Support SAML authentication #1241

Rainer-Keller · 2024-09-15T06:32:19Z

This pull request is based on #1219, but has everything unrelated to SAML removed and all the review issues fixed.

dsl400 · 2024-09-15T11:57:05Z

WARN: Bad key in configuration file: "route".
this will remove the option to configure routes locally and bypass the configuration coming from the server?

Rainer-Keller · 2024-09-15T13:07:05Z

WARN: Bad key in configuration file: "route". this will remove the option to configure routes locally and bypass the configuration coming from the server?

I've extracted only the SAML feature from your branch for easier review. The configuration options for dns and route overwrite I did not adopt. These options may go in as a separate pull request.

dsl400 · 2024-09-15T13:26:47Z

I will wait for this to be merged first

Rainer-Keller · 2024-09-15T13:33:47Z

I will wait for this to be merged first

Let's see how it goes...

exzombie · 2024-10-02T12:23:19Z

How does this compare to #1217?

Rainer-Keller · 2024-10-02T14:28:52Z

How does this compare to #1217?

At a first glance it looks like both MRs are doing about the same.

dsl400 · 2024-10-02T14:49:59Z

Not sure if something changed since I posted this comment

exzombie · 2024-10-02T15:23:40Z

Not sure if something changed since I posted this comment

It hasn't AFAICT, but all I get from your comment is that it's an independently developed alternative, and that you have implemented some additional features. Now, @Rainer-Keller has put some effort into breaking this up into manageable pieces, so I thought that there was some reason why this alternative implementation was deemed better.

Hopefully, in the near future, I'll have some time to try out one or the other implementation. I'm not convinced having two to test is better than one 😅

Rainer-Keller · 2024-10-02T15:52:16Z

@exzombie Yours looks fine as well. It has the extra option to pass the auth ID from the command line. But not sure of what use that is.
I was not aware that there is a 3rd implementation. The first one I found was the one from @dsl400 .
I left some comments on your MR ;)

If would be good to get some feedback from a maintainer which of these changes has the highest chance to get in. Otherwise we'll have double effort.
Once we know which one it is, I'll make some suggestions for error/debug message rephrasing.

src/http_server.c

exzombie · 2024-10-02T17:01:20Z

@exzombie Yours looks fine as well. It has the extra option to pass the auth ID from the command line. But not sure of what use that is.
I was not aware that there is a 3rd implementation. The first one I found was the one from @dsl400 .
I left some comments on your MR ;)

There seems to be some confusion, that MR is not mine, it is from @filippor. And are you sure there's a third one?

Anyway, thanks for reviewing that MR; I haven't taken the time yet, I'm still waiting for some prerequisites to fall into place. I hope we'll be able to move the SAML story forward, and that FortiClient updates won't break EMS, but that's a different ball of hair ...

mrbaseman · 2024-10-02T21:09:52Z

Actually, this pull request looks quite clean to me. I have been hesitant to dependencies on too many external tools, and also workflows involving sudo and pipes. Although I haven't recapitulated all discussions in the previous pull requests, and honestly I didn't do a detailed code review of them, I would still vote for this one. The reason for me is, that @Rainer-Keller has dropped several unrelated changes, and thereby has made the change much more readable and understandable. There are also a couple of potentially security related fixes included in this PR, compared to the original one.
Since I didn't have the time to take care of this project recently, I would like to hear the opinion of the other maintainers, too (I did follow the github discussions, but currently I'm not that much involved in the code development anymore)

Rainer-Keller · 2024-10-03T05:06:05Z

@exzombie
Right, seems I treated the PR you sent as if was yours.

I'm still waiting for some prerequisites to fall into place

Any details on what prerequisites that are?
Microsoft has dropped support for external 2nd factor (not sure if that is the right term). So right now, SAML is the only option. I'm using my custom built version at the moment.

And are you sure there's a third one?

There are solutions out there that seems to use a special built browser tool to extract the SAML id and forward this to openfortivpn.

@mrbaseman

I have been hesitant to dependencies on too many external tools, and also workflows involving sudo and pipes

Pipes have been used in the original MR from @dsl400 , but these were unrelated to SAML and I have removed them.

This would be my summary of the two PRs

#1241

Better error messages
Issues already resolved
More checks on the SAML id
Intuitive names of variables, functions and commandline options
User documentation

#1217

(a little) Less lines code
Realm support
HTML output for the response
Option to pass the SAML id on the commandline

If we all agree it is my PR that it the preferred candidate, then I can integrate the features from #1217 here as well.

exzombie · 2024-10-03T08:19:00Z

@Rainer-Keller

Any details on what prerequisites that are?

Our internal stuff, mostly, and Fortinet dragging their feet with supporting Ubuntu 24.04. So, nothing you need to bother yourself with.

There are solutions out there that seems to use a special built browser tool to extract the SAML id and forward this to openfortivpn.

Ah, ok. Just making sure I haven't missed another attempt at what I consider a proper SAML implementation.

filippor · 2024-10-04T17:36:05Z

Hello I create the pull request #1217 when I found the way to implement it using external browser. I'm not a c developer. Thanks for the code review. If it is needed I will fix the issue. I have no problems if this one will be merged. But I will wait for a word from a maintainer to complete my PR. It is working as is for my needs

exzombie

Hey! Thanks again for taking the time to push this feature forward. I'm happy with the simplicity of the approach, the "HTTP server" is really lightweight. That said, dealing with strings in C is one of the things I personally hate quite a bit, and the approach taken in the HTTP server does not convince me that the code is safe. I made some suggestions, hope you find them helpful.

src/config.c

src/http_server.c

src/http.c

src/http_server.c

exzombie · 2024-10-09T09:01:44Z

src/http_server.c

+        return -1;
+    }
+
+    strncpy(id, &request[id_start], id_length);


I'm confused here. id_length is determined by looking for a space. Then, you use this length with strncpy, which will not insert a null terminator at id[id_length-1]. And yet, the data in id is expected to be null terminated, because it's used with strlen in http.c. If this code works, I guess it's because id happens to be initialized to zeros. But we can't rely on that.

I suggest using memcpy and adding a null at the end explicitly.

This section was taken from the original author. I've replaced it with a completely different approach.

src/main.c

src/http_server.c

README.md

src/http_server.c

DimitriPapadopoulos · 2025-02-02T09:39:09Z

The remaining linter warnings are indentation warnings.

You can run the linters locally using ./tests/lint/run.sh.

Rainer-Keller · 2025-02-02T10:00:49Z

Ah, ok. I now see the problem. My assumption was that the project uses tab indentation. But looks like like the linters use mixed indentation. Half tabs half spaces.

Rainer-Keller · 2025-02-02T10:02:53Z

Ok, now applied the patch directly with mixed indenting.

Rainer-Keller · 2025-02-02T10:57:39Z

Hmm. My local lint run did produce a patch that is not accepted by the one in github.

DimitriPapadopoulos · 2025-02-02T11:23:26Z

You must be lacking astyle locally. We should fix the script should to emit an error message.

Rainer-Keller · 2025-02-02T11:28:35Z

You must be lacking astyle locally. We should fix the script should to emit an error message.

There is a warning about it. I've installed it to get the patch. Version 3.6.6 comes with my distro.

However, the last remaining style issue I also get locally. The messages are quite long, should I really make them a single long line? There were other style issues where long lines were not wanted.

DimitriPapadopoulos · 2025-02-02T11:55:57Z

I agree multiple lines are better in this case. I'm not sure how to silence checkpatch.pl in this case.

Rainer-Keller · 2025-02-02T11:59:47Z

The script seems to not complain when assigning a static const char *.
I'll try to move the message.

Rainer-Keller · 2025-02-02T12:05:07Z

Moving did not solve it. But turns out adding line breaks to the string makes code checker happy.

DimitriPapadopoulos · 2025-02-02T12:15:23Z

src/http.c

-	if (username[0] == '\0' && tunnel->config->password[0] == '\0') {
+	if (strlen(tunnel->config->saml_session_id) > 0) {
+		// SAML login
+		static const char *uri_pattern = "/remote/saml/auth_id?id=%s";


Suggested change

static const char *uri_pattern = "/remote/saml/auth_id?id=%s";

static const char uri_pattern[] = "/remote/saml/auth_id?id=%s";

DimitriPapadopoulos · 2025-02-02T12:17:08Z

src/http_server.c

+	// Desired string is
+	// https://company.com:port/remote/saml/start?redirect=1(&realm=<str>)
+	// with the realm being optional
+	static const char *uri_pattern = "https://%s:%d/remote/saml/start?redirect=1%s%s";


Suggested change

static const char *uri_pattern = "https://%s:%d/remote/saml/start?redirect=1%s%s";

static const char uri_pattern[] = "https://%s:%d/remote/saml/start?redirect=1%s%s";

DimitriPapadopoulos · 2025-02-02T12:18:02Z

src/http_server.c

+// after being redirected from the Fortinet Server.
+static void send_status_response(int socket, const char *userMessage)
+{
+	static const char *replyHeader = "HTTP/1.1 200 OK\r\n"


Suggested change

static const char *replyHeader = "HTTP/1.1 200 OK\r\n"

static const char replyHeader[] = "HTTP/1.1 200 OK\r\n"

DimitriPapadopoulos · 2025-02-02T12:18:29Z

src/http_server.c

+	                                 "Connection: close\r\n"
+	                                 "\r\n";
+
+	static const char *replyBody = "<!DOCTYPE html>\r\n"


Suggested change

static const char *replyBody = "<!DOCTYPE html>\r\n"

static const char replyBody[] = "<!DOCTYPE html>\r\n"

src/http_server.h

DimitriPapadopoulos · 2025-02-02T12:26:37Z

src/http_server.c

@@ -0,0 +1,295 @@
+#include <netinet/in.h>


Add a copyright statement at the top.

Also, I would reorganise includes as follows, for consistency with the other files:

#include "config.h" #include "http.h" #include "log.h" #include "tunnel.h" #include <unistd.h> #include <netinet/tcp.h> #include <sys/select.h> #include <ctype.h> #include <string.h>

That is:

openfortivpn header files

POSIX header files

ISO C header files

DimitriPapadopoulos · 2025-02-02T14:49:35Z

src/http_server.c

+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+


One last thing, don't forget to include the relevant header first:

Suggested change

#include "http_server.h"

DimitriPapadopoulos · 2025-02-02T14:50:57Z

src/http_server.c

+ */
+
+#include "config.h"
+#include "http.h" // for url_encode


Either we document why we include headers for all of them, or for none of them. We have chosen the latter so far:

Suggested change

#include "http.h" // for url_encode

#include "http.h"

DimitriPapadopoulos · 2025-02-02T14:58:36Z

@mrbaseman Linter issues and other details have been fixed. Would you mind having a last look at the source code?

DimitriPapadopoulos · 2025-02-02T15:07:26Z

src/http_server.c

+	request[sizeof(request) - 1] = 0;
+	request[read_result] = 0;
+
+	static const char *request_head = "GET /?id=";


Sorry, I missed this one:

Suggested change

static const char *request_head = "GET /?id=";

static const char request_head[] = "GET /?id=";

DimitriPapadopoulos · 2025-02-02T15:08:20Z

src/http_server.c

+	}
+
+	// Extract the id
+	static const char *token_delimiter = " &\r\n";


And this one:

Suggested change

static const char *token_delimiter = " &\r\n";

static const char token_delimiter[] = " &\r\n";

src/tunnel.c

DimitriPapadopoulos · 2025-02-02T15:10:16Z

src/tunnel.c

 				const char *eol = NULL;

-				for (int i = 0; (i < ARRAY_SIZE(HTTP_EOL)) &&
+				for (unsigned int i = 0; (i < ARRAY_SIZE(HTTP_EOL)) &&


Same.

If the rationale was type correctness, size_t might be a better candidate as the type of ARRAY_SIZE() is size_t.

Right. I'll switch to size_t then.

This change is based on work from Valentin Sasek <[email protected]>

Fix compiler warnings about comparing signed with unsigned integers.

mrbaseman · 2025-02-02T20:36:37Z

@mrbaseman Linter issues and other details have been fixed. Would you mind having a last look at the source code?

It's fine for me. I have just run the checks once more on the latest force-pushed commits and reviewed the last changes. I'll merge it now.

mrbaseman · 2025-02-02T20:42:26Z

done. Thanks to all who have contributed, especially to @Rainer-Keller who has put a lot of effort in improving the saml code.

mvillafuertem · 2025-02-07T15:13:08Z

Thanks to all, @mrbaseman when will we have a release tagged with this feature?

mrbaseman · 2025-02-10T11:13:54Z

Openfortivpn 1.23.0 has just been tagged

Rainer-Keller force-pushed the master branch from 5ac02fb to 4db8b39 Compare September 15, 2024 07:49

Rainer-Keller force-pushed the master branch from 4db8b39 to 0e9f255 Compare September 15, 2024 13:26

Rainer-Keller force-pushed the master branch 2 times, most recently from 412e692 to 191099c Compare September 21, 2024 05:06

Rainer-Keller commented Oct 2, 2024

View reviewed changes

src/http_server.c Outdated Show resolved Hide resolved

Rainer-Keller force-pushed the master branch from 191099c to 6b961e6 Compare October 4, 2024 05:53

Rainer-Keller force-pushed the master branch from 6b961e6 to da010ae Compare October 6, 2024 05:36

exzombie reviewed Oct 9, 2024

View reviewed changes

exzombie reviewed Oct 10, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

Rainer-Keller force-pushed the master branch 3 times, most recently from 8791318 to a91b087 Compare October 10, 2024 12:47

Rainer-Keller commented Oct 10, 2024

View reviewed changes

src/http_server.c Outdated Show resolved Hide resolved

Rainer-Keller force-pushed the master branch 3 times, most recently from 67769e6 to 400c787 Compare October 11, 2024 04:59

Rainer-Keller force-pushed the master branch from d47ed01 to 6d61723 Compare February 2, 2025 10:02

Rainer-Keller force-pushed the master branch from 6d61723 to 01ef73f Compare February 2, 2025 11:00

Rainer-Keller force-pushed the master branch from 01ef73f to 7ddc8d9 Compare February 2, 2025 12:04

DimitriPapadopoulos reviewed Feb 2, 2025

View reviewed changes

Rainer-Keller force-pushed the master branch from 7ddc8d9 to 5ee3e1c Compare February 2, 2025 12:48

DimitriPapadopoulos reviewed Feb 2, 2025

View reviewed changes

Rainer-Keller force-pushed the master branch from 5ee3e1c to f574d63 Compare February 2, 2025 14:54

DimitriPapadopoulos reviewed Feb 2, 2025

View reviewed changes

Rainer-Keller added 2 commits February 2, 2025 16:48

Support SAML login authentication

76ec591

This change is based on work from Valentin Sasek <[email protected]>

Fix some compiler warnings

07e1dde

Fix compiler warnings about comparing signed with unsigned integers.

Rainer-Keller force-pushed the master branch from f574d63 to 07e1dde Compare February 2, 2025 15:51

mrbaseman merged commit fa560c9 into adrienverge:master Feb 2, 2025
5 checks passed

This was referenced Feb 2, 2025

Cherry-pick and adapt to new codebase the following commit on saml br… #1061

Closed

Saml external browser #1217

Closed

Listen for SAML login requests #1219

Closed

Support login SAML #867

Open

	static const char *uri_pattern = "/remote/saml/auth_id?id=%s";
	static const char uri_pattern[] = "/remote/saml/auth_id?id=%s";

	static const char *uri_pattern = "https://%s:%d/remote/saml/start?redirect=1%s%s";
	static const char uri_pattern[] = "https://%s:%d/remote/saml/start?redirect=1%s%s";

	static const char *replyHeader = "HTTP/1.1 200 OK\r\n"
	static const char replyHeader[] = "HTTP/1.1 200 OK\r\n"

	static const char *replyBody = "<!DOCTYPE html>\r\n"
	static const char replyBody[] = "<!DOCTYPE html>\r\n"

	static const char *request_head = "GET /?id=";
	static const char request_head[] = "GET /?id=";

	static const char *token_delimiter = " &\r\n";
	static const char token_delimiter[] = " &\r\n";

Support SAML authentication #1241

Support SAML authentication #1241

Uh oh!

Conversation

Rainer-Keller commented Sep 15, 2024

Uh oh!

dsl400 commented Sep 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Rainer-Keller commented Sep 15, 2024

Uh oh!

dsl400 commented Sep 15, 2024

Uh oh!

Rainer-Keller commented Sep 15, 2024

Uh oh!

exzombie commented Oct 2, 2024

Uh oh!

Rainer-Keller commented Oct 2, 2024

Uh oh!

dsl400 commented Oct 2, 2024

Uh oh!

exzombie commented Oct 2, 2024

Uh oh!

Rainer-Keller commented Oct 2, 2024

Uh oh!

Uh oh!

exzombie commented Oct 2, 2024

Uh oh!

mrbaseman commented Oct 2, 2024

Uh oh!

Rainer-Keller commented Oct 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This would be my summary of the two PRs

Uh oh!

exzombie commented Oct 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

filippor commented Oct 4, 2024

Uh oh!

exzombie left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DimitriPapadopoulos commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DimitriPapadopoulos commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DimitriPapadopoulos commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025

Uh oh!

Rainer-Keller commented Feb 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dsl400 commented Sep 15, 2024 •

edited

Loading

Rainer-Keller commented Oct 3, 2024 •

edited

Loading

exzombie commented Oct 3, 2024 •

edited

Loading

Rainer-Keller commented Feb 2, 2025 •

edited

Loading

Rainer-Keller commented Feb 2, 2025 •

edited

Loading

Rainer-Keller commented Feb 2, 2025 •

edited

Loading

DimitriPapadopoulos Feb 2, 2025 •

edited

Loading