Skip to content

Handle SAML enforcement challenge from the server#5054

Merged
mislav merged 4 commits intotrunkfrom
sso-challenge
Jan 19, 2022
Merged

Handle SAML enforcement challenge from the server#5054
mislav merged 4 commits intotrunkfrom
sso-challenge

Conversation

@mislav
Copy link
Contributor

@mislav mislav commented Jan 17, 2022

Whenever an SSO challenge gets issued by the server by means of a URL in the X-GitHub-SSO response header, gh now additionally prints that URL on the standard error stream. Users will typically be presented with this challenge if they attempt to use a Personal Access Token that wasn't authorized to view resources in their org.

$ GH_TOKEN=<pat> gh issue view https://github.com/myorg/myproject/issues/123
GraphQL: Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization. (repository)
Authorize in your web browser:  https://github.com/orgs/myorg/sso?authorization_request=....

Printing of the challenge URL is achieved by installing a middleware to all HTTP requests and storing the server challenge to a value accessible by factory.SSOURL(). Such heavy-handed approach was made necessary mainly because of the shurcool-graphql client which doesn't give access to response headers when a GraphQL error case is encountered.

The URL is printed to stderr even when using gh api. (Previously, gh api consumers would have to use gh api --include to manually scan for the X-GitHub-SSO response header.)

Fixes #5002, followup to #4241

Whenever a SSO challenge gets issued by the server by means of a URL in
the `X-GitHub-SSO` response header, gh now additionally prints that URL
on the standard error stream.

This is achieved by installing a middleware to all HTTP requests and
storing the server challenge to a value accessible by `factory.SSOURL()`.
Such approach was made necessary mainly because of the
`shurcool-graphql` client which doesn't give access to response headers
when a GraphQL error case is encountered.
@mislav mislav requested a review from a team as a code owner January 17, 2022 18:32
@mislav mislav requested review from vilmibm and removed request for a team January 17, 2022 18:32
return api.NewHTTPClient(opts...), nil
}

var ssoHeader string
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping this state around from the request feels a bit off. I am wondering if we could actually do something similar to what we do with scope suggestions and modify the http response error message to indicate that it was a SSO auth challenge error and what the SSO URL is?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, it's not the most elegant solution, but the shurcool-graphql library does not allow access to HTTP response headers once it has parsed the GraphQL error information. Additionally, its errors type is an unexported type. Thus, we cannot decorate its error object with this information.

Copy link
Contributor

@samcoe samcoe Jan 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense. The current approach seems appropriate then. Also it looks like this was explained in the PR body which I didn't read closely enough, sorry about that.

}

var ssoHeader string
var ssoURLRE = regexp.MustCompile(`\burl=(\S+)`)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Considering the possibility of adding values after the url, wouldn't this regular expression be better? 😃

\burl=([^;]+)

https://rubular.com/r/oAROq4p1c20WCu

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good thought, but I wonder whether a literal ; would ever be present in the URL? Since GitHub uses & for param delimiter, I would guess that it's unlikely that we ever see a literal ;, in which case your proposed regex would be more future-proof.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I was not concerned about the url param, but about the value being added to X-GitHub-SSO.
But if there are no such changes in the future, it seems to be fine. 😃

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Respect the SSO challenge as received from the API when using a PAT

3 participants