Skip to content

Commit 3d2422d

Browse files
mokrinskymokrinsky
committed
fix: change authentik to use the new flow
1 parent 9b3c6ec commit 3d2422d

File tree

3 files changed

+223
-2
lines changed

3 files changed

+223
-2
lines changed

‎pkg/provider/authentik/authentik.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -156,11 +156,12 @@ func (kc *Client) queryNext(ctx *authentikContext) (bool, string, error) {
156156
if err != nil {
157157
return false, "", err
158158
}
159-
if payload.isTypeRedirect() {
159+
160+
if payload.isTypeRedirect() || payload.isComponentFlowRedirect() {
160161
// login success if there is a redirect
161162
logger.Debug("Login success, redirect to saml response")
162163
return false, payload.RedirectTo, nil
163-
} else if !payload.isTypeNative() {
164+
} else if !payload.isTypeNative() && !payload.isTypeEmpty() {
164165
return false, "", errors.New("Unknown type: " + payload.Type)
165166
}
166167

‎pkg/provider/authentik/authentik_test.go

+212
Original file line numberDiff line numberDiff line change
@@ -318,3 +318,215 @@ func Test_authWithCombinedUsernamePassword(t *testing.T) {
318318
assert.Nil(err)
319319
assert.Equal(result, samlResponse)
320320
}
321+
322+
// Test_simplifiedFlowAuthWithSeperatedUsernamePassword Password only if username/email verified
323+
func Test_simplifiedFlowAuthWithSeperatedUsernamePassword(t *testing.T) {
324+
defer gock.Off()
325+
samlResponse := "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaX"
326+
gock.New("http://127.0.0.1").
327+
Get("/application/saml/aws/sso/binding/init").
328+
Reply(302).
329+
SetHeader("Set-Cookie", "[authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJ6cHI3NGdzMjNnOGNqbmF1bXNheGQ1dXVrc2VtZGZpNyIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.zNiX4pk6G9ABeDip0PLs8-0irm2aQ_Arr_RgTxTGCQM; HttpOnly; Path=/; SameSite=None; Secure]").
330+
SetHeader("Location", "/flows/-/default/authentication/?next=/application/saml/aws/sso/binding/init/")
331+
332+
gock.New("http://127.0.0.1").
333+
Get("/flows/-/default/authentication").
334+
Reply(302).
335+
SetHeader("Location", "/if/flow/default-authentication-flow/?next=%2Fapplication%2Fsaml%2Faws%2Fsso%2Fbinding%2Finit%2F")
336+
337+
gock.New("http://127.0.0.1").
338+
Get("/if/flow/default-authentication-flow").
339+
Reply(200).
340+
BodyString("")
341+
342+
gock.New("http://127.0.0.1").
343+
Get("/api/v3/flows/executor/default-authentication-flow").
344+
Reply(200).
345+
JSON(map[string]interface{}{
346+
"flow_info": map[string]interface{}{"title": "Welcome to authentik!", "background": "/static/dist/assets/images/flow_background.jpg", "cancel_url": "/flows/-/cancel/", "layout": "stacked"},
347+
"component": "ak-stage-identification",
348+
"user_fields": []string{"username", "email"},
349+
"password_fields": false,
350+
"application_pre": "aws",
351+
"primary_action": "Log in",
352+
"sources": []string{},
353+
"show_source_labels": false,
354+
})
355+
356+
gock.New("http://127.0.0.1").
357+
Post("/api/v3/flows/executor/default-authentication-flow").
358+
Reply(302).
359+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
360+
361+
gock.New("http://127.0.0.1").
362+
Get("api/v3/flows/executor/default-authentication-flow").
363+
Reply(200).
364+
JSON(map[string]interface{}{
365+
"flow_info": map[string]interface{}{"title": "Welcome to authentik!", "background": "/static/dist/assets/images/flow_background.jpg", "cancel_url": "/flows/-/cancel/", "layout": "stacked"},
366+
"component": "ak-stage-password",
367+
"pending_user": "user",
368+
"pending_user_avatar": "https://secure.gravatar.com/avatar/0932141298741243?s=158&r=g",
369+
})
370+
gock.New("http://127.0.0.1").
371+
Post("/api/v3/flows/executor/default-authentication-flow").
372+
Reply(302).
373+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
374+
375+
gock.New("http://127.0.0.1").
376+
Get("/api/v3/flows/executor/default-authentication-flow").
377+
Reply(302).
378+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
379+
380+
gock.New("http://127.0.0.1").
381+
Get("/api/v3/flows/executor/default-authentication-flow").
382+
Reply(200).
383+
JSON(map[string]interface{}{
384+
"component": "xak-flow-redirect",
385+
"to": "http://127.0.0.1/application/saml/aws/sso/binding/init",
386+
})
387+
388+
gock.New("http://127.0.0.1").
389+
Get("/application/saml/aws/sso/binding/init").
390+
Reply(302).
391+
SetHeader("Location", "/if/flow/default-provider-authorization-implicit-consent/")
392+
393+
gock.New("http://127.0.0.1").
394+
Get("/if/flow/default-provider-authorization-implicit-consent/").
395+
Reply(200)
396+
397+
gock.New("http://127.0.0.1").
398+
Get("/api/v3/flows").
399+
Reply(200).
400+
JSON(map[string]interface{}{
401+
"flow_info": map[string]interface{}{
402+
"title": "Redirecting to aws",
403+
"background": "/static/dist/assets/images/flow_background.jpg",
404+
"cancel_url": "/flows/-/cancel/",
405+
"layout": "stacked",
406+
},
407+
"component": "ak-stage-autosubmit",
408+
"url": "https://signin.amazonaws.com/saml",
409+
"attrs": map[string]interface{}{
410+
"ACSUrl": "https://signin.amazonaws.com/saml",
411+
"SAMLResponse": samlResponse,
412+
},
413+
})
414+
client, _ := New(&cfg.IDPAccount{})
415+
loginDetails := &creds.LoginDetails{
416+
Username: "user",
417+
Password: "pwd",
418+
URL: "http://127.0.0.1/application/saml/aws/sso/binding/init",
419+
}
420+
gock.InterceptClient(&client.client.Client)
421+
result, err := client.Authenticate(loginDetails)
422+
423+
assert := assert.New(t)
424+
assert.Nil(err)
425+
assert.Equal(result, samlResponse)
426+
}
427+
428+
// Test_simplifiedFlowAuthWithCombinedUsernamePassword Username/email and password in one page
429+
func Test_simplifiedFlowAuthWithCombinedUsernamePassword(t *testing.T) {
430+
defer gock.Off()
431+
samlResponse := "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaX"
432+
gock.New("http://127.0.0.1").
433+
Get("/application/saml/aws/sso/binding/init").
434+
Reply(302).
435+
SetHeader("Set-Cookie", "[authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJ6cHI3NGdzMjNnOGNqbmF1bXNheGQ1dXVrc2VtZGZpNyIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.zNiX4pk6G9ABeDip0PLs8-0irm2aQ_Arr_RgTxTGCQM; HttpOnly; Path=/; SameSite=None; Secure]").
436+
SetHeader("Location", "/flows/-/default/authentication/?next=/application/saml/aws/sso/binding/init/")
437+
438+
gock.New("http://127.0.0.1").
439+
Get("/flows/-/default/authentication").
440+
Reply(302).
441+
SetHeader("Location", "/if/flow/default-authentication-flow/?next=%2Fapplication%2Fsaml%2Faws%2Fsso%2Fbinding%2Finit%2F")
442+
443+
gock.New("http://127.0.0.1").
444+
Get("/if/flow/default-authentication-flow").
445+
Reply(200).
446+
BodyString("")
447+
448+
gock.New("http://127.0.0.1").
449+
Get("/api/v3/flows/executor/default-authentication-flow").
450+
Reply(200).
451+
JSON(map[string]interface{}{
452+
"flow_info": map[string]interface{}{"title": "Welcome to authentik!", "background": "/static/dist/assets/images/flow_background.jpg", "cancel_url": "/flows/-/cancel/", "layout": "stacked"},
453+
"component": "ak-stage-identification",
454+
"user_fields": []string{"username", "email"},
455+
"password_fields": true,
456+
"application_pre": "aws",
457+
"primary_action": "Log in",
458+
"sources": []string{},
459+
"show_source_labels": false,
460+
})
461+
462+
gock.New("http://127.0.0.1").
463+
Post("/api/v3/flows/executor/default-authentication-flow").
464+
Reply(302).
465+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
466+
467+
gock.New("http://127.0.0.1").
468+
Get("api/v3/flows/executor/default-authentication-flow").
469+
Reply(200).
470+
JSON(map[string]interface{}{
471+
"flow_info": map[string]interface{}{"title": "Welcome to authentik!", "background": "/static/dist/assets/images/flow_background.jpg", "cancel_url": "/flows/-/cancel/", "layout": "stacked"},
472+
"component": "ak-stage-password",
473+
"pending_user": "user",
474+
"pending_user_avatar": "https://secure.gravatar.com/avatar/0932141298741243?s=158&r=g",
475+
})
476+
gock.New("http://127.0.0.1").
477+
Post("/api/v3/flows/executor/default-authentication-flow").
478+
Reply(302).
479+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
480+
481+
gock.New("http://127.0.0.1").
482+
Get("/api/v3/flows/executor/default-authentication-flow").
483+
Reply(302).
484+
SetHeader("Location", "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F")
485+
486+
gock.New("http://127.0.0.1").
487+
Get("/api/v3/flows/executor/default-authentication-flow").
488+
Reply(200).
489+
JSON(map[string]interface{}{
490+
"component": "xak-flow-redirect",
491+
"to": "http://127.0.0.1/application/saml/aws/sso/binding/init",
492+
})
493+
494+
gock.New("http://127.0.0.1").
495+
Get("/application/saml/aws/sso/binding/init").
496+
Reply(302).
497+
SetHeader("Location", "/if/flow/default-provider-authorization-implicit-consent/")
498+
499+
gock.New("http://127.0.0.1").
500+
Get("/if/flow/default-provider-authorization-implicit-consent/").
501+
Reply(200)
502+
503+
gock.New("http://127.0.0.1").
504+
Get("/api/v3/flows").
505+
Reply(200).
506+
JSON(map[string]interface{}{
507+
"flow_info": map[string]interface{}{
508+
"title": "Redirecting to aws",
509+
"background": "/static/dist/assets/images/flow_background.jpg",
510+
"cancel_url": "/flows/-/cancel/",
511+
"layout": "stacked",
512+
},
513+
"component": "ak-stage-autosubmit",
514+
"url": "https://signin.amazonaws.com/saml",
515+
"attrs": map[string]interface{}{
516+
"ACSUrl": "https://signin.amazonaws.com/saml",
517+
"SAMLResponse": samlResponse,
518+
},
519+
})
520+
client, _ := New(&cfg.IDPAccount{})
521+
loginDetails := &creds.LoginDetails{
522+
Username: "user",
523+
Password: "pwd",
524+
URL: "http://127.0.0.1/application/saml/aws/sso/binding/init",
525+
}
526+
gock.InterceptClient(&client.client.Client)
527+
result, err := client.Authenticate(loginDetails)
528+
529+
assert := assert.New(t)
530+
assert.Nil(err)
531+
assert.Equal(result, samlResponse)
532+
}

‎pkg/provider/authentik/model.go

+8
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,14 @@ func (payload *authentikPayload) isTypeRedirect() bool {
4949
return payload.Type == "redirect"
5050
}
5151

52+
func (payload *authentikPayload) isTypeEmpty() bool {
53+
return payload.Type == ""
54+
}
55+
5256
func (payload *authentikPayload) isComponentStageAutosubmit() bool {
5357
return payload.Component == "ak-stage-autosubmit"
5458
}
59+
60+
func (payload *authentikPayload) isComponentFlowRedirect() bool {
61+
return payload.Component == "xak-flow-redirect"
62+
}

0 commit comments

Comments
 (0)