|
| 1 | +// This Source Code Form is subject to the terms of the Mozilla Public |
| 2 | +// License, v. 2.0. If a copy of the MPL was not distributed with this |
| 3 | +// file, You can obtain one at https://mozilla.org/MPL/2.0/. |
| 4 | + |
| 5 | +use dropshot::{http_response_found, HttpError, HttpResponseFound}; |
| 6 | +use nexus_auth::context::OpContext; |
| 7 | +use nexus_db_model::{ConsoleSession, Name}; |
| 8 | +use nexus_db_queries::authn::silos::IdentityProviderType; |
| 9 | +use nexus_db_queries::db::identity::Asset; |
| 10 | +use nexus_types::external_api::{params::RelativeUri, shared::RelayState}; |
| 11 | +use omicron_common::api::external::Error; |
| 12 | + |
| 13 | +impl super::Nexus { |
| 14 | + pub(crate) async fn login_saml_redirect( |
| 15 | + &self, |
| 16 | + opctx: &OpContext, |
| 17 | + silo_name: &Name, |
| 18 | + provider_name: &Name, |
| 19 | + redirect_uri: Option<RelativeUri>, |
| 20 | + ) -> Result<HttpResponseFound, HttpError> { |
| 21 | + let (.., identity_provider) = self |
| 22 | + .datastore() |
| 23 | + .identity_provider_lookup(&opctx, silo_name, provider_name) |
| 24 | + .await?; |
| 25 | + |
| 26 | + match identity_provider { |
| 27 | + IdentityProviderType::Saml(saml_identity_provider) => { |
| 28 | + // Relay state is sent to the IDP, to be sent back to the SP |
| 29 | + // after a successful login. |
| 30 | + let relay_state = |
| 31 | + RelayState { redirect_uri }.to_encoded().map_err(|e| { |
| 32 | + HttpError::for_internal_error(format!( |
| 33 | + "encoding relay state failed: {}", |
| 34 | + e |
| 35 | + )) |
| 36 | + })?; |
| 37 | + |
| 38 | + let sign_in_url = saml_identity_provider |
| 39 | + .sign_in_url(Some(relay_state)) |
| 40 | + .map_err(|e| { |
| 41 | + HttpError::for_internal_error(e.to_string()) |
| 42 | + })?; |
| 43 | + |
| 44 | + http_response_found(sign_in_url) |
| 45 | + } |
| 46 | + } |
| 47 | + } |
| 48 | + |
| 49 | + pub(crate) async fn login_saml( |
| 50 | + &self, |
| 51 | + opctx: &OpContext, |
| 52 | + body_bytes: dropshot::UntypedBody, |
| 53 | + silo_name: &Name, |
| 54 | + provider_name: &Name, |
| 55 | + ) -> Result<(ConsoleSession, String), HttpError> { |
| 56 | + let (authz_silo, db_silo, identity_provider) = self |
| 57 | + .datastore() |
| 58 | + .identity_provider_lookup(&opctx, silo_name, provider_name) |
| 59 | + .await?; |
| 60 | + let (authenticated_subject, relay_state_string) = |
| 61 | + match identity_provider { |
| 62 | + IdentityProviderType::Saml(saml_identity_provider) => { |
| 63 | + let body_bytes = dbg!(body_bytes.as_str())?; |
| 64 | + saml_identity_provider.authenticated_subject( |
| 65 | + &body_bytes, |
| 66 | + self.samael_max_issue_delay(), |
| 67 | + )? |
| 68 | + } |
| 69 | + }; |
| 70 | + let relay_state = |
| 71 | + relay_state_string.and_then(|v| RelayState::from_encoded(v).ok()); |
| 72 | + let user = self |
| 73 | + .silo_user_from_authenticated_subject( |
| 74 | + &opctx, |
| 75 | + &authz_silo, |
| 76 | + &db_silo, |
| 77 | + &authenticated_subject, |
| 78 | + ) |
| 79 | + .await?; |
| 80 | + let session = self.create_session(opctx, user).await?; |
| 81 | + let next_url = relay_state |
| 82 | + .and_then(|r| r.redirect_uri) |
| 83 | + .map(|u| u.to_string()) |
| 84 | + .unwrap_or_else(|| "/".to_string()); |
| 85 | + Ok((session, next_url)) |
| 86 | + } |
| 87 | + |
| 88 | + // TODO: move this logic, it's weird |
| 89 | + pub(crate) async fn create_session( |
| 90 | + &self, |
| 91 | + opctx: &OpContext, |
| 92 | + user: Option<nexus_db_queries::db::model::SiloUser>, |
| 93 | + ) -> Result<ConsoleSession, Error> { |
| 94 | + let session = match user { |
| 95 | + Some(user) => self.session_create(&opctx, user.id()).await?, |
| 96 | + None => Err(Error::Unauthenticated { |
| 97 | + internal_message: String::from( |
| 98 | + "no matching user found or credentials were not valid", |
| 99 | + ), |
| 100 | + })?, |
| 101 | + }; |
| 102 | + Ok(session) |
| 103 | + } |
| 104 | +} |
0 commit comments