%s
`, id) w.Header().Set("Content-Length", fmt.Sprint(len(content))) if r.Method == "HEAD" { return } w.Write([]byte(content)) } func (h *Handler) xrdsid(w http.ResponseWriter, r *http.Request, p httprouter.Params) { id := p.ByName("id") w.Header().Set("Content-Type", "application/xrds+xml") fmt.Fprintf(w, `Login successful as {{.Username}}
") c.Assert(err, qt.IsNil) req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.Success(context.Background(), rr, req, "", &store.Identity{ Username: "test-user", }) c.Assert(rr.Code, qt.Equals, http.StatusOK) c.Assert(rr.HeaderMap.Get("Content-Type"), qt.Equals, "text/html;charset=utf-8") c.Assert(rr.Body.String(), qt.Equals, "Login successful as test-user
") } func (s *idpSuite) TestLoginRedirectSuccess(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "http://example.com/callback", "1234", &store.Identity{ Username: "test-user", }) resp := rr.Result() body, err := ioutil.ReadAll(resp.Body) c.Assert(err, qt.IsNil) c.Assert(resp.StatusCode, qt.Equals, http.StatusSeeOther, qt.Commentf("%s", body)) loc, err := resp.Location() c.Assert(err, qt.IsNil) v := loc.Query() loc.RawQuery = "" c.Assert(loc.String(), qt.Equals, "http://example.com/callback") c.Assert(v.Get("state"), qt.Equals, "1234") c.Assert(v.Get("code"), qt.Not(qt.Equals), "") } func (s *idpSuite) TestLoginRedirectSuccessInvalidReturnTo(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "::", "1234", &store.Identity{ Username: "test-user", }) c.Assert(rr.Code, qt.Equals, http.StatusBadRequest) var perr params.Error err = json.Unmarshal(rr.Body.Bytes(), &perr) c.Assert(err, qt.IsNil) c.Assert(perr, qt.DeepEquals, params.Error{ Code: params.ErrBadRequest, Message: `invalid return_to "::": parse "::": missing protocol scheme`, }) } func (s *idpSuite) TestLoginRedirectSuccessReturnToNotTrusted(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "https://example.com", "1234", &store.Identity{ Username: "test-user", }) c.Assert(rr.Code, qt.Equals, http.StatusBadRequest) var perr params.Error err = json.Unmarshal(rr.Body.Bytes(), &perr) c.Assert(err, qt.IsNil) c.Assert(perr, qt.DeepEquals, params.Error{ Code: params.ErrBadRequest, Message: `invalid return_to "https://example.com"`, }) } func (s *idpSuite) TestLoginRedirectSuccessReturnToTrustedDomain(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "https://www.example.net/callback/path", "1234", &store.Identity{ Username: "test-user", }) resp := rr.Result() c.Assert(resp.StatusCode, qt.Equals, http.StatusSeeOther) loc, err := resp.Location() c.Assert(err, qt.IsNil) v := loc.Query() loc.RawQuery = "" c.Assert(loc.String(), qt.Equals, "https://www.example.net/callback/path") c.Assert(v.Get("state"), qt.Equals, "1234") c.Assert(v.Get("code"), qt.Not(qt.Equals), "") } func (s *idpSuite) TestLoginRedirectSuccessReturnToTrustedDomainWildcard(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "https://my.host.example.org/callback/path", "1234", &store.Identity{ Username: "test-user", }) resp := rr.Result() c.Assert(resp.StatusCode, qt.Equals, http.StatusSeeOther) loc, err := resp.Location() c.Assert(err, qt.IsNil) v := loc.Query() loc.RawQuery = "" c.Assert(loc.String(), qt.Equals, "https://my.host.example.org/callback/path") c.Assert(v.Get("state"), qt.Equals, "1234") c.Assert(v.Get("code"), qt.Not(qt.Equals), "") } func (s *idpSuite) TestLoginRedirectSuccessReturnToTrustedDomainInsecure(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectSuccess(context.Background(), rr, req, "http://www.example.net/callback/path", "1234", &store.Identity{ Username: "test-user", }) c.Assert(rr.Code, qt.Equals, http.StatusBadRequest) var perr params.Error err = json.Unmarshal(rr.Body.Bytes(), &perr) c.Assert(err, qt.IsNil) c.Assert(perr, qt.DeepEquals, params.Error{ Code: params.ErrBadRequest, Message: `invalid return_to "http://www.example.net/callback/path"`, }) } func (s *idpSuite) TestLoginRedirectFailureInvalidReturnTo(c *qt.C) { req, err := http.NewRequest("GET", "", nil) c.Assert(err, qt.IsNil) rr := httptest.NewRecorder() s.vc.RedirectFailure(context.Background(), rr, req, "::", "1234", errgo.WithCausef(nil, params.ErrForbidden, "test error")) c.Assert(rr.Code, qt.Equals, http.StatusForbidden) var perr params.Error err = json.Unmarshal(rr.Body.Bytes(), &perr) c.Assert(err, qt.IsNil) c.Assert(perr, qt.DeepEquals, params.Error{ Code: params.ErrForbidden, Message: `test error`, }) } golang-github-canonical-candid-1.12.3/internal/discharger/internal/ 0000775 0000000 0000000 00000000000 14572631230 0025240 5 ustar 00root root 0000000 0000000 golang-github-canonical-candid-1.12.3/internal/discharger/internal/store.go 0000664 0000000 0000000 00000005116 14572631230 0026726 0 ustar 00root root 0000000 0000000 // Copyright 2018 Canonical Ltd. // Licensed under the AGPLv3, see LICENCE file for details. package internal import ( "context" "crypto/sha256" "encoding/base64" "encoding/json" "time" "github.com/juju/simplekv" errgo "gopkg.in/errgo.v1" "github.com/canonical/candid/store" ) // IdentityStore is a short-term store for identity information // associated with a specified key. It wraps a KeyValueStore. type IdentityStore struct { kvstore simplekv.Store store store.Store } // NewIdentityStore creates a new IdentityStore using the // given KeyValueStore for backing storage. func NewIdentityStore(kvstore simplekv.Store, store store.Store) *IdentityStore { return &IdentityStore{ kvstore: kvstore, store: store, } } // Put adds the given Identity to the store, returning the key that should // be used to later retrieve the identity. The Identity will // only be available in the store until the given expire time. func (s *IdentityStore) Put(ctx context.Context, id *store.Identity, expire time.Time) (string, error) { entry := providerIdentityEntry{ ProviderID: id.ProviderID, Expire: expire, } b, err := json.Marshal(entry) if err != nil { // This should be impossible. panic(err) } hash := sha256.Sum256(b) key := base64.RawURLEncoding.EncodeToString(hash[:]) if err := s.kvstore.Set(ctx, key, b, expire); err != nil { return "", errgo.Mask(err, errgo.Is(context.Canceled), errgo.Is(context.DeadlineExceeded)) } return key, nil } // Get retrieves the Identity with the given key from the store. If // there is no such token, or the token has expired, then the returned // error will have a cause of store.ErrNotFound. func (s *IdentityStore) Get(ctx context.Context, key string, id *store.Identity) error { b, err := s.kvstore.Get(ctx, key) if err != nil { if errgo.Cause(err) == simplekv.ErrNotFound { return errgo.WithCausef(err, store.ErrNotFound, "") } return errgo.Mask(err, errgo.Is(context.Canceled), errgo.Is(context.DeadlineExceeded)) } var entry providerIdentityEntry if err := json.Unmarshal(b, &entry); err != nil { return errgo.Mask(err) } if entry.Expire.Before(time.Now()) { return errgo.WithCausef(nil, store.ErrNotFound, "%q not found", key) } id.ProviderID = entry.ProviderID err = s.store.Identity(ctx, id) if errgo.Cause(err) == store.ErrNotFound { err = errgo.WithCausef(nil, store.ErrNotFound, "%q not found", key) } return errgo.Mask(err, errgo.Is(store.ErrNotFound), errgo.Is(context.Canceled), errgo.Is(context.DeadlineExceeded)) } type providerIdentityEntry struct { ProviderID store.ProviderIdentity Expire time.Time } golang-github-canonical-candid-1.12.3/internal/discharger/internal/store_test.go 0000664 0000000 0000000 00000015604 14572631230 0027770 0 ustar 00root root 0000000 0000000 // Copyright 2018 Canonical Ltd. // Licensed under the AGPLv3, see LICENCE file for details. package internal_test import ( "context" "testing" "time" qt "github.com/frankban/quicktest" "github.com/frankban/quicktest/qtsuite" "github.com/google/go-cmp/cmp/cmpopts" "github.com/juju/simplekv" errgo "gopkg.in/errgo.v1" "github.com/canonical/candid/internal/candidtest" "github.com/canonical/candid/internal/discharger/internal" "github.com/canonical/candid/store" ) func TestStore(t *testing.T) { qtsuite.Run(qt.New(t), &storeSuite{}) } type storeSuite struct { store *candidtest.Store } func (s *storeSuite) Init(c *qt.C) { s.store = candidtest.NewStore() } func (s *storeSuite) TestRoundTrip(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) st := internal.NewIdentityStore(kv, s.store.Store) id := store.Identity{ ProviderID: "test:test", Username: "test", Name: "Test User", Email: "test@example.com", } err = s.store.Store.UpdateIdentity(ctx, &id, store.Update{ store.Username: store.Set, store.Name: store.Set, store.Email: store.Set, }) c.Assert(err, qt.IsNil) key, err := st.Put(ctx, &id, time.Now().Add(time.Minute)) c.Assert(err, qt.IsNil) var id2 store.Identity err = st.Get(ctx, key, &id2) c.Assert(err, qt.IsNil) c.Check(id2, qt.CmpEquals(cmpopts.EquateEmpty()), id) } func (s *storeSuite) TestPutCanceled(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withSet(kv, func(context.Context, string, []byte, time.Time) error { return context.Canceled }) st := internal.NewIdentityStore(kv, s.store.Store) id := store.Identity{ ProviderID: "test:test", Username: "test", Name: "Test User", Email: "test@example.com", } err = s.store.Store.UpdateIdentity(ctx, &id, store.Update{ store.Username: store.Set, store.Name: store.Set, store.Email: store.Set, }) c.Assert(err, qt.IsNil) _, err = st.Put(ctx, &id, time.Now().Add(time.Minute)) c.Assert(err, qt.ErrorMatches, "context canceled") c.Assert(errgo.Cause(err), qt.Equals, context.Canceled) } func (s *storeSuite) TestPutDeadlineExceeded(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withSet(kv, func(context.Context, string, []byte, time.Time) error { return context.DeadlineExceeded }) st := internal.NewIdentityStore(kv, s.store.Store) id := store.Identity{ ProviderID: "test:test", Username: "test", Name: "Test User", Email: "test@example.com", } err = s.store.Store.UpdateIdentity(ctx, &id, store.Update{ store.Username: store.Set, store.Name: store.Set, store.Email: store.Set, }) c.Assert(err, qt.IsNil) _, err = st.Put(ctx, &id, time.Now().Add(time.Minute)) c.Assert(err, qt.ErrorMatches, "context deadline exceeded") c.Assert(errgo.Cause(err), qt.Equals, context.DeadlineExceeded) } func (s *storeSuite) TestGetNotFound(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withGet(kv, func(context.Context, string) ([]byte, error) { return nil, simplekv.ErrNotFound }) st := internal.NewIdentityStore(kv, s.store.Store) err = st.Get(ctx, "", nil) c.Assert(err, qt.ErrorMatches, "not found") c.Assert(errgo.Cause(err), qt.Equals, store.ErrNotFound) } func (s *storeSuite) TestGetCanceled(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withGet(kv, func(context.Context, string) ([]byte, error) { return nil, context.Canceled }) st := internal.NewIdentityStore(kv, s.store.Store) err = st.Get(ctx, "", nil) c.Assert(err, qt.ErrorMatches, "context canceled") c.Assert(errgo.Cause(err), qt.Equals, context.Canceled) } func (s *storeSuite) TestGetDeadlineExceeded(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withGet(kv, func(context.Context, string) ([]byte, error) { return nil, context.DeadlineExceeded }) st := internal.NewIdentityStore(kv, s.store.Store) err = st.Get(ctx, "", nil) c.Assert(err, qt.ErrorMatches, "context deadline exceeded") c.Assert(errgo.Cause(err), qt.Equals, context.DeadlineExceeded) } func (s *storeSuite) TestGetInvalidJSON(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) kv = withGet(kv, func(context.Context, string) ([]byte, error) { return []byte("}"), nil }) st := internal.NewIdentityStore(kv, s.store.Store) err = st.Get(ctx, "", nil) c.Assert(err, qt.ErrorMatches, "invalid character '}' looking for beginning of value") } func (s *storeSuite) TestExpiredEntry(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) st := internal.NewIdentityStore(kv, s.store.Store) id := store.Identity{ ProviderID: "test:test", Username: "test", Name: "Test User", Email: "test@example.com", } err = s.store.Store.UpdateIdentity(ctx, &id, store.Update{ store.Username: store.Set, store.Name: store.Set, store.Email: store.Set, }) c.Assert(err, qt.IsNil) key, err := st.Put(ctx, &id, time.Now()) c.Assert(err, qt.IsNil) err = st.Get(ctx, key, nil) c.Assert(err, qt.ErrorMatches, `".*" not found`) c.Assert(errgo.Cause(err), qt.Equals, store.ErrNotFound) } func (s *storeSuite) TestIdentityNotInStore(c *qt.C) { ctx := context.Background() kv, err := s.store.ProviderDataStore.KeyValueStore(ctx, "test") c.Assert(err, qt.IsNil) st := internal.NewIdentityStore(kv, s.store.Store) id := store.Identity{ ProviderID: "test:test", Username: "test", Name: "Test User", Email: "test@example.com", } key, err := st.Put(ctx, &id, time.Now().Add(time.Minute)) c.Assert(err, qt.IsNil) var id2 store.Identity err = st.Get(ctx, key, &id2) c.Assert(err, qt.ErrorMatches, `".*" not found`) c.Assert(errgo.Cause(err), qt.Equals, store.ErrNotFound) } type testGetStore struct { simplekv.Store f func(context.Context, string) ([]byte, error) } func (s testGetStore) Get(ctx context.Context, key string) ([]byte, error) { return s.f(ctx, key) } func withGet(store simplekv.Store, get func(context.Context, string) ([]byte, error)) simplekv.Store { return testGetStore{ Store: store, f: get, } } type testSetStore struct { simplekv.Store f func(context.Context, string, []byte, time.Time) error } func (s testSetStore) Set(ctx context.Context, key string, value []byte, expire time.Time) error { return s.f(ctx, key, value, expire) } func withSet(store simplekv.Store, set func(context.Context, string, []byte, time.Time) error) simplekv.Store { return testSetStore{ Store: store, f: set, } } golang-github-canonical-candid-1.12.3/internal/discharger/login.go 0000664 0000000 0000000 00000023541 14572631230 0025070 0 ustar 00root root 0000000 0000000 // Copyright 2015 Canonical Ltd. // Licensed under the AGPLv3, see LICENCE file for details. package discharger import ( "fmt" "net/http" "net/url" "time" "github.com/go-macaroon-bakery/macaroon-bakery/v3/httpbakery/agent" "gopkg.in/errgo.v1" "gopkg.in/httprequest.v1" "github.com/canonical/candid/idp/idputil" "github.com/canonical/candid/params" "github.com/canonical/candid/store" ) // legacyLoginRequest is a request to start a login to the identity manager // using the legacy visit-wait protocol. type legacyLoginRequest struct { httprequest.Route `httprequest:"GET /login-legacy"` Domain string `httprequest:"domain,form"` DischargeID string `httprequest:"did,form"` } // LoginLegacy handles the GET /login-legacy endpoint that is used to log in to Candid // when the legacy visit-wait protocol is used. func (h *handler) LoginLegacy(p httprequest.Params, req *legacyLoginRequest) error { // We should really be parsing the accept header properly here, but // it's really complicated http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.1 // perhaps use http://godoc.org/bitbucket.org/ww/goautoneg for this. // Probably not worth it now that it's only part of the legacy protocol. if p.Request.Header.Get("Accept") == "application/json" { methods := map[string]string{"agent": legacyAgentURL(h.params.Location, req.DischargeID)} for _, idp := range h.params.IdentityProviders { methods[idp.Name()] = idp.URL(req.DischargeID) } err := httprequest.WriteJSON(p.Response, http.StatusOK, methods) if err != nil { return errgo.Notef(err, "cannot write login methods") } return nil } _, _, err := agent.LoginCookie(p.Request) if errgo.Cause(err) != agent.ErrNoAgentLoginCookie { resp, err := h.LegacyAgentLogin(p, &legacyAgentLoginRequest{ DischargeID: req.DischargeID, }) if err != nil { return errgo.Mask(err, errgo.Any) } return httprequest.WriteJSON(p.Response, http.StatusOK, resp) } if err != nil && errgo.Cause(err) != agent.ErrNoAgentLoginCookie { return errgo.Notef(err, "bad agent-login cookie") } return h.Login(p, (*loginRequest)(req)) } // loginRequest is a request to start a login to the identity manager. type loginRequest struct { httprequest.Route `httprequest:"GET /login"` Domain string `httprequest:"domain,form"` DischargeID string `httprequest:"did,form"` } // Login handles the GET /v1/login endpoint that is used to log in to Candid. // when an interactive visit-wait protocol has been chosen by the client. func (h *handler) Login(p httprequest.Params, req *loginRequest) error { // Store the requested discharge ID in a session cookie so that // when the redirect comes back to login-complete we know the // login was initiated in this session. cookiePath := idputil.CookiePathRelativeToLocation("/login-complete", h.params.Location, h.params.SkipLocationForCookiePaths) state, err := h.params.codec.SetCookie(p.Response, waitCookieName, cookiePath, waitState{ DischargeID: req.DischargeID, }) if err != nil { return errgo.Mask(err) } v := url.Values{ "state": {state}, "return_to": {h.params.Location + "/login-complete"}, } if req.Domain != "" { v.Set("domain", req.Domain) } http.Redirect(p.Response, p.Request, h.params.Location+"/login-redirect?"+v.Encode(), http.StatusTemporaryRedirect) return nil } // redirectLoginRequest is a request to start a redirect based login to // the identity server. type redirectLoginRequest struct { httprequest.Route `httprequest:"GET /login-redirect"` // Domain holdes the requested identity provider domain, if any. Domain string `httprequest:"domain,form"` // ReturnTo holds the URL that the service will redirect to when // the login attempt is complete. ReturnTo string `httprequest:"return_to,form"` // State holds an opaque token that will be sent back to the // requesting service so the service can check that it initiated // the original login request. State string `httprequest:"state,form"` } // RedirectLogin handles starting a redirect based login request for a // domain (if specified). It produces a page with the possible choices of // identity provider which the user must then choose to start the login // process. func (h *handler) RedirectLogin(p httprequest.Params, req *redirectLoginRequest) error { cookiePath := idputil.CookiePathRelativeToLocation(idputil.LoginCookiePath, h.params.Location, h.params.SkipLocationForCookiePaths) state, err := h.params.codec.SetCookie(p.Response, idputil.LoginCookieName, cookiePath, idputil.LoginState{ ReturnTo: req.ReturnTo, State: req.State, Expires: time.Now().Add(15 * time.Minute), }) if err != nil { return errgo.Mask(err) } return errgo.Mask(h.authChoice(p.Response, p.Request, state, req.Domain, "", false)) } func (h *handler) authChoice(w http.ResponseWriter, req *http.Request, state, domain, errorMessage string, useEmail bool) error { // Find all the possible login methods. var allIDPs []params.IDPChoiceDetails var idps []params.IDPChoiceDetails for _, idp := range h.params.IdentityProviders { if !idp.Interactive() { continue } choice := params.IDPChoiceDetails{ Name: idp.Name(), Domain: idp.Domain(), Description: idp.Description(), Icon: idp.IconURL(), URL: idp.URL(state), } if !idp.Hidden() { allIDPs = append(allIDPs, choice) } if domain != "" && idp.Domain() == domain { idps = append(idps, choice) } } if len(allIDPs) == 0 { return errgo.Newf("no interactive login methods found") } if len(idps) == 0 { idps = allIDPs } if req.Header.Get("Accept") == "application/json" { httprequest.WriteJSON(w, http.StatusOK, params.IDPChoice{IDPs: idps}) return nil } type authenticationRequiredParams struct { params.TemplateBrandParameters IDPs []params.IDPChoiceDetails Error string UseEmail bool ShowEmailLink bool WithEmailURL string } authParams := authenticationRequiredParams{ TemplateBrandParameters: params.BrandParameters(), IDPs: idps, Error: errorMessage, UseEmail: useEmail, ShowEmailLink: h.params.EnableEmailLogin && domain == "" && !useEmail, WithEmailURL: h.params.Location + "/login-email?state=" + state, } if err := h.params.Template.ExecuteTemplate(w, "authentication-required", authParams); err != nil { return errgo.Mask(err) } return nil } type emailLoginRequest struct { httprequest.Route `httprequest:"GET /login-email"` // State holds the state information generated in the /login-redirect // handler. State string `httprequest:"state,form"` } // EmailLogin starts a request to choose an identity provider using an // email address. func (h *handler) EmailLogin(p httprequest.Params, req *emailLoginRequest) error { return h.authChoice(p.Response, p.Request, req.State, "", "", true) } type emailLoginSubmitRequest struct { httprequest.Route `httprequest:"POST /login-email"` // State holds the state information generated in the /login-redirect // handler. State string `httprequest:"state,form"` // Email holds the email address to use to select the identity // provider. Email string `httprequest:"email,form"` } // EmailLoginSubmit attemtps to find an identity provider suitable for // use with the provided email address and either redirects to that // identity provider, or outputs the same email form with an error message. func (h *handler) EmailLoginSubmit(p httprequest.Params, req *emailLoginSubmitRequest) error { for _, idp := range h.params.IdentityProviders { type isForEmailAddrer interface { IsForEmailAddr(string) bool } matcher, ok := idp.(isForEmailAddrer) if !ok { continue } if matcher.IsForEmailAddr(req.Email) { http.Redirect(p.Response, p.Request, idp.URL(req.State), http.StatusSeeOther) return nil } } return h.authChoice(p.Response, p.Request, req.State, "", fmt.Sprintf(`cannot find identity provider for email address "%s"`, req.Email), true) } // loginCompleteRequest is a request that completes a login attempt. type loginCompleteRequest struct { httprequest.Route `httprequest:"GET /login-complete"` // State holds the login state that was sent with the original // login request. This must match the candid-discharge-wait // cookie for the request to be processed. State string `httprequest:"state,form"` // Code holds the authorisation code to swap for the discharge // token. This is only set on successful requests. Code string `httprequest:"code,form"` // ErrorCode contains the error code, if any, for a failed login. ErrorCode string `httprequest:"error_code,form"` // Error holds the error message from a failed login. Error string `httprequest:"error,form"` } // LoginComplete handles completing the login process for visitor based // login flows. The redirect based login will return here with either a // code to get a discharge token, or an error. This endpoint completes // any waiting endpoint. func (h *handler) LoginComplete(p httprequest.Params, req *loginCompleteRequest) { ctx := p.Context var ws waitState if err := h.params.codec.Cookie(p.Request, waitCookieName, req.State, &ws); err != nil { logger.Infof("login error: %s", err) idputil.BadRequestf(p.Response, "invalid login state") return } if req.Error != "" { err := ¶ms.Error{ Message: req.Error, Code: params.ErrorCode(req.ErrorCode), } h.params.visitCompleter.Failure(ctx, p.Response, p.Request, ws.DischargeID, err) return } var id store.Identity if err := h.params.identityStore.Get(ctx, req.Code, &id); err != nil { h.params.visitCompleter.Failure(ctx, p.Response, p.Request, ws.DischargeID, err) return } h.params.visitCompleter.Success(ctx, p.Response, p.Request, ws.DischargeID, &id) } const waitCookieName = "candid-discharge-wait" // A waitState is a cookie that stores the current state of a login that // is part of a interact/wait pair. type waitState struct { DischargeID string } golang-github-canonical-candid-1.12.3/internal/discharger/login_sublocation_test.go 0000664 0000000 0000000 00000003617 14572631230 0030533 0 ustar 00root root 0000000 0000000 // Copyright 2021 Canonical Ltd. // Licensed under the AGPLv3, see LICENCE file for details. package discharger_test import ( "net/http" "path/filepath" "testing" qt "github.com/frankban/quicktest" "github.com/canonical/candid/idp" "github.com/canonical/candid/idp/static" "github.com/canonical/candid/internal/candidtest" "github.com/canonical/candid/internal/discharger" "github.com/canonical/candid/internal/identity" ) const sublocationPath = "/sublocation" var cookiePathTests = []struct { about string skipLocation bool }{{ about: "location in the cookie", skipLocation: false, }, { about: "location NOT in the cookie", skipLocation: true, }} func TestLoginCookiePath(t *testing.T) { c := qt.New(t) for _, test := range cookiePathTests { c.Run(test.about, func(c *qt.C) { // Set up the store and the server. store := candidtest.NewStore() p := store.ServerParams() p.IdentityProviders = []idp.IdentityProvider{ static.NewIdentityProvider(static.Params{ Name: "test", Domain: "test", Icon: "/static/static1.bmp", }), } p.SkipLocationForCookiePaths = test.skipLocation srv := candidtest.NewServerWithSublocation(c, p, map[string]identity.NewAPIHandlerFunc{ "discharger": discharger.NewAPIHandler, }, sublocationPath) // Make the request. req, err := http.NewRequest("GET", sublocationPath+"/login", nil) c.Assert(err, qt.IsNil) req.Header.Set("Accept", "application/json") resp := srv.Do(c, req) defer resp.Body.Close() // Check the response. c.Assert(resp.StatusCode, qt.Equals, http.StatusOK) cookies := resp.Cookies() c.Assert(cookies, qt.Not(qt.HasLen), 0) for _, cookie := range cookies { dir := filepath.Dir(cookie.Path) if test.skipLocation { c.Assert(dir, qt.Not(qt.Equals), sublocationPath) } else { c.Assert(dir, qt.Equals, sublocationPath) } } }) } } golang-github-canonical-candid-1.12.3/internal/discharger/login_test.go 0000664 0000000 0000000 00000027531 14572631230 0026132 0 ustar 00root root 0000000 0000000 // Copyright 2015 Canonical Ltd. // Licensed under the AGPLv3, see LICENCE file for details. package discharger_test import ( "encoding/json" "html/template" "io/ioutil" "net/http" "net/url" "strings" "testing" qt "github.com/frankban/quicktest" "github.com/frankban/quicktest/qtsuite" "github.com/go-macaroon-bakery/macaroon-bakery/v3/bakery/identchecker" "github.com/go-macaroon-bakery/macaroon-bakery/v3/httpbakery" errgo "gopkg.in/errgo.v1" "github.com/canonical/candid/idp" "github.com/canonical/candid/idp/static" "github.com/canonical/candid/internal/auth" "github.com/canonical/candid/internal/candidtest" "github.com/canonical/candid/internal/discharger" "github.com/canonical/candid/internal/identity" "github.com/canonical/candid/params" ) // loginTemplate contains the template to use in login tests. var loginTemplate *template.Template func init() { var err error loginTemplate, err = candidtest.DefaultTemplate.Clone() if err != nil { panic(err) } template.Must(loginTemplate.New("authentication-required").Parse(` {{range .IDPs}}{{.URL}} {{end}}Error: {{.Error}} UseEmail: {{.UseEmail}} ShowEmailLink: {{.ShowEmailLink}} WithEmailURL: {{.WithEmailURL}} `[1:])) } func TestLogin(t *testing.T) { qtsuite.Run(qt.New(t), &loginSuite{}) } type loginSuite struct { store *candidtest.Store srv *candidtest.Server dischargeCreator *candidtest.DischargeCreator interactor httpbakery.WebBrowserInteractor } func (s *loginSuite) Init(c *qt.C) { s.store = candidtest.NewStore() sp := s.store.ServerParams() sp.RedirectLoginTrustedURLs = []string{ "https://example.com/callback", } sp.IdentityProviders = []idp.IdentityProvider{ static.NewIdentityProvider(static.Params{ Name: "test", Users: map[string]static.UserInfo{ "test": { Password: "testpassword", Name: "Test User", Email: "test@example.com", Groups: []string{"test1", "test2"}, }, }, Icon: "/static/static1.bmp", }), static.NewIdentityProvider(static.Params{ Name: "test2", Domain: "test2", Icon: "/static/static2.bmp", MatchEmailAddr: "@example.com$", }), static.NewIdentityProvider(static.Params{ Name: "test3", Domain: "test3", Icon: "/static/static3.bmp", Hidden: true, }), } sp.Template = loginTemplate s.srv = candidtest.NewServer(c, sp, map[string]identity.NewAPIHandlerFunc{ "discharger": discharger.NewAPIHandler, }) s.dischargeCreator = candidtest.NewDischargeCreator(s.srv) s.interactor = httpbakery.WebBrowserInteractor{ OpenWebBrowser: candidtest.PasswordLogin(c, "test", "testpassword"), } } func (s *loginSuite) TestLegacyInteractiveLogin(c *qt.C) { client := s.srv.Client(s.interactor) // Use "
Log in {{ if .UseEmail }}with email address{{ end }}
{{if and .Error (not .UseEmail)}}Error:{{.Error}}
Or continue with...
{{ end }}
{{ $length := len .IDPs }}
{{ range .IDPs }}
{{ if .ShowEmailLink }}
Or login with email address
{{ end }}
{{ if .Icon }}
{{ end }}
You're logged in as {{.Username}}
You can now close this window.
{{if .ManageURL}} {{end}}
Security keys
{{if .MustRegister}}Identity provider requires you to register a 2FA security key.
Please complete the MFA login.
{{end}}
Manage security keys
{{.Note}}
Your registered security keys
-
{{range .Credentials}}
{{.Name}}
You are logged in. You can close this window.
User Registration
{{if .Error}}
Error:{{.Error}}
Remove security key
You are going to remove the following security key:
{{.Name}}
Are you sure?