mirror of https://github.com/go-gitea/gitea
This reverts #25165 (5bb8d1924d), as there
was a chance some important reviews got missed.
so after reverting this patch it will be resubmitted for reviewing again
https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242
temporary Open #5512 again
pull/29243/head
6543
9 months ago
committed by
GitHub
parent
875f5ea6d8
commit
4ba642d07d
File diff suppressed because one or more lines are too long
@ -1,172 +0,0 @@ |
|||||||
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package auth |
|
||||||
|
|
||||||
import ( |
|
||||||
"errors" |
|
||||||
"fmt" |
|
||||||
"net/http" |
|
||||||
"strings" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/models/auth" |
|
||||||
user_model "code.gitea.io/gitea/models/user" |
|
||||||
"code.gitea.io/gitea/modules/context" |
|
||||||
"code.gitea.io/gitea/modules/log" |
|
||||||
"code.gitea.io/gitea/modules/setting" |
|
||||||
"code.gitea.io/gitea/modules/util" |
|
||||||
"code.gitea.io/gitea/modules/web/middleware" |
|
||||||
"code.gitea.io/gitea/services/auth/source/saml" |
|
||||||
"code.gitea.io/gitea/services/externalaccount" |
|
||||||
|
|
||||||
"github.com/markbates/goth" |
|
||||||
) |
|
||||||
|
|
||||||
func SignInSAML(ctx *context.Context) { |
|
||||||
provider := ctx.Params(":provider") |
|
||||||
|
|
||||||
loginSource, err := auth.GetActiveAuthSourceByName(ctx, provider, auth.SAML) |
|
||||||
if err != nil || loginSource == nil { |
|
||||||
ctx.NotFound("SAMLMetadata", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
if err = loginSource.Cfg.(*saml.Source).Callout(ctx.Req, ctx.Resp); err != nil { |
|
||||||
if strings.Contains(err.Error(), "no provider for ") { |
|
||||||
ctx.Error(http.StatusNotFound) |
|
||||||
return |
|
||||||
} |
|
||||||
ctx.ServerError("SignIn", err) |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
func SignInSAMLCallback(ctx *context.Context) { |
|
||||||
provider := ctx.Params(":provider") |
|
||||||
loginSource, err := auth.GetActiveAuthSourceByName(ctx, provider, auth.SAML) |
|
||||||
if err != nil || loginSource == nil { |
|
||||||
ctx.NotFound("SignInSAMLCallback", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
if loginSource == nil { |
|
||||||
ctx.ServerError("SignIn", fmt.Errorf("no valid provider found, check configured callback url in provider")) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
u, gothUser, err := samlUserLoginCallback(*ctx, loginSource, ctx.Req, ctx.Resp) |
|
||||||
if err != nil { |
|
||||||
ctx.ServerError("SignInSAMLCallback", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
if u == nil { |
|
||||||
if ctx.Doer != nil { |
|
||||||
// attach user to already logged in user
|
|
||||||
err = externalaccount.LinkAccountToUser(ctx, ctx.Doer, gothUser, auth.SAML) |
|
||||||
if err != nil { |
|
||||||
ctx.ServerError("LinkAccountToUser", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
ctx.Redirect(setting.AppSubURL + "/user/settings/security") |
|
||||||
return |
|
||||||
} else if !setting.Service.AllowOnlyInternalRegistration && false { |
|
||||||
// TODO: allow auto registration from saml users (OAuth2 uses the following setting.OAuth2Client.EnableAutoRegistration)
|
|
||||||
} else { |
|
||||||
// no existing user is found, request attach or new account
|
|
||||||
showLinkingLogin(ctx, gothUser, auth.SAML) |
|
||||||
return |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
handleSamlSignIn(ctx, loginSource, u, gothUser) |
|
||||||
} |
|
||||||
|
|
||||||
func handleSamlSignIn(ctx *context.Context, source *auth.Source, u *user_model.User, gothUser goth.User) { |
|
||||||
if err := updateSession(ctx, nil, map[string]any{ |
|
||||||
"uid": u.ID, |
|
||||||
"uname": u.Name, |
|
||||||
}); err != nil { |
|
||||||
ctx.ServerError("updateSession", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
// Clear whatever CSRF cookie has right now, force to generate a new one
|
|
||||||
ctx.Csrf.DeleteCookie(ctx) |
|
||||||
|
|
||||||
// Register last login
|
|
||||||
u.SetLastLogin() |
|
||||||
|
|
||||||
// update external user information
|
|
||||||
if err := externalaccount.UpdateExternalUser(ctx, u, gothUser, auth.SAML); err != nil { |
|
||||||
if !errors.Is(err, util.ErrNotExist) { |
|
||||||
log.Error("UpdateExternalUser failed: %v", err) |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
if err := resetLocale(ctx, u); err != nil { |
|
||||||
ctx.ServerError("resetLocale", err) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 { |
|
||||||
middleware.DeleteRedirectToCookie(ctx.Resp) |
|
||||||
ctx.RedirectToFirst(redirectTo) |
|
||||||
return |
|
||||||
} |
|
||||||
|
|
||||||
ctx.Redirect(setting.AppSubURL + "/") |
|
||||||
} |
|
||||||
|
|
||||||
func samlUserLoginCallback(ctx context.Context, authSource *auth.Source, request *http.Request, response http.ResponseWriter) (*user_model.User, goth.User, error) { |
|
||||||
samlSource := authSource.Cfg.(*saml.Source) |
|
||||||
|
|
||||||
gothUser, err := samlSource.Callback(request, response) |
|
||||||
if err != nil { |
|
||||||
return nil, gothUser, err |
|
||||||
} |
|
||||||
|
|
||||||
user := &user_model.User{ |
|
||||||
LoginName: gothUser.UserID, |
|
||||||
LoginType: auth.SAML, |
|
||||||
LoginSource: authSource.ID, |
|
||||||
} |
|
||||||
|
|
||||||
hasUser, err := user_model.GetUser(ctx, user) |
|
||||||
if err != nil { |
|
||||||
return nil, goth.User{}, err |
|
||||||
} |
|
||||||
|
|
||||||
if hasUser { |
|
||||||
return user, gothUser, nil |
|
||||||
} |
|
||||||
|
|
||||||
// search in external linked users
|
|
||||||
externalLoginUser := &user_model.ExternalLoginUser{ |
|
||||||
ExternalID: gothUser.UserID, |
|
||||||
LoginSourceID: authSource.ID, |
|
||||||
} |
|
||||||
hasUser, err = user_model.GetExternalLogin(ctx, externalLoginUser) |
|
||||||
if err != nil { |
|
||||||
return nil, goth.User{}, err |
|
||||||
} |
|
||||||
if hasUser { |
|
||||||
user, err = user_model.GetUserByID(request.Context(), externalLoginUser.UserID) |
|
||||||
return user, gothUser, err |
|
||||||
} |
|
||||||
|
|
||||||
// no user found to login
|
|
||||||
return nil, gothUser, nil |
|
||||||
} |
|
||||||
|
|
||||||
func SAMLMetadata(ctx *context.Context) { |
|
||||||
provider := ctx.Params(":provider") |
|
||||||
loginSource, err := auth.GetActiveAuthSourceByName(ctx, provider, auth.SAML) |
|
||||||
if err != nil || loginSource == nil { |
|
||||||
ctx.NotFound("SAMLMetadata", err) |
|
||||||
return |
|
||||||
} |
|
||||||
if err = loginSource.Cfg.(*saml.Source).Metadata(ctx.Req, ctx.Resp); err != nil { |
|
||||||
ctx.ServerError("SAMLMetadata", err) |
|
||||||
} |
|
||||||
} |
|
||||||
@ -1,22 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml_test |
|
||||||
|
|
||||||
import ( |
|
||||||
auth_model "code.gitea.io/gitea/models/auth" |
|
||||||
"code.gitea.io/gitea/services/auth" |
|
||||||
"code.gitea.io/gitea/services/auth/source/saml" |
|
||||||
) |
|
||||||
|
|
||||||
// This test file exists to assert that our Source exposes the interfaces that we expect
|
|
||||||
// It tightly binds the interfaces and implementation without breaking go import cycles
|
|
||||||
|
|
||||||
type sourceInterface interface { |
|
||||||
auth_model.Config |
|
||||||
auth_model.SourceSettable |
|
||||||
auth_model.RegisterableSource |
|
||||||
auth.PasswordAuthenticator |
|
||||||
} |
|
||||||
|
|
||||||
var _ (sourceInterface) = &saml.Source{} |
|
||||||
@ -1,29 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"context" |
|
||||||
"sync" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/models/auth" |
|
||||||
"code.gitea.io/gitea/modules/log" |
|
||||||
) |
|
||||||
|
|
||||||
var samlRWMutex = sync.RWMutex{} |
|
||||||
|
|
||||||
func Init(ctx context.Context) error { |
|
||||||
loginSources, _ := auth.GetActiveAuthProviderSources(ctx, auth.SAML) |
|
||||||
for _, source := range loginSources { |
|
||||||
samlSource, ok := source.Cfg.(*Source) |
|
||||||
if !ok { |
|
||||||
continue |
|
||||||
} |
|
||||||
err := samlSource.RegisterSource() |
|
||||||
if err != nil { |
|
||||||
log.Error("Unable to register source: %s due to Error: %v.", source.Name, err) |
|
||||||
} |
|
||||||
} |
|
||||||
return nil |
|
||||||
} |
|
||||||
@ -1,38 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
type NameIDFormat int |
|
||||||
|
|
||||||
const ( |
|
||||||
SAML11Email NameIDFormat = iota + 1 |
|
||||||
SAML11Persistent |
|
||||||
SAML11Unspecified |
|
||||||
SAML20Email |
|
||||||
SAML20Persistent |
|
||||||
SAML20Transient |
|
||||||
SAML20Unspecified |
|
||||||
) |
|
||||||
|
|
||||||
const DefaultNameIDFormat NameIDFormat = SAML20Persistent |
|
||||||
|
|
||||||
var NameIDFormatNames = map[NameIDFormat]string{ |
|
||||||
SAML11Email: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", |
|
||||||
SAML11Persistent: "urn:oasis:names:tc:SAML:1.1:nameid-format:persistent", |
|
||||||
SAML11Unspecified: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", |
|
||||||
SAML20Email: "urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress", |
|
||||||
SAML20Persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", |
|
||||||
SAML20Transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", |
|
||||||
SAML20Unspecified: "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified", |
|
||||||
} |
|
||||||
|
|
||||||
// String returns the name of the NameIDFormat
|
|
||||||
func (n NameIDFormat) String() string { |
|
||||||
return NameIDFormatNames[n] |
|
||||||
} |
|
||||||
|
|
||||||
// Int returns the int value of the NameIDFormat
|
|
||||||
func (n NameIDFormat) Int() int { |
|
||||||
return int(n) |
|
||||||
} |
|
||||||
@ -1,109 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"context" |
|
||||||
"fmt" |
|
||||||
"html" |
|
||||||
"html/template" |
|
||||||
"io" |
|
||||||
"net/http" |
|
||||||
"sort" |
|
||||||
"time" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/models/auth" |
|
||||||
"code.gitea.io/gitea/models/db" |
|
||||||
"code.gitea.io/gitea/modules/httplib" |
|
||||||
"code.gitea.io/gitea/modules/svg" |
|
||||||
"code.gitea.io/gitea/modules/util" |
|
||||||
) |
|
||||||
|
|
||||||
// Providers is list of known/available providers.
|
|
||||||
type Providers map[string]Source |
|
||||||
|
|
||||||
var providers = Providers{} |
|
||||||
|
|
||||||
// Provider is an interface for describing a single SAML provider
|
|
||||||
type Provider interface { |
|
||||||
Name() string |
|
||||||
IconHTML(size int) template.HTML |
|
||||||
} |
|
||||||
|
|
||||||
// AuthSourceProvider is a SAML provider
|
|
||||||
type AuthSourceProvider struct { |
|
||||||
sourceName, iconURL string |
|
||||||
} |
|
||||||
|
|
||||||
func (p *AuthSourceProvider) Name() string { |
|
||||||
return p.sourceName |
|
||||||
} |
|
||||||
|
|
||||||
func (p *AuthSourceProvider) IconHTML(size int) template.HTML { |
|
||||||
if p.iconURL != "" { |
|
||||||
return template.HTML(fmt.Sprintf(`<img class="gt-object-contain gt-mr-3" width="%d" height="%d" src="%s" alt="%s">`, |
|
||||||
size, |
|
||||||
size, |
|
||||||
html.EscapeString(p.iconURL), html.EscapeString(p.Name()), |
|
||||||
)) |
|
||||||
} |
|
||||||
return svg.RenderHTML("gitea-lock-cog", size, "gt-mr-3") |
|
||||||
} |
|
||||||
|
|
||||||
func readIdentityProviderMetadata(ctx context.Context, source *Source) ([]byte, error) { |
|
||||||
if source.IdentityProviderMetadata != "" { |
|
||||||
return []byte(source.IdentityProviderMetadata), nil |
|
||||||
} |
|
||||||
|
|
||||||
req := httplib.NewRequest(source.IdentityProviderMetadataURL, "GET") |
|
||||||
req.SetTimeout(20*time.Second, time.Minute) |
|
||||||
resp, err := req.Response() |
|
||||||
if err != nil { |
|
||||||
return nil, fmt.Errorf("Unable to contact gitea: %v", err) |
|
||||||
} |
|
||||||
defer resp.Body.Close() |
|
||||||
if resp.StatusCode != http.StatusOK { |
|
||||||
return nil, err |
|
||||||
} |
|
||||||
|
|
||||||
data, err := io.ReadAll(resp.Body) |
|
||||||
if err != nil { |
|
||||||
return nil, err |
|
||||||
} |
|
||||||
return data, nil |
|
||||||
} |
|
||||||
|
|
||||||
func createProviderFromSource(source *auth.Source) (Provider, error) { |
|
||||||
samlCfg, ok := source.Cfg.(*Source) |
|
||||||
if !ok { |
|
||||||
return nil, fmt.Errorf("invalid SAML source config: %v", samlCfg) |
|
||||||
} |
|
||||||
return &AuthSourceProvider{sourceName: source.Name, iconURL: samlCfg.IconURL}, nil |
|
||||||
} |
|
||||||
|
|
||||||
// GetSAMLProviders returns the list of configured SAML providers
|
|
||||||
func GetSAMLProviders(ctx context.Context, isActive util.OptionalBool) ([]Provider, error) { |
|
||||||
authSources, err := db.Find[auth.Source](ctx, auth.FindSourcesOptions{ |
|
||||||
IsActive: isActive, |
|
||||||
LoginType: auth.SAML, |
|
||||||
}) |
|
||||||
if err != nil { |
|
||||||
return nil, err |
|
||||||
} |
|
||||||
|
|
||||||
samlProviders := make([]Provider, 0, len(authSources)) |
|
||||||
for _, source := range authSources { |
|
||||||
p, err := createProviderFromSource(source) |
|
||||||
if err != nil { |
|
||||||
return nil, err |
|
||||||
} |
|
||||||
samlProviders = append(samlProviders, p) |
|
||||||
} |
|
||||||
|
|
||||||
sort.Slice(samlProviders, func(i, j int) bool { |
|
||||||
return samlProviders[i].Name() < samlProviders[j].Name() |
|
||||||
}) |
|
||||||
|
|
||||||
return samlProviders, nil |
|
||||||
} |
|
||||||
@ -1,202 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"context" |
|
||||||
"crypto/rand" |
|
||||||
"crypto/rsa" |
|
||||||
"crypto/tls" |
|
||||||
"crypto/x509" |
|
||||||
"encoding/base64" |
|
||||||
"encoding/pem" |
|
||||||
"encoding/xml" |
|
||||||
"errors" |
|
||||||
"fmt" |
|
||||||
"math/big" |
|
||||||
"net/url" |
|
||||||
"time" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/models/auth" |
|
||||||
"code.gitea.io/gitea/modules/json" |
|
||||||
"code.gitea.io/gitea/modules/log" |
|
||||||
"code.gitea.io/gitea/modules/setting" |
|
||||||
|
|
||||||
saml2 "github.com/russellhaering/gosaml2" |
|
||||||
"github.com/russellhaering/gosaml2/types" |
|
||||||
dsig "github.com/russellhaering/goxmldsig" |
|
||||||
) |
|
||||||
|
|
||||||
// Source holds configuration for the SAML login source.
|
|
||||||
type Source struct { |
|
||||||
// IdentityProviderMetadata description: The SAML Identity Provider metadata XML contents (for static configuration of the SAML Service Provider). The value of this field should be an XML document whose root element is `<EntityDescriptor>` or `<EntityDescriptors>`. To escape the value into a JSON string, you may want to use a tool like https://json-escape-text.now.sh.
|
|
||||||
IdentityProviderMetadata string |
|
||||||
// IdentityProviderMetadataURL description: The SAML Identity Provider metadata URL (for dynamic configuration of the SAML Service Provider).
|
|
||||||
IdentityProviderMetadataURL string |
|
||||||
// InsecureSkipAssertionSignatureValidation description: Whether the Service Provider should (insecurely) accept assertions from the Identity Provider without a valid signature.
|
|
||||||
InsecureSkipAssertionSignatureValidation bool |
|
||||||
// NameIDFormat description: The SAML NameID format to use when performing user authentication.
|
|
||||||
NameIDFormat NameIDFormat |
|
||||||
// ServiceProviderCertificate description: The SAML Service Provider certificate in X.509 encoding (begins with "-----BEGIN CERTIFICATE-----"). This certificate is used by the Identity Provider to validate the Service Provider's AuthnRequests and LogoutRequests. It corresponds to the Service Provider's private key (`serviceProviderPrivateKey`). To escape the value into a JSON string, you may want to use a tool like https://json-escape-text.now.sh.
|
|
||||||
ServiceProviderCertificate string |
|
||||||
// ServiceProviderIssuer description: The SAML Service Provider name, used to identify this Service Provider. This is required if the "externalURL" field is not set (as the SAML metadata endpoint is computed as "<externalURL>.auth/saml/metadata"), or when using multiple SAML authentication providers.
|
|
||||||
ServiceProviderIssuer string |
|
||||||
// ServiceProviderPrivateKey description: The SAML Service Provider private key in PKCS#8 encoding (begins with "-----BEGIN PRIVATE KEY-----"). This private key is used to sign AuthnRequests and LogoutRequests. It corresponds to the Service Provider's certificate (`serviceProviderCertificate`). To escape the value into a JSON string, you may want to use a tool like https://json-escape-text.now.sh.
|
|
||||||
ServiceProviderPrivateKey string |
|
||||||
|
|
||||||
CallbackURL string |
|
||||||
IconURL string |
|
||||||
|
|
||||||
// EmailAssertionKey description: Assertion key for user.Email
|
|
||||||
EmailAssertionKey string |
|
||||||
// NameAssertionKey description: Assertion key for user.NickName
|
|
||||||
NameAssertionKey string |
|
||||||
// UsernameAssertionKey description: Assertion key for user.Name
|
|
||||||
UsernameAssertionKey string |
|
||||||
|
|
||||||
// reference to the authSource
|
|
||||||
authSource *auth.Source |
|
||||||
|
|
||||||
samlSP *saml2.SAMLServiceProvider |
|
||||||
} |
|
||||||
|
|
||||||
func GenerateSAMLSPKeypair() (string, string, error) { |
|
||||||
key, err := rsa.GenerateKey(rand.Reader, 4096) |
|
||||||
if err != nil { |
|
||||||
return "", "", err |
|
||||||
} |
|
||||||
|
|
||||||
keyBytes := x509.MarshalPKCS1PrivateKey(key) |
|
||||||
keyPem := pem.EncodeToMemory( |
|
||||||
&pem.Block{ |
|
||||||
Type: "RSA PRIVATE KEY", |
|
||||||
Bytes: keyBytes, |
|
||||||
}, |
|
||||||
) |
|
||||||
|
|
||||||
now := time.Now() |
|
||||||
|
|
||||||
template := &x509.Certificate{ |
|
||||||
SerialNumber: big.NewInt(0), |
|
||||||
NotBefore: now.Add(-5 * time.Minute), |
|
||||||
NotAfter: now.Add(365 * 24 * time.Hour), |
|
||||||
|
|
||||||
KeyUsage: x509.KeyUsageDigitalSignature, |
|
||||||
ExtKeyUsage: []x509.ExtKeyUsage{}, |
|
||||||
BasicConstraintsValid: true, |
|
||||||
} |
|
||||||
|
|
||||||
certificate, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key) |
|
||||||
if err != nil { |
|
||||||
return "", "", err |
|
||||||
} |
|
||||||
|
|
||||||
certPem := pem.EncodeToMemory( |
|
||||||
&pem.Block{ |
|
||||||
Type: "CERTIFICATE", |
|
||||||
Bytes: certificate, |
|
||||||
}, |
|
||||||
) |
|
||||||
|
|
||||||
return string(keyPem), string(certPem), nil |
|
||||||
} |
|
||||||
|
|
||||||
func (source *Source) initSAMLSp() error { |
|
||||||
source.CallbackURL = setting.AppURL + "user/saml/" + url.PathEscape(source.authSource.Name) + "/acs" |
|
||||||
|
|
||||||
idpMetadata, err := readIdentityProviderMetadata(context.Background(), source) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
{ |
|
||||||
if source.IdentityProviderMetadataURL != "" { |
|
||||||
log.Trace(fmt.Sprintf("Identity Provider metadata: %s", source.IdentityProviderMetadataURL), string(idpMetadata)) |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
metadata := &types.EntityDescriptor{} |
|
||||||
err = xml.Unmarshal(idpMetadata, metadata) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
certStore := dsig.MemoryX509CertificateStore{ |
|
||||||
Roots: []*x509.Certificate{}, |
|
||||||
} |
|
||||||
|
|
||||||
if metadata.IDPSSODescriptor == nil { |
|
||||||
return errors.New("saml idp metadata missing IDPSSODescriptor") |
|
||||||
} |
|
||||||
|
|
||||||
for _, kd := range metadata.IDPSSODescriptor.KeyDescriptors { |
|
||||||
for idx, xcert := range kd.KeyInfo.X509Data.X509Certificates { |
|
||||||
if xcert.Data == "" { |
|
||||||
return fmt.Errorf("metadata certificate(%d) must not be empty", idx) |
|
||||||
} |
|
||||||
certData, err := base64.StdEncoding.DecodeString(xcert.Data) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
idpCert, err := x509.ParseCertificate(certData) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
certStore.Roots = append(certStore.Roots, idpCert) |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
var keyStore dsig.X509KeyStore |
|
||||||
|
|
||||||
if source.ServiceProviderCertificate != "" && source.ServiceProviderPrivateKey != "" { |
|
||||||
keyPair, err := tls.X509KeyPair([]byte(source.ServiceProviderCertificate), []byte(source.ServiceProviderPrivateKey)) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
keyPair.Leaf, err = x509.ParseCertificate(keyPair.Certificate[0]) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
keyStore = dsig.TLSCertKeyStore(keyPair) |
|
||||||
} |
|
||||||
|
|
||||||
source.samlSP = &saml2.SAMLServiceProvider{ |
|
||||||
IdentityProviderSSOURL: metadata.IDPSSODescriptor.SingleSignOnServices[0].Location, |
|
||||||
IdentityProviderIssuer: metadata.EntityID, |
|
||||||
AudienceURI: setting.AppURL + "user/saml/" + url.PathEscape(source.authSource.Name) + "/metadata", |
|
||||||
AssertionConsumerServiceURL: source.CallbackURL, |
|
||||||
SkipSignatureValidation: source.InsecureSkipAssertionSignatureValidation, |
|
||||||
NameIdFormat: source.NameIDFormat.String(), |
|
||||||
IDPCertificateStore: &certStore, |
|
||||||
SignAuthnRequests: source.ServiceProviderCertificate != "" && source.ServiceProviderPrivateKey != "", |
|
||||||
SPKeyStore: keyStore, |
|
||||||
ServiceProviderIssuer: setting.AppURL + "user/saml/" + url.PathEscape(source.authSource.Name) + "/metadata", |
|
||||||
} |
|
||||||
|
|
||||||
return nil |
|
||||||
} |
|
||||||
|
|
||||||
// FromDB fills up a SAML from serialized format.
|
|
||||||
func (source *Source) FromDB(bs []byte) error { |
|
||||||
if err := json.UnmarshalHandleDoubleEncode(bs, &source); err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
return source.initSAMLSp() |
|
||||||
} |
|
||||||
|
|
||||||
// ToDB exports a SAML to a serialized format.
|
|
||||||
func (source *Source) ToDB() ([]byte, error) { |
|
||||||
return json.Marshal(source) |
|
||||||
} |
|
||||||
|
|
||||||
// SetAuthSource sets the related AuthSource
|
|
||||||
func (source *Source) SetAuthSource(authSource *auth.Source) { |
|
||||||
source.authSource = authSource |
|
||||||
} |
|
||||||
|
|
||||||
func init() { |
|
||||||
auth.RegisterTypeConfig(auth.SAML, &Source{}) |
|
||||||
} |
|
||||||
@ -1,16 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"context" |
|
||||||
|
|
||||||
user_model "code.gitea.io/gitea/models/user" |
|
||||||
"code.gitea.io/gitea/services/auth/source/db" |
|
||||||
) |
|
||||||
|
|
||||||
// Authenticate falls back to the db authenticator
|
|
||||||
func (source *Source) Authenticate(ctx context.Context, user *user_model.User, login, password string) (*user_model.User, error) { |
|
||||||
return db.Authenticate(ctx, user, login, password) |
|
||||||
} |
|
||||||
@ -1,89 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"fmt" |
|
||||||
"net/http" |
|
||||||
"strings" |
|
||||||
|
|
||||||
"github.com/markbates/goth" |
|
||||||
) |
|
||||||
|
|
||||||
// Callout redirects request/response pair to authenticate against the provider
|
|
||||||
func (source *Source) Callout(request *http.Request, response http.ResponseWriter) error { |
|
||||||
samlRWMutex.RLock() |
|
||||||
defer samlRWMutex.RUnlock() |
|
||||||
if _, ok := providers[source.authSource.Name]; !ok { |
|
||||||
return fmt.Errorf("no provider for this saml") |
|
||||||
} |
|
||||||
|
|
||||||
authURL, err := providers[source.authSource.Name].samlSP.BuildAuthURL("") |
|
||||||
if err == nil { |
|
||||||
http.Redirect(response, request, authURL, http.StatusTemporaryRedirect) |
|
||||||
} |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
// Callback handles SAML callback, resolve to a goth user and send back to original url
|
|
||||||
// this will trigger a new authentication request, but because we save it in the session we can use that
|
|
||||||
func (source *Source) Callback(request *http.Request, response http.ResponseWriter) (goth.User, error) { |
|
||||||
samlRWMutex.RLock() |
|
||||||
defer samlRWMutex.RUnlock() |
|
||||||
|
|
||||||
user := goth.User{ |
|
||||||
Provider: source.authSource.Name, |
|
||||||
} |
|
||||||
samlResponse := request.FormValue("SAMLResponse") |
|
||||||
assertions, err := source.samlSP.RetrieveAssertionInfo(samlResponse) |
|
||||||
if err != nil { |
|
||||||
return user, err |
|
||||||
} |
|
||||||
|
|
||||||
if assertions.WarningInfo.OneTimeUse { |
|
||||||
return user, fmt.Errorf("SAML response contains one time use warning") |
|
||||||
} |
|
||||||
|
|
||||||
if assertions.WarningInfo.ProxyRestriction != nil { |
|
||||||
return user, fmt.Errorf("SAML response contains proxy restriction warning: %v", assertions.WarningInfo.ProxyRestriction) |
|
||||||
} |
|
||||||
|
|
||||||
if assertions.WarningInfo.NotInAudience { |
|
||||||
return user, fmt.Errorf("SAML response contains audience warning") |
|
||||||
} |
|
||||||
|
|
||||||
if assertions.WarningInfo.InvalidTime { |
|
||||||
return user, fmt.Errorf("SAML response contains invalid time warning") |
|
||||||
} |
|
||||||
|
|
||||||
samlMap := make(map[string]string) |
|
||||||
for key, value := range assertions.Values { |
|
||||||
keyParsed := strings.ToLower(key[strings.LastIndex(key, "/")+1:]) // Uses the trailing slug as the key name.
|
|
||||||
valueParsed := value.Values[0].Value |
|
||||||
samlMap[keyParsed] = valueParsed |
|
||||||
|
|
||||||
} |
|
||||||
|
|
||||||
user.UserID = assertions.NameID |
|
||||||
if user.UserID == "" { |
|
||||||
return user, fmt.Errorf("no nameID found in SAML response") |
|
||||||
} |
|
||||||
|
|
||||||
// email
|
|
||||||
if _, ok := samlMap[source.EmailAssertionKey]; !ok { |
|
||||||
user.Email = samlMap[source.EmailAssertionKey] |
|
||||||
} |
|
||||||
// name
|
|
||||||
if _, ok := samlMap[source.NameAssertionKey]; !ok { |
|
||||||
user.NickName = samlMap[source.NameAssertionKey] |
|
||||||
} |
|
||||||
// username
|
|
||||||
if _, ok := samlMap[source.UsernameAssertionKey]; !ok { |
|
||||||
user.Name = samlMap[source.UsernameAssertionKey] |
|
||||||
} |
|
||||||
|
|
||||||
// TODO: utilize groups once mapping is supported
|
|
||||||
|
|
||||||
return user, nil |
|
||||||
} |
|
||||||
@ -1,32 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
import ( |
|
||||||
"encoding/xml" |
|
||||||
"fmt" |
|
||||||
"net/http" |
|
||||||
) |
|
||||||
|
|
||||||
// Metadata redirects request/response pair to authenticate against the provider
|
|
||||||
func (source *Source) Metadata(request *http.Request, response http.ResponseWriter) error { |
|
||||||
samlRWMutex.RLock() |
|
||||||
defer samlRWMutex.RUnlock() |
|
||||||
if _, ok := providers[source.authSource.Name]; !ok { |
|
||||||
return fmt.Errorf("provider does not exist") |
|
||||||
} |
|
||||||
|
|
||||||
metadata, err := providers[source.authSource.Name].samlSP.Metadata() |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
buf, err := xml.Marshal(metadata) |
|
||||||
if err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
|
|
||||||
response.Header().Set("Content-Type", "application/samlmetadata+xml; charset=utf-8") |
|
||||||
_, _ = response.Write(buf) |
|
||||||
return nil |
|
||||||
} |
|
||||||
@ -1,23 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package saml |
|
||||||
|
|
||||||
// RegisterSource causes an OAuth2 configuration to be registered
|
|
||||||
func (source *Source) RegisterSource() error { |
|
||||||
samlRWMutex.Lock() |
|
||||||
defer samlRWMutex.Unlock() |
|
||||||
if err := source.initSAMLSp(); err != nil { |
|
||||||
return err |
|
||||||
} |
|
||||||
providers[source.authSource.Name] = *source |
|
||||||
return nil |
|
||||||
} |
|
||||||
|
|
||||||
// UnregisterSource causes an SAML configuration to be unregistered
|
|
||||||
func (source *Source) UnregisterSource() error { |
|
||||||
samlRWMutex.Lock() |
|
||||||
defer samlRWMutex.Unlock() |
|
||||||
delete(providers, source.authSource.Name) |
|
||||||
return nil |
|
||||||
} |
|
||||||
@ -1,62 +0,0 @@ |
|||||||
<div class="saml field {{if not (eq .type 8)}}gt-hidden{{end}}"> |
|
||||||
|
|
||||||
<div class="inline required field"> |
|
||||||
<label>{{ctx.Locale.Tr "admin.auths.saml_nameidformat"}}</label> |
|
||||||
<div class="ui selection type dropdown"> |
|
||||||
<input type="hidden" id="name_id_format" name="name_id_format" value="{{.name_id_format}}"> |
|
||||||
<div class="text">{{.CurrentNameIDFormat}}</div> |
|
||||||
{{svg "octicon-triangle-down" 14 "dropdown icon"}} |
|
||||||
<div class="menu"> |
|
||||||
{{range .NameIDFormats}} |
|
||||||
<div class="item" data-value="{{.Type.Int}}">{{.Name}}</div> |
|
||||||
{{end}} |
|
||||||
</div> |
|
||||||
</div> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="optional field"> |
|
||||||
<label for="saml_icon_url">{{ctx.Locale.Tr "admin.auths.saml_icon_url"}}</label> |
|
||||||
<input id="saml_icon_url" name="saml_icon_url" value="{{.SAMLIconURL}}"> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="field"> |
|
||||||
<label for="identity_provider_metadata_url">{{ctx.Locale.Tr "admin.auths.saml_identity_provider_metadata_url"}}</label> |
|
||||||
<input id="identity_provider_metadata_url" name="identity_provider_metadata_url" value="{{.IdentityProviderMetadataURL}}"> |
|
||||||
</div> |
|
||||||
<div class="field"> |
|
||||||
<label for="identity_provider_metadata">{{ctx.Locale.Tr "admin.auths.saml_identity_provider_metadata"}}</label> |
|
||||||
<textarea rows=2 id="identity_provider_metadata" name="identity_provider_metadata" value="{{.IdentityProviderMetadata}}"></textarea> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="inline field"> |
|
||||||
<div class="ui checkbox"> |
|
||||||
<label><strong>{{ctx.Locale.Tr "admin.auths.saml_insecure_skip_assertion_signature_validation"}}</strong></label> |
|
||||||
<input name="insecure_skip_assertion_signature_validation" type="checkbox" {{if .InsecureSkipAssertionSignatureValidation}}checked{{end}}> |
|
||||||
</div> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="field"> |
|
||||||
<label for="service_provider_certificate">{{ctx.Locale.Tr "admin.auths.saml_service_provider_certificate"}}</label> |
|
||||||
<textarea rows=2 id="service_provider_certificate" name="service_provider_certificate" value="{{.ServiceProviderCertificate}}"></textarea> |
|
||||||
</div> |
|
||||||
<div class="field"> |
|
||||||
<label for="service_provider_private_key">{{ctx.Locale.Tr "admin.auths.saml_service_provider_private_key"}}</label> |
|
||||||
<textarea rows=2 id="service_provider_private_key" name="service_provider_private_key" value="{{.ServiceProviderPrivateKey}}"></textarea> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="field"> |
|
||||||
<label for="email_assertion_key">{{ctx.Locale.Tr "admin.auths.saml_identity_provider_email_assertion_key"}}</label> |
|
||||||
<input id="email_assertion_key" name="email_assertion_key" value="{{if not .EmailAssertionKey}}http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress{{else}}{{.EmailAssertionKey}}{{end}}"> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="field"> |
|
||||||
<label for="name_assertion_key">{{ctx.Locale.Tr "admin.auths.saml_identity_provider_name_assertion_key"}}</label> |
|
||||||
<input id="name_assertion_key" name="name_assertion_key" value="{{if not .NameAssertionKey}}http://schemas.xmlsoap.org/claims/CommonName{{else}}{{.NameAssertionKey}}{{end}}"> |
|
||||||
</div> |
|
||||||
|
|
||||||
<div class="field"> |
|
||||||
<label for="username_assertion_key">{{ctx.Locale.Tr "admin.auths.saml_identity_provider_username_assertion_key"}}</label> |
|
||||||
<input id="username_assertion_key" name="username_assertion_key" value="{{if not .UsernameAssertionKey}}http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name{{else}}{{.UsernameAssertionKey}}{{end}}"> |
|
||||||
</div> |
|
||||||
|
|
||||||
</div> |
|
||||||
@ -1,150 +0,0 @@ |
|||||||
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
||||||
// SPDX-License-Identifier: MIT
|
|
||||||
|
|
||||||
package integration |
|
||||||
|
|
||||||
import ( |
|
||||||
"crypto/tls" |
|
||||||
"crypto/x509" |
|
||||||
"fmt" |
|
||||||
"io" |
|
||||||
"net/http" |
|
||||||
"net/http/cookiejar" |
|
||||||
"net/url" |
|
||||||
"os" |
|
||||||
"regexp" |
|
||||||
"strings" |
|
||||||
"testing" |
|
||||||
"time" |
|
||||||
|
|
||||||
"code.gitea.io/gitea/models/auth" |
|
||||||
"code.gitea.io/gitea/models/db" |
|
||||||
user_model "code.gitea.io/gitea/models/user" |
|
||||||
"code.gitea.io/gitea/modules/setting" |
|
||||||
"code.gitea.io/gitea/modules/test" |
|
||||||
"code.gitea.io/gitea/services/auth/source/saml" |
|
||||||
"code.gitea.io/gitea/tests" |
|
||||||
|
|
||||||
"github.com/stretchr/testify/assert" |
|
||||||
) |
|
||||||
|
|
||||||
func TestSAMLRegistration(t *testing.T) { |
|
||||||
defer tests.PrepareTestEnv(t)() |
|
||||||
|
|
||||||
samlURL := "localhost:8080" |
|
||||||
|
|
||||||
if os.Getenv("CI") == "" || !setting.Database.Type.IsPostgreSQL() { |
|
||||||
// Make it possible to run tests against a local simplesaml instance
|
|
||||||
samlURL = os.Getenv("TEST_SIMPLESAML_URL") |
|
||||||
if samlURL == "" { |
|
||||||
t.Skip("TEST_SIMPLESAML_URL not set and not running in CI") |
|
||||||
return |
|
||||||
} |
|
||||||
} |
|
||||||
|
|
||||||
privateKey, cert, err := saml.GenerateSAMLSPKeypair() |
|
||||||
assert.NoError(t, err) |
|
||||||
|
|
||||||
// verify that the keypair can be parsed
|
|
||||||
keyPair, err := tls.X509KeyPair([]byte(cert), []byte(privateKey)) |
|
||||||
assert.NoError(t, err) |
|
||||||
keyPair.Leaf, err = x509.ParseCertificate(keyPair.Certificate[0]) |
|
||||||
assert.NoError(t, err) |
|
||||||
|
|
||||||
assert.NoError(t, auth.CreateSource(db.DefaultContext, &auth.Source{ |
|
||||||
Type: auth.SAML, |
|
||||||
Name: "test-sp", |
|
||||||
IsActive: true, |
|
||||||
IsSyncEnabled: false, |
|
||||||
Cfg: &saml.Source{ |
|
||||||
IdentityProviderMetadata: "", |
|
||||||
IdentityProviderMetadataURL: fmt.Sprintf("http://%s/simplesaml/saml2/idp/metadata.php", samlURL), |
|
||||||
InsecureSkipAssertionSignatureValidation: false, |
|
||||||
NameIDFormat: 4, |
|
||||||
ServiceProviderCertificate: "", // SimpleSAMLPhp requires that the SP certificate be specified in the server configuration rather than SP metadata
|
|
||||||
ServiceProviderPrivateKey: "", |
|
||||||
EmailAssertionKey: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", |
|
||||||
NameAssertionKey: "http://schemas.xmlsoap.org/claims/CommonName", |
|
||||||
UsernameAssertionKey: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", |
|
||||||
IconURL: "", |
|
||||||
}, |
|
||||||
})) |
|
||||||
|
|
||||||
// check the saml metadata url
|
|
||||||
req := NewRequest(t, "GET", "/user/saml/test-sp/metadata") |
|
||||||
MakeRequest(t, req, http.StatusOK) |
|
||||||
|
|
||||||
req = NewRequest(t, "GET", "/user/saml/test-sp") |
|
||||||
resp := MakeRequest(t, req, http.StatusTemporaryRedirect) |
|
||||||
|
|
||||||
jar, err := cookiejar.New(nil) |
|
||||||
assert.NoError(t, err) |
|
||||||
|
|
||||||
client := http.Client{ |
|
||||||
Timeout: 30 * time.Second, |
|
||||||
Jar: jar, |
|
||||||
} |
|
||||||
|
|
||||||
httpReq, err := http.NewRequest("GET", test.RedirectURL(resp), nil) |
|
||||||
assert.NoError(t, err) |
|
||||||
|
|
||||||
var formRedirectURL *url.URL |
|
||||||
client.CheckRedirect = func(req *http.Request, via []*http.Request) error { |
|
||||||
// capture the redirected destination to use in POST request
|
|
||||||
formRedirectURL = req.URL |
|
||||||
return nil |
|
||||||
} |
|
||||||
|
|
||||||
res, err := client.Do(httpReq) |
|
||||||
client.CheckRedirect = nil |
|
||||||
assert.NoError(t, err) |
|
||||||
assert.Equal(t, http.StatusOK, res.StatusCode) |
|
||||||
assert.NotNil(t, formRedirectURL) |
|
||||||
|
|
||||||
form := url.Values{ |
|
||||||
"username": {"user1"}, |
|
||||||
"password": {"user1pass"}, |
|
||||||
} |
|
||||||
|
|
||||||
httpReq, err = http.NewRequest("POST", formRedirectURL.String(), strings.NewReader(form.Encode())) |
|
||||||
assert.NoError(t, err) |
|
||||||
httpReq.Header.Add("Content-Type", "application/x-www-form-urlencoded") |
|
||||||
|
|
||||||
res, err = client.Do(httpReq) |
|
||||||
assert.NoError(t, err) |
|
||||||
assert.Equal(t, http.StatusOK, res.StatusCode) |
|
||||||
|
|
||||||
body, err := io.ReadAll(res.Body) |
|
||||||
assert.NoError(t, err) |
|
||||||
|
|
||||||
samlResMatcher := regexp.MustCompile(`<input.*?name="SAMLResponse".*?value="([^"]+)".*?>`) |
|
||||||
matches := samlResMatcher.FindStringSubmatch(string(body)) |
|
||||||
assert.Len(t, matches, 2) |
|
||||||
assert.NoError(t, res.Body.Close()) |
|
||||||
|
|
||||||
session := emptyTestSession(t) |
|
||||||
|
|
||||||
req = NewRequestWithValues(t, "POST", "/user/saml/test-sp/acs", map[string]string{ |
|
||||||
"SAMLResponse": matches[1], |
|
||||||
}) |
|
||||||
resp = session.MakeRequest(t, req, http.StatusSeeOther) |
|
||||||
assert.Equal(t, test.RedirectURL(resp), "/user/link_account") |
|
||||||
|
|
||||||
csrf := GetCSRF(t, session, test.RedirectURL(resp)) |
|
||||||
|
|
||||||
// link the account
|
|
||||||
req = NewRequestWithValues(t, "POST", "/user/link_account_signup", map[string]string{ |
|
||||||
"_csrf": csrf, |
|
||||||
"user_name": "samluser", |
|
||||||
"email": "saml@example.com", |
|
||||||
}) |
|
||||||
|
|
||||||
resp = session.MakeRequest(t, req, http.StatusSeeOther) |
|
||||||
assert.Equal(t, test.RedirectURL(resp), "/") |
|
||||||
|
|
||||||
// verify that the user was created
|
|
||||||
u, err := user_model.GetUserByEmail(db.DefaultContext, "saml@example.com") |
|
||||||
assert.NoError(t, err) |
|
||||||
assert.NotNil(t, u) |
|
||||||
assert.Equal(t, "samluser", u.Name) |
|
||||||
} |
|
||||||
Loading…
Reference in new issue