318 lines
12 KiB
Go
318 lines
12 KiB
Go
package service
|
||
|
||
import (
|
||
"context"
|
||
"crypto/rand"
|
||
"encoding/hex"
|
||
"errors"
|
||
"fmt"
|
||
"io"
|
||
"path"
|
||
"strings"
|
||
"unicode"
|
||
|
||
"oci-portal/internal/oci"
|
||
)
|
||
|
||
// idpIconMaxBytes 是 IdP 图标上传上限;idpIconExts 是允许的图片扩展名。
|
||
const (
|
||
idpIconMaxBytes = 1 << 20
|
||
idpIconRandomBytes = 16
|
||
)
|
||
|
||
var idpIconExts = map[string]bool{
|
||
".png": true, ".jpg": true, ".jpeg": true, ".gif": true, ".svg": true, ".webp": true, ".ico": true,
|
||
}
|
||
|
||
// 图标校验错误哨兵:api 层据此映射 400 / 413 / 415,不落统一 500 边界。
|
||
var (
|
||
ErrIdpIconEmpty = errors.New("icon file is empty")
|
||
ErrIdpIconTooLarge = errors.New("icon exceeds 1MB")
|
||
ErrIdpIconBadType = errors.New("icon file type not allowed")
|
||
ErrIdpIconBadName = errors.New("icon file name is invalid")
|
||
)
|
||
|
||
// IdentityProviders 列出域内 SAML 身份提供者。
|
||
func (s *OciConfigService) IdentityProviders(ctx context.Context, id uint, domainID string) ([]oci.IdentityProviderInfo, error) {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return s.client.ListIdentityProviders(ctx, cred, homeRegion, domainID)
|
||
}
|
||
|
||
// CreateIdentityProvider 创建禁用态 SAML IdP，激活另走 activate。
|
||
// 映射与 JIT 字段缺省时填控制台默认值（normalizeIdpInput）。
|
||
func (s *OciConfigService) CreateIdentityProvider(ctx context.Context, id uint, domainID string, in oci.CreateIdpInput) (oci.IdentityProviderInfo, error) {
|
||
if strings.TrimSpace(in.Name) == "" {
|
||
return oci.IdentityProviderInfo{}, fmt.Errorf("create identity provider: name is required")
|
||
}
|
||
if !strings.Contains(in.Metadata, "EntityDescriptor") {
|
||
return oci.IdentityProviderInfo{}, fmt.Errorf("create identity provider: metadata must be a SAML metadata XML")
|
||
}
|
||
// IDCS 校验 iconUrl 必须是 http(s) URL，data URI 会被 400 拒绝
|
||
if in.IconURL != "" && !strings.HasPrefix(in.IconURL, "http://") && !strings.HasPrefix(in.IconURL, "https://") {
|
||
return oci.IdentityProviderInfo{}, fmt.Errorf("create identity provider: iconUrl 需为 http(s) 外链图片 URL")
|
||
}
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return oci.IdentityProviderInfo{}, err
|
||
}
|
||
in, err = s.enforceIdpDomainSettings(ctx, cred, homeRegion, domainID, normalizeIdpInput(in))
|
||
if err != nil {
|
||
return oci.IdentityProviderInfo{}, err
|
||
}
|
||
return s.client.CreateSamlIdentityProvider(ctx, cred, homeRegion, domainID, in)
|
||
}
|
||
|
||
func (s *OciConfigService) enforceIdpDomainSettings(ctx context.Context, cred oci.Credentials, region, domainID string, in oci.CreateIdpInput) (oci.CreateIdpInput, error) {
|
||
if !in.JitEnabled {
|
||
return in, nil
|
||
}
|
||
setting, err := s.client.GetIdentitySetting(ctx, cred, region, domainID)
|
||
if err != nil {
|
||
return in, fmt.Errorf("get identity setting before create idp: %w", err)
|
||
}
|
||
if setting.PrimaryEmailRequired {
|
||
in.JitMapEmail = true
|
||
}
|
||
return in, nil
|
||
}
|
||
|
||
// normalizeIdpInput 填充映射字段的控制台默认值：名称 ID 格式「无」、
|
||
// 目标域用户属性「用户名」（JIT 开关组合由 API 层的指针缺省决定）。
|
||
func normalizeIdpInput(in oci.CreateIdpInput) oci.CreateIdpInput {
|
||
if in.NameIDFormat == "" {
|
||
in.NameIDFormat = "saml-none"
|
||
}
|
||
if in.UserStoreAttribute == "" {
|
||
in.UserStoreAttribute = "userName"
|
||
}
|
||
return in
|
||
}
|
||
|
||
// SetIdentityProviderEnabled 激活/停用 IdP 并同步登录页显示。
|
||
func (s *OciConfigService) SetIdentityProviderEnabled(ctx context.Context, id uint, domainID, idpID string, enabled bool) (oci.IdentityProviderInfo, error) {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return oci.IdentityProviderInfo{}, err
|
||
}
|
||
return s.client.SetIdentityProviderEnabled(ctx, cred, homeRegion, domainID, idpID, enabled)
|
||
}
|
||
|
||
// DeleteIdentityProvider 级联删除 IdP：先删关联的免 MFA 规则，再从登录页
|
||
// 移除、停用、删除 IdP 本体。
|
||
func (s *OciConfigService) DeleteIdentityProvider(ctx context.Context, id uint, domainID, idpID string) error {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if err := s.deleteIdpExemptions(ctx, cred, homeRegion, domainID, idpID); err != nil {
|
||
return err
|
||
}
|
||
return s.client.DeleteIdentityProvider(ctx, cred, homeRegion, domainID, idpID)
|
||
}
|
||
|
||
// deleteIdpExemptions 删除 sign-on 策略中引用目标 IdP 的免 MFA 规则。
|
||
func (s *OciConfigService) deleteIdpExemptions(ctx context.Context, cred oci.Credentials, region, domainID, idpID string) error {
|
||
rules, err := s.client.ListConsoleSignOnRules(ctx, cred, region, domainID)
|
||
if err != nil {
|
||
return fmt.Errorf("list sign-on rules before delete idp: %w", err)
|
||
}
|
||
for _, r := range rules {
|
||
if r.BuiltIn || !strings.Contains(r.ConditionValue, idpID) {
|
||
continue
|
||
}
|
||
if err := s.client.DeleteMfaExemptionRule(ctx, cred, region, domainID, r.ID); err != nil {
|
||
return fmt.Errorf("delete exemption rule %s: %w", r.Name, err)
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
// DomainSamlMetadata 下载域的 SP SAML 元数据 XML（提供给 IdP 侧配置）。
|
||
func (s *OciConfigService) DomainSamlMetadata(ctx context.Context, id uint, domainID string) ([]byte, error) {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return s.client.DownloadDomainSamlMetadata(ctx, cred, homeRegion, domainID)
|
||
}
|
||
|
||
// UploadIdpIcon 上传 IdP 图标到身份域公共图片存储,返回公网地址与存储内文件名。
|
||
func (s *OciConfigService) UploadIdpIcon(ctx context.Context, id uint, domainID, fileName string, data []byte) (string, string, error) {
|
||
return s.uploadIdpIcon(ctx, id, domainID, fileName, data, rand.Reader)
|
||
}
|
||
|
||
func (s *OciConfigService) uploadIdpIcon(ctx context.Context, id uint, domainID, fileName string, data []byte, random io.Reader) (string, string, error) {
|
||
if len(data) == 0 {
|
||
return "", "", fmt.Errorf("upload idp icon: %w", ErrIdpIconEmpty)
|
||
}
|
||
if len(data) > idpIconMaxBytes {
|
||
return "", "", fmt.Errorf("upload idp icon: %w", ErrIdpIconTooLarge)
|
||
}
|
||
fileName, err := validateIdpIcon(fileName, data)
|
||
if err != nil {
|
||
return "", "", fmt.Errorf("upload idp icon: %w", err)
|
||
}
|
||
fileName, err = newIdpIconStorageName(fileName, random)
|
||
if err != nil {
|
||
return "", "", fmt.Errorf("upload idp icon: %w", err)
|
||
}
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return "", "", err
|
||
}
|
||
url, storedName, err := s.client.UploadDomainImage(ctx, cred, homeRegion, domainID, fileName, data)
|
||
if err != nil {
|
||
return "", "", fmt.Errorf("upload idp icon: %w", err)
|
||
}
|
||
return url, storedName, nil
|
||
}
|
||
|
||
func newIdpIconStorageName(fileName string, random io.Reader) (string, error) {
|
||
token := make([]byte, idpIconRandomBytes)
|
||
if _, err := io.ReadFull(random, token); err != nil {
|
||
return "", fmt.Errorf("generate storage name: %w", err)
|
||
}
|
||
ext := strings.ToLower(path.Ext(fileName))
|
||
return "idp-icon-" + hex.EncodeToString(token) + ext, nil
|
||
}
|
||
|
||
// DeleteIdpIcon 按上传响应中的 fileName 删除身份域公开图片。
|
||
func (s *OciConfigService) DeleteIdpIcon(ctx context.Context, id uint, domainID, fileName string) error {
|
||
if err := validateDomainImageFileName(fileName); err != nil {
|
||
return fmt.Errorf("delete idp icon: %w", err)
|
||
}
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if err := s.client.DeleteDomainImage(ctx, cred, homeRegion, domainID, fileName); err != nil {
|
||
return fmt.Errorf("delete idp icon: %w", err)
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func validateIdpIcon(input string, data []byte) (string, error) {
|
||
fileName := path.Base(strings.ReplaceAll(input, "\\", "/"))
|
||
if invalidIconName(fileName, 255) {
|
||
return "", ErrIdpIconBadName
|
||
}
|
||
ext := strings.ToLower(path.Ext(fileName))
|
||
if !idpIconExts[ext] || !iconMagicOK(ext, data) {
|
||
return "", fmt.Errorf("%w: %q", ErrIdpIconBadType, ext)
|
||
}
|
||
return fileName, nil
|
||
}
|
||
|
||
func validateDomainImageFileName(fileName string) error {
|
||
if invalidIconName(fileName, 1024) || strings.Contains(fileName, "\\") {
|
||
return ErrIdpIconBadName
|
||
}
|
||
clean := path.Clean(fileName)
|
||
if clean != fileName || path.Dir(clean) != "images" || !validIdpIconStorageBase(path.Base(clean)) {
|
||
return ErrIdpIconBadName
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func validIdpIconStorageBase(fileName string) bool {
|
||
ext := path.Ext(fileName)
|
||
if ext == "" || ext != strings.ToLower(ext) || !idpIconExts[ext] {
|
||
return false
|
||
}
|
||
stem := strings.TrimSuffix(fileName, ext)
|
||
if !strings.HasPrefix(stem, "idp-icon-") {
|
||
return false
|
||
}
|
||
token := strings.TrimPrefix(stem, "idp-icon-")
|
||
if len(token) != hex.EncodedLen(idpIconRandomBytes) || token != strings.ToLower(token) {
|
||
return false
|
||
}
|
||
_, err := hex.DecodeString(token)
|
||
return err == nil
|
||
}
|
||
|
||
func invalidIconName(fileName string, maxBytes int) bool {
|
||
return fileName == "" || fileName == "." || fileName == ".." ||
|
||
len(fileName) > maxBytes || strings.TrimSpace(fileName) != fileName ||
|
||
strings.IndexFunc(fileName, unicode.IsControl) >= 0
|
||
}
|
||
|
||
// iconMagicOK 用文件头魔数轻量核对扩展名与内容大体一致。不做深度解码:
|
||
// 图标由管理员为自己租户上传,存储与服务均在 Oracle 域名侧,传错内容只会
|
||
// 让自己登录页图标裂开,深度校验的收益承担不起其复杂度与误伤。
|
||
func iconMagicOK(ext string, data []byte) bool {
|
||
has := func(prefix string) bool {
|
||
return len(data) >= len(prefix) && string(data[:len(prefix)]) == prefix
|
||
}
|
||
switch ext {
|
||
case ".png":
|
||
return has("\x89PNG\r\n\x1a\n")
|
||
case ".jpg", ".jpeg":
|
||
return len(data) >= 3 && data[0] == 0xff && data[1] == 0xd8 && data[2] == 0xff
|
||
case ".gif":
|
||
return has("GIF87a") || has("GIF89a")
|
||
case ".webp":
|
||
return len(data) >= 12 && string(data[:4]) == "RIFF" && string(data[8:12]) == "WEBP"
|
||
case ".ico":
|
||
return len(data) >= 4 && data[0] == 0 && data[1] == 0 && data[2] == 1 && data[3] == 0
|
||
case ".svg":
|
||
head := data
|
||
if len(head) > 512 {
|
||
head = head[:512]
|
||
}
|
||
return strings.Contains(strings.ToLower(string(head)), "<svg")
|
||
}
|
||
return false
|
||
}
|
||
|
||
// ConsoleSignOnRules 按优先级列出 OCI Console sign-on 策略的规则。
|
||
func (s *OciConfigService) ConsoleSignOnRules(ctx context.Context, id uint, domainID string) ([]oci.SignOnRuleInfo, error) {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return s.client.ListConsoleSignOnRules(ctx, cred, homeRegion, domainID)
|
||
}
|
||
|
||
// CreateMfaExemption 为指定 IdP 创建免 MFA 规则并置为最高优先级。
|
||
func (s *OciConfigService) CreateMfaExemption(ctx context.Context, id uint, domainID, idpID string) (oci.SignOnRuleInfo, error) {
|
||
if strings.TrimSpace(idpID) == "" {
|
||
return oci.SignOnRuleInfo{}, fmt.Errorf("create mfa exemption: identityProviderId is required")
|
||
}
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return oci.SignOnRuleInfo{}, err
|
||
}
|
||
name, err := s.exemptionRuleName(ctx, cred, homeRegion, domainID, idpID)
|
||
if err != nil {
|
||
return oci.SignOnRuleInfo{}, err
|
||
}
|
||
return s.client.CreateMfaExemptionRule(ctx, cred, homeRegion, domainID, idpID, name)
|
||
}
|
||
|
||
// exemptionRuleName 校验 IdP 存在并用其名称生成规则名。
|
||
func (s *OciConfigService) exemptionRuleName(ctx context.Context, cred oci.Credentials, region, domainID, idpID string) (string, error) {
|
||
idps, err := s.client.ListIdentityProviders(ctx, cred, region, domainID)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
for _, idp := range idps {
|
||
if idp.ID == idpID {
|
||
return "skip-mfa-" + idp.Name, nil
|
||
}
|
||
}
|
||
return "", fmt.Errorf("create mfa exemption: identity provider %s not found", idpID)
|
||
}
|
||
|
||
// DeleteMfaExemption 删除免 MFA 规则并恢复其余规则优先级。
|
||
func (s *OciConfigService) DeleteMfaExemption(ctx context.Context, id uint, domainID, ruleID string) error {
|
||
cred, homeRegion, err := s.credentialsAndHomeRegion(ctx, id)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
return s.client.DeleteMfaExemptionRule(ctx, cred, homeRegion, domainID, ruleID)
|
||
}
|