rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix missing child session on SAML

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-12-24 15:20:06 +01:00
parent 41a6df9aec
commit 3e95c8c38a
9 changed files with 69 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/connect/v1/resolver.go
View File

@@ -55,7 +55,7 @@ func NewMux(logger *log.Logger, svc *iam.Service, cookieConfig securecookie.Conf
sessionMiddleware := NewSessionMiddleware(svc, cookieConfig)
graphqlHandler := NewGraphQLHandler(svc, logger, baseURL, cookieConfig)
samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL)
samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL, logger)
router := r.With(sessionMiddleware)

48
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -7,6 +7,7 @@ import (
"github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/baseurl"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
@@ -17,10 +18,15 @@ type SAMLHandler struct {
iam *iam.Service
cookieConfig securecookie.Config
baseURL *baseurl.BaseURL
logger *log.Logger
}
func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL) *SAMLHandler {
return &SAMLHandler{iam: iam, cookieConfig: cookieConfig, baseURL: baseURL}
func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL, logger *log.Logger) *SAMLHandler {
return &SAMLHandler{iam: iam, cookieConfig: cookieConfig, baseURL: baseURL, logger: logger}
}
func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter, r *http.Request) {
httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))
}
func (h *SAMLHandler) MetadataHandler(w http.ResponseWriter, r *http.Request) {
@@ -58,17 +64,41 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
return
}
session := SessionFromContext(ctx)
if session == nil {
h.iam.AuthService.OpenSessionWithSAML(ctx, user.ID, membership.OrganizationID)
rootSession := SessionFromContext(ctx)
switch {
case rootSession == nil:
rootSession, err = h.iam.AuthService.OpenSessionWithSAML(ctx, user.ID, membership.OrganizationID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err))
h.renderInternalServerError(w, r)
return
}
case rootSession.IdentityID != user.ID:
err = h.iam.SessionService.CloseSession(ctx, rootSession.ID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
h.renderInternalServerError(w, r)
return
}
rootSession, err = h.iam.AuthService.OpenSessionWithSAML(ctx, user.ID, membership.OrganizationID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err))
h.renderInternalServerError(w, r)
return
}
}
// TODO open or update the organization session
securecookie.Set(w, h.cookieConfig, session.ID.String())
_, _, err = h.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, membership.OrganizationID)
if err != nil {
h.logger.ErrorCtx(ctx, "cannot assume organization session", log.Error(err))
h.renderInternalServerError(w, r)
return
}
securecookie.Set(w, h.cookieConfig, rootSession.ID.String())
redirectURL := h.baseURL.WithPath("/organizations/" + membership.OrganizationID.String()).MustString()
http.Redirect(w, r, redirectURL, http.StatusFound)
}