mirror of
https://github.com/codeninjasllc/discourse.git
synced 2024-11-23 23:58:31 -05:00
c3eb2025d8
add an external_username attribute for username from SSO payload repair the field name in SingleSignOnRecord migration move setting of external_username for sso to controller add settings toggle to override username/email from SSO payload fix changing of external username after override toggle complete tests and logic for sso override add some extra context to username override option add external_email and external_name to single sign on record add setting for name override from SSO payload complete override with stored external_email and external_name add missing checks to tests remove an unneeded describe block break up a monster method for single sign on fixes for sso attribute override after failed tests
70 lines
1.6 KiB
Ruby
70 lines
1.6 KiB
Ruby
class SingleSignOn
|
|
ACCESSORS = [:nonce, :name, :username, :email, :about_me, :external_email, :external_username, :external_name, :external_id]
|
|
FIXNUMS = []
|
|
NONCE_EXPIRY_TIME = 10.minutes
|
|
|
|
attr_accessor(*ACCESSORS)
|
|
attr_accessor :sso_secret, :sso_url
|
|
|
|
def self.sso_secret
|
|
raise RuntimeError, "sso_secret not implemented on class, be sure to set it on instance"
|
|
end
|
|
|
|
def self.sso_url
|
|
raise RuntimeError, "sso_url not implemented on class, be sure to set it on instance"
|
|
end
|
|
|
|
def sso_secret
|
|
@sso_secret || self.class.sso_secret
|
|
end
|
|
|
|
def sso_url
|
|
@sso_url || self.class.sso_url
|
|
end
|
|
|
|
def self.parse(payload, sso_secret = nil)
|
|
sso = new
|
|
sso.sso_secret = sso_secret if sso_secret
|
|
|
|
parsed = Rack::Utils.parse_query(payload)
|
|
if sso.sign(parsed["sso"]) != parsed["sig"]
|
|
raise RuntimeError, "Bad signature for payload"
|
|
end
|
|
|
|
decoded = Base64.decode64(parsed["sso"])
|
|
decoded_hash = Rack::Utils.parse_query(decoded)
|
|
|
|
ACCESSORS.each do |k|
|
|
val = decoded_hash[k.to_s]
|
|
val = val.to_i if FIXNUMS.include? k
|
|
sso.send("#{k}=", val)
|
|
end
|
|
sso
|
|
end
|
|
|
|
def sign(payload)
|
|
OpenSSL::HMAC.hexdigest("sha256", sso_secret, payload)
|
|
end
|
|
|
|
|
|
def to_url(base_url=nil)
|
|
"#{base_url || sso_url}?#{payload}"
|
|
end
|
|
|
|
def payload
|
|
payload = Base64.encode64(unsigned_payload)
|
|
"sso=#{CGI::escape(payload)}&sig=#{sign(payload)}"
|
|
end
|
|
|
|
def unsigned_payload
|
|
payload = {}
|
|
ACCESSORS.each do |k|
|
|
next unless (val = send k)
|
|
|
|
payload[k] = val
|
|
end
|
|
|
|
Rack::Utils.build_query(payload)
|
|
end
|
|
|
|
end
|