# File lib/uaa/stub/uaa.rb, line 50 def primary_email(emails) return unless emails emails.each {|e| return e[:value] if e[:type] && e[:type] == 'primary' } emails[0][:value] end
class CF::UAA::StubUAAConn
Attributes
authcode_store[RW]
Public Instance Methods
access_denied(msg = 'access denied')
click to toggle source
# File lib/uaa/stub/uaa.rb, line 36 def access_denied(msg = 'access denied') reply_in_kind(403, error: 'access_denied', error_description: msg) end
assign_auth_code(client_id, user_id, scope, redir_uri)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 279 def assign_auth_code(client_id, user_id, scope, redir_uri) code = SecureRandom.base64(8) raise 'authcode collision' if self.class.authcode_store[code] self.class.authcode_store[code] = {client_id: client_id, user_id: user_id, scope: scope, redir_uri: redir_uri} code end
auth_client(basic_auth_header)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 168 def auth_client(basic_auth_header) ah = basic_auth_header.split(' ') return unless ah[0] =~ /^basic$/i ah = Base64::strict_decode64(ah[1]).split(':') ah = ah.map { |item| CGI::unescape(item) } client = server.scim.get_by_name(ah[0], :client) client if client && client[:client_secret] == ah[1] end
bad_params?(params, required, optional = nil)
click to toggle source
if required and optional arrays are given, extra params are an error
# File lib/uaa/stub/uaa.rb, line 260 def bad_params?(params, required, optional = nil) required.each {|r| next if params[r] reply.json(400, error: 'invalid_request', error_description: "no #{r} in request") return true } return false unless optional params.each {|k, v| next if required.include?(k) || optional.include?(k) reply.json(400, error: 'invalid_request', error_description: "#{k} not allowed") return true } false end
bad_request(msg = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 34 def bad_request(msg = nil); reply_in_kind(400, error: "bad request#{msg ? ',' : ''} #{msg}") end
calc_scope(client, user, requested_scope)
click to toggle source
returns granted scopes TODO: doesn’t handle actual user authorization yet
# File lib/uaa/stub/uaa.rb, line 206 def calc_scope(client, user, requested_scope) possible_scope = ids_to_names(client[user ? :scope : :authorities]) requested_scope = Util.arglist(requested_scope) || [] return unless (requested_scope - possible_scope).empty? requested_scope = possible_scope if requested_scope.empty? granted_scopes = user ? (ids_to_names(user[:groups]) & requested_scope) : requested_scope # handle auto-deny Util.strlist(granted_scopes) unless granted_scopes.empty? end
client_to_scim(info)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 356 def client_to_scim(info) ['authorities', 'scope', 'autoapprove'].each { |a| info[a] = names_to_ids(info[a], :group) if info.key?(a) } info end
default_route()
click to toggle source
# File lib/uaa/stub/uaa.rb, line 66 def default_route; reply_in_kind(404, error: 'not found', error_description: "unknown path #{request.path}") end
find_user(name, pwd = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 57 def find_user(name, pwd = nil) user = server.scim.get_by_name(name, :user, :password, :id, :emails, :username, :groups) user if user && (!pwd || user[:password] == pwd) end
ids_to_names(ids)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 37 def ids_to_names(ids); ids ? ids.map { |id| server.scim.name(id) } : [] end
inject_error(input = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 25 def inject_error(input = nil) case server.reply_badly when :non_json then reply.text('non-json reply') when :bad_json then reply.body = '{"access_token":"good.access.token" "missed a comma":"there"}' when :bad_state then input[:state] = 'badstate' when :no_token_type then input.delete(:token_type) end end
names_to_ids(names, rtype)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 38 def names_to_ids(names, rtype); names ? names.map { |name| server.scim.id(name, rtype) } : [] end
not_found(name = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 35 def not_found(name = nil); reply_in_kind(404, error: "#{name} not found") end
obj_access?(rtype, oid, perm)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 435 def obj_access?(rtype, oid, perm) major_scope = perm == :writers ? 'scim.write' : 'scim.read' return unless tkn = valid_token("#{major_scope} scim.me") return tkn if tkn['scope'].include?(major_scope) || rtype == :group && server.scim.is_member(oid, tkn['user_id'], perm) access_denied end
page_query(rtype, query, attrs, acl = nil, acl_id = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 502 def page_query(rtype, query, attrs, acl = nil, acl_id = nil) if query['attributes'] attrs = attrs & Util.arglist(query['attributes']).each_with_object([]) {|a, o| o << a.to_sym if StubScim::ATTR_NAMES.include?(a = a.downcase) } end start = sanitize_int(query['startindex'], 1, 1) count = sanitize_int(query['count'], 15, 1, 3000) return bad_request('invalid startIndex or count') unless start && count info, total = server.scim.find(rtype, start: start - 1, count: count, filter: query['filter'], attrs: attrs, acl: acl, acl_id: acl_id) reply_in_kind(resources: info, itemsPerPage: info.length, startIndex: start, totalResults: total) end
primary_email(emails)
click to toggle source
redeem_auth_code(client_id, redir_uri, code)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 286 def redeem_auth_code(client_id, redir_uri, code) return unless info = self.class.authcode_store.delete(code) return unless info[:client_id] == client_id && info[:redir_uri] == redir_uri [info[:user_id], info[:scope]] end
redir_err_f(cburi, state, msg)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 201 def redir_err_f(cburi, state, msg); redir_with_fragment(cburi, error: msg, state: state) end
redir_err_q(cburi, state, msg)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 202 def redir_err_q(cburi, state, msg); redir_with_query(cburi, error: msg, state: state) end
redir_with_fragment(cburi, params)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 187 def redir_with_fragment(cburi, params) reply.status = 302 uri = URI.parse(cburi) uri.fragment = Util.encode_form(params) reply.headers[:location] = uri.to_s end
redir_with_query(cburi, params)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 194 def redir_with_query(cburi, params) reply.status = 302 uri = URI.parse(cburi) uri.query = Util.encode_form(params) reply.headers[:location] = uri.to_s end
sanitize_int(arg, default, min, max = nil)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 496 def sanitize_int(arg, default, min, max = nil) return default if arg.nil? return unless arg.to_i.to_s == arg && (i = arg.to_i) >= min max && i > max ? max : i end
scim_to_client(info)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 361 def scim_to_client(info) [:authorities, :scope, :autoapprove].each { |a| info[a] = ids_to_names(info[a]) if info.key?(a) } info.delete(:id) info end
token_reply_info(client, scope, user = nil, state = nil, refresh = false)
click to toggle source
current uaa token contents: exp, user_name, scope, email, user_id,
client_id, client_authorities, user_authorities
# File lib/uaa/stub/uaa.rb, line 151 def token_reply_info(client, scope, user = nil, state = nil, refresh = false) interval = client[:access_token_validity] || 3600 token_body = { jti: SecureRandom.uuid, aud: scope, scope: scope, client_id: client[:client_id], exp: interval + Time.now.to_i } if user token_body[:user_id] = user[:id] token_body[:email] = primary_email(user[:emails]) token_body[:user_name] = user[:username] end info = { access_token: TokenCoder.encode(token_body, :algorithm => 'none'), token_type: 'bearer', expires_in: interval, scope: scope} info[:state] = state if state info[:refresh_token] = 'universal_refresh_token' if refresh inject_error(info) info end
valid_redir_uri?(client, redir_uri)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 177 def valid_redir_uri?(client, redir_uri) t = URI.parse(redir_uri) return true unless (ruris = client[:redirect_uris]) && !ruris.empty? false unless ruris.each { |reg_uri| r = URI.parse(reg_uri) return true if r.scheme == t.scheme && r.host == t.host && (!r.port || r.port == t.port) && (!r.path || r.path == t.path) } end
valid_token(accepted_scope)
click to toggle source
# File lib/uaa/stub/uaa.rb, line 42 def valid_token(accepted_scope) return nil unless (ah = request.headers['authorization']) && (ah = ah.split(' '))[0] =~ /^bearer$/i contents = TokenCoder.decode(ah[1], accept_algorithms: 'none') contents['scope'], accepted_scope = Util.arglist(contents['scope']), Util.arglist(accepted_scope) return contents if accepted_scope.nil? || !(accepted_scope & contents['scope']).empty? access_denied("accepted scope #{Util.strlist(accepted_scope)}") end