trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

outpost: update to new api schema

Browse source 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-05-24 14:41:40 +02:00
parent 6f6ae7831e
commit 25a88c17d1
1 changed files with 48 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

64
outpost/pkg/ldap/instance_bind.go
View file

@ -8,6 +8,7 @@ import (
"net/http" "net/http"
"net/http/cookiejar" "net/http/cookiejar"
"net/url" "net/url"
"strconv"
"strings" "strings"
"time" "time"
@ -133,46 +134,77 @@ func (pi *ProviderInstance) delayDeleteUserInfo(dn string) {
}() }()
} }
type ChallengeInt interface {
GetComponent() string
GetType() api.ChallengeChoices
GetResponseErrors() map[string][]api.ErrorDetail
}
func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, error) { func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, error) {
req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug) req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug).Query(urlParams)
req.Query(urlParams)
challenge, _, err := req.Execute() challenge, _, err := req.Execute()
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to get challenge") pi.log.WithError(err).Warning("Failed to get challenge")
return false, err return false, err
} }
pi.log.WithField("component", challenge.Component).WithField("type", challenge.Type).Debug("Got challenge") ch := challenge.GetActualInstance().(ChallengeInt)
responseReq := client.FlowsApi.FlowsExecutorSolve(context.Background(), pi.flowSlug) pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got challenge")
responseReq.Query(urlParams) responseReq := client.FlowsApi.FlowsExecutorSolve(context.Background(), pi.flowSlug).Query(urlParams)
switch *challenge.Component { switch ch.GetComponent() {
case "ak-stage-identification": case "ak-stage-identification":
responseReq.RequestBody(map[string]interface{}{ responseReq.ChallengeResponseRequest(api.ChallengeResponseRequest{
"uid_field": bindDN, IdentificationChallengeResponseRequest: &api.IdentificationChallengeResponseRequest{
UidField: bindDN,
},
}) })
case "ak-stage-password": case "ak-stage-password":
responseReq.RequestBody(map[string]interface{}{ responseReq.ChallengeResponseRequest(api.ChallengeResponseRequest{
"password": password, PasswordChallengeResponseRequest: &api.PasswordChallengeResponseRequest{
Password: password,
},
})
case "ak-stage-authenticator-validate":
// We only support duo as authenticator, check if that's allowed
var deviceChallenge *api.DeviceChallenge
for _, devCh := range challenge.AuthenticatorValidationChallenge.DeviceChallenges {
if devCh.DeviceClass == string(api.DEVICECLASSESENUM_DUO) {
deviceChallenge = &devCh
}
}
if deviceChallenge == nil {
return false, errors.New("got ak-stage-authenticator-validate without duo")
}
devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
if err != nil {
return false, errors.New("failed to convert duo device id to int")
}
devId32 := int32(devId)
responseReq.ChallengeResponseRequest(api.ChallengeResponseRequest{
AuthenticatorValidationChallengeResponseRequest: &api.AuthenticatorValidationChallengeResponseRequest{
Duo: &devId32,
},
}) })
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") return false, errors.New("got ak-stage-access-denied")
default: default:
return false, fmt.Errorf("unsupported challenge type: %s", *challenge.Component) return false, fmt.Errorf("unsupported challenge type: %s", ch.GetComponent())
} }
response, _, err := responseReq.Execute() response, _, err := responseReq.Execute()
pi.log.WithField("component", response.Component).WithField("type", response.Type).Debug("Got response") ch = response.GetActualInstance().(ChallengeInt)
switch *response.Component { pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got response")
switch ch.GetComponent() {
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") return false, errors.New("got ak-stage-access-denied")
} }
if response.Type == "redirect" { if ch.GetType() == "redirect" {
return true, nil return true, nil
} }
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to submit challenge") pi.log.WithError(err).Warning("Failed to submit challenge")
return false, err return false, err
} }
if len(*response.ResponseErrors) > 0 { if len(ch.GetResponseErrors()) > 0 {
for key, errs := range *response.ResponseErrors { for key, errs := range ch.GetResponseErrors() {
for _, err := range errs { for _, err := range errs {
pi.log.WithField("key", key).WithField("code", err.Code).Debug(err.String) pi.log.WithField("key", key).WithField("code", err.Code).Debug(err.String)
return false, nil return false, nil