3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-31 09:57:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

authenticate: add device-enrolled page (#2892)

Browse source 
* authenticate: add device-enrolled page

* remove device credential id from page
This commit is contained in:
Caleb Doxsey 2022-01-06 10:01:12 -07:00 • committed by GitHub
parent 6ed3fa20bc
commit 9330f6b0ac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 61 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
authenticate/authenticate.go
View file

@ -137,7 +137,7 @@ func (a *Authenticate) getWebAuthnURL(values url.Values) (*url.URL, error) {
urlutil.QueryDeviceType: {webauthnutil.DefaultDeviceType},
urlutil.QueryEnrollmentToken: nil,
urlutil.QueryRedirectURI: {uri.ResolveReference(&url.URL{
Path: "/.pomerium/",
Path: "/.pomerium/device-enrolled",
}).String()},
}).Encode(),
})

2
authenticate/handlers.go
View file

@ -18,6 +18,7 @@ import (
"golang.org/x/oauth2"
"google.golang.org/protobuf/types/known/timestamppb"
"github.com/pomerium/pomerium/authenticate/handlers"
"github.com/pomerium/pomerium/authenticate/handlers/webauthn"
"github.com/pomerium/pomerium/internal/httputil"
"github.com/pomerium/pomerium/internal/identity"
@ -98,6 +99,7 @@ func (a *Authenticate) mountDashboard(r *mux.Router) {
sr.Path("/sign_in").Handler(a.requireValidSignature(a.SignIn))
sr.Path("/sign_out").Handler(a.requireValidSignature(a.SignOut))
sr.Path("/webauthn").Handler(webauthn.New(a.getWebauthnState))
sr.Path("/device-enrolled").Handler(handlers.DeviceEnrolled())
}
func (a *Authenticate) mountWellKnown(r *mux.Router) {

18
authenticate/handlers/device-enrolled.go Normal file
View file

@ -0,0 +1,18 @@
package handlers
import (
"html/template"
"net/http"
"github.com/pomerium/pomerium/internal/frontend"
"github.com/pomerium/pomerium/internal/httputil"
)
// DeviceEnrolled displays an HTML page informing the user that they've successfully enrolled a device.
func DeviceEnrolled() http.Handler {
tpl := template.Must(frontend.NewTemplates())
type TemplateData struct{}
return httputil.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
return tpl.ExecuteTemplate(w, "device-enrolled.html", TemplateData{})
})
}

2
authenticate/handlers/handlers.go Normal file
View file

@ -0,0 +1,2 @@
// Package handlers contains various web handlers for the authenticate service.
package handlers

3
authenticate/handlers/webauthn/webauthn.go
View file

@ -302,6 +302,7 @@ func (h *Handler) handleRegister(w http.ResponseWriter, r *http.Request, state *
Id: webauthnutil.GetDeviceCredentialID(serverCredential.ID),
},
})
return h.saveSessionAndRedirect(w, r, state, redirectURIParam)
}
@ -432,7 +433,7 @@ func (h *Handler) saveSessionAndRedirect(w http.ResponseWriter, r *http.Request,
encodedJWT := base64.URLEncoding.EncodeToString(encryptedJWT)
// redirect to the proxy callback URL with the session
callbackURL, err := urlutil.GetCallbackURL(r, encodedJWT)
callbackURL, err := urlutil.GetCallbackURLForRedirectURI(r, encodedJWT, rawRedirectURI)
if err != nil {
return err
}

30
internal/frontend/assets/html/device-enrolled.go.html Normal file
View file

@ -0,0 +1,30 @@
{{define "device-enrolled.html"}}<!DOCTYPE html>
<html lang="en" charset="utf-8">
<head>
<title>Device Successfully Enrolled</title>
{{template "header.html"}}
</head>
<body>
<div class="inner">
<div class="header clearfix">
<div class="heading"></div>
</div>
<div class="content">
<div class="white box">
<div class="largestatus">
<div class="title-wrapper">
<span class="title">Device Successfully Enrolled</span>
<label class="status-time">
<span>
Device was successfully enrolled.
</span>
</label>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
{{end}}

7
internal/urlutil/proxy.go
View file

@ -11,7 +11,12 @@ var ErrMissingRedirectURI = errors.New("missing " + QueryRedirectURI)
// GetCallbackURL gets the proxy's callback URL from a request and a base64url encoded + encrypted session state JWT.
func GetCallbackURL(r *http.Request, encodedSessionJWT string) (*url.URL, error) {
rawRedirectURI := r.FormValue(QueryRedirectURI)
return GetCallbackURLForRedirectURI(r, encodedSessionJWT, r.FormValue(QueryRedirectURI))
}
// GetCallbackURLForRedirectURI gets the proxy's callback URL from a request and a base64url encoded + encrypted session
// state JWT.
func GetCallbackURLForRedirectURI(r *http.Request, encodedSessionJWT, rawRedirectURI string) (*url.URL, error) {
if rawRedirectURI == "" {
return nil, ErrMissingRedirectURI
}