Class: PuavoRest::ExternalService

Inherits:

LdapModel

• Object
• LdapModel
• PuavoRest::ExternalService

show all

Includes:

LocalStore

Defined in:

resources/sso.rb

Constant Summary

Constant Summary

Constants inherited from LdapModel

LdapModel::ESCAPES, LdapModel::ESCAPE_RE, LdapModel::KRB_LOCK, LdapModel::PROF

Instance Attribute Summary

Attributes inherited from LdapModel

#ldap_attr_store, #serialize_attrs

Class Method Summary (collapse)

• + (Object) by_domain(domain)
• + (Object) by_url(url)
• + (Object) ldap_base
• + (Object) secret_by_share_once_token(token)

Instance Method Summary (collapse)

• - (Object) generate_login_url(user, return_to_url)
• - (Object) instance_key
• - (Object) share_once_token=(token)

Methods included from LocalStore

close_connection, included, #local_store, #local_store_del, #local_store_expire, #local_store_get, #local_store_set

Methods inherited from LdapModel

#[], #[]=, _class_store, #add, #add_validation_error, after, all, #as_json, #assert_validation, base_filter, before, by_attr, by_attr!, by_dn, by_dn!, by_dn_array, by_id, by_id!, by_ldap_attr, by_ldap_attr!, callable_from_instance, #changed?, class_store, clear_setup, computed_attr, connection, #create!, create_connection, create_filter_lambda, #dirty?, dn_bind, #empty?, escape, filter, from_ldap_hash, #get_own, #get_raw, inherited, #initialize, is_dn, is_not_found?, ldap_attrs, ldap_map, #ldap_merge!, ldap_op, #ldap_set, #link, #merge, #new?, #object_model, organisation, organisation?, pretty_attrs_to_ldap, raw_by_dn, raw_filter, sasl_bind, #save!, search, search_filters, #set, settings, settings=, setup, skip_serialize, #to_hash, #to_json, #to_ldap_hash, #transform, #update!, #validate, #validate!, #validate_unique, #write_raw

29
30
31

# File 'resources/sso.rb', line 29

def self.by_domain(domain)
  by_attr(:domain, domain, :multi)
end

33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# File 'resources/sso.rb', line 33

def self.by_url(url)
  url = Addressable::URI.parse(url.to_s)

  return LdapModel.setup(:credentials => CONFIG["server"]) do

    # Single domain might have multiple external services configured to
    # different paths. Match paths from the longest to shortest.
    ExternalService.by_domain(url.host).sort do |a,b|
      b["prefix"].size <=> a["prefix"].size
    end.select do |s|
      if url.path.to_s.empty?
        path = "/"
      else
        path = url.path
      end
      path.start_with?(s["prefix"])
    end.first
  end

end

25
26
27

# File 'resources/sso.rb', line 25

def self.ldap_base
  "ou=Services,o=puavo"
end

74
75
76
77
78
79
80
81
82

# File 'resources/sso.rb', line 74

def self.secret_by_share_once_token(token)
  encrypt_secret = self.new.local_store_get(token)

  return if encrypt_secret.nil?

  self.new.local_store_del(token)
  cipher = Gibberish::AES.new(token)
  cipher.dec(encrypt_secret)
end

54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

# File 'resources/sso.rb', line 54

def generate_login_url(user, return_to_url)
  return_to_url = Addressable::URI.parse(return_to_url.to_s)

  jwt_data = user.to_hash.merge({
    # Issued At
    "iat" => Time.now.to_i.to_s,
    # JWT ID
    "jti" => UUID.generator.generate,

    # use external_id like in Zendesk?
    # https://support.zendesk.com/entries/23675367

    "external_service_path_prefix" => prefix
  })

  jwt = JWT.encode(jwt_data, secret)
  return_to_url.query_values = (return_to_url.query_values || {}).merge("jwt" => jwt)
  return return_to_url.to_s
end

90
91
92

# File 'resources/sso.rb', line 90

def instance_key
  "external_service:"
end

84
85
86
87
88

# File 'resources/sso.rb', line 84

def share_once_token=(token)
  cipher = Gibberish::AES.new(token)
  local_store_set(token, cipher.enc(self.secret))
  local_store_expire(token, 60*60*24*7)
end