wonder/xinfra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): complete sso subsystem integration

Browse Source
This commit is contained in:
mac
2026-07-16 15:52:56 +08:00
parent f8c389606f
commit eb2621d914
24 changed files with 1977 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/sso/login.go
+40 -1
View File
@@ -27,6 +27,13 @@ import (
const (
samlHTTPRedirectBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
samlHTTPPostBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
xmlEncAES128CBC = "http://www.w3.org/2001/04/xmlenc#aes128-cbc"
xmlEncAES192CBC = "http://www.w3.org/2001/04/xmlenc#aes192-cbc"
xmlEncAES256CBC = "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
xmlEncAES128GCM = "http://www.w3.org/2009/xmlenc11#aes128-gcm"
xmlEncAES192GCM = "http://www.w3.org/2009/xmlenc11#aes192-gcm"
xmlEncAES256GCM = "http://www.w3.org/2009/xmlenc11#aes256-gcm"
)
type LoginConfig struct {
@@ -178,7 +185,7 @@ func decryptEncryptedAssertion(encrypted encryptedAssertion, privateKeyFile stri
if err != nil {
return "", assertion{}, fmt.Errorf("decode saml encrypted assertion: %w", err)
}
plain, err := decryptAESCBC(encryptedValue, sessionKey)
plain, err := decryptAssertionCipherValue(encryptedValue, sessionKey, encrypted.EncryptedData.EncryptionMethod.Algorithm)
if err != nil {
return "", assertion{}, err
}
@@ -216,6 +223,17 @@ func readRSAPrivateKey(path string) (*rsa.PrivateKey, error) {
return key, nil
}
func decryptAssertionCipherValue(value, key []byte, algorithm string) ([]byte, error) {
switch strings.TrimSpace(algorithm) {
case "", xmlEncAES128CBC, xmlEncAES192CBC, xmlEncAES256CBC:
return decryptAESCBC(value, key)
case xmlEncAES128GCM, xmlEncAES192GCM, xmlEncAES256GCM:
return decryptAESGCM(value, key)
default:
return nil, fmt.Errorf("unsupported saml assertion encryption algorithm: %s", algorithm)
}
}
func decryptAESCBC(value, key []byte) ([]byte, error) {
block, err := aes.NewCipher(key)
if err != nil {
@@ -235,6 +253,27 @@ func decryptAESCBC(value, key []byte) ([]byte, error) {
return plain, nil
}
func decryptAESGCM(value, key []byte) ([]byte, error) {
block, err := aes.NewCipher(key)
if err != nil {
return nil, fmt.Errorf("init saml assertion cipher: %w", err)
}
aead, err := cipher.NewGCM(block)
if err != nil {
return nil, fmt.Errorf("init saml assertion gcm: %w", err)
}
if len(value) <= aead.NonceSize()+aead.Overhead() {
return nil, errors.New("invalid saml encrypted assertion gcm length")
}
nonce := value[:aead.NonceSize()]
cipherText := value[aead.NonceSize():]
plain, err := aead.Open(nil, nonce, cipherText, nil)
if err != nil {
return nil, fmt.Errorf("decrypt saml assertion gcm: %w", err)
}
return plain, nil
}
func pkcs7Unpad(value []byte, blockSize int) ([]byte, error) {
if len(value) == 0 || len(value)%blockSize != 0 {
return nil, errors.New("invalid saml assertion padding length")
server/internal/sso/login_test.go
+65
View File
@@ -143,6 +143,53 @@ func TestDecodeSAMLResponseDecryptsEncryptedAssertion(t *testing.T) {
}
}
func TestDecodeSAMLResponseDecryptsGCMEncryptedAssertion(t *testing.T) {
t.Parallel()
key, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
t.Fatalf("generate key: %v", err)
}
keyFile := writeTestPrivateKey(t, key)
assertion := `<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:Subject><saml:NameID>bob@example.com</saml:NameID></saml:Subject>
<saml:AttributeStatement>
<saml:Attribute Name="email"><saml:AttributeValue>bob@example.com</saml:AttributeValue></saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>`
sessionKey := []byte("0123456789abcdef0123456789abcdef")
encryptedAssertion := encryptTestAssertionGCM(t, []byte(assertion), sessionKey)
encryptedKey, err := rsa.EncryptOAEP(sha1.New(), rand.Reader, &key.PublicKey, sessionKey, nil)
if err != nil {
t.Fatalf("encrypt key: %v", err)
}
response := `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<saml:EncryptedAssertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="` + xmlEncAES256GCM + `"></xenc:EncryptionMethod>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey>
<xenc:CipherData><xenc:CipherValue>` + base64.StdEncoding.EncodeToString(encryptedKey) + `</xenc:CipherValue></xenc:CipherData>
</xenc:EncryptedKey>
</ds:KeyInfo>
<xenc:CipherData><xenc:CipherValue>` + base64.StdEncoding.EncodeToString(encryptedAssertion) + `</xenc:CipherValue></xenc:CipherData>
</xenc:EncryptedData>
</saml:EncryptedAssertion>
</samlp:Response>`
info, err := DecodeSAMLResponse(base64.StdEncoding.EncodeToString([]byte(response)), keyFile)
if err != nil {
t.Fatalf("DecodeSAMLResponse returned error: %v", err)
}
if info.NameID != "bob@example.com" {
t.Fatalf("unexpected name id: %q", info.NameID)
}
if got := info.Attributes["email"]; len(got) != 1 || got[0] != "bob@example.com" {
t.Fatalf("unexpected email attribute: %#v", got)
}
}
func writeTestPrivateKey(t *testing.T, key *rsa.PrivateKey) string {
t.Helper()
file, err := os.CreateTemp(t.TempDir(), "sp-*.key")
@@ -174,6 +221,24 @@ func encryptTestAssertion(t *testing.T, plain, key []byte) []byte {
return out
}
func encryptTestAssertionGCM(t *testing.T, plain, key []byte) []byte {
t.Helper()
block, err := aes.NewCipher(key)
if err != nil {
t.Fatalf("init cipher: %v", err)
}
aead, err := cipher.NewGCM(block)
if err != nil {
t.Fatalf("init gcm: %v", err)
}
nonce := bytes.Repeat([]byte{2}, aead.NonceSize())
cipherText := aead.Seal(nil, nonce, plain, nil)
out := make([]byte, len(nonce)+len(cipherText))
copy(out, nonce)
copy(out[len(nonce):], cipherText)
return out
}
func pkcs7Pad(value []byte, blockSize int) []byte {
padding := blockSize - len(value)%blockSize
return append(value, bytes.Repeat([]byte{byte(padding)}, padding)...)