opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-01 15:07:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7506 from swordqiu/hotfix/qj-sso-preserve-state

Browse Source 
fix: preserve state while doing sso redirect
This commit is contained in:
Zexi Li
2020-08-07 11:07:15 +08:00
committed by GitHub
parent a8c0e8291a 60eec6440b
commit e8e5c3dbe5
2 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apigateway/handler/idp.go
+14 -4
View File
@@ -16,6 +16,7 @@ package handler
import (
"context"
"encoding/base64"
"net/http"
"net/url"
"regexp"
@@ -75,7 +76,11 @@ func (h *AuthHandlers) getIdpSsoRedirectUri(ctx context.Context, w http.Response
referer := req.Header.Get(http.CanonicalHeaderKey("referer"))
state := utils.GenRequestId(16)
if query == nil {
query = jsonutils.NewDict()
}
query.(*jsonutils.JSONDict).Set("idp_nonce", jsonutils.NewString(utils.GenRequestId(4)))
state := base64.URLEncoding.EncodeToString([]byte(query.String()))
redirectUri := getSsoCallbackUrl()
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
input := api.GetIdpSsoRedirectUriInput{
@@ -125,6 +130,10 @@ func (h *AuthHandlers) handleSsoLogin(ctx context.Context, w http.ResponseWriter
clearCookie(w, k, "")
}
idpStateQsBytes, _ := base64.URLEncoding.DecodeString(idpState)
idpStateQs, _ := jsonutils.Parse(idpStateQsBytes)
log.Debugf("state query sting: %s", idpStateQs)
var body jsonutils.JSONObject
var err error
switch req.Method {
@@ -166,7 +175,7 @@ func (h *AuthHandlers) handleSsoLogin(ctx context.Context, w http.ResponseWriter
if err != nil {
log.Debugf("error: %s", err)
}
redirUrl := generateRedirectUrl(refererUrl, err, "", "")
redirUrl := generateRedirectUrl(refererUrl, idpStateQs, err, "", "")
// success, do redirect
appsrv.SendRedirect(w, redirUrl)
} else {
@@ -187,18 +196,19 @@ func (h *AuthHandlers) handleSsoLogin(ctx context.Context, w http.ResponseWriter
}
log.Debugf("error: %s", err)
}
redirUrl := generateRedirectUrl(refererUrl, err, idpId, idpUserId)
redirUrl := generateRedirectUrl(refererUrl, idpStateQs, err, idpId, idpUserId)
appsrv.SendRedirect(w, redirUrl)
}
}
func generateRedirectUrl(originUrl *url.URL, err error, idpId, idpUserId string) string {
func generateRedirectUrl(originUrl *url.URL, stateQs jsonutils.JSONObject, err error, idpId, idpUserId string) string {
var qs jsonutils.JSONObject
if len(originUrl.RawQuery) > 0 {
qs, _ = jsonutils.ParseQueryString(originUrl.RawQuery)
} else {
qs = jsonutils.NewDict()
}
qs.(*jsonutils.JSONDict).Update(stateQs)
if err != nil {
var errCls, errDetails string
switch je := err.(type) {
pkg/keystone/models/identity_provider.go
+6 -3
View File
@@ -1194,15 +1194,18 @@ func fetchAttributes(attrs map[string][]string, key string) []string {
}
func (idp *SIdentityProvider) TryUserJoinProject(attrConf api.SIdpAttributeOptions, ctx context.Context, usr *SUser, domainId string, attrs map[string][]string) {
if idp.AutoCreateUser.IsFalse() {
return
}
// update user attributes
_, err := db.Update(usr, func() error {
if v, ok := attrs[attrConf.UserDisplaynameAttribtue]; ok && len(v) > 0 {
if v, ok := attrs[attrConf.UserDisplaynameAttribtue]; ok && len(v) > 0 && len(v[0]) > 0 {
usr.Displayname = v[0]
}
if v, ok := attrs[attrConf.UserEmailAttribute]; ok && len(v) > 0 {
if v, ok := attrs[attrConf.UserEmailAttribute]; ok && len(v) > 0 && len(v[0]) > 0 {
usr.Email = v[0]
}
if v, ok := attrs[attrConf.UserMobileAttribute]; ok && len(v) > 0 {
if v, ok := attrs[attrConf.UserMobileAttribute]; ok && len(v) > 0 && len(v[0]) > 0 {
usr.Mobile = v[0]
}
return nil