Fixed OAuth/SAML when used in multi-domain.
Ylian Saint-Hilaire committed
May 24, 2020 at 22:05 UTC
c706759cb22bd82acab8b5c4bb5a6bb020d3d3c5
2 files changed
+36
-6
docs/MeshCentral2 User's Guide v0.2.9.odt
renamed
Binary files a/docs/MeshCentral2 User's Guide v0.2.8.odt and b/docs/MeshCentral2 User's Guide v0.2.9.odt differ
webserver.js
+36
-6
@@ -4199,8 +4199,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4199
return cb(null, user);
4200
}
4201
));
4202
- obj.app.get(url + 'auth-twitter', domain.passport.authenticate('twitter'));
4202
+ obj.app.get(url + 'auth-twitter', function (req, res, next) {
4203
+ var domain = getDomain(req);
4204
+ if (domain.passport == null) { next(); return; }
4205
+ domain.passport.authenticate('twitter')(req, res, next);
4206
+ });
4207
obj.app.get(url + 'auth-twitter-callback', function (req, res, next) {
4208
+ var domain = getDomain(req);
4209
if (domain.passport == null) { next(); return; }
4210
if ((Object.keys(req.session).length == 0) && (req.query.nmr == null)) {
4211
// This is an empty session likely due to the 302 redirection, redirect again (this is a bit of a hack).
@@ -4225,8 +4230,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4230
return cb(null, user);
4231
}
4232
));
4228
- obj.app.get(url + 'auth-google', domain.passport.authenticate('google', { scope: ['profile', 'email'] }));
4229
- obj.app.get(url + 'auth-google-callback', domain.passport.authenticate('google', { failureRedirect: '/' }), handleStrategyLogin);
4233
+ obj.app.get(url + 'auth-google', function (req, res, next) {
4234
+ var domain = getDomain(req);
4235
+ if (domain.passport == null) { next(); return; }
4236
+ domain.passport.authenticate('google', { scope: ['profile', 'email'] })(req, res, next);
4237
+ });
4238
+ obj.app.get(url + 'auth-google-callback', function (req, res, next) {
4239
+ var domain = getDomain(req);
4240
+ if (domain.passport == null) { next(); return; }
4241
+ domain.passport.authenticate('google', { failureRedirect: '/' })(req, res, next);
4242
+ }, handleStrategyLogin);
4243
}
4244
4245
// Github
@@ -4240,8 +4253,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4253
return cb(null, user);
4254
}
4255
));
4243
- obj.app.get(url + 'auth-github', domain.passport.authenticate('github', { scope: ['user:email'] }));
4244
- obj.app.get(url + 'auth-github-callback', domain.passport.authenticate('github', { failureRedirect: '/' }), handleStrategyLogin);
4256
+ obj.app.get(url + 'auth-github', function (req, res, next) {
4257
+ var domain = getDomain(req);
4258
+ if (domain.passport == null) { next(); return; }
4259
+ domain.passport.authenticate('github', { scope: ['user:email'] })(req, res, next);
4260
+ });
4261
+ obj.app.get(url + 'auth-github-callback', function (req, res, next) {
4262
+ var domain = getDomain(req);
4263
+ if (domain.passport == null) { next(); return; }
4264
+ domain.passport.authenticate('github', { failureRedirect: '/' })(req, res, next);
4265
+ }, handleStrategyLogin);
4266
}
4267
4268
// Reddit
@@ -4256,11 +4277,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4277
}
4278
));
4279
obj.app.get(url + 'auth-reddit', function (req, res, next) {
4280
+ var domain = getDomain(req);
4281
if (domain.passport == null) { next(); return; }
4282
req.session.rstate = obj.crypto.randomBytes(32).toString('hex');
4283
domain.passport.authenticate('reddit', { state: req.session.rstate, duration: 'permanent' })(req, res, next);
4284
});
4285
obj.app.get(url + 'auth-reddit-callback', function (req, res, next) {
4286
+ var domain = getDomain(req);
4287
if (domain.passport == null) { next(); return; }
4288
if ((Object.keys(req.session).length == 0) && (req.query.nmr == null)) {
4289
// This is an empty session likely due to the 302 redirection, redirect again (this is a bit of a hack).
@@ -4302,11 +4325,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4325
}
4326
));
4327
obj.app.get(url + 'auth-azure', function (req, res, next) {
4328
+ var domain = getDomain(req);
4329
if (domain.passport == null) { next(); return; }
4330
req.session.rstate = obj.crypto.randomBytes(32).toString('hex');
4331
domain.passport.authenticate('azure', { state: req.session.rstate })(req, res, next);
4332
});
4333
obj.app.get(url + 'auth-azure-callback', function (req, res, next) {
4334
+ var domain = getDomain(req);
4335
if (domain.passport == null) { next(); return; }
4336
if ((Object.keys(req.session).length == 0) && (req.query.nmr == null)) {
4337
// This is an empty session likely due to the 302 redirection, redirect again (this is a bit of a hack).
@@ -4350,10 +4375,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4375
}
4376
));
4377
obj.app.get(url + 'auth-saml', function (req, res, next) {
4378
+ var domain = getDomain(req);
4379
if (domain.passport == null) { next(); return; }
4380
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4381
});
4382
obj.app.post(url + 'auth-saml-callback', function (req, res, next) {
4383
+ var domain = getDomain(req);
4384
if (domain.passport == null) { next(); return; }
4385
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4386
}, handleStrategyLogin);
@@ -4382,15 +4409,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4409
else if ((typeof profile.FirstName == 'string') && (typeof profile.LastName == 'string')) { user.name = profile.FirstName + ' ' + profile.LastName; }
4410
if (typeof profile.email == 'string') { user.email = profile.email; }
4411
else if (typeof profile.EmailAddress == 'string') { user.email = profile.EmailAddress; }
4385
- console.log(user);
4412
return done(null, user);
4413
}
4414
));
4415
obj.app.get(url + 'auth-intel', function (req, res, next) {
4416
+ var domain = getDomain(req);
4417
if (domain.passport == null) { next(); return; }
4418
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4419
});
4420
obj.app.post(url + 'auth-intel-callback', function (req, res, next) {
4421
+ var domain = getDomain(req);
4422
if (domain.passport == null) { next(); return; }
4423
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4424
}, handleStrategyLogin);
@@ -4421,10 +4449,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4449
}
4450
));
4451
obj.app.get(url + 'auth-jumpcloud', function (req, res, next) {
4452
+ var domain = getDomain(req);
4453
if (domain.passport == null) { next(); return; }
4454
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4455
});
4456
obj.app.post(url + 'auth-jumpcloud-callback', function (req, res, next) {
4457
+ var domain = getDomain(req);
4458
if (domain.passport == null) { next(); return; }
4459
domain.passport.authenticate('saml', { failureRedirect: '/', failureFlash: true })(req, res, next);
4460
}, handleStrategyLogin);