More multi-domain single sign-on fixes.
Ylian Saint-Hilaire committed
May 24, 2020 at 23:22 UTC
76372d910bf14845ac013d067e58195beaa42434
1 file changed
+27
-21
webserver.js
+27
-21
@@ -1739,11 +1739,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1739
const domain = checkUserIpAddress(req, res);
1740
if (domain == null) { return; }
1741
parent.debug('web', 'handleStrategyLogin: ' + JSON.stringify(req.user));
1742
- if ((req.user != null) && (req.user.id != null) && (domain.id == req.user.id.split('/')[1])) {
1743
- const userid = req.user.id;
1742
+ if ((req.user != null) && (req.user.sid != null)) {
1743
+ const userid = 'user/' + domain.id + '/' + req.user.sid;
1744
var user = obj.users[userid];
1745
if (user == null) {
1746
- if ((domain.newaccounts === true) || (req.user.newaccounts === true)) {
1746
+ var newAccountAllowed = false;
1747
+ if (domain.newaccounts === true) { newAccountAllowed = true; }
1748
+ if ((domain.authstrategies != null) && (domain.authstrategies[req.user.strategy] != null) && (domain.authstrategies[req.user.strategy].newaccounts === true)) { newAccountAllowed = true; }
1749
+
1750
+ if (newAccountAllowed === true) {
1751
// Create the user
1752
parent.debug('web', 'handleStrategyLogin: creating new user: ' + userid);
1753
user = { type: 'user', _id: userid, name: req.user.name, email: req.user.email, creation: Math.floor(Date.now() / 1000), domain: domain.id };
@@ -1757,7 +1761,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1761
if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to create the user. Another event will come.
1762
parent.DispatchEvent(targets, obj, event);
1763
1760
- req.session.userid = req.user.id;
1764
+ req.session.userid = userid;
1765
req.session.domainid = domain.id;
1766
} else {
1767
// New users not allowed
@@ -1782,7 +1786,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1786
parent.DispatchEvent(targets, obj, event);
1787
}
1788
parent.debug('web', 'handleStrategyLogin: succesful login: ' + userid);
1785
- req.session.userid = req.user.id;
1789
+ req.session.userid = userid;
1790
req.session.domainid = domain.id;
1791
}
1792
}
@@ -4183,8 +4187,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4187
// Setup auth strategies using passport if needed
4188
if (typeof domain.authstrategies == 'object') {
4189
const passport = domain.passport = require('passport');
4186
- passport.serializeUser(function (user, done) { done(null, user.id); });
4187
- passport.deserializeUser(function (id, done) { done(null, { id: id }); });
4190
+ passport.serializeUser(function (user, done) { done(null, user.sid); });
4191
+ passport.deserializeUser(function (sid, done) { done(null, { sid: sid }); });
4192
obj.app.use(passport.initialize());
4193
//obj.app.use(passport.session());
4194
@@ -4193,9 +4197,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4197
const TwitterStrategy = require('passport-twitter');
4198
passport.use(new TwitterStrategy({ consumerKey: domain.authstrategies.twitter.clientid, consumerSecret: domain.authstrategies.twitter.clientsecret, callbackURL: url + 'auth-twitter-callback' },
4199
function (token, tokenSecret, profile, cb) {
4196
- var user = { id: 'user/' + domain.id + '/~twitter:' + profile.id, name: profile.displayName };
4200
+ parent.debug('web', 'Twitter profile: ' + JSON.stringify(profile));
4201
+ var user = { sid: '~twitter:' + profile.id, name: profile.displayName, strategy: 'twitter' };
4202
if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
4198
- if (domain.authstrategies.twitter.newaccounts == true) { user.newaccounts = true; }
4203
return cb(null, user);
4204
}
4205
));
@@ -4224,9 +4228,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4228
const GoogleStrategy = require('passport-google-oauth20');
4229
passport.use(new GoogleStrategy({ clientID: domain.authstrategies.google.clientid, clientSecret: domain.authstrategies.google.clientsecret, callbackURL: url + 'auth-google-callback' },
4230
function (token, tokenSecret, profile, cb) {
4227
- var user = { id: 'user/' + domain.id + '/~google:' + profile.id, name: profile.displayName };
4231
+ parent.debug('web', 'Google profile: ' + JSON.stringify(profile));
4232
+ var user = { sid: '~google:' + profile.id, name: profile.displayName, strategy: 'google' };
4233
if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string') && (profile.emails[0].verified == true)) { user.email = profile.emails[0].value; }
4229
- if (domain.authstrategies.google.newaccounts == true) { user.newaccounts = true; }
4234
return cb(null, user);
4235
}
4236
));
@@ -4247,9 +4251,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4251
const GitHubStrategy = require('passport-github2');
4252
passport.use(new GitHubStrategy({ clientID: domain.authstrategies.github.clientid, clientSecret: domain.authstrategies.github.clientsecret, callbackURL: url + 'auth-github-callback' },
4253
function (token, tokenSecret, profile, cb) {
4250
- var user = { id: 'user/' + domain.id + '/~github:' + profile.id, name: profile.displayName };
4254
+ parent.debug('web', 'Github profile: ' + JSON.stringify(profile));
4255
+ var user = { sid: '~github:' + profile.id, name: profile.displayName, strategy: 'github' };
4256
if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
4252
- if (domain.authstrategies.github.newaccounts == true) { user.newaccounts = true; }
4257
return cb(null, user);
4258
}
4259
));
@@ -4270,9 +4274,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4274
const RedditStrategy = require('passport-reddit');
4275
passport.use(new RedditStrategy.Strategy({ clientID: domain.authstrategies.reddit.clientid, clientSecret: domain.authstrategies.reddit.clientsecret, callbackURL: url + 'auth-reddit-callback' },
4276
function (token, tokenSecret, profile, cb) {
4273
- var user = { id: 'user/' + domain.id + '/~reddit:' + profile.id, name: profile.name };
4277
+ parent.debug('web', 'Reddit profile: ' + JSON.stringify(profile));
4278
+ var user = { sid: '~reddit:' + profile.id, name: profile.name, strategy: 'reddit' };
4279
if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
4275
- if (domain.authstrategies.reddit.newaccounts == true) { user.newaccounts = true; }
4280
return cb(null, user);
4281
}
4282
));
@@ -4315,11 +4319,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4319
function (accessToken, refreshtoken, params, profile, done) {
4320
var userex = null;
4321
try { userex = require('jwt-simple').decode(params.id_token, "", true); } catch (ex) { }
4322
+ parent.debug('web', 'Azure profile: ' + JSON.stringify(userex));
4323
var user = null;
4324
if (userex != null) {
4320
- var user = { id: 'user/' + domain.id + '/~azure:' + userex.unique_name, name: userex.name };
4325
+ var user = { sid: '~azure:' + userex.unique_name, name: userex.name, strategy: 'azure' };
4326
if (typeof userex.email == 'string') { user.email = userex.email; }
4322
- if (domain.authstrategies.azure.newaccounts == true) { user.newaccounts = true; }
4327
}
4328
return done(null, user);
4329
}
@@ -4366,11 +4370,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4370
const SamlStrategy = require('passport-saml').Strategy;
4371
passport.use(new SamlStrategy(options,
4372
function (profile, done) {
4373
+ parent.debug('web', 'SAML profile: ' + JSON.stringify(profile));
4374
if (typeof profile.nameID != 'string') { return done(); }
4370
- var user = { id: 'user/' + domain.id + '/~' + profile.issuer + ':' + profile.nameID, name: profile.nameID };
4375
+ var user = { sid: '~' + profile.issuer + ':' + profile.nameID, name: profile.nameID, strategy: 'saml' };
4376
if ((typeof profile.firstname == 'string') && (typeof profile.lastname == 'string')) { user.name = profile.firstname + ' ' + profile.lastname; }
4377
if (typeof profile.email == 'string') { user.email = profile.email; }
4373
- if (domain.authstrategies.saml.newaccounts == true) { user.newaccounts = true; }
4378
return done(null, user);
4379
}
4380
));
@@ -4403,8 +4407,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4407
const SamlStrategy = require('passport-saml').Strategy;
4408
passport.use(new SamlStrategy(options,
4409
function (profile, done) {
4410
+ parent.debug('web', 'Intel profile: ' + JSON.stringify(profile));
4411
if (typeof profile.nameID != 'string') { return done(); }
4407
- var user = { id: 'user/' + domain.id + '/~intel:' + profile.nameID, name: profile.nameID };
4412
+ var user = { sid: '~intel:' + profile.nameID, name: profile.nameID, strategy: 'intel' };
4413
if ((typeof profile.firstname == 'string') && (typeof profile.lastname == 'string')) { user.name = profile.firstname + ' ' + profile.lastname; }
4414
else if ((typeof profile.FirstName == 'string') && (typeof profile.LastName == 'string')) { user.name = profile.FirstName + ' ' + profile.LastName; }
4415
if (typeof profile.email == 'string') { user.email = profile.email; }
@@ -4441,8 +4446,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4446
const SamlStrategy = require('passport-saml').Strategy;
4447
passport.use(new SamlStrategy(options,
4448
function (profile, done) {
4449
+ parent.debug('web', 'JumpCloud profile: ' + JSON.stringify(profile));
4450
if (typeof profile.nameID != 'string') { return done(); }
4445
- var user = { id: 'user/' + domain.id + '/~jumpcloud:' + profile.nameID, name: profile.nameID };
4451
+ var user = { sid: '~jumpcloud:' + profile.nameID, name: profile.nameID, strategy: 'jumpcloud' };
4452
if ((typeof profile.firstname == 'string') && (typeof profile.lastname == 'string')) { user.name = profile.firstname + ' ' + profile.lastname; }
4453
if (typeof profile.email == 'string') { user.email = profile.email; }
4454
return done(null, user);