Skip to content

Commit

Permalink
Fix SSO AuthRequest backwards compatibility. (#13589)
Browse files Browse the repository at this point in the history
  • Loading branch information
@Joerger
Joerger committed Jun 17, 2022
1 parent 77b35b8 commit 6aa596d
Show file tree
Hide file tree
Showing 14 changed files with 915 additions and 915 deletions.
2 changes: 1 addition & 1 deletion api/types/github.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -308,7 +308,7 @@ func (r *GithubAuthRequest) Check() error {
if err != nil {
return trace.BadParameter("bad PublicKey: %v", err)
}
if (r.CertTTL.Duration() > defaults.MaxCertDuration) || (r.CertTTL.Duration() < defaults.MinCertDuration) {
if (r.CertTTL > defaults.MaxCertDuration) || (r.CertTTL < defaults.MinCertDuration) {
return trace.BadParameter("wrong CertTTL")
}
}
Expand Down
2 changes: 1 addition & 1 deletion api/types/oidc.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -437,7 +437,7 @@ func (i *OIDCAuthRequest) Check() error {
if err != nil {
return trace.BadParameter("PublicKey: bad key: %v", err)
}
if (i.CertTTL.Duration() > defaults.MaxCertDuration) || (i.CertTTL.Duration() < defaults.MinCertDuration) {
if (i.CertTTL > defaults.MaxCertDuration) || (i.CertTTL < defaults.MinCertDuration) {
return trace.BadParameter("CertTTL: wrong certificate TTL")
}
}
Expand Down
2 changes: 1 addition & 1 deletion api/types/saml.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,7 @@ func (i *SAMLAuthRequest) Check() error {
if err != nil {
return trace.BadParameter("PublicKey: bad key: %v", err)
}
if (i.CertTTL.Duration() > defaults.MaxCertDuration) || (i.CertTTL.Duration() < defaults.MinCertDuration) {
if (i.CertTTL > defaults.MaxCertDuration) || (i.CertTTL < defaults.MinCertDuration) {
return trace.BadParameter("CertTTL: wrong certificate TTL")
}
}
Expand Down
1,754 changes: 877 additions & 877 deletions api/types/types.pb.go
View file

Large diffs are not rendered by default.

6 changes: 3 additions & 3 deletions api/types/types.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2712,7 +2712,7 @@ message OIDCAuthRequest {
bytes PublicKey = 7 [ (gogoproto.jsontag) = "public_key" ];

// CertTTL is the TTL of the certificate user wants to get
int64 CertTTL = 8 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "Duration" ];
int64 CertTTL = 8 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "time.Duration" ];

// CreateWebSession indicates if user wants to generate a web
// session after successful authentication
Expand Down Expand Up @@ -2824,7 +2824,7 @@ message SAMLAuthRequest {
bytes PublicKey = 6 [ (gogoproto.jsontag) = "public_key" ];

// CertTTL is the TTL of the certificate user wants to get.
int64 CertTTL = 7 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "Duration" ];
int64 CertTTL = 7 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "time.Duration" ];

// CSRFToken is associated with user web session token.
string CSRFToken = 8 [ (gogoproto.jsontag) = "csrf_token" ];
Expand Down Expand Up @@ -2926,7 +2926,7 @@ message GithubAuthRequest {
// PublicKey is an optional public key to sign in case of successful auth.
bytes PublicKey = 5 [ (gogoproto.jsontag) = "public_key" ];
// CertTTL is TTL of the cert that's generated in case of successful auth.
int64 CertTTL = 6 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "Duration" ];
int64 CertTTL = 6 [ (gogoproto.jsontag) = "cert_ttl", (gogoproto.casttype) = "time.Duration" ];
// CreateWebSession indicates that a user wants to generate a web session
// after successful authentication.
bool CreateWebSession = 7 [ (gogoproto.jsontag) = "create_web_session" ];
Expand Down
2 changes: 1 addition & 1 deletion e
Submodule e updated from e464ef to f6b027
2 changes: 1 addition & 1 deletion lib/auth/github.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -470,7 +470,7 @@ func (a *Server) calculateGithubUser(connector types.GithubConnector, claims *ty
return nil, trace.Wrap(err)
}
roleTTL := roles.AdjustSessionTTL(apidefaults.MaxCertDuration)
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL.Duration())
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL)

return &p, nil
}
Expand Down
2 changes: 1 addition & 1 deletion lib/auth/oidc.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -621,7 +621,7 @@ func (a *Server) calculateOIDCUser(diagCtx *ssoDiagContext, connector types.OIDC
return nil, trace.Wrap(err)
}
roleTTL := roles.AdjustSessionTTL(apidefaults.MaxCertDuration)
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL.Duration())
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL)

return &p, nil
}
Expand Down
2 changes: 1 addition & 1 deletion lib/auth/oidc_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ func TestSSODiagnostic(t *testing.T) {
oidcRequest := types.OIDCAuthRequest{
ConnectorID: "-sso-test-okta",
Type: constants.OIDC,
CertTTL: types.Duration(defaults.OIDCAuthRequestTTL),
CertTTL: defaults.OIDCAuthRequestTTL,
SSOTestFlow: true,
ConnectorSpec: &spec,
}
Expand Down
2 changes: 1 addition & 1 deletion lib/auth/saml.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ func (a *Server) calculateSAMLUser(diagCtx *ssoDiagContext, connector types.SAML
return nil, trace.Wrap(err)
}
roleTTL := roles.AdjustSessionTTL(apidefaults.MaxCertDuration)
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL.Duration())
p.sessionTTL = utils.MinTTL(roleTTL, request.CertTTL)

return &p, nil
}
Expand Down
46 changes: 23 additions & 23 deletions lib/services/identity_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -48,7 +48,7 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1 * time.Second),
CertTTL: 1 * time.Second,
},
wantErr: true,
},
Expand All @@ -57,15 +57,15 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1000 * time.Hour),
CertTTL: 1000 * time.Hour,
},
wantErr: true,
},
{
name: "TTL ignored without cert",
req: types.SAMLAuthRequest{
ConnectorID: "foo",
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -74,7 +74,7 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
},
wantErr: true,
Expand All @@ -84,7 +84,7 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
ConnectorSpec: &types.SAMLConnectorSpecV2{Display: "dummy"},
},
wantErr: true,
Expand All @@ -94,7 +94,7 @@ func TestSAMLAuthRequest_Check(t *testing.T) {
req: types.SAMLAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
ConnectorSpec: &types.SAMLConnectorSpecV2{Display: "dummy"},
},
Expand Down Expand Up @@ -129,7 +129,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -138,7 +138,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
req: types.OIDCAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: true,
},
Expand All @@ -148,7 +148,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1 * time.Second),
CertTTL: 1 * time.Second,
},
wantErr: true,
},
Expand All @@ -158,7 +158,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1000 * time.Hour),
CertTTL: 1000 * time.Hour,
},
wantErr: true,
},
Expand All @@ -167,7 +167,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
req: types.OIDCAuthRequest{
ConnectorID: "foo",
StateToken: "bar",
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -177,7 +177,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
},
wantErr: true,
Expand All @@ -188,7 +188,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
ConnectorSpec: &types.OIDCConnectorSpecV3{Display: "dummy"},
},
wantErr: true,
Expand All @@ -199,7 +199,7 @@ func TestOIDCAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
ConnectorSpec: &types.OIDCConnectorSpecV3{Display: "dummy"},
},
Expand Down Expand Up @@ -234,7 +234,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -243,7 +243,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
req: types.GithubAuthRequest{
ConnectorID: "foo",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: true,
},
Expand All @@ -253,7 +253,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1 * time.Second),
CertTTL: 1 * time.Second,
},
wantErr: true,
},
Expand All @@ -263,7 +263,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(1000 * time.Hour),
CertTTL: 1000 * time.Hour,
},
wantErr: true,
},
Expand All @@ -272,7 +272,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
req: types.GithubAuthRequest{
ConnectorID: "foo",
StateToken: "bar",
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
},
wantErr: false,
},
Expand All @@ -282,7 +282,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
},
wantErr: true,
Expand All @@ -293,7 +293,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
ConnectorSpec: &types.GithubConnectorSpecV3{Display: "dummy"},
},
wantErr: true,
Expand All @@ -304,7 +304,7 @@ func TestGithubAuthRequest_Check(t *testing.T) {
ConnectorID: "foo",
StateToken: "bar",
PublicKey: []byte(exampleSSHCert),
CertTTL: types.Duration(60 * time.Minute),
CertTTL: 60 * time.Minute,
SSOTestFlow: true,
ConnectorSpec: &types.GithubConnectorSpecV3{Display: "dummy"},
},
Expand Down
4 changes: 2 additions & 2 deletions lib/web/apiserver.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1124,7 +1124,7 @@ func (h *Handler) githubLoginConsole(w http.ResponseWriter, r *http.Request, p h
response, err := h.cfg.ProxyClient.CreateGithubAuthRequest(r.Context(), types.GithubAuthRequest{
ConnectorID: req.ConnectorID,
PublicKey: req.PublicKey,
CertTTL: types.Duration(req.CertTTL),
CertTTL: req.CertTTL,
ClientRedirectURL: req.RedirectURL,
Compatibility: req.Compatibility,
RouteToCluster: req.RouteToCluster,
Expand Down Expand Up @@ -1225,7 +1225,7 @@ func (h *Handler) oidcLoginConsole(w http.ResponseWriter, r *http.Request, p htt
ConnectorID: req.ConnectorID,
ClientRedirectURL: req.RedirectURL,
PublicKey: req.PublicKey,
CertTTL: types.Duration(req.CertTTL),
CertTTL: req.CertTTL,
CheckUser: true,
Compatibility: req.Compatibility,
RouteToCluster: req.RouteToCluster,
Expand Down
2 changes: 1 addition & 1 deletion lib/web/saml.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ func (h *Handler) samlSSOConsole(w http.ResponseWriter, r *http.Request, p httpr
ConnectorID: req.ConnectorID,
ClientRedirectURL: req.RedirectURL,
PublicKey: req.PublicKey,
CertTTL: types.Duration(req.CertTTL),
CertTTL: req.CertTTL,
Compatibility: req.Compatibility,
RouteToCluster: req.RouteToCluster,
KubernetesCluster: req.KubernetesCluster,
Expand Down
2 changes: 1 addition & 1 deletion tool/tctl/sso/tester/github.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ func githubTest(c auth.ClientI, connector types.GithubConnector) (*AuthRequestIn
ConnectorID: req.ConnectorID + "-" + connector.GetName(),
Type: constants.Github,
PublicKey: req.PublicKey,
CertTTL: types.Duration(defaults.GithubAuthRequestTTL),
CertTTL: defaults.GithubAuthRequestTTL,
CreateWebSession: false,
ClientRedirectURL: req.RedirectURL,
RouteToCluster: req.RouteToCluster,
Expand Down

0 comments on commit 6aa596d

Please sign in to comment.