authentik.enterprise.providers.ssf.views.stream

  1from uuid import uuid4
  2
  3from django.http import Http404, HttpRequest
  4from django.urls import reverse
  5from rest_framework.exceptions import PermissionDenied, ValidationError
  6from rest_framework.fields import CharField, ChoiceField, ListField, SerializerMethodField
  7from rest_framework.request import Request
  8from rest_framework.response import Response
  9from structlog.stdlib import get_logger
 10
 11from authentik.api.validation import validate
 12from authentik.core.api.utils import ModelSerializer, PassiveSerializer
 13from authentik.enterprise.providers.ssf.models import (
 14    DeliveryMethods,
 15    EventTypes,
 16    SSFProvider,
 17    Stream,
 18    StreamStatus,
 19)
 20from authentik.enterprise.providers.ssf.tasks import send_ssf_events
 21from authentik.enterprise.providers.ssf.views.base import SSFStreamView
 22
 23LOGGER = get_logger()
 24
 25
 26class StreamDeliverySerializer(PassiveSerializer):
 27    method = ChoiceField(choices=[(x.value, x.value) for x in DeliveryMethods])
 28    endpoint_url = CharField(required=False)
 29    authorization_header = CharField(required=False)
 30
 31    def validate_method(self, method: DeliveryMethods):
 32        """Currently only push is supported"""
 33        if method == DeliveryMethods.RISC_POLL:
 34            raise ValidationError("Polling for SSF events is not currently supported.")
 35        return method
 36
 37    def validate(self, attrs: dict) -> dict:
 38        if attrs.get("method") in [DeliveryMethods.RISC_PUSH, DeliveryMethods.RFC_PUSH]:
 39            if not attrs.get("endpoint_url"):
 40                raise ValidationError("Endpoint URL is required when using push.")
 41        return attrs
 42
 43
 44class StreamSerializer(ModelSerializer):
 45    delivery = StreamDeliverySerializer()
 46    events_requested = ListField(
 47        child=ChoiceField(choices=[(x.value, x.value) for x in EventTypes])
 48    )
 49    format = CharField(default="iss_sub")
 50    aud = ListField(child=CharField(), allow_empty=True, default=list)
 51
 52    def create(self, validated_data):
 53        provider: SSFProvider = validated_data["provider"]
 54        request: HttpRequest = self.context["request"]
 55        iss = request.build_absolute_uri(
 56            reverse(
 57                "authentik_providers_ssf:configuration",
 58                kwargs={
 59                    "application_slug": provider.backchannel_application.slug,
 60                },
 61            )
 62        )
 63        # Ensure that streams always get SET verification events sent to them
 64        validated_data["events_requested"].append(EventTypes.SET_VERIFICATION)
 65        stream_id = uuid4()
 66        default_aud = f"goauthentik.io/providers/ssf/{str(stream_id)}"
 67        return super().create(
 68            {
 69                "delivery_method": validated_data["delivery"]["method"],
 70                "endpoint_url": validated_data["delivery"].get("endpoint_url"),
 71                "authorization_header": validated_data["delivery"].get("authorization_header"),
 72                "format": validated_data["format"],
 73                "provider": validated_data["provider"],
 74                "events_requested": validated_data["events_requested"],
 75                "aud": validated_data["aud"] or [default_aud],
 76                "iss": iss,
 77                "pk": stream_id,
 78            }
 79        )
 80
 81    class Meta:
 82        model = Stream
 83        fields = [
 84            "delivery",
 85            "events_requested",
 86            "format",
 87            "aud",
 88        ]
 89
 90
 91class StreamResponseSerializer(PassiveSerializer):
 92    stream_id = CharField(source="pk")
 93    iss = CharField()
 94    aud = ListField(child=CharField())
 95    delivery = SerializerMethodField()
 96    format = CharField()
 97
 98    events_requested = ListField(child=CharField())
 99    events_supported = SerializerMethodField()
100    events_delivered = ListField(child=CharField(), source="events_requested")
101
102    def get_delivery(self, instance: Stream) -> StreamDeliverySerializer:
103        return {
104            "method": instance.delivery_method,
105            "endpoint_url": instance.endpoint_url,
106        }
107
108    def get_events_supported(self, instance: Stream) -> list[str]:
109        return [
110            EventTypes.CAEP_SESSION_REVOKED,
111            EventTypes.CAEP_CREDENTIAL_CHANGE,
112            EventTypes.SET_VERIFICATION,
113        ]
114
115
116class StreamView(SSFStreamView):
117
118    def get(self, request: Request, *args, **kwargs):
119        stream = self.get_object()
120        return Response(
121            StreamResponseSerializer(instance=stream, context={"request": request}).data
122        )
123
124    @validate(StreamSerializer)
125    def post(self, request: Request, *args, body: StreamSerializer, **kwargs) -> Response:
126        if not request.user.has_perm("authentik_providers_ssf.add_stream", self.provider):
127            raise PermissionDenied(
128                "User does not have permission to create stream for this provider."
129            )
130        instance: Stream = body.save(provider=self.provider)
131
132        LOGGER.info("Sending verification event", stream=instance)
133        send_ssf_events(
134            EventTypes.SET_VERIFICATION,
135            {},
136            stream_filter={"pk": instance.uuid},
137            request=request,
138            sub_id={"format": "opaque", "id": str(instance.uuid)},
139        )
140        response = StreamResponseSerializer(instance=instance, context={"request": request}).data
141        return Response(response, status=201)
142
143    def patch(self, request: Request, *args, **kwargs) -> Response:
144        stream = self.get_object()
145        serializer = StreamSerializer(stream, data=request.data, partial=True)
146        serializer.is_valid(raise_exception=True)
147        serializer.save()
148        response = StreamResponseSerializer(
149            instance=serializer.instance, context={"request": request}
150        ).data
151        return Response(response, status=200)
152
153    def put(self, request: Request, *args, **kwargs) -> Response:
154        stream = self.get_object()
155        serializer = StreamSerializer(stream, data=request.data)
156        serializer.is_valid(raise_exception=True)
157        serializer.save()
158        response = StreamResponseSerializer(
159            instance=serializer.instance, context={"request": request}
160        ).data
161        return Response(response, status=200)
162
163    def delete(self, request: Request, *args, **kwargs) -> Response:
164        stream = self.get_object()
165        if stream.status == StreamStatus.DISABLED_DELETED:
166            raise Http404
167        stream.status = StreamStatus.DISABLED_DELETED
168        stream.save()
169        return Response(status=204)
170
171
172class StreamVerifyView(SSFStreamView):
173
174    def post(self, request: Request, *args, **kwargs):
175        stream = self.get_object()
176        state = request.data.get("state", None)
177        send_ssf_events(
178            EventTypes.SET_VERIFICATION,
179            {
180                "state": state,
181            },
182            stream_filter={"pk": stream.uuid},
183            request=request,
184            sub_id={"format": "opaque", "id": str(stream.uuid)},
185        )
186        return Response(status=204)
187
188
189class StreamStatusView(SSFStreamView):
190
191    class StreamStatusSerializer(PassiveSerializer):
192        stream_id = CharField()
193        status = ChoiceField(choices=StreamStatus.choices)
194
195    def get(self, request: Request, *args, **kwargs):
196        stream = self.get_object()
197        return Response(
198            {
199                "stream_id": str(stream.pk),
200                "status": str(stream.status),
201            }
202        )
203
204    def post(self, request: Request, *args, **kwargs):
205        stream = self.get_object()
206        serializer = self.StreamStatusSerializer(stream, data=request.data)
207        serializer.is_valid(raise_exception=True)
208        stream.status = serializer.validated_data["status"]
209        stream.save()
210        return Response(
211            {
212                "stream_id": str(stream.pk),
213                "status": str(stream.status),
214            }
215        )