FindUserFromExternalProviderAsync(AuthenticateResult result) { var provider = result.Properties.Items["scheme"]; var orgId = new Guid(provider); var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId); if (ssoConfig == null || !ssoConfig.Enabled) { throw new Exception(_i18nService.T("OrganizationOrSsoConfigNotFound")); } var options = new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase, }; var ssoConfigData = JsonSerializer.Deserialize <SsoConfigurationData>(ssoConfig.Data, options); var externalUser = result.Principal; // Validate acr claim against expectation before going further if (!string.IsNullOrWhiteSpace(ssoConfigData.ExpectedReturnAcrValue)) { var acrClaim = externalUser.FindFirst(JwtClaimTypes.AuthenticationContextClassReference); if (acrClaim?.Value != ssoConfigData.ExpectedReturnAcrValue) { throw new Exception(_i18nService.T("AcrMissingOrInvalid")); } }
public async Task SaveAsync(SsoConfig config, Organization organization) { var now = DateTime.UtcNow; config.RevisionDate = now; if (config.Id == default) { config.CreationDate = now; } var useKeyConnector = config.GetData().KeyConnectorEnabled; if (useKeyConnector) { await VerifyDependenciesAsync(config, organization); } var oldConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(config.OrganizationId); var disabledKeyConnector = oldConfig?.GetData()?.KeyConnectorEnabled == true && !useKeyConnector; if (disabledKeyConnector && await AnyOrgUserHasKeyConnectorEnabledAsync(config.OrganizationId)) { throw new BadRequestException("Key Connector cannot be disabled at this moment."); } await LogEventsAsync(config, oldConfig); await _ssoConfigRepository.UpsertAsync(config); }
private async Task RequiredByKeyConnectorAsync(Organization org) { var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(org.Id); if (ssoConfig?.GetData()?.KeyConnectorEnabled == true) { throw new BadRequestException("Key Connector is enabled."); } }
public async Task <OrganizationSsoResponseModel> GetSso(Guid id) { if (!await _currentContext.ManageSso(id)) { throw new NotFoundException(); } var organization = await _organizationRepository.GetByIdAsync(id); if (organization == null) { throw new NotFoundException(); } var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(id); return(new OrganizationSsoResponseModel(organization, _globalSettings, ssoConfig)); }
public async Task <IActionResult> Index() { var orgId = _enterprisePortalCurrentContext.SelectedOrganizationId; if (orgId == null) { return(Redirect("~/")); } if (!_enterprisePortalCurrentContext.SelectedOrganizationDetails.UseSso || !_enterprisePortalCurrentContext.AdminForSelectedOrganization) { return(Redirect("~/")); } var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId.Value); var model = new SsoConfigEditViewModel(ssoConfig, _i18nService, _globalSettings); return(View(model)); }
public async Task Leave(string id) { var orgGuidId = new Guid(id); if (!await _currentContext.OrganizationUser(orgGuidId)) { throw new NotFoundException(); } var user = await _userService.GetUserByPrincipalAsync(User); var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgGuidId); if (ssoConfig?.GetData()?.KeyConnectorEnabled == true && user.UsesKeyConnector) { throw new BadRequestException("Your organization's Single Sign-On settings prevent you from leaving."); } await _organizationService.DeleteUserAsync(orgGuidId, user.Id); }
protected override async Task SetSuccessResult(CustomTokenRequestValidationContext context, User user, List <Claim> claims, Dictionary <string, object> customResponse) { context.Result.CustomResponse = customResponse; if (claims?.Any() ?? false) { context.Result.ValidatedRequest.Client.AlwaysSendClientClaims = true; context.Result.ValidatedRequest.Client.ClientClaimsPrefix = string.Empty; foreach (var claim in claims) { context.Result.ValidatedRequest.ClientClaims.Add(claim); } } if (context.Result.CustomResponse == null || user.MasterPassword != null) { return; } // KeyConnector responses below // Apikey login if (context.Result.ValidatedRequest.GrantType == "client_credentials") { if (user.UsesKeyConnector) { // KeyConnectorUrl is configured in the CLI client, we just need to tell the client to use it context.Result.CustomResponse["ApiUseKeyConnector"] = true; context.Result.CustomResponse["ResetMasterPassword"] = false; } return; } // SSO login var organizationClaim = context.Result.ValidatedRequest.Subject?.FindFirst(c => c.Type == "organizationId"); if (organizationClaim?.Value != null) { var organizationId = new Guid(organizationClaim.Value); var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(organizationId); var ssoConfigData = ssoConfig.GetData(); if (ssoConfigData is { KeyConnectorEnabled : true } && !string.IsNullOrEmpty(ssoConfigData.KeyConnectorUrl))
FindUserFromExternalProviderAsync(AuthenticateResult result) { var provider = result.Properties.Items["scheme"]; var orgId = new Guid(provider); var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId); if (ssoConfig == null || !ssoConfig.Enabled) { throw new Exception(_i18nService.T("OrganizationOrSsoConfigNotFound")); } var options = new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase, }; var ssoConfigData = JsonSerializer.Deserialize <SsoConfigurationData>(ssoConfig.Data, options); var externalUser = result.Principal;