Add SLO and SSO endpoints for Login.gov #1476

jessieay · 2016-12-22T21:21:05Z

This means users can sign in and out with Login.gov
This is based off of code in https://github.com/18F/identity-sp-rails
Next steps:
- protect this route so that only logged-in admins can see it
- add whitelisting for certain users who log in with login.gov to be
  admins
- add this config to identity-idp repo

* Use `SessionsController` * This means users can sign in and out with Login.gov * This is based off of code in https://github.com/18F/identity-sp-rails * Next steps: - protect this route so that only logged-in admins can see it - add whitelisting for certain users who log in with login.gov to be admins - add this config to identity-idp repo

pkarman · 2016-12-22T21:27:58Z

app/controllers/sessions_controller.rb

+    if params.key?(:loa)
+      request.env['omniauth.strategy'].options[:authn_context] = [
+        "http://idmanagement.gov/ns/assurance/loa/#{params[:loa]}",
+        'http://idmanagement.gov/ns/requested_attributes?ReqAttr=email,phone,first_name,last_name,ssn'


do you need SSN for this app? Don't ask for it unless you have a business need, because that's PII.

ah! didn't even see this. We do not need it. Removing.

Removed at 46cf31f

mtorres253 · 2016-12-22T21:31:31Z

No SSN is required for this app

…

On Thu, Dec 22, 2016 at 1:27 PM, Peter Karman ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In app/controllers/sessions_controller.rb <#1476 (review)> : > + + def destroy + if params[:SAMLRequest] + idp_logout_request + elsif params[:SAMLResponse] + validate_slo_response + else + sp_logout_request + end + end + + def setup + if params.key?(:loa) + request.env['omniauth.strategy'].options[:authn_context] = [ + "http://idmanagement.gov/ns/assurance/loa/#{params[:loa]}", + 'http://idmanagement.gov/ns/requested_attributes?ReqAttr=email,phone,first_name,last_name,ssn' do you need SSN for this app? Don't ask for it unless you have a business need, because that's PII. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1476 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGHNa9uUSRw-iIVOOR0WiCD7WD-ypopks5rKutegaJpZM4LUYpS> .

-- Michael Torres Product Lead, Micropurchase Platform 18F (415) 920-3205

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

adelevie · 2016-12-27T16:12:12Z

app/controllers/sessions_controller.rb

+  def setup
+    if params.key?(:loa)
+      request.env['omniauth.strategy'].options[:authn_context] = [
+        "http://idmanagement.gov/ns/assurance/loa/#{params[:loa]}",


I'm new to all of this identity stuff. What are these URLs? Is it OK that they are HTTP and not HTTPS?

Yes, http is fine here. These are identifiers, not actual addressable URLs.

adelevie · 2016-12-27T16:13:36Z

app/controllers/sessions_controller.rb

+    render inline: error_msg
+  end
+
+  def validate_slo_response


What does slo stand for?

Single Logout

this was also very confusing to me at first! while I am generally allergic to acronyms, this one seems pretty broadly accepted in the "single log out" world. do you think we should use full name, @adelevie ?

adelevie · 2016-12-27T16:16:29Z

app/services/user_with_asserted_attributes.rb

+
+  delegate :email, :uid, to: :user
+
+  attr_reader :asserted_attributes


What does asserted_attributes mean?

this is a very SAML-y term http://docs.oracle.com/cd/E27515_01/common/tutorials/attributes_saml_assertion.html

adelevie · 2016-12-27T16:16:45Z

certs/sp/demo_sp.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----


What is this?

this is the x509 cert -- we use a fingerprint of this cert so that the "service provider" (in this case, the identity idp app) knows who is making the request.

the way one SO responder but it:

You can use the public key to verify that the content of the SAML response matches the key - in other words - that response definitely came from someone who has the matching private key to the public key in the message, and the response hasn't been tampered with.

this is the public key. :)

more info here: https://developers.onelogin.com/saml/ruby

also, I may be messing this all up. but this is my working understanding. still learning myself!

not to be too pedantic, but the service provider is micropurchase. The identity idp app is the identity provider.

the cert belongs to the SP (micropurchase) and is registered with the IdP. Likewise, the Idp may register its public cert with the SP. The certs are used as @jessieay indicates: to verify the incoming requests are signed from the org they claim to be.

Yes, you are right. Sorry to mix up the words and create even more confusion in an already confusing world!

jessieay · 2017-01-09T21:16:09Z

app/models/user.rb

  validates :sam_status, presence: true

  enum sam_status: { duns_blank: 0, sam_accepted: 1, sam_rejected: 2, sam_pending: 3 }

+  def self.from_omniauth(auth)


note that once we actually let users sign in with login.gov, this will find an existing user via email rather than find or create. doing it this way for now so it's easier to test, but we can also make it just FIND if people are uncomfortable with this bandaid

jessieay · 2017-01-09T21:16:23Z

app/models/user.rb

-  validates :github_id, presence: true
-  validates :github_login, presence: true
+  validates :github_id, presence: true, if: :not_login_user?
+  validates :github_login, presence: true, if: :not_login_user?


these if validations will be removed in the future.

nickbristow

This makes more sense semantically, compared to sessions_controller

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

jessieay added the needs review label Dec 22, 2016

pkarman reviewed Dec 22, 2016

View reviewed changes

jessieay added 2 commits December 22, 2016 13:55

Remove un-needed attributes

46cf31f

Make rubocop happy

917a0e8

jessieay force-pushed the jy-saml-oauth-2 branch from dd98f8e to 917a0e8 Compare December 22, 2016 22:21

jessieay added a commit to 18F/identity-idp that referenced this pull request Dec 23, 2016

Add Micro-purchase staging and prod to SP config

704eecc

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

jessieay mentioned this pull request Dec 23, 2016

Add Micro-purchase staging and prod to SP config 18F/identity-idp#900

Merged

Update SAML issuers

ea2cb40

adelevie reviewed Dec 27, 2016

View reviewed changes

Cleanup

6b95842

jessieay force-pushed the jy-saml-oauth-2 branch from 0db3311 to 4967690 Compare January 9, 2017 21:13

Remove unused migration

4967690

jessieay commented Jan 9, 2017

View reviewed changes

jessieay added 2 commits January 9, 2017 13:24

Rename SessionsController

84a5baf

Rename method

54ed203

nickbristow approved these changes Jan 9, 2017

View reviewed changes

jessieay merged commit bacc012 into develop Jan 9, 2017

jessieay removed the needs review label Jan 9, 2017

jessieay deleted the jy-saml-oauth-2 branch January 9, 2017 21:53

jessieay added a commit to 18F/identity-idp that referenced this pull request Jan 11, 2017

Add Micro-purchase staging and prod to SP config (#900)

aa9f7fc

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

amoose pushed a commit to 18F/identity-idp that referenced this pull request Feb 7, 2017

Add Micro-purchase staging and prod to SP config (#900)

7c55499

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

amoose pushed a commit to 18F/identity-idp that referenced this pull request Feb 24, 2017

Add Micro-purchase staging and prod to SP config (#900)

e752557

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

amoose pushed a commit to 18F/identity-idp that referenced this pull request Feb 28, 2017

Add Micro-purchase staging and prod to SP config (#900)

16b0e66

**Why**: This is a required step for adding a new service provider * See 18F/micropurchase#1476

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SLO and SSO endpoints for Login.gov #1476

Add SLO and SSO endpoints for Login.gov #1476

jessieay commented Dec 22, 2016 •

edited

Loading

pkarman Dec 22, 2016

jessieay Dec 22, 2016

jessieay Dec 22, 2016

mtorres253 commented Dec 22, 2016 via email

adelevie Dec 27, 2016

pkarman Jan 3, 2017

adelevie Dec 27, 2016

nickbristow Dec 28, 2016

jessieay Jan 9, 2017

adelevie Dec 27, 2016

jessieay Jan 9, 2017

adelevie Dec 27, 2016

jessieay Jan 9, 2017

pkarman Jan 9, 2017 •

edited

Loading

jessieay Jan 9, 2017

jessieay Jan 9, 2017

jessieay Jan 9, 2017

nickbristow left a comment •

edited

Loading


		delegate :email, :uid, to: :user

		attr_reader :asserted_attributes

Add SLO and SSO endpoints for Login.gov #1476

Add SLO and SSO endpoints for Login.gov #1476

Conversation

jessieay commented Dec 22, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mtorres253 commented Dec 22, 2016 via email

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pkarman Jan 9, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickbristow left a comment • edited Loading

Choose a reason for hiding this comment

jessieay commented Dec 22, 2016 •

edited

Loading

pkarman Jan 9, 2017 •

edited

Loading

nickbristow left a comment •

edited

Loading