rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use authn.Cookie for SAML SSO

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-19 15:17:11 +04:00
parent ac65c05488
commit d92e893bfd
5 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/server/api/authn/cookie.go
View File

@@ -34,8 +34,8 @@ func (c *Cookie) Set(w http.ResponseWriter, session *coredata.Session) {
)
}
func (c *Cookie) Clear(w http.ResponseWriter, session *coredata.Session) {
securecookie.Clear(w, c.sessionCookieConfig(time.Until(session.ExpiredAt)))
func (c *Cookie) Clear(w http.ResponseWriter) {
securecookie.Clear(w, c.sessionCookieConfig(-1*time.Second))
}
func NewCookie(config *securecookie.Config) *Cookie {

22
pkg/server/api/connect/v1/saml_handler.go
View File

@@ -16,14 +16,19 @@ import (
)
type SAMLHandler struct {
iam *iam.Service
cookieConfig securecookie.Config
baseURL *baseurl.BaseURL
logger *log.Logger
iam *iam.Service
sessionCookie *authn.Cookie
baseURL *baseurl.BaseURL
logger *log.Logger
}
func NewSAMLHandler(iam *iam.Service, cookieConfig securecookie.Config, baseURL *baseurl.BaseURL, logger *log.Logger) *SAMLHandler {
return &SAMLHandler{iam: iam, cookieConfig: cookieConfig, baseURL: baseURL, logger: logger}
return &SAMLHandler{
iam: iam,
sessionCookie: authn.NewCookie(&cookieConfig),
baseURL: baseURL,
logger: logger,
}
}
func (h *SAMLHandler) renderInternalServerError(w http.ResponseWriter, r *http.Request) {
@@ -98,11 +103,8 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
return
}
if err := securecookie.Set(w, h.cookieConfig, rootSession.ID.String()); err != nil {
h.logger.ErrorCtx(ctx, "cannot set cookie", log.Error(err))
h.renderInternalServerError(w, r)
return
}
h.sessionCookie.Set(w, rootSession)
redirectURL := h.baseURL.WithPath("/organizations/" + membership.OrganizationID.String()).MustString()
http.Redirect(w, r, redirectURL, http.StatusFound)
}

2
pkg/server/api/connect/v1/schema.graphql
View File

@@ -46,7 +46,7 @@ type Query {
viewer: Identity @session(required: PRESENT)
ssoLoginURL(email: EmailAddr!): String
@goField(forceResolver: true)
@session(required: NONE)
@session(required: OPTIONAL)
}
type Mutation {

4
pkg/server/api/connect/v1/schema/schema.go
View File

@@ -2321,7 +2321,7 @@ type Query {
viewer: Identity @session(required: PRESENT)
ssoLoginURL(email: EmailAddr!): String
@goField(forceResolver: true)
@session(required: NONE)
@session(required: OPTIONAL)
}
type Mutation {
@@ -9540,7 +9540,7 @@ func (ec *executionContext) _Query_ssoLoginURL(ctx context.Context, field graphq
directive0 := next
directive1 := func(ctx context.Context) (any, error) {
required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "NONE")
required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋgqlutilsᚋdirectivesᚋsessionᚐSessionRequirement(ctx, "OPTIONAL")
if err != nil {
var zeroVal *string
return zeroVal, err

2
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -427,7 +427,7 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload,
}
w := gqlutils.HTTPResponseWriterFromContext(ctx)
r.sessionCookie.Clear(w, session)
r.sessionCookie.Clear(w)
return &types.SignOutPayload{Success: true}, nil
}