From 804842e7c5da5fadf9ada4e90dfa8929d6f68ff7 Mon Sep 17 00:00:00 2001 From: ston1th Date: Sun, 10 Jul 2022 17:33:03 +0200 Subject: [PATCH] some improvements --- pkg/core/types.go | 1 + pkg/db/user.go | 5 ++++- pkg/server/context.go | 35 ++++++++++++++++++++++++----------- pkg/server/handler.go | 29 ++++++++++++++++++----------- 4 files changed, 47 insertions(+), 23 deletions(-) diff --git a/pkg/core/types.go b/pkg/core/types.go index 82f4bdf..bf3578c 100644 --- a/pkg/core/types.go +++ b/pkg/core/types.go @@ -8,6 +8,7 @@ type User struct { Password string Created string Secret string + Claims map[string]string Admin bool Disabled bool Locked int diff --git a/pkg/db/user.go b/pkg/db/user.go index 3a005c3..0600f8c 100644 --- a/pkg/db/user.go +++ b/pkg/db/user.go @@ -39,9 +39,12 @@ func (db *DB) GetUsers() (users core.Users, err error) { return } -func (db *DB) GetUserWithoutPassword(username string) (u *core.User, err error) { +func (db *DB) GetUserWithoutSecrets(username string) (u *core.User, err error) { u, err = db.GetUser(username) u.Password = "" + if u.Secret != "" { + u.Secret = "redacted" + } return } diff --git a/pkg/server/context.go b/pkg/server/context.go index cebce91..cc07b28 100644 --- a/pkg/server/context.go +++ b/pkg/server/context.go @@ -301,9 +301,16 @@ func (c *Context) Admin() bool { return c.Token.Claims.GetBool(adminClaim) } -func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) { +func (c *Context) ApproveLogin(u *core.User, challenge string) (rdr string, err error) { + accept := client.NewAcceptLoginRequest(u.Username) + accept.Acr = new(string) + if u.Secret == "" { + *accept.Acr = "pwd" + } else { + *accept.Acr = "mfa" + } cr, resp, err := c.Srv.API.AdminApi.AcceptLoginRequest(context.Background()). - AcceptLoginRequest(*client.NewAcceptLoginRequest(user)). + AcceptLoginRequest(*accept). LoginChallenge(challenge). Execute() if err != nil { @@ -314,7 +321,7 @@ func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) { return } -func (c *Context) ApproveConsent(challenge string) (rdr string, err error) { +func (c *Context) ApproveConsent(u *core.User, challenge string) (rdr string, err error) { ci, err := c.Consent(challenge) if err != nil { return @@ -324,6 +331,15 @@ func (c *Context) ApproveConsent(challenge string) (rdr string, err error) { accept.GrantAccessTokenAudience = ci.RequestedAccessTokenAudience accept.Remember = new(bool) *accept.Remember = true + accept.Session = &client.ConsentRequestSession{ + IdToken: u.Claims, + } + /* + map[string]string{ + "apps": "git", + "git_group": "admin", + }, + */ cr, resp, err := c.Srv.API.AdminApi.AcceptConsentRequest(context.Background()). AcceptConsentRequest(*accept). ConsentChallenge(challenge). @@ -399,14 +415,11 @@ func (c *Context) RevokeSession(user, client string, all bool) (err error) { if client == "" && !all { return } - req := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()). - Subject(user) - if all { - req = req.All(all) - } else { - req = req.Client(client) - } - resp, err := req.Execute() + resp, err := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()). + Subject(user). + Client(client). + All(all). + Execute() if err != nil { return } diff --git a/pkg/server/handler.go b/pkg/server/handler.go index f963a36..d22a73c 100644 --- a/pkg/server/handler.go +++ b/pkg/server/handler.go @@ -112,10 +112,7 @@ func sessionsHandler(ctx *Context) { func loginHandler(ctx *Context) { log := ctx.log.WithName("login") - var ( - data loginData - err error - ) + var data loginData data.LoginChallenge = ctx.Query("login_challenge") ctx.Template("loginHandler") ctx.Data = webData{ @@ -125,7 +122,12 @@ func loginHandler(ctx *Context) { if ctx.LoggedOn() { rdr := sessions if data.LoginChallenge != "" { - rdr, err = ctx.ApproveLogin(ctx.User(), data.LoginChallenge) + u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User()) + if err != nil { + ctx.Error(err) + return + } + rdr, err = ctx.ApproveLogin(u, data.LoginChallenge) if err != nil { ctx.Error(err) return @@ -174,7 +176,7 @@ func loginHandler(ctx *Context) { ctx.Login(u, remember) rdr := sessions if data.LoginChallenge != "" { - rdr, err = ctx.ApproveLogin(data.User, data.LoginChallenge) + rdr, err = ctx.ApproveLogin(u, data.LoginChallenge) if err != nil { ctx.Error(err) return @@ -224,7 +226,7 @@ func loginTotpHandler(ctx *Context) { ctx.Login(u, ctx.Remember()) rdr := sessions if data.LoginChallenge != "" { - rdr, err = ctx.ApproveLogin(user, data.LoginChallenge) + rdr, err = ctx.ApproveLogin(u, data.LoginChallenge) if err != nil { ctx.Error(err) ctx.log.Error(err, "error approving login") @@ -243,6 +245,11 @@ func consentHandler(ctx *Context) { BodyTitle: "Authorize", } var data consentData + u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User()) + if err != nil { + ctx.Error(err) + return + } switch ctx.Method() { case "GET": data.ConsentChallenge = ctx.Query("consent_challenge") @@ -254,7 +261,7 @@ func consentHandler(ctx *Context) { return } if cr.GetSkip() { - rdr, err := ctx.ApproveConsent(data.ConsentChallenge) + rdr, err := ctx.ApproveConsent(u, data.ConsentChallenge) if err != nil { ctx.log.Error(err, "error approving consent") ctx.Error("error approving consent") @@ -276,7 +283,7 @@ func consentHandler(ctx *Context) { var err error rdr := root if consent == "approve" { - rdr, err = ctx.ApproveConsent(data.ConsentChallenge) + rdr, err = ctx.ApproveConsent(u, data.ConsentChallenge) if err != nil { ctx.log.Error(err, "error approving consent") ctx.Error("error approving consent") @@ -356,7 +363,7 @@ func userEditHandler(ctx *Context) { Title: "Edit User", BodyTitle: "Edit User", } - u, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user")) + u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user")) if err != nil { ctx.Error(err) return @@ -523,7 +530,7 @@ func userDelHandler(ctx *Context) { } switch ctx.Method() { case "GET": - user, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user")) + user, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user")) if err != nil { ctx.Error(err) return