Adding ability to authenticate rest calls with bearer token #96

sicurezza · 2016-09-22T14:47:59Z

No description provided.

change: load metadata using tenant or common, depending on presence of org_domain_hint

…. Added new settings resourceId and issuer. Added resourceId in Settings page

psignoret

First of all, apologies for the (huge) delay in this review. Second, thanks! I really like the idea of adding logic here to accept an access token issued by Azure AD (for the app in question).

I'm a bit confused by the implementation with regards to token validation. I noticed that you've added code to parse the JWT token. This is unnecessary, the JWT library already does this, and it already verifies the nbf and iat. So, a lot of this code is actually unnecessary.

I haven't quite looked at the code related to the REST request itself, I need to go learn a bit more about the filters you've added--if I have any comments on that, I'll update this.

This code could use some style clean-up, to ensure we're sticking to the WordPress coding standards: https://make.wordpress.org/core/handbook/best-practices/coding-standards/php/

psignoret · 2016-10-29T14:07:54Z

AuthorizationHelper.php

+	 * @param \AADSSO_Settings $settings The settings to use.
+	 *
+	 */
+	private static function validate_token_claims( $bearer_token, $settings){


When this is used, Firebase\JWT::decode() has already decoded the JWT, validated the nbf and exp claims, and verified the signature. There is no need to do your own splitting, decoding or expiry validation.

psignoret · 2016-10-29T14:15:09Z

AuthorizationHelper.php

+	 *
+	 * @return mixed The decoded authorization result.
+	 */
+	private static function split_id_token($bearer_token) {


As mentioned above, this is all handled by Firebase\JWT, there's no need to do this yourself.

psignoret · 2016-10-29T14:19:14Z

AuthorizationHelper.php

+	/**
+	 * Validates signature and claims of a bearer_token value returned
+	 *
+	 * @param array $authentication_request_body The body to use in the Authentication Request.


The @param doesn't match the method signature.

psignoret · 2016-10-29T14:20:23Z

AuthorizationHelper.php

+	/**
+	 * Decodes and validates an id_token value returned
+	 *
+	 * @param array $authentication_request_body The body to use in the Authentication Request.


@param doesn't match the method.

psignoret · 2016-10-29T14:24:44Z

Settings.php

@@ -107,7 +117,8 @@ class AADSSO_Settings {
 	/**
 	 * @var string The OpenID Connect configuration discovery endpoint.
 	 */
-	public $openid_configuration_endpoint = 'https://login.microsoftonline.com/common/.well-known/openid-configuration';
+	public $openid_configuration_endpoint_prefix = 'https://login.microsoftonline.com/';


In daa9697, we made openid_configuration_endpoint a configurable setting. This allows the site to be either multi-tenant without external users (using common), or single-tenant with external users (using the tenanted endpoint). So, this is unnecessary.

psignoret · 2016-10-29T14:31:20Z

AuthorizationHelper.php

 	 *
 	 * @param array $authentication_request_body The body to use in the Authentication Request.
 	 * @param \AADSSO_Settings $settings The settings to use.
 	 *
 	 * @return mixed The decoded authorization result.
 	 */
-	public static function validate_id_token( $id_token, $settings, $antiforgery_id ) {
+	private static function validate_token_signature( $id_token, $settings) {


This method does more than validate the token signature. (See comments below for more details.) The change to the method documentation isn't quite clear.

psignoret · 2016-10-29T14:33:39Z

Settings.php

@@ -19,6 +19,11 @@ class AADSSO_Settings {
 	public $client_id = '';

 	/**
+	 * @var string The resource ID obtained after registering an application in AAD.
+	 */
+	public $resource_id = '';


In which situation would the "resource ID" be different from the "client ID"?

psignoret · 2016-10-29T14:35:53Z

Settings.php

@@ -206,8 +217,10 @@ public static function init() {
 		 */
 		$openid_configuration = get_transient( 'aadsso_openid_configuration' );
 		if( false === $openid_configuration || isset( $_GET['aadsso_reload_openid_config'] ) ) {
+			$tenant = !empty($instance->org_domain_hint) ? $instance->org_domain_hint : 'common';


As mentioned on L120, this is unnecessary, since the OpenID Connect configuration endpoint is configurable.

psignoret · 2016-10-29T14:40:16Z

aad-sso-wordpress.php

@@ -278,7 +382,7 @@ function authenticate( $user, $username, $password ) {
 					// exists in WordPress (either because it already existed, or we created it
 					// on-the-fly). All that's left is to set the roles based on group membership.
 					if ( true === $this->settings->enable_aad_group_to_wp_role ) {
-						$user = $this->update_wp_user_roles( $user, $jwt->upn, $jwt->tid );
+						$user = $this->update_wp_user_roles( $user, $jwt->oid, $jwt->tid );


Indeed, good catch! (This was only working before because Azure AD Graph API lets you use the UPN as the object ID for most requests, but this wouldn't hold up for external users.)

sicurezza · 2016-11-04T16:22:47Z

Hi,
I edited files according to your questions.

regarding the resource id and client id they are different.

When an application requests azureAD a token to authenticate with a second application (in our case our application request a token to authenticate with wordpress) then it uses the resource id to identify the resource. This information is stored in AUD field of the token and the receiving application has to verify that the token it receives is for itself.

bradkovach · 2016-11-08T18:22:26Z

Is this so that AD bearer tokens can be used through the WP REST API?

sicurezza · 2016-11-09T11:02:39Z

yes

sicurezza added 3 commits September 21, 2016 15:03

use oid instead of upn in function authenticate

56d527c

change: load metadata using tenant or common, depending on presence of org_domain_hint

use of $unique_name instead of $jwt->upn in authenticate function

9c07f52

added new ability to authenticate rest requests with aad bearer token…

0a8121e

…. Added new settings resourceId and issuer. Added resourceId in Settings page

psignoret requested changes Oct 29, 2016

View reviewed changes

- edit pull request

1ecb648

psignoret force-pushed the master branch from f5ea9f8 to cd4bada Compare August 20, 2017 17:47

psignoret force-pushed the master branch from 07a3a0b to cc48018 Compare September 15, 2017 00:53

psignoret force-pushed the master branch from 404c3cd to 4da5465 Compare April 6, 2018 19:21

psignoret force-pushed the master branch 2 times, most recently from 0320183 to 37c8428 Compare July 18, 2018 18:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding ability to authenticate rest calls with bearer token #96

Adding ability to authenticate rest calls with bearer token #96

sicurezza commented Sep 22, 2016

psignoret left a comment •

edited

Loading

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

psignoret Oct 29, 2016

sicurezza commented Nov 4, 2016

bradkovach commented Nov 8, 2016

sicurezza commented Nov 9, 2016

Adding ability to authenticate rest calls with bearer token #96

Are you sure you want to change the base?

Adding ability to authenticate rest calls with bearer token #96

Conversation

sicurezza commented Sep 22, 2016

psignoret left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sicurezza commented Nov 4, 2016

bradkovach commented Nov 8, 2016

sicurezza commented Nov 9, 2016

psignoret left a comment •

edited

Loading