authentik.enterprise.providers.ssf.models

  1from datetime import datetime
  2from functools import cached_property
  3from uuid import uuid4
  4
  5from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
  6from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
  7from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
  8from django.contrib.postgres.fields import ArrayField
  9from django.db import models
 10from django.templatetags.static import static
 11from django.utils.timezone import now
 12from django.utils.translation import gettext_lazy as _
 13from jwt import encode
 14
 15from authentik.core.models import BackchannelProvider, ExpiringModel, Token
 16from authentik.crypto.models import CertificateKeyPair
 17from authentik.lib.models import CreatedUpdatedModel, InternallyManagedMixin
 18from authentik.lib.utils.time import timedelta_from_string, timedelta_string_validator
 19from authentik.providers.oauth2.models import JWTAlgorithms, OAuth2Provider
 20from authentik.tasks.models import TasksModel
 21
 22
 23class EventTypes(models.TextChoices):
 24    """SSF Event types supported by authentik"""
 25
 26    CAEP_SESSION_REVOKED = "https://schemas.openid.net/secevent/caep/event-type/session-revoked"
 27    CAEP_CREDENTIAL_CHANGE = "https://schemas.openid.net/secevent/caep/event-type/credential-change"
 28    SET_VERIFICATION = "https://schemas.openid.net/secevent/ssf/event-type/verification"
 29
 30
 31class DeliveryMethods(models.TextChoices):
 32    """SSF Delivery methods"""
 33
 34    RISC_PUSH = "https://schemas.openid.net/secevent/risc/delivery-method/push"
 35    RISC_POLL = "https://schemas.openid.net/secevent/risc/delivery-method/poll"
 36    RFC_PUSH = "urn:ietf:rfc:8935", _("SSF RFC Push")
 37    RFC_PULL = "urn:ietf:rfc:8936", _("SSF RFC Pull")
 38
 39
 40class SSFEventStatus(models.TextChoices):
 41    """SSF Event status"""
 42
 43    PENDING_NEW = "pending_new"
 44    PENDING_FAILED = "pending_failed"
 45    SENT = "sent"
 46
 47
 48class StreamStatus(models.TextChoices):
 49
 50    ENABLED = "enabled"
 51    PAUSED = "paused"
 52    DISABLED = "disabled"
 53
 54
 55class SSFProvider(TasksModel, BackchannelProvider):
 56    """Shared Signals Framework provider to allow applications to
 57    receive user events from authentik."""
 58
 59    signing_key = models.ForeignKey(
 60        CertificateKeyPair,
 61        verbose_name=_("Signing Key"),
 62        on_delete=models.CASCADE,
 63        help_text=_("Key used to sign the SSF Events."),
 64    )
 65
 66    push_verify_certificates = models.BooleanField(default=True)
 67
 68    oidc_auth_providers = models.ManyToManyField(OAuth2Provider, blank=True, default=None)
 69
 70    token = models.ForeignKey(Token, on_delete=models.CASCADE, null=True, default=None)
 71
 72    event_retention = models.TextField(
 73        default="days=30",
 74        validators=[timedelta_string_validator],
 75    )
 76
 77    @cached_property
 78    def jwt_key(self) -> tuple[PrivateKeyTypes, str]:
 79        """Get either the configured certificate or the client secret"""
 80        key: CertificateKeyPair = self.signing_key
 81        private_key = key.private_key
 82        if isinstance(private_key, RSAPrivateKey):
 83            return private_key, JWTAlgorithms.RS256
 84        if isinstance(private_key, EllipticCurvePrivateKey):
 85            return private_key, JWTAlgorithms.ES256
 86        raise ValueError(f"Invalid private key type: {type(private_key)}")
 87
 88    @property
 89    def service_account_identifier(self) -> str:
 90        return f"ak-providers-ssf-{self.pk}"
 91
 92    @property
 93    def serializer(self):
 94        from authentik.enterprise.providers.ssf.api.providers import SSFProviderSerializer
 95
 96        return SSFProviderSerializer
 97
 98    @property
 99    def icon_url(self) -> str | None:
100        return static("authentik/sources/ssf.svg")
101
102    @property
103    def component(self) -> str:
104        return "ak-provider-ssf-form"
105
106    class Meta:
107        verbose_name = _("Shared Signals Framework Provider")
108        verbose_name_plural = _("Shared Signals Framework Providers")
109        permissions = [
110            # This overrides the default "add_stream" permission of the Stream object,
111            # as the user requesting to add a stream must have the permission on the provider
112            ("add_stream", _("Add stream to SSF provider")),
113        ]
114
115
116class Stream(models.Model):
117    """SSF Stream"""
118
119    uuid = models.UUIDField(default=uuid4, primary_key=True, editable=False)
120
121    status = models.TextField(choices=StreamStatus.choices, default=StreamStatus.ENABLED)
122
123    provider = models.ForeignKey(SSFProvider, on_delete=models.CASCADE)
124
125    delivery_method = models.TextField(choices=DeliveryMethods.choices)
126    endpoint_url = models.TextField(null=True)
127    authorization_header = models.TextField(null=True, default=None)
128
129    events_requested = ArrayField(models.TextField(choices=EventTypes.choices), default=list)
130    format = models.TextField()
131    aud = ArrayField(models.TextField(), default=list)
132
133    iss = models.TextField()
134
135    class Meta:
136        verbose_name = _("SSF Stream")
137        verbose_name_plural = _("SSF Streams")
138        default_permissions = ["change", "delete", "view"]
139
140    def __str__(self) -> str:
141        return "SSF Stream"
142
143    def prepare_event_payload(self, type: EventTypes, event_data: dict, **kwargs) -> dict:
144        jti = uuid4()
145        _now = now()
146        return {
147            "uuid": jti,
148            "stream_id": str(self.pk),
149            "type": type,
150            "expiring": True,
151            "status": SSFEventStatus.PENDING_NEW,
152            "expires": _now + timedelta_from_string(self.provider.event_retention),
153            "payload": {
154                "jti": jti.hex,
155                "aud": self.aud,
156                "iat": int(datetime.now().timestamp()),
157                "iss": self.iss,
158                "events": {type: event_data},
159                **kwargs,
160            },
161        }
162
163    def encode(self, data: dict) -> str:
164        headers = {"typ": "secevent+jwt"}
165        if self.provider.signing_key:
166            headers["kid"] = self.provider.signing_key.kid
167        key, alg = self.provider.jwt_key
168        return encode(data, key, algorithm=alg, headers=headers)
169
170
171class StreamEvent(InternallyManagedMixin, CreatedUpdatedModel, ExpiringModel):
172    """Single stream event to be sent"""
173
174    uuid = models.UUIDField(default=uuid4, primary_key=True, editable=False)
175
176    stream = models.ForeignKey(Stream, on_delete=models.CASCADE)
177    status = models.TextField(choices=SSFEventStatus.choices)
178
179    type = models.TextField(choices=EventTypes.choices)
180    payload = models.JSONField(default=dict)
181
182    def expire_action(self, *args, **kwargs):
183        """Only allow automatic cleanup of successfully sent event"""
184        if self.status != SSFEventStatus.SENT:
185            return
186        return super().expire_action(*args, **kwargs)
187
188    def __str__(self):
189        return f"Stream event {self.type}"
190
191    class Meta:
192        verbose_name = _("SSF Stream Event")
193        verbose_name_plural = _("SSF Stream Events")
194        ordering = ("-created",)