feat(ui5-middleware-onelogin): possible to provide certificate to login directly #1079

marianfoo · 2024-09-13T19:41:25Z

i added a sample app to login to BTP Cockpit

TODO:

Login was successfull but still says looks like a login page, reloading...
Don´t know how to implement the parameter for clientCertificates, currently just use some of the directly
- ClientCertificate is currently a Array Object Property as defined in playwright api reference.
Just reuse useCertificate like i did in the sample?
- Currently the Property ClientCertificate is only used if useCertficate is true and ClientCertificate is defined.
Add Documentation
Avoid having passphrase in log output?
maybe passphrase only through env?

Playwright API Reference for `clientCertificates`:

https://playwright.dev/docs/api/class-testoptions#test-options-client-certificates

Array<Object>
origin string

Exact origin that the certificate is valid for. Origin includes https protocol, a hostname and optionally a port.

certPath string (optional)

Path to the file with the certificate in PEM format.

cert Buffer (optional)

Direct value of the certificate in PEM format.

keyPath string (optional)

Path to the file with the private key in PEM format.

key Buffer (optional)

Direct value of the private key in PEM format.

pfxPath string (optional)

Path to the PFX or PKCS12 encoded private key and certificate chain.

pfx Buffer (optional)

Direct value of the PFX or PKCS12 encoded private key and certificate chain.

passphrase string (optional)

Passphrase for the private key (PEM or PFX).

Current Output

npm start 

> [email protected] start
> ui5 serve --port 8080 -o index.html

info graph:helpers:ui5Framework Using OpenUI5 version: 1.120.20
info server:custom-middleware:ui5-middleware-livereload Livereload server started!
Server started
URL: http://localhost:8080
info server:custom-middleware:ui5-middleware-onelogin Fetching cookie, hang on!
info server:custom-middleware:ui5-middleware-onelogin Default options:
info server:custom-middleware:ui5-middleware-onelogin {
  configuration: { subdirectory: 'sap/bc/ui2/flp/', useCertificate: false }
}
info server:custom-middleware:ui5-middleware-onelogin Env options:
info server:custom-middleware:ui5-middleware-onelogin { configuration: { useCertificate: false, debug: false } }
info server:custom-middleware:ui5-middleware-onelogin Yaml options:
info server:custom-middleware:ui5-middleware-onelogin {
  configuration: {
    debug: true,
    path: 'https://emea.cockpit.btp.cloud.sap',
    subdirectory: 'cockpit#/',
    useCertificate: true,
    clientCertificatesOrigin: 'https://accounts.sap.com',
    clientCertificatesPfxPath: 'sap.pfx',
    clientCertificatesPfxPpassphrase: 'XXX'
  },
  middlewareName: 'ui5-middleware-onelogin'
}
info server:custom-middleware:ui5-middleware-onelogin Effective options:
info server:custom-middleware:ui5-middleware-onelogin {
  configuration: {
    subdirectory: 'cockpit#/',
    useCertificate: true,
    debug: true,
    path: 'https://emea.cockpit.btp.cloud.sap',
    clientCertificatesOrigin: 'https://accounts.sap.com',
    clientCertificatesPfxPath: 'sap.pfx',
    clientCertificatesPfxPpassphrase: 'XXX'
  },
  middlewareName: 'ui5-middleware-onelogin'
}
info server:custom-middleware:ui5-middleware-onelogin Trying to fetch cookie from "https://emea.cockpit.btp.cloud.sap/cockpit#/"
info server:custom-middleware:ui5-middleware-onelogin "https://emea.cockpit.btp.cloud.sap/cockpit#/" looks like a login page, reloading...
info server:custom-middleware:ui5-middleware-onelogin "https://emea.cockpit.btp.cloud.sap/cockpit#/" looks like a login page, reloading...
info server:custom-middleware:ui5-middleware-onelogin "https://emea.cockpit.btp.cloud.sap/cockpit#/" looks like a login page, reloading...
info server:custom-middleware:ui5-middleware-onelogin Couldn't login using a certificate!
info server:custom-middleware:ui5-middleware-onelogin Parsed cookie is dtCookie=v_4_srv_24_sn_8A31D654D1F57B8420411A106CD110CB_perc_100000_ol_0_mul_1_app-3Acab67a9e1543df82_1; Domain=.cloud.sap; Path=/; SameSite=Lax; IDP_USER=NzY0OTYwMzY

petermuessig · 2024-09-14T05:48:35Z

@marianfoo : you also need to update the package-lock.json otherwise the build fails

marianfoo · 2024-09-14T12:56:27Z

@marianfoo : you also need to update the package-lock.json otherwise the build fails

done

marianfoo · 2024-09-16T09:01:53Z

added property ClientCertificate defined in

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/src/index.ts

Lines 18 to 28 in e555a5e

    
           /** 
        
            * @typedef {Object} ClientCertificate 
        
            * @property {string} origin - Exact origin that the certificate is valid for. Origin includes https protocol, a hostname and optionally a port. 
        
            * @property {string} [certPath] - Path to the file with the certificate in PEM format. 
        
            * @property {Buffer} [cert] - Direct value of the certificate in PEM format. 
        
            * @property {string} [keyPath] - Path to the file with the private key in PEM format. 
        
            * @property {Buffer} [key] - Direct value of the private key in PEM format. 
        
            * @property {string} [pfxPath] - Path to the PFX or PKCS12 encoded private key and certificate chain. 
        
            * @property {Buffer} [pfx] - Direct value of the PFX or PKCS12 encoded private key and certificate chain. 
        
            * @property {string} [passphrase] - Passphrase for the private key (PEM or PFX). 
        
            */

usage as object in env like in this sample

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/sample/certificate/.envTEMPLATE

Line 3 in e555a5e

    
           UI5_MIDDLEWARE_ONELOGIN_CLIENT_CERTIFICATES=[{"origin": "https://accounts.sap.com","pfxPath": "sap.pfx","passphrase": "XXX"}]

or in yaml like this

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/sample/certificate/ui5.yaml

Lines 25 to 33 in e555a5e

    
           # clientCertificates: 
        
           #   - origin: "https://accounts.sap.com" 
        
           #     #certPath: "path/to/cert.pem" 
        
           #     # cert: Buffer value (not applicable in YAML) 
        
           #     #keyPath: "path/to/key.pem" 
        
           #     # key: Buffer value (not applicable in YAML) 
        
           #     pfxPath: "sap.pfx" 
        
           #     # pfx: Buffer value (not applicable in YAML) 
        
           #     #passphrase: "your_passphrase_here"

…in directly

marianfoo · 2024-11-05T12:04:26Z

Login was successfull but still says looks like a login page, reloading...

Created a new case avoid breaking changes, it´s assumed that after network idle the login with cert worked

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/src/cookieGetter.ts

Line 242 in 602cf6e

} else if (isUseCertificateEnabled && hasCertificateConfig) {

Don´t know how to implement the parameter for clientCertificates, currently just use some of the directly
ClientCertificate is currently a Array Object Property as defined in playwright api reference.

I changed it to use currently only use one certificate instead of an array of certificates, makes the implementation easier

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/sample/certificate/.envTEMPLATE

Lines 3 to 7 in 602cf6e

    
           UI5_MIDDLEWARE_ONELOGIN_CERTIFICATE_ORIGIN=https://accounts.sap.com 
        
           #UI5_MIDDLEWARE_ONELOGIN_CERTIFICATE_CERT_PATH=path/to/cert.pem 
        
           #UI5_MIDDLEWARE_ONELOGIN_CERTIFICATE_KEY_PATH=path/to/key.pem 
        
           UI5_MIDDLEWARE_ONELOGIN_CERTIFICATE_PFX_PATH=sap.pfx 
        
           UI5_MIDDLEWARE_ONELOGIN_CERTIFICATE_PASSPHRASE=your_passphrase_here

Just reuse useCertificate like i did in the sample?
Currently the Property ClientCertificate is only used if useCertficate is true and ClientCertificate is defined.
Add Documentation

useCertificate must be true to use login with certificate, if useCertificate is true and no certificateconfig is set, the old way for login is used

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/src/cookieGetter.ts

Lines 101 to 109 in 602cf6e

    
           const isUseCertificateEnabled = effectiveOptions.configuration.useCertificate; 
        
           const hasCertificateConfig = 
        
           	effectiveOptions.configuration.certificateCertPath || 
        
           	effectiveOptions.configuration.certificateCert || 
        
           	effectiveOptions.configuration.certificateKeyPath || 
        
           	effectiveOptions.configuration.certificateKey || 
        
           	effectiveOptions.configuration.certificatePfxPath || 
        
           	effectiveOptions.configuration.certificatePfx; 
        
           const useClientCertificates = isUseCertificateEnabled && hasCertificateConfig;

Avoid having passphrase in log output?

added

ui5-ecosystem-showcase/packages/ui5-middleware-onelogin/src/cookieGetter.ts

Lines 111 to 122 in 551dc58

    
           const sanitizePassphrase = (obj: any) => { 
        
           	// eslint-disable-next-line @typescript-eslint/no-unsafe-return 
        
           	if (!obj?.configuration?.certificatePassphrase) return obj; 
        
           	// eslint-disable-next-line @typescript-eslint/no-unsafe-return 
        
           	return { 
        
           		...obj, 
        
           		configuration: { 
        
           			...obj.configuration, 
        
           			certificatePassphrase: "***", 
        
           		}, 
        
           	}; 
        
           };

marianfoo · 2024-11-05T12:05:24Z

@uxkjaer @petermuessig @vobu
would be great to have some feedback from you!

wridgeu

Hey @marianfoo as we spoke about it, I had a look. Just some general comments/feedback/hints from my side. hth.

packages/ui5-middleware-onelogin/README.md

packages/ui5-middleware-onelogin/src/cookieGetter.ts

packages/ui5-middleware-onelogin/src/types.ts

Copilot reviewed 14 out of 29 changed files in this pull request and generated no suggestions.

Files not reviewed (15)

packages/ui5-middleware-onelogin/package.json: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/.envTEMPLATE: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/.gitignore: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/package.json: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/i18n/i18n.properties: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/i18n/i18n_de.properties: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/i18n/i18n_en.properties: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/index-cdn.html: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/index.html: Language not supported
packages/ui5-middleware-onelogin/sample/certificate/webapp/manifest.json: Language not supported
packages/ui5-middleware-onelogin/lib/index.js: Evaluated as low risk
packages/ui5-middleware-onelogin/README.md: Evaluated as low risk
packages/ui5-middleware-onelogin/lib/cookieGetter.js: Evaluated as low risk
packages/ui5-middleware-onelogin/sample/certificate/webapp/model/formatter.js: Evaluated as low risk
packages/ui5-middleware-onelogin/sample/certificate/webapp/controller/BaseController.js: Evaluated as low risk

marianfoo requested review from petermuessig and uxkjaer September 13, 2024 19:41

marianfoo marked this pull request as draft September 13, 2024 19:41

marianfoo requested a review from vobu September 16, 2024 09:37

marianfoo self-assigned this Nov 5, 2024

marianfoo marked this pull request as ready for review November 5, 2024 10:51

marianfoo added 6 commits November 5, 2024 12:49

feat(ui5-middleware-onelogin): possible to provide certificate to log…

5fe0580

…in directly

chore: update lockfile

00693b3

feat: use as ClientCertificateas object property

d87bcd4

chore: add build watch

989239a

feat: working version with one cert

122e24b

chore: update pnpm lockfile

602cf6e

marianfoo force-pushed the feat/login-certificate branch from 891745a to 602cf6e Compare November 5, 2024 11:51

marianfoo added 2 commits November 5, 2024 12:52

fix: removed unsused config

f3b3fe2

fix: dont log passphrase

3c3aba3

marianfoo added 2 commits November 5, 2024 13:32

fix: dont log passphrase

551dc58

chore: update readme

8628767

wridgeu reviewed Nov 5, 2024

View reviewed changes

chore: update readme

2ef0514

marianfoo requested a review from Copilot November 5, 2024 14:25

Copilot AI reviewed Nov 5, 2024

View reviewed changes

marianfoo added 3 commits November 5, 2024 15:31

refactor: make the removal of passphrase for log more simple

b970209

refactor: remove useClientCertificates

a0f688e

refactor: revert is login page check

3d33fb5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ui5-middleware-onelogin): possible to provide certificate to login directly #1079

feat(ui5-middleware-onelogin): possible to provide certificate to login directly #1079

marianfoo commented Sep 13, 2024 •

edited

Loading

petermuessig commented Sep 14, 2024

marianfoo commented Sep 14, 2024

marianfoo commented Sep 16, 2024

marianfoo commented Nov 5, 2024 •

edited

Loading

marianfoo commented Nov 5, 2024 •

edited

Loading

wridgeu left a comment

feat(ui5-middleware-onelogin): possible to provide certificate to login directly #1079

Are you sure you want to change the base?

feat(ui5-middleware-onelogin): possible to provide certificate to login directly #1079

Conversation

marianfoo commented Sep 13, 2024 • edited Loading

Playwright API Reference for clientCertificates:

Current Output

petermuessig commented Sep 14, 2024

marianfoo commented Sep 14, 2024

marianfoo commented Sep 16, 2024

marianfoo commented Nov 5, 2024 • edited Loading

marianfoo commented Nov 5, 2024 • edited Loading

wridgeu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marianfoo commented Sep 13, 2024 •

edited

Loading

Playwright API Reference for `clientCertificates`:

marianfoo commented Nov 5, 2024 •

edited

Loading

marianfoo commented Nov 5, 2024 •

edited

Loading