diff --git a/addons/api/addon/models/auth-method.js b/addons/api/addon/models/auth-method.js index a0a8e1b27..f0df015f6 100644 --- a/addons/api/addon/models/auth-method.js +++ b/addons/api/addon/models/auth-method.js @@ -8,4 +8,18 @@ export default class AuthMethodModel extends GeneratedAuthMethodModel { * @type {boolean} */ @equal('primary', true) isPrimary; + + /** + * @type {boolean} + */ + get isPassword() { + return this.type === 'password'; + } + + /** + * @type {boolean} + */ + get isOIDC() { + return this.type === 'oidc'; + } } diff --git a/addons/api/mirage/config.js b/addons/api/mirage/config.js index 243467bc7..769e7e810 100644 --- a/addons/api/mirage/config.js +++ b/addons/api/mirage/config.js @@ -69,7 +69,7 @@ export default function () { if (scope.primaryAuthMethodId === id) { scope.update({ primaryAuthMethodId: null }); } - return new Response(204); + return new Response(202); }); // Auth Method Accounts diff --git a/addons/api/mirage/factories/auth-method.js b/addons/api/mirage/factories/auth-method.js index b14366c19..b7dc8ddda 100644 --- a/addons/api/mirage/factories/auth-method.js +++ b/addons/api/mirage/factories/auth-method.js @@ -1,9 +1,14 @@ import factory from '../generated/factories/auth-method'; import { trait } from 'ember-cli-mirage'; +const types = ['password', 'oidc']; + export default factory.extend({ id: (i) => `auth-method-id-${i}`, + // Cycle through available types + type: (i) => types[i % types.length], + /** * Adds accounts (with associated users) to auth method. */ diff --git a/addons/api/mirage/route-handlers/auth.js b/addons/api/mirage/route-handlers/auth.js index 1876cd128..bd4fca7ac 100644 --- a/addons/api/mirage/route-handlers/auth.js +++ b/addons/api/mirage/route-handlers/auth.js @@ -12,7 +12,7 @@ import { Response } from 'miragejs'; // */ // export default function authenticateHandler(schema, request) { // const payload = JSON.parse(request.requestBody); -// if (payload.credentials.login_name === 'error') { +// if (payload.attributes.login_name === 'error') { // return new Response(400); // } else { // const cookieName = config.auth.passwordCookieName; @@ -23,32 +23,98 @@ import { Response } from 'miragejs'; // } // } +// Quick and dirty counter system to simulate the polling behavior +// of the API. If the OIDC flow is pending, the route returns 100. +// If complete it returns 200 with the token JSON. +let oidcAttemptCounter = 0; +const oidcRequiredAttempts = 3; + +const commandHandlers = { + password: { + login: (payload, scopeAttrs) => { + if (payload.attributes.login_name === 'error') { + return new Response(400); + } else { + return new Response( + 200, + {}, + { + attributes: { + scope: scopeAttrs, + id: 'token123', + token: 'thetokenstring', + account_id: '1', + user_id: 'user123', + auth_method_id: 'authmethod123', + created_time: '', + updated_time: '', + last_used_time: '', + expiration_time: '', + }, + } + ); + } + }, + }, + + /** + * OIDC authentication is a two-step process: + * + * 1. `authenticate:start` kicks of authentication by requesting some details + * from the Boundary server about the request, including the third-party + * URL to which to redirect the user. + * 2. `authenticate` accepts the token_id and state parameters in + * order to retrieve a Boundary token. This endpoint may be polled until + * the authentication flow is completed. + */ + oidc: { + start: () => + new Response( + 200, + {}, + { + attributes: { + auth_url: 'https://www.duckduckgo.com', + token_id: 'token_1234', + }, + } + ), + token: (_, scopeAttrs) => { + oidcAttemptCounter++; + if (oidcAttemptCounter < oidcRequiredAttempts) { + return new Response(202); + } else { + return new Response( + 200, + {}, + { + attributes: { + scope: scopeAttrs, + id: 'token123', + token: 'thetokenstring', + account_id: '1', + user_id: 'user123', + auth_method_id: 'authmethod123', + created_time: '', + updated_time: '', + last_used_time: '', + expiration_time: '', + }, + } + ); + } + }, + }, +}; + export function authHandler({ scopes, authMethods }, request) { const payload = JSON.parse(request.requestBody); - if (payload.credentials.login_name === 'error') { - return new Response(400); - } else { - const id = request.params.id_method.split(':')[0]; - const authMethod = authMethods.find(id); - const scope = scopes.find(authMethod.scopeId); - const scopeAttrs = this.serialize(scopes.find(scope.id)); - return new Response( - 200, - {}, - { - scope: scopeAttrs, - id: 'token123', - token: 'thetokenstring', - account_id: '1', - user_id: 'authenticateduser', - auth_method_id: 'authmethod123', - created_time: '', - updated_time: '', - last_used_time: '', - expiration_time: '', - } - ); - } + const [, id] = request.params.id_method.match(/(?.[^:]*)/); + const { command } = payload; + const authMethod = authMethods.find(id); + const scope = scopes.find(authMethod.scopeId); + const scopeAttrs = this.serialize(scopes.find(scope.id)); + return commandHandlers[authMethod.type][command](payload, scopeAttrs); } export function deauthHandler() { diff --git a/addons/auth/addon/authenticators/base.js b/addons/auth/addon/authenticators/base.js index 641142222..bdc69d504 100644 --- a/addons/auth/addon/authenticators/base.js +++ b/addons/auth/addon/authenticators/base.js @@ -4,10 +4,31 @@ import fetch from 'fetch'; /** * Encapsulates common authenticator functionality. + * + * Upon session invalidation, deauthentication should be attempted at the URL + * generated by `buildDeauthEndpointURL` on a best-effort basis. + * + * When a session is restored, a call should be made to the endpoint specified + * by `buildTokenValidationEndpointURL`. If this endpoint responds with 401 or + * 404, then the session is invalid and the restoration should be rejected. + * All other responses should resolve the session restoration successfully. */ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator { // =unimplemented methods + /** + * Generates an auth method URL with which to authenticate. + * @override + * @param {object} options + * @param {string} options.scope.scope_id + * @param {string} options.authMethod.id + * @return {string} + */ + buildAuthEndpointURL(/* { + scope: { id: scopeID }, + authMethod: { id: authMethodID }, + } */) {} + /** * Generates a scope URL with which to deauthenticate. * @override @@ -51,9 +72,10 @@ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator { */ async restore(data) { if (!data) return reject(); - return this.validateToken(data.token, data.id).then(() => - this.normalizeData(data) - ); + return this.validateToken( + data.attributes.token, + data.attributes.id + ).then(() => this.normalizeData(data)); } /** @@ -65,6 +87,10 @@ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator { * @return {object} */ normalizeData(data, username) { + // Pull fields up from `data.attributes` for easier access in JavaScript. + // The `attributes` field exists on the Go side for its convenience but is + // unnecessary here. + Object.assign(data, data.attributes); // Add booleans indicated the scope type data.isGlobal = data?.scope?.type === 'global'; data.isOrg = data?.scope?.type === 'org'; diff --git a/addons/auth/addon/authenticators/oidc.js b/addons/auth/addon/authenticators/oidc.js new file mode 100644 index 000000000..2de7f1184 --- /dev/null +++ b/addons/auth/addon/authenticators/oidc.js @@ -0,0 +1,107 @@ +import BaseAuthenticator from './base'; +import { inject as service } from '@ember/service'; +import { reject } from 'rsvp'; +import fetch from 'fetch'; + +/** + * The OIDC base authenticator encapsulates the multistep OIDC flow. + * + * 1. Start authentication flow: this step is actually a combination of two + * sub steps: + * 1. Initiate a call via `startAuthentication` to the API at + * `buildAuthEndpointURL` using the `start` command to fetch the URL of + * the external authentication provider (`auth_url`). + * 2. Open `auth_url`. This may be either inline (same tab) + * or external in a new tab or browser window. + * 2. Requests the token from `buildAuthEndpointURL` using the `token` command. + * A token isn't guaranteed to be ready, so the OIDC flow can be in a + * "pending" state. + * + * This authenticator should not be used directly because it does not specify + * URL-building endpoints of its own. + * To use, generate an application authenticator in your app + * `authenticators/application.js` and extend this class. + */ +export default class OIDCAuthenticator extends BaseAuthenticator { + // =services + + @service session; + + // =methods + + /** + * Kicks-off the OIDC flow: calls the `authenticate:start` action on the + * specified auth method, which returns some meta data along with an + * authorization request URL. The response data is saved for later and + * authentication enters a pending state. + * + * @param {boolean} requestCookies request cookie tokens (default `true`) + * @param {object} options + * @return {object} + */ + async startAuthentication(options) { + const url = this.buildAuthEndpointURL(options); + const body = JSON.stringify({ command: 'start' }); + const response = await fetch(url, { method: 'post', body }); + const json = await response.json(); + if (response.status < 400) { + // Store meta about the pending OIDC flow + this.session.set('data.pending', { + oidc: json, + }); + return json; + } else { + return reject(); + } + } + + /** + * OIDC is a _process_ and does not have a singular "authenticate" step. Thus + * this authenticate method simply normalizes the data passed into it once + * `attemptFetchToken` completes. Notably, no requests are made by calling + * authenticate. A Boundary token must already have been obtained. + * @param {object} json + * @return {object} + */ + async authenticate(json) { + return this.normalizeData(json); + } + + /** + * This request attempts to fetch a Boundary token. This method represents a + * single request the polling sequence used to wait for authentication. + * There are three possible outcomes: + * + * 1. If the token is ready, it is persisted into the session, the session + * enters an authenticated state, and this method returns `true`. + * 2. If the token is not yet ready, this method returns false. + * 3. If the request errors, this method returns to a rejection, + * requiring appropriate error handling. + */ + async attemptFetchToken(options) { + // Get the URL and setup the request body + const url = this.buildAuthEndpointURL(options); + const body = JSON.stringify({ + command: 'token', + attributes: { + //state: this.session.get('data.pending.oidc.attributes.state'), + token_id: this.session.get('data.pending.oidc.attributes.token_id'), + }, + }); + // Fetch the endpoint and get the response JSON + const response = await fetch(url, { method: 'post', body }); + if (response.status === 202) { + // The token isn't ready yet, keep trying. + return false; + } else if (response.status < 400) { + // Response was successful, meaning a token was obtained. + // Authenticate with the session service using the response JSON. + const json = await response.json(); + await this.session.authenticate('authenticator:oidc', json); + return true; + } else { + // Response errors, return a rejection for further handling. + return reject(); + } + } +} diff --git a/addons/auth/addon/authenticators/password.js b/addons/auth/addon/authenticators/password.js index e130a23ee..3e0eb53e4 100644 --- a/addons/auth/addon/authenticators/password.js +++ b/addons/auth/addon/authenticators/password.js @@ -34,21 +34,6 @@ import fetch from 'fetch'; * */ export default class PasswordAuthenticator extends BaseAuthenticator { - // =unimplemented methods - - /** - * Generates an auth method URL with which to authenticate. - * @override - * @param {object} options - * @param {string} options.scope.scope_id - * @param {string} options.authMethod.id - * @return {string} - */ - buildAuthEndpointURL(/* { - scope: { id: scopeID }, - authMethod: { id: authMethodID }, - } */) {} - // =methods /** @@ -71,8 +56,9 @@ export default class PasswordAuthenticator extends BaseAuthenticator { options ) { const body = JSON.stringify({ + command: 'login', token_type: requestCookies ? 'cookie' : null, - credentials: { login_name, password }, + attributes: { login_name, password }, }); const authEndpointURL = this.buildAuthEndpointURL(options); const response = await fetch(authEndpointURL, { method: 'post', body }); diff --git a/addons/auth/tests/dummy/app/authenticators/oidc.js b/addons/auth/tests/dummy/app/authenticators/oidc.js new file mode 100644 index 000000000..b6508934b --- /dev/null +++ b/addons/auth/tests/dummy/app/authenticators/oidc.js @@ -0,0 +1,15 @@ +import OIDCAuthenticator from 'auth/authenticators/oidc'; + +export default class ApplicationOIDCAuthenticator extends OIDCAuthenticator { + buildTokenValidationEndpointURL(id) { + return `/validate/${id}`; + } + + buildAuthEndpointURL() { + return '/authenticate'; + } + + buildDeauthEndpointURL() { + return '/deauthenticate'; + } +} diff --git a/addons/auth/tests/unit/authenticators/base-test.js b/addons/auth/tests/unit/authenticators/base-test.js index 726e76162..31d2b3603 100644 --- a/addons/auth/tests/unit/authenticators/base-test.js +++ b/addons/auth/tests/unit/authenticators/base-test.js @@ -32,29 +32,25 @@ module('Unit | Authenticator | base', function (hooks) { test('it passes token validation on restoration if receiving 200', async function (assert) { assert.expect(1); - const mockData = { id: 'token_123' }; + const id = 'token_123'; + const mockData = { attributes: { id } }; const authenticator = this.owner.lookup('authenticator:base'); - this.server.get( - authenticator.buildTokenValidationEndpointURL(mockData.id), - () => { - assert.ok(true, 'token validation was requested'); - return new Response(200); - } - ); + this.server.get(authenticator.buildTokenValidationEndpointURL(id), () => { + assert.ok(true, 'token validation was requested'); + return new Response(200); + }); await authenticator.restore(mockData); }); test('it fails token validation on restoration if receiving 401', async function (assert) { assert.expect(2); - const mockData = { id: 'token_123' }; + const id = 'token_123'; + const mockData = { attributes: { id } }; const authenticator = this.owner.lookup('authenticator:base'); - this.server.get( - authenticator.buildTokenValidationEndpointURL(mockData.id), - () => { - assert.ok(true, 'token validation was requested'); - return new Response(401); - } - ); + this.server.get(authenticator.buildTokenValidationEndpointURL(id), () => { + assert.ok(true, 'token validation was requested'); + return new Response(401); + }); try { await authenticator.restore(mockData); } catch (e) { @@ -64,15 +60,13 @@ module('Unit | Authenticator | base', function (hooks) { test('it fails token validation on restoration if receiving 404', async function (assert) { assert.expect(2); - const mockData = { id: 'token_123' }; + const id = 'token_123'; + const mockData = { attributes: { id } }; const authenticator = this.owner.lookup('authenticator:base'); - this.server.get( - authenticator.buildTokenValidationEndpointURL(mockData.id), - () => { - assert.ok(true, 'token validation was requested'); - return new Response(404); - } - ); + this.server.get(authenticator.buildTokenValidationEndpointURL(id), () => { + assert.ok(true, 'token validation was requested'); + return new Response(404); + }); try { await authenticator.restore(mockData); } catch (e) { diff --git a/addons/auth/tests/unit/authenticators/oidc-test.js b/addons/auth/tests/unit/authenticators/oidc-test.js new file mode 100644 index 000000000..e2e7bb0a9 --- /dev/null +++ b/addons/auth/tests/unit/authenticators/oidc-test.js @@ -0,0 +1,36 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; +import { Response } from 'miragejs'; +import setupMirage from 'ember-cli-mirage/test-support/setup-mirage'; + +module('Unit | Authenticator | OIDC', function (hooks) { + setupTest(hooks); + setupMirage(hooks); + + test('`startAuthentication` initiates the authentication flow and returns the response', async function (assert) { + assert.expect(2); + const authenticator = this.owner.lookup('authenticator:oidc'); + this.server.post( + authenticator.buildAuthEndpointURL(), + () => new Response(200, {}, { foo: 'bar' }) + ); + const response = await authenticator.startAuthentication(); + assert.ok(true, 'authentication succeeded'); + assert.deepEqual(response, { foo: 'bar' }); + }); + + test('`startAuthentication` rejects/errors if API returns an error response', async function (assert) { + assert.expect(1); + const authenticator = this.owner.lookup('authenticator:oidc'); + this.server.post( + authenticator.buildAuthEndpointURL(), + () => new Response(400) + ); + // Because assert.throws doesn't work with async errors/promise rejections + try { + await authenticator.startAuthentication(); + } catch (e) { + assert.ok(true); + } + }); +}); diff --git a/addons/auth/tests/unit/authenticators/password-test.js b/addons/auth/tests/unit/authenticators/password-test.js index 3bac47edb..9799101e7 100644 --- a/addons/auth/tests/unit/authenticators/password-test.js +++ b/addons/auth/tests/unit/authenticators/password-test.js @@ -47,8 +47,9 @@ module('Unit | Authenticator | password', function (hooks) { (schema, request) => { const json = JSON.parse(request.requestBody); assert.deepEqual(json, { + command: 'login', token_type: 'cookie', - credentials: { + attributes: { login_name: 'foo', password: 'bar', }, diff --git a/ui/desktop/app/authenticators/password.js b/addons/core/addon/authenticators/oidc.js similarity index 72% rename from ui/desktop/app/authenticators/password.js rename to addons/core/addon/authenticators/oidc.js index f9d97033e..f159fa87f 100644 --- a/ui/desktop/app/authenticators/password.js +++ b/addons/core/addon/authenticators/oidc.js @@ -1,17 +1,15 @@ -import BasePasswordAuthenticator from 'auth/authenticators/password'; +import BaseOIDCAuthenticator from 'auth/authenticators/oidc'; import { inject as service } from '@ember/service'; /** - * A username/password authenticator that authenticates with - * a scope/auth-method endpoint. Authentication occurs on an auth method - * endpoint, while deauthentication occurs on a scope endpoint. + * An OIDC authenticator that handles flow kick-off and polling. */ -export default class PasswordAuthenticator extends BasePasswordAuthenticator { +export default class OIDCAuthenticator extends BaseOIDCAuthenticator { // =services @service store; - // =attributes + // =methods /** * Generates an auth method URL with which to authenticate. @@ -30,19 +28,6 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { return adapter.buildURL('auth-method', authMethodID, options, 'findRecord'); } - /** - * Generates a scope URL with which to deauthenticate. - * @override - * @param {object} options - * @param {string} scopeID - * @return {string} - */ - buildDeauthEndpointURL({ scope: { id: scopeID } }) { - const adapter = this.store.adapterFor('application'); - const options = { adapterOptions: { method: 'deauthenticate' } }; - return adapter.buildURL('scope', scopeID, options, 'findRecord'); - } - /** * Generates an auth token validation URL used to check tokens on restoration. * @override @@ -62,7 +47,7 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { */ authenticate() { return super.authenticate(...arguments).then((data) => { - const token = data?.token; + const token = data?.attributes?.token; this.addTokenToAuthorization(token); return data; }); @@ -76,7 +61,7 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { * @return {object} */ restore(data) { - const token = data?.token; + const token = data?.attributes?.token; this.addTokenToAuthorization(token); return super.restore(data); } @@ -85,6 +70,9 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { * Assigns a token string all future requests via the `Authorization` header * on the application adapter prototype. Only application and adapters that * extend the application adapter receive this header (which is most). + * + * TODO: if cookies were requested, this step should be skipped. + * * @param {string} token */ addTokenToAuthorization(token) { diff --git a/addons/core/addon/authenticators/password.js b/addons/core/addon/authenticators/password.js index c76874ce9..186731a7d 100644 --- a/addons/core/addon/authenticators/password.js +++ b/addons/core/addon/authenticators/password.js @@ -62,7 +62,7 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { */ authenticate() { return super.authenticate(...arguments).then((data) => { - const token = data?.token; + const token = data?.attributes?.token; this.addTokenToAuthorization(token); return data; }); @@ -76,7 +76,7 @@ export default class PasswordAuthenticator extends BasePasswordAuthenticator { * @return {object} */ restore(data) { - const token = data?.token; + const token = data?.attributes?.token; this.addTokenToAuthorization(token); return super.restore(data); } diff --git a/addons/core/addon/components/form/authenticate/oidc/index.hbs b/addons/core/addon/components/form/authenticate/oidc/index.hbs new file mode 100644 index 000000000..e8e1294fe --- /dev/null +++ b/addons/core/addon/components/form/authenticate/oidc/index.hbs @@ -0,0 +1,13 @@ + + + + + diff --git a/addons/core/app/authenticators/oidc.js b/addons/core/app/authenticators/oidc.js new file mode 100644 index 000000000..2299b299d --- /dev/null +++ b/addons/core/app/authenticators/oidc.js @@ -0,0 +1 @@ +export { default } from 'core/authenticators/oidc'; diff --git a/addons/core/app/components/form/authenticate/oidc.js b/addons/core/app/components/form/authenticate/oidc.js new file mode 100644 index 000000000..7e7fe7a85 --- /dev/null +++ b/addons/core/app/components/form/authenticate/oidc.js @@ -0,0 +1 @@ +export { default } from 'core/components/form/authenticate/oidc'; diff --git a/addons/core/package.json b/addons/core/package.json index ef95521ec..59bf006c6 100644 --- a/addons/core/package.json +++ b/addons/core/package.json @@ -37,6 +37,7 @@ "ember-loading": "^0.4.0", "ember-page-title": "^6.0.3", "ember-route-action-helper": "^2.0.8", + "ember-feature-flags": "^6.0.0", "rose": "*" }, "devDependencies": { diff --git a/addons/core/tests/unit/authenticators/password-test.js b/addons/core/tests/unit/authenticators/password-test.js index a7580ef7d..2542aed56 100644 --- a/addons/core/tests/unit/authenticators/password-test.js +++ b/addons/core/tests/unit/authenticators/password-test.js @@ -26,13 +26,11 @@ module('Unit | Authenticator | password', function (hooks) { test('it adds an authorization header to application adapter on restore', async function (assert) { assert.expect(1); - const mockData = { id: 'token1234', token: 'token1234' }; - this.server.get( - authenticator.buildTokenValidationEndpointURL(mockData.id), - () => { - return new Response(200); - } - ); + const id = 'token1234'; + const mockData = { attributes: { id, token: 'token1234' } }; + this.server.get(authenticator.buildTokenValidationEndpointURL(id), () => { + return new Response(200); + }); authenticator.restore(mockData); assert.equal(applicationAdapter.headers.Authorization, 'Bearer token1234'); }); diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml index 021b4e84e..7432ac466 100644 --- a/addons/core/translations/resources/en-us.yaml +++ b/addons/core/translations/resources/en-us.yaml @@ -27,8 +27,12 @@ auth-method: no-primary-auth-method: title: "Recommendation: Select a Primary Auth Method" description: A primary auth method auto-creates users when they authenticate for the first time. Scopes without primary auth methods may experience authentication failures. + pending: + title: Authentication Pending + description: Complete authentication in the newly-opened window. types: password: Password + oidc: OIDC actions: create: Create Auth Method delete: Delete Auth Method @@ -42,6 +46,7 @@ auth-method: remove-as-primary: Remove primary auth method? make-primary-confirm: "A primary auth method auto-creates users on their first authentication attempt if needed. Note: if you change the primary auth method, the previous primary will no longer auto-create users." remove-as-primary-confirm: Removing the primary auth method may lead to authentication failures for this scope. + no-see-window: Don't see the new window? group: title: Group title_plural: Groups diff --git a/addons/rose/addon/styles/rose/components/dialog/_cover.scss b/addons/rose/addon/styles/rose/components/dialog/_cover.scss index 04ea3d566..7652dc3b2 100644 --- a/addons/rose/addon/styles/rose/components/dialog/_cover.scss +++ b/addons/rose/addon/styles/rose/components/dialog/_cover.scss @@ -1,6 +1,7 @@ .rose-dialog-cover { position: fixed; top: 0; + left: 0; width: 100vw; height: 100vh; display: flex; @@ -16,6 +17,8 @@ .rose-dialog-cover-header, .rose-dialog-cover-body { + position: relative; + top: -10vh; max-width: 650px; } } diff --git a/ui/admin/app/controllers/scopes/scope/authenticate/method/oidc.js b/ui/admin/app/controllers/scopes/scope/authenticate/method/oidc.js new file mode 100644 index 000000000..119f54ed0 --- /dev/null +++ b/ui/admin/app/controllers/scopes/scope/authenticate/method/oidc.js @@ -0,0 +1,18 @@ +import Controller from '@ember/controller'; +import { inject as service } from '@ember/service'; + +export default class ScopesScopeAuthenticateMethodOidcController extends Controller { + // =services + + @service session; + + // =attributes + + /** + * Authetnication URL for the pending OIDC flow, if any. + * @type {?string} + */ + get authURL() { + return this.session.data.pending.oidc.attributes.auth_url; + } +} diff --git a/ui/admin/app/router.js b/ui/admin/app/router.js index 97294b7ac..c63c9a627 100644 --- a/ui/admin/app/router.js +++ b/ui/admin/app/router.js @@ -13,7 +13,9 @@ Router.map(function () { this.route('scopes', function () { this.route('scope', { path: ':scope_id' }, function () { this.route('authenticate', function () { - this.route('method', { path: ':auth_method_id' }); + this.route('method', { path: ':auth_method_id' }, function () { + this.route('oidc'); + }); }); this.route('scopes', function () {}); diff --git a/ui/admin/app/routes/scopes/scope/authenticate/method.js b/ui/admin/app/routes/scopes/scope/authenticate/method.js index 1e4c9f46a..33dec88f9 100644 --- a/ui/admin/app/routes/scopes/scope/authenticate/method.js +++ b/ui/admin/app/routes/scopes/scope/authenticate/method.js @@ -1,5 +1,6 @@ import Route from '@ember/routing/route'; import { inject as service } from '@ember/service'; +import { getOwner } from '@ember/application'; import { action } from '@ember/object'; import loading from 'ember-loading/decorator'; import { notifyError } from 'core/decorators/notify'; @@ -23,6 +24,27 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route { return this.store.findRecord('auth-method', id, adapterOptions); } + /** + * + */ + async startOIDCAuthentication(authenticatorName, options) { + const oidc = getOwner(this).lookup(authenticatorName); + // TODO: delegate this call from the session service so that we don't have + // to look up the authenticator directly + const json = await oidc.startAuthentication(options); + await this.openExternalOIDCFlow(json.attributes.auth_url); + } + + /** + * Opens the specified URL in a new tab or window. By default this uses + * `window.open`, but may be overriden. + * @param {string} url + */ + async openExternalOIDCFlow(url) { + // TODO don't use window directly + await window.open(url); + } + // =actions /** @@ -37,10 +59,23 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route { const authMethod = this.modelFor('scopes.scope.authenticate.method'); const authenticatorName = `authenticator:${authMethod.type}`; const requestCookies = false; - await this.session.authenticate(authenticatorName, creds, requestCookies, { - scope, - authMethod, - }); - this.transitionTo('index'); + switch (authMethod.type) { + case 'password': + await this.session.authenticate( + authenticatorName, + creds, + requestCookies, + { scope, authMethod } + ); + this.transitionTo('index'); + break; + case 'oidc': + await this.startOIDCAuthentication(authenticatorName, { + scope, + authMethod, + }); + this.transitionTo('scopes.scope.authenticate.method.oidc'); + break; + } } } diff --git a/ui/admin/app/routes/scopes/scope/authenticate/method/index.js b/ui/admin/app/routes/scopes/scope/authenticate/method/index.js new file mode 100644 index 000000000..fc9b10575 --- /dev/null +++ b/ui/admin/app/routes/scopes/scope/authenticate/method/index.js @@ -0,0 +1,3 @@ +import Route from '@ember/routing/route'; + +export default class ScopesScopeAuthenticateMethodIndexRoute extends Route {} diff --git a/ui/admin/app/routes/scopes/scope/authenticate/method/oidc.js b/ui/admin/app/routes/scopes/scope/authenticate/method/oidc.js new file mode 100644 index 000000000..b6cb354c4 --- /dev/null +++ b/ui/admin/app/routes/scopes/scope/authenticate/method/oidc.js @@ -0,0 +1,82 @@ +import Route from '@ember/routing/route'; +import { getOwner } from '@ember/application'; +import { inject as service } from '@ember/service'; +import { task, timeout } from 'ember-concurrency'; +import { action } from '@ember/object'; +import { notifyError } from 'core/decorators/notify'; +import config from '../../../../../config/environment'; + +const POLL_TIMEOUT_SECONDS = config.oidcPollingTimeoutSeconds; + +export default class ScopesScopeAuthenticateMethodOidcRoute extends Route { + + // =services + + @service session; + + // =attributes + + /** + * A simple Ember Concurrency-based polling task that refreshes the route + * every POLL_TIMEOUT_SECONDS seconds. This is necessary to display changes + * to session `status` that may occur. + * + * NOTE: tasks are sort of attributes and sort of methods, but they are not + * language-level constructs. Thus we annotate this task as if it + * is an attribute. + * @type {Task} + */ + @task(function * () { + while(!this.session.isAuthenticated) { + yield timeout(POLL_TIMEOUT_SECONDS * 1000); + yield this.refresh(); + } + /* eslint-disable-next-line prettier/prettier */ + }).drop() poller; + + // =methods + + model() { + const scope = this.modelFor('scopes.scope'); + const authMethod = this.modelFor('scopes.scope.authenticate.method'); + const authenticatorName = `authenticator:${authMethod.type}`; + const oidc = getOwner(this).lookup(authenticatorName); + // TODO: delegate this call from the session service so that we don't have + // to look up the authenticator directly + return oidc.attemptFetchToken({ scope, authMethod }); + } + + /** + * If authenticated, redirects to index for further processing. + */ + redirect() { + if (this.session.isAuthenticated) this.replaceWith('index'); + } + + /** + * When this route is activated (entered), begin polling for changes. + */ + activate() { + this.poller.perform(); + } + + /** + * When this route is deactivated (exited), stop polling for changes. + */ + deactivate() { + this.poller.cancelAll(); + } + + /** + * An error in this route indicates authentication failed. The user is + * notified and returned to the index. + */ + @action + @notifyError(() => 'errors.authentication-failed.title', { catch: true }) + error(e) { + this.transitionTo('scopes.scope.authenticate.method.index'); + // rethrow the error to activate the notifyError decorator + throw e; + } + +} diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs index d80548df7..f8038c37b 100644 --- a/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs +++ b/ui/admin/app/templates/scopes/scope/auth-methods/index.hbs @@ -58,12 +58,30 @@ {{#each @model as |authMethod|}} - - {{authMethod.displayName}} - + {{! + Show link to auth method route if non-OIDC and when + oidc-crud feature is enabled, otherwise show just the name + (when the method is OIDC and oidc-crud is disabled) + }} + {{#if authMethod.isOIDC}} + {{#if (feature-flag 'oidc-crud')}} + + {{authMethod.displayName}} + + {{else}} + {{authMethod.displayName}} + {{/if}} + {{else}} + + {{authMethod.displayName}} + + {{/if}}

{{authMethod.description}}

 diff --git a/ui/admin/app/templates/scopes/scope/authenticate.hbs b/ui/admin/app/templates/scopes/scope/authenticate.hbs index 15118750e..2edc1abd9 100644 --- a/ui/admin/app/templates/scopes/scope/authenticate.hbs +++ b/ui/admin/app/templates/scopes/scope/authenticate.hbs @@ -28,15 +28,31 @@ - {{#each @model.authMethods as |authMethod|}} - - {{#if authMethod.name}} - {{authMethod.name}} - {{else}} - {{t (concat "resources.auth-method.types." authMethod.type)}} - {{/if}} - - {{/each}} + {{#if (feature-flag 'oidc')}} + {{! OIDC enable: list all auth methods }} + {{#each @model.authMethods as |authMethod|}} + + {{#if authMethod.name}} + {{authMethod.name}} + {{else}} + {{t (concat "resources.auth-method.types." authMethod.type)}} + {{/if}} + + {{/each}} + {{else}} + {{! OIDC disabled: filter out OIDC auth methods}} + {{#each @model.authMethods as |authMethod|}} + {{#unless authMethod.isOIDC}} + + {{#if authMethod.name}} + {{authMethod.name}} + {{else}} + {{t (concat "resources.auth-method.types." authMethod.type)}} + {{/if}} + + {{/unless}} + {{/each}} + {{/if}} {{#if @model.authMethods}} diff --git a/ui/admin/app/templates/scopes/scope/authenticate/method.hbs b/ui/admin/app/templates/scopes/scope/authenticate/method.hbs index 6428c8118..c24cd6895 100644 --- a/ui/admin/app/templates/scopes/scope/authenticate/method.hbs +++ b/ui/admin/app/templates/scopes/scope/authenticate/method.hbs @@ -1,5 +1 @@ - +{{outlet}} diff --git a/ui/admin/app/templates/scopes/scope/authenticate/method/index.hbs b/ui/admin/app/templates/scopes/scope/authenticate/method/index.hbs new file mode 100644 index 000000000..e05057cee --- /dev/null +++ b/ui/admin/app/templates/scopes/scope/authenticate/method/index.hbs @@ -0,0 +1,17 @@ +{{#if (feature-flag 'oidc')}} + {{! OIDC enabled: show form for any auth method}} + +{{else}} + {{! OIDC disabled: hide OIDC auth form}} + {{#unless @model.isOIDC}} + + {{/unless}} +{{/if}} diff --git a/ui/admin/app/templates/scopes/scope/authenticate/method/oidc.hbs b/ui/admin/app/templates/scopes/scope/authenticate/method/oidc.hbs new file mode 100644 index 000000000..dedca3ab3 --- /dev/null +++ b/ui/admin/app/templates/scopes/scope/authenticate/method/oidc.hbs @@ -0,0 +1,24 @@ + + <:header> + {{inline-svg "logo-app-full"}} +

{{t 'resources.auth-method.messages.pending.title'}}

+ + <:body> +

{{t 'resources.auth-method.messages.pending.description'}}

+

+ {{t 'resources.auth-method.questions.no-see-window'}} + + {{t 'actions.retry'}} + +

+

+ + {{t 'actions.cancel'}} + +

+ + diff --git a/ui/admin/config/environment.js b/ui/admin/config/environment.js index 355dc4585..f36c204a5 100644 --- a/ui/admin/config/environment.js +++ b/ui/admin/config/environment.js @@ -36,6 +36,7 @@ module.exports = function (environment) { notifyTimeout: 4000, sessionPollingTimeoutSeconds: 2.5, + oidcPollingTimeoutSeconds: 1, documentation: { baseURL: 'https://boundaryproject.io/help/admin-ui', @@ -85,6 +86,8 @@ module.exports = function (environment) { }, featureFlags: { + oidc: true, + 'oidc-crud': false, 'primary-auth-method': false, }, }; @@ -122,6 +125,8 @@ module.exports = function (environment) { // Enable features in development ENV.featureFlags['primary-auth-method'] = true; + ENV.featureFlags['oidc'] = true; + //ENV.featureFlags['oidc-crud'] = true; } if (environment === 'test') { diff --git a/ui/admin/package.json b/ui/admin/package.json index fe423eda1..7ab846102 100644 --- a/ui/admin/package.json +++ b/ui/admin/package.json @@ -65,7 +65,6 @@ "ember-concurrency": "^1.3.0", "ember-exam": "^6.0.1", "ember-export-application-global": "^2.0.1", - "ember-feature-flags": "^6.0.0", "ember-inline-svg": "^1.0.0", "ember-load-initializers": "^2.1.2", "ember-maybe-import-regenerator": "^0.1.6", diff --git a/ui/admin/public/logo-app-full.svg b/ui/admin/public/logo-app-full.svg new file mode 100644 index 000000000..fd38d1aa7 --- /dev/null +++ b/ui/admin/public/logo-app-full.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/ui/admin/tests/acceptance/authentication-test.js b/ui/admin/tests/acceptance/authentication-test.js index 502e684af..3578ae935 100644 --- a/ui/admin/tests/acceptance/authentication-test.js +++ b/ui/admin/tests/acceptance/authentication-test.js @@ -66,9 +66,12 @@ module('Acceptance | authentication', function (hooks) { scope = { id: orgScope.id, type: orgScope.type }; globalAuthMethod = this.server.create('auth-method', { scope: globalScope, + type: 'password', + }); + authMethod = this.server.create('auth-method', { + scope: orgScope, + type: 'password', }); - this.server.create('user', { scope: globalScope }); - authMethod = this.server.create('auth-method', { scope: orgScope }); orgScopeID = orgScope.id; globalAuthMethodID = globalAuthMethod.id; authMethodID = authMethod.id; diff --git a/ui/admin/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js b/ui/admin/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js new file mode 100644 index 000000000..0a98d8794 --- /dev/null +++ b/ui/admin/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js @@ -0,0 +1,17 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Controller | scopes/scope/authenticate/method/oidc', + function (hooks) { + setupTest(hooks); + + // TODO: Replace this with your real tests. + test('it exists', function (assert) { + let controller = this.owner.lookup( + 'controller:scopes/scope/authenticate/method/oidc' + ); + assert.ok(controller); + }); + } +); diff --git a/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/index-test.js b/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/index-test.js new file mode 100644 index 000000000..10a6a561c --- /dev/null +++ b/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/index-test.js @@ -0,0 +1,16 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Route | scopes/scope/authenticate/method/index', + function (hooks) { + setupTest(hooks); + + test('it exists', function (assert) { + let route = this.owner.lookup( + 'route:scopes/scope/authenticate/method/index' + ); + assert.ok(route); + }); + } +); diff --git a/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js b/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js new file mode 100644 index 000000000..2c2764470 --- /dev/null +++ b/ui/admin/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js @@ -0,0 +1,16 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Route | scopes/scope/authenticate/method/oidc', + function (hooks) { + setupTest(hooks); + + test('it exists', function (assert) { + let route = this.owner.lookup( + 'route:scopes/scope/authenticate/method/oidc' + ); + assert.ok(route); + }); + } +); diff --git a/ui/desktop/app/controllers/scopes/scope/authenticate/method/oidc.js b/ui/desktop/app/controllers/scopes/scope/authenticate/method/oidc.js new file mode 100644 index 000000000..119f54ed0 --- /dev/null +++ b/ui/desktop/app/controllers/scopes/scope/authenticate/method/oidc.js @@ -0,0 +1,18 @@ +import Controller from '@ember/controller'; +import { inject as service } from '@ember/service'; + +export default class ScopesScopeAuthenticateMethodOidcController extends Controller { + // =services + + @service session; + + // =attributes + + /** + * Authetnication URL for the pending OIDC flow, if any. + * @type {?string} + */ + get authURL() { + return this.session.data.pending.oidc.attributes.auth_url; + } +} diff --git a/ui/desktop/app/router.js b/ui/desktop/app/router.js index 041868e34..71ea1f191 100644 --- a/ui/desktop/app/router.js +++ b/ui/desktop/app/router.js @@ -10,7 +10,9 @@ Router.map(function () { this.route('scopes', function () { this.route('scope', { path: ':scope_id' }, function () { this.route('authenticate', function () { - this.route('method', { path: ':auth_method_id' }); + this.route('method', { path: ':auth_method_id' }, function () { + this.route('oidc'); + }); }); this.route('projects', function () { this.route('targets', function () { diff --git a/ui/desktop/app/routes/scopes/scope/authenticate/method.js b/ui/desktop/app/routes/scopes/scope/authenticate/method.js index 33b7fd324..66fc52286 100644 --- a/ui/desktop/app/routes/scopes/scope/authenticate/method.js +++ b/ui/desktop/app/routes/scopes/scope/authenticate/method.js @@ -1,5 +1,6 @@ import Route from '@ember/routing/route'; import { inject as service } from '@ember/service'; +import { getOwner } from '@ember/application'; import { action } from '@ember/object'; import loading from 'ember-loading/decorator'; import { notifyError } from 'core/decorators/notify'; @@ -9,6 +10,7 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route { @service session; @service notify; + @service ipc; @service intl; // =methods @@ -23,6 +25,26 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route { return this.store.findRecord('auth-method', id, adapterOptions); } + /** + * + */ + async startOIDCAuthentication(authenticatorName, options) { + const oidc = getOwner(this).lookup(authenticatorName); + // TODO: delegate this call from the session service so that we don't have + // to look up the authenticator directly + const json = await oidc.startAuthentication(options); + await this.openExternalOIDCFlow(json.attributes.auth_url); + } + + /** + * Opens the specified URL in a new tab or window. By default this uses + * `window.open`, but may be overriden. + * @param {string} url + */ + async openExternalOIDCFlow(url) { + await this.ipc.invoke('openExternal', url); + } + // =actions /** @@ -37,10 +59,23 @@ export default class ScopesScopeAuthenticateMethodRoute extends Route { const authMethod = this.modelFor('scopes.scope.authenticate.method'); const authenticatorName = `authenticator:${authMethod.type}`; const requestCookies = false; - await this.session.authenticate(authenticatorName, creds, requestCookies, { - scope, - authMethod, - }); - this.replaceWith('index'); + switch (authMethod.type) { + case 'password': + await this.session.authenticate( + authenticatorName, + creds, + requestCookies, + { scope, authMethod } + ); + this.transitionTo('index'); + break; + case 'oidc': + await this.startOIDCAuthentication(authenticatorName, { + scope, + authMethod, + }); + this.transitionTo('scopes.scope.authenticate.method.oidc'); + break; + } } } diff --git a/ui/desktop/app/routes/scopes/scope/authenticate/method/index.js b/ui/desktop/app/routes/scopes/scope/authenticate/method/index.js new file mode 100644 index 000000000..fc9b10575 --- /dev/null +++ b/ui/desktop/app/routes/scopes/scope/authenticate/method/index.js @@ -0,0 +1,3 @@ +import Route from '@ember/routing/route'; + +export default class ScopesScopeAuthenticateMethodIndexRoute extends Route {} diff --git a/ui/desktop/app/routes/scopes/scope/authenticate/method/oidc.js b/ui/desktop/app/routes/scopes/scope/authenticate/method/oidc.js new file mode 100644 index 000000000..b6cb354c4 --- /dev/null +++ b/ui/desktop/app/routes/scopes/scope/authenticate/method/oidc.js @@ -0,0 +1,82 @@ +import Route from '@ember/routing/route'; +import { getOwner } from '@ember/application'; +import { inject as service } from '@ember/service'; +import { task, timeout } from 'ember-concurrency'; +import { action } from '@ember/object'; +import { notifyError } from 'core/decorators/notify'; +import config from '../../../../../config/environment'; + +const POLL_TIMEOUT_SECONDS = config.oidcPollingTimeoutSeconds; + +export default class ScopesScopeAuthenticateMethodOidcRoute extends Route { + + // =services + + @service session; + + // =attributes + + /** + * A simple Ember Concurrency-based polling task that refreshes the route + * every POLL_TIMEOUT_SECONDS seconds. This is necessary to display changes + * to session `status` that may occur. + * + * NOTE: tasks are sort of attributes and sort of methods, but they are not + * language-level constructs. Thus we annotate this task as if it + * is an attribute. + * @type {Task} + */ + @task(function * () { + while(!this.session.isAuthenticated) { + yield timeout(POLL_TIMEOUT_SECONDS * 1000); + yield this.refresh(); + } + /* eslint-disable-next-line prettier/prettier */ + }).drop() poller; + + // =methods + + model() { + const scope = this.modelFor('scopes.scope'); + const authMethod = this.modelFor('scopes.scope.authenticate.method'); + const authenticatorName = `authenticator:${authMethod.type}`; + const oidc = getOwner(this).lookup(authenticatorName); + // TODO: delegate this call from the session service so that we don't have + // to look up the authenticator directly + return oidc.attemptFetchToken({ scope, authMethod }); + } + + /** + * If authenticated, redirects to index for further processing. + */ + redirect() { + if (this.session.isAuthenticated) this.replaceWith('index'); + } + + /** + * When this route is activated (entered), begin polling for changes. + */ + activate() { + this.poller.perform(); + } + + /** + * When this route is deactivated (exited), stop polling for changes. + */ + deactivate() { + this.poller.cancelAll(); + } + + /** + * An error in this route indicates authentication failed. The user is + * notified and returned to the index. + */ + @action + @notifyError(() => 'errors.authentication-failed.title', { catch: true }) + error(e) { + this.transitionTo('scopes.scope.authenticate.method.index'); + // rethrow the error to activate the notifyError decorator + throw e; + } + +} diff --git a/ui/desktop/app/templates/scopes/scope/authenticate.hbs b/ui/desktop/app/templates/scopes/scope/authenticate.hbs index 3d7d834bd..027736bc3 100644 --- a/ui/desktop/app/templates/scopes/scope/authenticate.hbs +++ b/ui/desktop/app/templates/scopes/scope/authenticate.hbs @@ -21,11 +21,23 @@ - {{#each @model.authMethods as |authMethod|}} - - {{t (concat "resources.auth-method.types." authMethod.type)}} - - {{/each}} + {{#if (feature-flag 'oidc')}} + {{! OIDC enable: list all auth methods }} + {{#each @model.authMethods as |authMethod|}} + + {{t (concat "resources.auth-method.types." authMethod.type)}} + + {{/each}} + {{else}} + {{! OIDC disabled: filter out OIDC auth methods}} + {{#each @model.authMethods as |authMethod|}} + {{#unless authMethod.isOIDC}} + + {{t (concat "resources.auth-method.types." authMethod.type)}} + + {{/unless}} + {{/each}} + {{/if}} {{#if @model.authMethods}} diff --git a/ui/desktop/app/templates/scopes/scope/authenticate/method.hbs b/ui/desktop/app/templates/scopes/scope/authenticate/method.hbs index 6428c8118..c24cd6895 100644 --- a/ui/desktop/app/templates/scopes/scope/authenticate/method.hbs +++ b/ui/desktop/app/templates/scopes/scope/authenticate/method.hbs @@ -1,5 +1 @@ - +{{outlet}} diff --git a/ui/desktop/app/templates/scopes/scope/authenticate/method/index.hbs b/ui/desktop/app/templates/scopes/scope/authenticate/method/index.hbs new file mode 100644 index 000000000..e05057cee --- /dev/null +++ b/ui/desktop/app/templates/scopes/scope/authenticate/method/index.hbs @@ -0,0 +1,17 @@ +{{#if (feature-flag 'oidc')}} + {{! OIDC enabled: show form for any auth method}} + +{{else}} + {{! OIDC disabled: hide OIDC auth form}} + {{#unless @model.isOIDC}} + + {{/unless}} +{{/if}} diff --git a/ui/desktop/app/templates/scopes/scope/authenticate/method/oidc.hbs b/ui/desktop/app/templates/scopes/scope/authenticate/method/oidc.hbs new file mode 100644 index 000000000..c6e38e882 --- /dev/null +++ b/ui/desktop/app/templates/scopes/scope/authenticate/method/oidc.hbs @@ -0,0 +1,23 @@ + + <:header> +

{{t 'resources.auth-method.messages.pending.title'}}

+ + <:body> +

{{t 'resources.auth-method.messages.pending.description'}}

+

+ {{t 'resources.auth-method.questions.no-see-window'}} + + {{t 'actions.retry'}} + +

+

+ + {{t 'actions.cancel'}} + +

+ + diff --git a/ui/desktop/config/environment.js b/ui/desktop/config/environment.js index 8e854404a..c45790089 100644 --- a/ui/desktop/config/environment.js +++ b/ui/desktop/config/environment.js @@ -44,6 +44,7 @@ module.exports = function (environment) { notifyTimeout: 4000, sessionPollingTimeoutSeconds: 2.5, + oidcPollingTimeoutSeconds: 1, documentation: { baseURL: 'https://boundaryproject.io/help/desktop', @@ -52,6 +53,10 @@ module.exports = function (environment) { sessions: '/sessions', }, }, + + featureFlags: { + oidc: true, + }, }; if (process.env.ENABLE_MIRAGE) { @@ -69,6 +74,9 @@ module.exports = function (environment) { // of the UI, which only makes sense in development where the origin is // usually the same as the application origin. ENV.autoOrigin = true; + + // Enable features in development + ENV.featureFlags['oidc'] = true; } if (environment === 'test') { diff --git a/ui/desktop/electron-app/src/handlers.js b/ui/desktop/electron-app/src/handlers.js index 6a251d742..4e102212a 100644 --- a/ui/desktop/electron-app/src/handlers.js +++ b/ui/desktop/electron-app/src/handlers.js @@ -1,4 +1,5 @@ const { shell } = require('electron'); +const isDev = require('electron-is-dev'); const handle = require('./ipc-handler'); const boundaryCli = require('./boundary-cli'); const origin = require('./origin.js'); @@ -26,12 +27,17 @@ handle('resetOrigin', async (requestOrigin) => { }); /** - * Opens the specified URL in an external browser. Only HTTPS URLs are allowed. + * Opens the specified URL in an external browser. Only secure HTTPs URLs are + * allowed except in the case of localhost (which enables development and + * testing workflows). Insecure URLs are allowed in dev mode. */ handle('openExternal', async (href) => { - if (href.startsWith('https://')) { + const isSecure = href.startsWith('https://'); + const isLocalhost = href.startsWith('http://localhost') + || href.startsWith('http://127.0.0.1'); + if (isSecure || isLocalhost || isDev) { // openExternal is necessary in order to display documentation and to - // support arbitrary OIDC flows. The protocol is validated. + // support arbitrary OIDC flows. The protocol is validated (see above). shell.openExternal(href); /* eng-disable OPEN_EXTERNAL_JS_CHECK */ } else { throw new Error( diff --git a/ui/desktop/package.json b/ui/desktop/package.json index 082ee9edb..45c22f113 100644 --- a/ui/desktop/package.json +++ b/ui/desktop/package.json @@ -36,6 +36,9 @@ "postinstall": "cd electron-app && yarn install", "posttest": "ember coverage-merge && yarn clean:coverage" }, + "dependencies": { + "ember-named-blocks-polyfill": "^0.2.4" + }, "devDependencies": { "@doyensec/electronegativity": "^1.8.1", "@ember/jquery": "^1.1.0", diff --git a/ui/desktop/tests/acceptance/authentication-test.js b/ui/desktop/tests/acceptance/authentication-test.js index fa34de896..514d1d2b7 100644 --- a/ui/desktop/tests/acceptance/authentication-test.js +++ b/ui/desktop/tests/acceptance/authentication-test.js @@ -87,9 +87,11 @@ module('Acceptance | authentication', function (hooks) { // create other resources instances.authMethods.global = this.server.create('auth-method', { scope: instances.scopes.global, + type: 'password', }); instances.authMethods.org = this.server.create('auth-method', { scope: instances.scopes.org, + type: 'password', }); urls.scopes.global = `/scopes/${instances.scopes.global.id}`; diff --git a/ui/desktop/tests/unit/authenticators/password-test.js b/ui/desktop/tests/unit/authenticators/password-test.js deleted file mode 100644 index 35e872b48..000000000 --- a/ui/desktop/tests/unit/authenticators/password-test.js +++ /dev/null @@ -1,53 +0,0 @@ -import { module, test } from 'qunit'; -import { setupTest } from 'ember-qunit'; -import setupMirage from 'ember-cli-mirage/test-support/setup-mirage'; -import { Response } from 'miragejs'; - -module('Unit | Authenticator | password', function (hooks) { - setupTest(hooks); - setupMirage(hooks); - - let store; - let applicationAdapter; - let session; - let authenticator; - - hooks.beforeEach(function () { - store = this.owner.lookup('service:store'); - applicationAdapter = store.adapterFor('application'); - session = this.owner.lookup('service:session'); - authenticator = this.owner.lookup('authenticator:password'); - session.invalidate(); - }); - - hooks.afterEach(function () { - session.invalidate(); - }); - - test('it adds an authorization header to application adapter on restore', async function (assert) { - assert.expect(1); - const mockData = { id: 'token1234', token: 'token1234' }; - this.server.get( - authenticator.buildTokenValidationEndpointURL(mockData.id), - () => { - return new Response(200); - } - ); - authenticator.restore(mockData); - assert.equal(applicationAdapter.headers.Authorization, 'Bearer token1234'); - }); - - test('it adds an authorization header to application adapter on authenticate', async function (assert) { - assert.expect(1); - const creds = { identification: 'foo', password: 'bar' }; - const scope = { id: 'global' }; - const authMethod = { id: 'paum_1234' }; - this.server.create('scope', { id: 'global', type: 'global' }); - this.server.create('auth-method', { id: authMethod.id, scopeId: 'global' }); - await authenticator.authenticate(creds, null, { scope, authMethod }); - assert.equal( - applicationAdapter.headers.Authorization, - 'Bearer thetokenstring' - ); - }); -}); diff --git a/ui/desktop/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js b/ui/desktop/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js new file mode 100644 index 000000000..0a98d8794 --- /dev/null +++ b/ui/desktop/tests/unit/controllers/scopes/scope/authenticate/method/oidc-test.js @@ -0,0 +1,17 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Controller | scopes/scope/authenticate/method/oidc', + function (hooks) { + setupTest(hooks); + + // TODO: Replace this with your real tests. + test('it exists', function (assert) { + let controller = this.owner.lookup( + 'controller:scopes/scope/authenticate/method/oidc' + ); + assert.ok(controller); + }); + } +); diff --git a/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/index-test.js b/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/index-test.js new file mode 100644 index 000000000..10a6a561c --- /dev/null +++ b/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/index-test.js @@ -0,0 +1,16 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Route | scopes/scope/authenticate/method/index', + function (hooks) { + setupTest(hooks); + + test('it exists', function (assert) { + let route = this.owner.lookup( + 'route:scopes/scope/authenticate/method/index' + ); + assert.ok(route); + }); + } +); diff --git a/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js b/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js new file mode 100644 index 000000000..2c2764470 --- /dev/null +++ b/ui/desktop/tests/unit/routes/scopes/scope/authenticate/method/oidc-test.js @@ -0,0 +1,16 @@ +import { module, test } from 'qunit'; +import { setupTest } from 'ember-qunit'; + +module( + 'Unit | Route | scopes/scope/authenticate/method/oidc', + function (hooks) { + setupTest(hooks); + + test('it exists', function (assert) { + let route = this.owner.lookup( + 'route:scopes/scope/authenticate/method/oidc' + ); + assert.ok(route); + }); + } +); diff --git a/yarn.lock b/yarn.lock index daf05ce0d..249fbe42c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7578,7 +7578,7 @@ debug@~4.1.0: dependencies: ms "^2.1.1" -debuglog@*, debuglog@^1.0.1: +debuglog@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492" integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI= @@ -12343,7 +12343,7 @@ import-lazy@^4.0.0: resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-4.0.0.tgz#e8eb627483a0a43da3c03f3e35548be5cb0cc153" integrity sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw== -imurmurhash@*, imurmurhash@^0.1.4: +imurmurhash@^0.1.4: version "0.1.4" resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea" integrity sha1-khi5srkoojixPcT7a21XbyMUU+o= @@ -14041,11 +14041,6 @@ lodash._baseflatten@^3.0.0: lodash.isarguments "^3.0.0" lodash.isarray "^3.0.0" -lodash._baseindexof@*: - version "3.1.0" - resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c" - integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw= - lodash._baseuniq@~4.6.0: version "4.6.0" resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8" @@ -14054,16 +14049,11 @@ lodash._baseuniq@~4.6.0: lodash._createset "~4.0.0" lodash._root "~3.0.0" -lodash._bindcallback@*, lodash._bindcallback@^3.0.0: +lodash._bindcallback@^3.0.0: version "3.0.1" resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e" integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4= -lodash._cacheindexof@*: - version "3.0.2" - resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92" - integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI= - lodash._createassigner@^3.0.0: version "3.1.1" resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11" @@ -14073,19 +14063,12 @@ lodash._createassigner@^3.0.0: lodash._isiterateecall "^3.0.0" lodash.restparam "^3.0.0" -lodash._createcache@*: - version "3.1.2" - resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093" - integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM= - dependencies: - lodash._getnative "^3.0.0" - lodash._createset@~4.0.0: version "4.0.3" resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26" integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY= -lodash._getnative@*, lodash._getnative@^3.0.0: +lodash._getnative@^3.0.0: version "3.9.1" resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5" integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U= @@ -14303,7 +14286,7 @@ lodash.pick@^4.4.0: resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3" integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM= -lodash.restparam@*, lodash.restparam@^3.0.0: +lodash.restparam@^3.0.0: version "3.6.1" resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805" integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=