authentik.enterprise.providers.ssf.models

  1from datetime import datetime
  2from functools import cached_property
  3from uuid import uuid4
  4
  5from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
  6from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
  7from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
  8from django.contrib.postgres.fields import ArrayField
  9from django.db import models
 10from django.templatetags.static import static
 11from django.utils.timezone import now
 12from django.utils.translation import gettext_lazy as _
 13from jwt import encode
 14
 15from authentik.core.models import BackchannelProvider, ExpiringModel, Token
 16from authentik.crypto.models import CertificateKeyPair
 17from authentik.lib.models import CreatedUpdatedModel, InternallyManagedMixin
 18from authentik.lib.utils.time import timedelta_from_string, timedelta_string_validator
 19from authentik.providers.oauth2.models import JWTAlgorithms, OAuth2Provider
 20from authentik.tasks.models import TasksModel
 21
 22
 23class EventTypes(models.TextChoices):
 24    """SSF Event types supported by authentik"""
 25
 26    CAEP_SESSION_REVOKED = "https://schemas.openid.net/secevent/caep/event-type/session-revoked"
 27    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.1"""
 28    CAEP_TOKEN_CLAIMS_CHANGE = (
 29        "https://schemas.openid.net/secevent/caep/event-type/token-claims-change"
 30    )
 31    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.2"""
 32    CAEP_CREDENTIAL_CHANGE = "https://schemas.openid.net/secevent/caep/event-type/credential-change"
 33    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.3"""
 34    CAEP_ASSURANCE_LEVEL_CHANGE = (
 35        "https://schemas.openid.net/secevent/caep/event-type/assurance-level-change"
 36    )
 37    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.4"""
 38    CAEP_DEVICE_COMPLIANCE_CHANGE = (
 39        "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"
 40    )
 41    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.5"""
 42    CAEP_SESSION_ESTABLISHED = (
 43        "https://schemas.openid.net/secevent/caep/event-type/session-established"
 44    )
 45    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.6"""
 46    CAEP_SESSION_PRESENTED = "https://schemas.openid.net/secevent/caep/event-type/session-presented"
 47    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.7"""
 48    CAEP_RISK_LEVEL_CHANGE = "https://schemas.openid.net/secevent/caep/event-type/risk-level-change"
 49    """https://openid.net/specs/openid-caep-1_0-final.html#section-3.8"""
 50    SET_VERIFICATION = "https://schemas.openid.net/secevent/ssf/event-type/verification"
 51    """https://openid.net/specs/openid-sharedsignals-framework-1_0.html#section-8.1.4.1"""
 52
 53
 54class DeliveryMethods(models.TextChoices):
 55    """SSF Delivery methods"""
 56
 57    RISC_PUSH = "https://schemas.openid.net/secevent/risc/delivery-method/push"
 58    RISC_POLL = "https://schemas.openid.net/secevent/risc/delivery-method/poll"
 59    RFC_PUSH = "urn:ietf:rfc:8935", _("SSF RFC Push")
 60    RFC_PULL = "urn:ietf:rfc:8936", _("SSF RFC Pull")
 61
 62
 63class SSFEventStatus(models.TextChoices):
 64    """SSF Event status"""
 65
 66    PENDING_NEW = "pending_new"
 67    PENDING_FAILED = "pending_failed"
 68    SENT = "sent"
 69
 70
 71class StreamStatus(models.TextChoices):
 72    """SSF Stream status"""
 73
 74    ENABLED = "enabled"
 75    PAUSED = "paused"
 76    DISABLED = "disabled"
 77    DISABLED_DELETED = "disabled_deleted"
 78
 79
 80class SSFProvider(TasksModel, BackchannelProvider):
 81    """Shared Signals Framework provider to allow applications to
 82    receive user events from authentik."""
 83
 84    signing_key = models.ForeignKey(
 85        CertificateKeyPair,
 86        verbose_name=_("Signing Key"),
 87        on_delete=models.CASCADE,
 88        help_text=_("Key used to sign the SSF Events."),
 89    )
 90
 91    push_verify_certificates = models.BooleanField(default=True)
 92
 93    oidc_auth_providers = models.ManyToManyField(OAuth2Provider, blank=True, default=None)
 94
 95    token = models.ForeignKey(Token, on_delete=models.CASCADE, null=True, default=None)
 96
 97    event_retention = models.TextField(
 98        default="days=30",
 99        validators=[timedelta_string_validator],
100    )
101
102    @cached_property
103    def jwt_key(self) -> tuple[PrivateKeyTypes, str]:
104        """Get either the configured certificate or the client secret"""
105        key: CertificateKeyPair = self.signing_key
106        private_key = key.private_key
107        if isinstance(private_key, RSAPrivateKey):
108            return private_key, JWTAlgorithms.RS256
109        if isinstance(private_key, EllipticCurvePrivateKey):
110            return private_key, JWTAlgorithms.ES256
111        raise ValueError(f"Invalid private key type: {type(private_key)}")
112
113    @property
114    def service_account_identifier(self) -> str:
115        return f"ak-providers-ssf-{self.pk}"
116
117    @property
118    def serializer(self):
119        from authentik.enterprise.providers.ssf.api.providers import SSFProviderSerializer
120
121        return SSFProviderSerializer
122
123    @property
124    def icon_url(self) -> str | None:
125        return static("authentik/sources/ssf.svg")
126
127    @property
128    def component(self) -> str:
129        return "ak-provider-ssf-form"
130
131    class Meta:
132        verbose_name = _("Shared Signals Framework Provider")
133        verbose_name_plural = _("Shared Signals Framework Providers")
134        permissions = [
135            # This overrides the default "add_stream" permission of the Stream object,
136            # as the user requesting to add a stream must have the permission on the provider
137            ("add_stream", _("Add stream to SSF provider")),
138        ]
139
140
141class Stream(models.Model):
142    """SSF Stream"""
143
144    uuid = models.UUIDField(default=uuid4, primary_key=True, editable=False)
145
146    status = models.TextField(choices=StreamStatus.choices, default=StreamStatus.ENABLED)
147
148    provider = models.ForeignKey(SSFProvider, on_delete=models.CASCADE)
149
150    delivery_method = models.TextField(choices=DeliveryMethods.choices)
151    endpoint_url = models.TextField(null=True)
152    authorization_header = models.TextField(null=True, default=None)
153
154    events_requested = ArrayField(models.TextField(choices=EventTypes.choices), default=list)
155    format = models.TextField()
156    aud = ArrayField(models.TextField(), default=list)
157
158    iss = models.TextField()
159
160    class Meta:
161        verbose_name = _("SSF Stream")
162        verbose_name_plural = _("SSF Streams")
163        default_permissions = ["change", "delete", "view"]
164
165    def __str__(self) -> str:
166        return "SSF Stream"
167
168    def prepare_event_payload(self, type: EventTypes, event_data: dict, **kwargs) -> dict:
169        jti = uuid4()
170        _now = now()
171        return {
172            "uuid": jti,
173            "stream_id": str(self.pk),
174            "type": type,
175            "expiring": True,
176            "status": SSFEventStatus.PENDING_NEW,
177            "expires": _now + timedelta_from_string(self.provider.event_retention),
178            "payload": {
179                "jti": jti.hex,
180                "aud": self.aud,
181                "iat": int(datetime.now().timestamp()),
182                "iss": self.iss,
183                "events": {type: event_data},
184                **kwargs,
185            },
186        }
187
188    def encode(self, data: dict) -> str:
189        headers = {"typ": "secevent+jwt"}
190        if self.provider.signing_key:
191            headers["kid"] = self.provider.signing_key.kid
192        key, alg = self.provider.jwt_key
193        return encode(data, key, algorithm=alg, headers=headers)
194
195
196class StreamEvent(InternallyManagedMixin, CreatedUpdatedModel, ExpiringModel):
197    """Single stream event to be sent"""
198
199    uuid = models.UUIDField(default=uuid4, primary_key=True, editable=False)
200
201    stream = models.ForeignKey(Stream, on_delete=models.CASCADE)
202    status = models.TextField(choices=SSFEventStatus.choices)
203
204    type = models.TextField(choices=EventTypes.choices)
205    payload = models.JSONField(default=dict)
206
207    def expire_action(self, *args, **kwargs):
208        """Only allow automatic cleanup of successfully sent event"""
209        if self.status != SSFEventStatus.SENT:
210            return
211        return super().expire_action(*args, **kwargs)
212
213    def __str__(self):
214        return f"Stream event {self.type}"
215
216    class Meta:
217        verbose_name = _("SSF Stream Event")
218        verbose_name_plural = _("SSF Stream Events")
219        ordering = ("-created",)