From f37a7c9e91f5e32608c40dab5757e726fb8b658b Mon Sep 17 00:00:00 2001 From: thycotic-rd Date: Fri, 16 Apr 2021 12:16:27 +0000 Subject: [PATCH] Automated from: 1304921d095afb8d399603b0ec2a880f48be13e1 --- .gitignore | 2 + auth/auth.go | 67 ++-- auth/html_responses.go | 4 +- cicd-integration/integration_test.go | 30 +- commands/auth.go | 40 ++- commands/base.go | 1 + commands/cli-config.go | 53 +-- commands/encryption_auto.go | 501 +++++++++++++++++++++++++++ commands/encryption_manual.go | 478 +++++++++++++++++++++++++ commands/report.go | 331 ++++++++++++++++++ commands/report_test.go | 181 ++++++++++ constants/commands.go | 5 +- constants/crypto.go | 14 + constants/doc.go | 4 +- fake/fake_graph_client.go | 120 +++++++ go.mod | 6 +- go.sum | 80 +++++ main.go | 26 +- requests/graphclient.go | 46 +++ requests/graphql_test.go | 33 ++ tools/tools.go | 10 + 21 files changed, 1954 insertions(+), 78 deletions(-) create mode 100644 commands/encryption_auto.go create mode 100644 commands/encryption_manual.go create mode 100644 commands/report.go create mode 100644 commands/report_test.go create mode 100644 constants/crypto.go create mode 100644 fake/fake_graph_client.go create mode 100644 requests/graphclient.go create mode 100644 requests/graphql_test.go create mode 100644 tools/tools.go diff --git a/.gitignore b/.gitignore index 8aefe66d..27f14483 100644 --- a/.gitignore +++ b/.gitignore @@ -28,6 +28,8 @@ bin/* /svc_acct_creds_1 docs/mkdocsenv/ docs/site/ +dsv +dsv.exe inittests/initenv/ inittests/__pycache__/ diff --git a/auth/auth.go b/auth/auth.go index 8fa49cc7..21b0c0a4 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -12,6 +12,7 @@ import ( "reflect" "runtime" "strings" + "text/template" "time" "thy/paths" @@ -173,7 +174,7 @@ func (a *authenticator) getTokenForAuthType(at AuthType, useCache bool) (*TokenR if keySuffix == "" { keySuffix = cst.DefaultProfile } - } else if at == Oidc { + } else if at == Oidc || at == FederatedThyOne { profile := viper.GetString(cst.Profile) keySuffix = viper.GetString(keyName) if profile != "" && profile != cst.DefaultProfile { @@ -271,7 +272,7 @@ func (a *authenticator) getTokenForAuthType(at AuthType, useCache bool) (*TokenR data = requestBody{ GrantType: authTypeToGrantType[at], } - if at == Password || at == FederatedThyOne { + if at == Password { err := setupDataForPasswordAuth(&data) if err != nil { return nil, errors.New(err) @@ -294,10 +295,16 @@ func (a *authenticator) getTokenForAuthType(at AuthType, useCache bool) (*TokenR } data.RefreshToken = refreshToken } - } else if at == Oidc { + } else if at == Oidc || at == FederatedThyOne { data.Provider = viper.GetString(cst.AuthProvider) - data.CallbackHost = viper.GetString(cst.Callback) - data.CallbackUrl = fmt.Sprintf("http://%s/callback", viper.GetString(cst.Callback)) + + callback := viper.GetString(cst.Callback) + if callback == "" { + callback = cst.DefaultCallback + } + + data.CallbackHost = callback + data.CallbackUrl = fmt.Sprintf("http://%s/callback", callback) } } @@ -345,7 +352,7 @@ func (a *authenticator) fetchTokenVault(at AuthType, data requestBody) (*TokenRe if err := data.ValidateForAuthType(at); err != nil { return nil, errors.New(err) } - if at == Oidc { + if at == Oidc || at == FederatedThyOne { ui := cli.BasicUi{ Writer: os.Stdout, Reader: os.Stdin, @@ -394,9 +401,9 @@ func (a *authenticator) fetchTokenVault(at AuthType, data requestBody) (*TokenRe } data.State = ar.state data.AuthorizationCode = ar.authCode - ui.Info(fmt.Sprintf("Received response from oidc provider, submitting authorization code to %s", cst.ProductName)) + ui.Info(fmt.Sprintf("Received response from %s provider, submitting authorization code to %s", at, cst.ProductName)) case <-time.After(5 * time.Minute): - ui.Info(fmt.Sprintf("Timeout occurred waiting for callback from oidc provider")) + ui.Info(fmt.Sprintf("Timeout occurred waiting for callback from %s provider", at)) return nil, errors.NewS("no callback occurred after redirect") } } @@ -410,10 +417,9 @@ func (a *authenticator) fetchTokenVault(at AuthType, data requestBody) (*TokenRe return &response, nil } -// +// handleOidcAuth handles OIDC and Thycotic One auths func (a *authenticator) handleOidcAuth(doneCh chan<- AuthResponse) http.HandlerFunc { return func(w http.ResponseWriter, req *http.Request) { - b, err := ioutil.ReadAll(req.Body) if err != nil { w.Write([]byte(err.Error())) @@ -434,7 +440,28 @@ func (a *authenticator) handleOidcAuth(doneCh chan<- AuthResponse) http.HandlerF return } - w.Write([]byte(youDidIt)) + tmpl, err := template.New("youDidIt").Parse(youDidIt) + if err != nil { + w.Write([]byte(err.Error())) + doneCh <- AuthResponse{ + err: errors.New(err), + message: "error in html parse template", + } + } + + vars := map[string]interface{}{ + "providerName": viper.GetString(cst.AuthType), + } + + err = tmpl.Execute(w, vars) + if err != nil { + w.Write([]byte(err.Error())) + doneCh <- AuthResponse{ + err: errors.New(err), + message: "error in html template execute", + } + } + doneCh <- AuthResponse{ err: nil, message: "success", @@ -564,7 +591,7 @@ func (r *requestBody) ValidateForAuthType(at AuthType) error { var authTypeToGrantType = map[AuthType]string{ Password: "password", - FederatedThyOne: "password", + FederatedThyOne: "oidc", ClientCredential: "client_credentials", Certificate: "certificate", Refresh: "refresh_token", @@ -600,20 +627,10 @@ var paramSpecDict = map[AuthType][]paramSpec{ }, }, FederatedThyOne: { - {PropName: "Password", - ArgName: cst.Password, - IsKey: false, - RequestVar: true, - }, - {PropName: "Username", - ArgName: cst.Username, + {PropName: "AuthType", + ArgName: cst.AuthType, IsKey: true, - RequestVar: true, - }, - {PropName: "Provider", - ArgName: cst.AuthProvider, - IsKey: false, - RequestVar: true, + RequestVar: false, }, }, ClientCredential: { diff --git a/auth/html_responses.go b/auth/html_responses.go index 685a799a..301ac27d 100644 --- a/auth/html_responses.go +++ b/auth/html_responses.go @@ -5,7 +5,7 @@ const youDidIt = ` - OIDC Sign In Complete + {{.providerName}} Sign In Complete