61 lines
2.2 KiB
Text
61 lines
2.2 KiB
Text
|
|
sso_secret_file=$werc_root/etc/misaki_sso.secret
|
|
sso_cookie='; Path=/; HttpOnly; Secure; SameSite=Lax'
|
|
sso_domain='; Domain=thirdculture.diy'
|
|
|
|
# Sets logged_user from misaki's signed header. Only after the visitor chose to log in here (werc_sso cookie).
|
|
fn misaki_sso_auth {
|
|
if(! ~ $#logged_user 0 || ~ $"HTTP_X_AUTH_USER '')
|
|
ssoskip=yes
|
|
if not if(! ~ $1 force && ! ~ `{get_cookie werc_sso} 1)
|
|
ssoskip=yes
|
|
if not if(! test -s $sso_secret_file)
|
|
dprint 'misaki-sso: secret file missing/empty: '^$sso_secret_file
|
|
if not {
|
|
sso_u=$"HTTP_X_AUTH_USER
|
|
sso_exp=$"HTTP_X_AUTH_EXP
|
|
if(! echo -n $sso_u | grep -s '^[a-zA-Z0-9_-]+$')
|
|
dprint 'misaki-sso: bad X-Auth-User: '^$"sso_u
|
|
if not if(! echo -n $sso_exp | grep -s '^[0-9]+$')
|
|
dprint 'misaki-sso: missing/non-numeric X-Auth-Exp ('^$"sso_exp^') - is auth_secret set in misaki?'
|
|
if not if(! test $sso_exp -gt `{date -n})
|
|
dprint 'misaki-sso: expired token for '^$sso_u
|
|
if not {
|
|
sso_want=`{echo -n 'v1:'^$sso_u^':'^$sso_exp | openssl dgst -sha256 -hmac `{cat $sso_secret_file} -binary | openssl base64 -A | tr '+/' '-_' | tr -d '='}
|
|
if(~ $"sso_want '')
|
|
dprint 'misaki-sso: empty HMAC - is openssl installed?'
|
|
if not if(! ~ $"HTTP_X_AUTH_SIG $sso_want)
|
|
dprint 'misaki-sso: signature mismatch for '^$sso_u^''
|
|
if not {
|
|
logged_user=$sso_u
|
|
logged_password=()
|
|
dprint 'misaki-sso: authenticated '^$sso_u
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
fn sso_go {
|
|
sso_to=$1
|
|
shift
|
|
echo 'Status: 303 See Other'
|
|
for(c in $*) echo 'Set-Cookie: '^$c
|
|
echo 'Location: '^$sso_to
|
|
echo
|
|
exit
|
|
}
|
|
|
|
fn misaki-sso_init { misaki_sso_auth }
|
|
|
|
# POST /_users/misaki: log in here with the misaki session (a cross-site POST carries no misaki cookie, so no forced logins)
|
|
# /_users/logout: drop this site's login only, misaki stays signed in
|
|
if(~ $REQUEST_URI /_users/misaki && ~ $REQUEST_METHOD POST && ~ $SERVER_NAME thirdculture.diy *.thirdculture.diy) {
|
|
misaki_sso_auth force
|
|
if(~ $#logged_user 0)
|
|
sso_go 'https://misaki.thirdculture.diy/login?next=https://'^$SERVER_NAME^'/_users/login'
|
|
sso_go /_users/login 'werc_sso=1; Max-Age=604800'^$sso_domain^$sso_cookie
|
|
}
|
|
if(~ $REQUEST_URI /_users/logout)
|
|
sso_go / 'werc_sso=; Max-Age=0'^$sso_domain^$sso_cookie 'werc_sso=; Max-Age=0'^$sso_cookie 'werc_user=; Max-Age=0; Path=/'
|
|
|
|
misaki_sso_auth
|