
||||
config.IdPSsoURL,
|
||||
saml.HTTPRedirectBinding,
|
||||
saml.HTTPPostBinding,
|
||||
)
|
||||
if err != nil {
|
||||
return "", ErrCannotCreateAuthRequest{Err: err}
|
||||
}
|
||||
|
||||
relayStateToken, err := coredata.GenerateSecureToken()
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("cannot generate relay state token: %w", err)
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
requestExpiry := now.Add(10 * time.Minute)
|
||||
relayStateExpiry := now.Add(15 * time.Minute)
|
||||
|
||||
err = s.pg.WithTx(
|
||||
ctx,
|
||||
func(tx pg.Conn) error {
|
||||
samlRequest := coredata.SAMLRequest{
|
||||
ID: authReq.ID,
|
||||
OrganizationID: organizationID,
|
||||
CreatedAt: now,
|
||||
ExpiresAt: requestExpiry,
|
||||
}
|
||||
if err := samlRequest.Insert(ctx, tx, scope); err != nil {
|
||||
return fmt.Errorf("cannot store SAML request: %w", err)
|
||||
}
|
||||
|
||||
relayState := coredata.SAMLRelayState{
|
||||
Token: relayStateToken,
|
||||
OrganizationID: organizationID,
|
||||
SAMLConfigID: config.ID,
|
||||
RequestID: authReq.ID,
|
||||
CreatedAt: now,
|
||||
ExpiresAt: relayStateExpiry,
|
||||
}
|
||||
if err := relayState.Insert(ctx, tx, scope); err != nil {
|
||||
return fmt.Errorf("cannot store relay state: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
redirectURL, err := authReq.Redirect(relayStateToken, sp)
|
||||
if err != nil {
|
||||
return "", ErrCannotGenerateRedirectURL{Err: err}
|
||||
}
|
||||
|
||||
return redirectURL.String(), nil
|
||||
}
|
||||
|
||||
type SAMLUserInfo struct {
|
||||
Email string
|
||||
FullName string
|
||||
Role string
|
||||
SAMLSubject string
|
||||
OrganizationID gid.GID
|
||||
TenantID gid.TenantID
|
||||
SAMLConfigID gid.GID
|
||||
}
|
||||
|
||||
func (s *SAMLService) HandleSAMLAssertion(
|
||||
ctx context.Context,
|
||||
req *http.Request,
|
||||
) (*SAMLUserInfo, error) {
|
||||
relayStateToken := req.FormValue("RelayState")
|
||||
if relayStateToken == "" {
|
||||
return nil, fmt.Errorf("missing RelayState in SAML response")
|
||||
}
|
||||
|
||||
var relayState coredata.SAMLRelayState
|
||||
var samlRequest coredata.SAMLRequest
|
||||
var config coredata.SAMLConfiguration
|
||||
var org coredata.Organization
|
||||
|
||||
now := time.Now()
|
||||
|
||||
err := s.pg.WithTx(
|
||||
ctx,
|
||||
func(tx pg.Conn) error {
|
||||
if err := relayState.Load(ctx, tx, relayStateToken); err != nil {
|
||||
return fmt.Errorf("invalid relay state: %w", err)
|
||||
}
|
||||
|
||||
if relayState.IsExpired(now) {
|
||||
return coredata.ErrRelayStateExpired{Token: relayStateToken, ExpiresAt: relayState.ExpiresAt}
|
||||
}
|
||||
|
||||
if err := samlRequest.Load(ctx, tx, relayState.RequestID, relayState.OrganizationID); err != nil {
|
||||
return fmt.Errorf("invalid SAML request: %w", err)
|
||||
}
|
||||
|
||||
if samlRequest.IsExpired(now) {
|
||||
return coredata.ErrSAMLRequestExpired{RequestID: relayState.RequestID, ExpiresAt: samlRequest.ExpiresAt}
|
||||
}
|
||||
|
||||
if err := org.LoadByID(ctx, tx, coredata.NewNoScope(), relayState.OrganizationID); err != nil {
|
||||
return fmt.Errorf("organization not found: %w", err)
|
||||
}
|
||||
|
||||
if err := relayState.Delete(ctx, tx); err != nil {
|
||||
return fmt.Errorf("cannot delete relay state: %w", err)
|
||||
}
|
||||
if err := samlRequest.Delete(ctx, tx); err != nil {
|
||||
return fmt.Errorf("cannot delete SAML request: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
samlResponseEncoded := req.FormValue("SAMLResponse")
|
||||
if samlResponseEncoded == "" {
|
||||
return nil, fmt.Errorf("missing SAMLResponse in request")
|
||||
}
|
||||
|
||||
scope := coredata.NewScope(org.TenantID)
|
||||
err = s.pg.WithConn(
|
||||
ctx,
|
||||
func(conn pg.Conn) error {
|
||||
return config.LoadByID(ctx, conn, scope, relayState.SAMLConfigID)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, ErrSAMLConfigurationNotFound{OrganizationID: relayState.OrganizationID}
|
||||
}
|
||||
|
||||
if !config.Enabled {
|
||||
return nil, ErrSAMLDisabled{OrganizationID: relayState.OrganizationID}
|
||||
}
|
||||
|
||||
sp, err := s.GetServiceProvider(ctx, &config)
|
||||
if err != nil {
|
||||
return nil, ErrCannotCreateServiceProvider{Err: err}
|
||||
}
|
||||
|
||||
if req.URL.Scheme == "" {
|
||||
req.URL.Scheme = "https"
|
||||
}
|
||||
if req.URL.Host == "" {
|
||||
req.URL.Host = req.Host
|
||||
}
|
||||
|
||||
possibleRequestIDs := []string{samlRequest.ID}
|
||||
assertion, err := sp.ParseResponse(req, possibleRequestIDs)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot parse SAML response (SP EntityID: %s, IdP EntityID: %s): %w",
|
||||
s.GetEntityID(), config.IdPEntityID, err)
|
||||
}
|
||||
|
||||
if err := ValidateAssertion(assertion, s.GetEntityID(), now); err != nil {
|
||||
return nil, ErrCannotValidateAssertion{Err: err}
|
||||
}
|
||||
if assertion.ID != "" {
|
||||
var expiresAt time.Time
|
||||
if assertion.Conditions != nil && !assertion.Conditions.NotOnOrAfter.IsZero() {
|
||||
expiresAt = assertion.Conditions.NotOnOrAfter
|
||||
} else {
|
||||
expiresAt = now.Add(24 * time.Hour)
|
||||
}
|
||||
|
||||
scope := coredata.NewScope(org.TenantID)
|
||||
err = s.pg.WithTx(
|
||||
ctx,
|
||||
func(tx pg.Conn) error {
|
||||
return PreventReplayAttack(ctx, tx, scope, assertion.ID, relayState.OrganizationID, expiresAt)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, ErrReplayAttackDetected{AssertionID: assertion.ID, Err: err}
|
||||
}
|
||||
}
|
||||
|
||||
email, fullname, samlRole, err := ExtractUserAttributes(
|
||||
assertion,
|
||||
config.AttributeEmail,
|
||||
config.AttributeFirstname,
|
||||
config.AttributeLastname,
|
||||
config.AttributeRole,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, ErrCannotExtractUserAttributes{Err: err}
|
||||
}
|
||||
|
||||
actualEmailDomain, err := ExtractEmailDomain(email)
|
||||
if err != nil {
|
||||
return nil, ErrCannotExtractUserAttributes{Err: fmt.Errorf("cannot extract domain from email: %w", err)}
|
||||
}
|
||||
if actualEmailDomain != config.EmailDomain {
|
||||
return nil, fmt.Errorf("email domain mismatch: assertion contains email with domain %s but SAML config is for domain %s", actualEmailDomain, config.EmailDomain)
|
||||
}
|
||||
|
||||
systemRole, err := MapSAMLRoleToSystemRole(samlRole, config.DefaultRole)
|
||||
if err != nil {
|
||||
return nil, ErrCannotMapRole{Err: err}
|
||||
}
|
||||
|
||||
samlSubject := ""
|
||||
if assertion.Subject != nil && assertion.Subject.NameID != nil {
|
||||
samlSubject = assertion.Subject.NameID.Value
|
||||
}
|
||||
|
||||
return &SAMLUserInfo{
|
||||
Email: email,
|
||||
FullName: fullname,
|
||||
Role: systemRole,
|
||||
SAMLSubject: samlSubject,
|
||||
OrganizationID: relayState.OrganizationID,
|
||||
TenantID: org.TenantID,
|
||||
SAMLConfigID: relayState.SAMLConfigID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (s *SAMLService) GetMetadataURL(organizationID gid.GID) string {
|
||||
return fmt.Sprintf("%s/auth/saml/metadata/%s", s.baseURL, organizationID)
|
||||
}
|
||||
|
||||
func (s *SAMLService) GenerateMetadata() ([]byte, error) {
|
||||
if s.certificate == nil {
|
||||
return nil, ErrSPCertificateNotConfigured{}
|
||||
}
|
||||
|
||||
return GenerateServiceProviderMetadata(
|
||||
s.GetEntityID(),
|
||||
s.GetAcsURL(),
|
||||
s.certificate,
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user