mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
c69d56ed64
For https://github.com/fleetdm/confidential/issues/9931.
[Here](ec3e8edbdc/docs/Contributing/Testing-and-local-development.md (L339))'s
how to test SAML locally with SimpleSAML.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved SSO and SAML integration with enhanced session management
using secure cookies.
* Added support for IdP-initiated login flows.
* Introduced new tests covering SSO login flows, metadata handling, and
error scenarios.
* **Bug Fixes**
* Enhanced validation and error handling for invalid or tampered SAML
responses.
* Fixed session cookie handling during SSO and Apple MDM SSO flows.
* **Refactor**
* Replaced custom SAML implementation with the crewjam/saml library for
improved reliability.
* Simplified SAML metadata parsing and session store management.
* Streamlined SSO authorization request and response processing.
* Removed deprecated fields and redundant code related to SSO.
* **Documentation**
* Updated testing and local development docs with clearer instructions
for SSO and IdP-initiated login.
* **Chores**
* Upgraded dependencies including crewjam/saml and related packages.
* Cleaned up tests and configuration by removing deprecated fields and
unused imports.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
65 lines
1.7 KiB
Go
65 lines
1.7 KiB
Go
package sso
|
|
|
|
import (
|
|
"encoding/xml"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/crewjam/saml"
|
|
"github.com/fleetdm/fleet/v4/pkg/fleethttp"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
)
|
|
|
|
// GetMetadata returns the parsed IdP metadata from the config.MetadataURL or config.Metadata.
|
|
// If config.MetadataURL is set, then it's used to request the metadata.
|
|
// If config.MetadataURL is not set, then config.Metadata is used.
|
|
func GetMetadata(config *fleet.SSOProviderSettings) (*saml.EntityDescriptor, error) {
|
|
if config.MetadataURL == "" && config.Metadata == "" {
|
|
return nil, fmt.Errorf("missing metadata for idp %q", config.IDPName)
|
|
}
|
|
|
|
var xmlMetadata []byte
|
|
if config.MetadataURL != "" {
|
|
var err error
|
|
xmlMetadata, err = getMetadata(config.MetadataURL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
} else {
|
|
xmlMetadata = []byte(config.Metadata)
|
|
}
|
|
|
|
return ParseMetadata(xmlMetadata)
|
|
}
|
|
|
|
func getMetadata(metadataURL string) ([]byte, error) {
|
|
client := fleethttp.NewClient(fleethttp.WithTimeout(5 * time.Second))
|
|
request, err := http.NewRequest(http.MethodGet, metadataURL, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
resp, err := client.Do(request)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode != http.StatusOK {
|
|
return nil, fmt.Errorf("SAML metadata server at %s returned %s", metadataURL, resp.Status)
|
|
}
|
|
xmlData, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return xmlData, nil
|
|
}
|
|
|
|
// ParseMetadata parses SSO IdP metadata from the given raw XML bytes.
|
|
func ParseMetadata(xmlMetadata []byte) (*saml.EntityDescriptor, error) {
|
|
var entityDescriptor saml.EntityDescriptor
|
|
if err := xml.Unmarshal(xmlMetadata, &entityDescriptor); err != nil {
|
|
return nil, err
|
|
}
|
|
return &entityDescriptor, nil
|
|
}
|