added cognito-idp initiate_auth and PASSWORD_VERIFIER challenge to respond_to_auth_challenge (#3260)
* added cognito-idp initiate_auth and PASSWORD_VERIFIER challenge to respond_to_auth_challenge * fixed for python2 * added mfa, REFRESH_TOKEN to initiate_auth, SOFTWARE_TOKEN_MFA to respond_to_auth_challenge * added negative tests * test
This commit is contained in:
xsphrx
GitHub
parent
bcf61d0b09
commit
236ab59afe
5 changed files with 681 additions and 2 deletions
|
|
@ -45,6 +45,14 @@ class NotAuthorizedError(BadRequest):
|
|||
)
|
||||
|
||||
|
||||
class UserNotConfirmedException(BadRequest):
|
||||
def __init__(self, message):
|
||||
super(UserNotConfirmedException, self).__init__()
|
||||
self.description = json.dumps(
|
||||
{"message": message, "__type": "UserNotConfirmedException"}
|
||||
)
|
||||
|
||||
|
||||
class InvalidParameterException(JsonRESTError):
|
||||
def __init__(self, msg=None):
|
||||
self.code = 400
|
||||
|
|
|
|||
|
|
@ -21,13 +21,15 @@ from .exceptions import (
|
|||
ResourceNotFoundError,
|
||||
UserNotFoundError,
|
||||
UsernameExistsException,
|
||||
UserNotConfirmedException,
|
||||
InvalidParameterException,
|
||||
)
|
||||
from .utils import create_id
|
||||
from .utils import create_id, check_secret_hash
|
||||
|
||||
UserStatus = {
|
||||
"FORCE_CHANGE_PASSWORD": "FORCE_CHANGE_PASSWORD",
|
||||
"CONFIRMED": "CONFIRMED",
|
||||
"UNCONFIRMED": "UNCONFIRMED",
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -300,6 +302,9 @@ class CognitoIdpUser(BaseModel):
|
|||
self.attributes = attributes
|
||||
self.create_date = datetime.datetime.utcnow()
|
||||
self.last_modified_date = datetime.datetime.utcnow()
|
||||
self.sms_mfa_enabled = False
|
||||
self.software_token_mfa_enabled = False
|
||||
self.token_verified = False
|
||||
|
||||
# Groups this user is a member of.
|
||||
# Note that these links are bidirectional.
|
||||
|
|
@ -316,6 +321,11 @@ class CognitoIdpUser(BaseModel):
|
|||
|
||||
# list_users brings back "Attributes" while admin_get_user brings back "UserAttributes".
|
||||
def to_json(self, extended=False, attributes_key="Attributes"):
|
||||
user_mfa_setting_list = []
|
||||
if self.software_token_mfa_enabled:
|
||||
user_mfa_setting_list.append("SOFTWARE_TOKEN_MFA")
|
||||
elif self.sms_mfa_enabled:
|
||||
user_mfa_setting_list.append("SMS_MFA")
|
||||
user_json = self._base_json()
|
||||
if extended:
|
||||
user_json.update(
|
||||
|
|
@ -323,6 +333,7 @@ class CognitoIdpUser(BaseModel):
|
|||
"Enabled": self.enabled,
|
||||
attributes_key: self.attributes,
|
||||
"MFAOptions": [],
|
||||
"UserMFASettingList": user_mfa_setting_list,
|
||||
}
|
||||
)
|
||||
|
||||
|
|
@ -731,6 +742,9 @@ class CognitoIdpBackend(BaseBackend):
|
|||
def respond_to_auth_challenge(
|
||||
self, session, client_id, challenge_name, challenge_responses
|
||||
):
|
||||
if challenge_name == "PASSWORD_VERIFIER":
|
||||
session = challenge_responses.get("PASSWORD_CLAIM_SECRET_BLOCK")
|
||||
|
||||
user_pool = self.sessions.get(session)
|
||||
if not user_pool:
|
||||
raise ResourceNotFoundError(session)
|
||||
|
|
@ -751,6 +765,62 @@ class CognitoIdpBackend(BaseBackend):
|
|||
del self.sessions[session]
|
||||
|
||||
return self._log_user_in(user_pool, client, username)
|
||||
elif challenge_name == "PASSWORD_VERIFIER":
|
||||
username = challenge_responses.get("USERNAME")
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
password_claim_signature = challenge_responses.get(
|
||||
"PASSWORD_CLAIM_SIGNATURE"
|
||||
)
|
||||
if not password_claim_signature:
|
||||
raise ResourceNotFoundError(password_claim_signature)
|
||||
password_claim_secret_block = challenge_responses.get(
|
||||
"PASSWORD_CLAIM_SECRET_BLOCK"
|
||||
)
|
||||
if not password_claim_secret_block:
|
||||
raise ResourceNotFoundError(password_claim_secret_block)
|
||||
timestamp = challenge_responses.get("TIMESTAMP")
|
||||
if not timestamp:
|
||||
raise ResourceNotFoundError(timestamp)
|
||||
|
||||
if user.software_token_mfa_enabled:
|
||||
return {
|
||||
"ChallengeName": "SOFTWARE_TOKEN_MFA",
|
||||
"Session": session,
|
||||
"ChallengeParameters": {},
|
||||
}
|
||||
|
||||
if user.sms_mfa_enabled:
|
||||
return {
|
||||
"ChallengeName": "SMS_MFA",
|
||||
"Session": session,
|
||||
"ChallengeParameters": {},
|
||||
}
|
||||
|
||||
del self.sessions[session]
|
||||
return self._log_user_in(user_pool, client, username)
|
||||
elif challenge_name == "SOFTWARE_TOKEN_MFA":
|
||||
username = challenge_responses.get("USERNAME")
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
software_token_mfa_code = challenge_responses.get("SOFTWARE_TOKEN_MFA_CODE")
|
||||
if not software_token_mfa_code:
|
||||
raise ResourceNotFoundError(software_token_mfa_code)
|
||||
|
||||
if client.generate_secret:
|
||||
secret_hash = challenge_responses.get("SECRET_HASH")
|
||||
if not check_secret_hash(
|
||||
client.secret, client.id, username, secret_hash
|
||||
):
|
||||
raise NotAuthorizedError(secret_hash)
|
||||
|
||||
del self.sessions[session]
|
||||
return self._log_user_in(user_pool, client, username)
|
||||
|
||||
else:
|
||||
return {}
|
||||
|
||||
|
|
@ -806,6 +876,165 @@ class CognitoIdpBackend(BaseBackend):
|
|||
user_pool.resource_servers[identifier] = resource_server
|
||||
return resource_server
|
||||
|
||||
def sign_up(self, client_id, username, password, attributes):
|
||||
user_pool = None
|
||||
for p in self.user_pools.values():
|
||||
if client_id in p.clients:
|
||||
user_pool = p
|
||||
if user_pool is None:
|
||||
raise ResourceNotFoundError(client_id)
|
||||
|
||||
user = CognitoIdpUser(
|
||||
user_pool_id=user_pool.id,
|
||||
username=username,
|
||||
password=password,
|
||||
attributes=attributes,
|
||||
status=UserStatus["UNCONFIRMED"],
|
||||
)
|
||||
user_pool.users[user.username] = user
|
||||
return user
|
||||
|
||||
def confirm_sign_up(self, client_id, username, confirmation_code):
|
||||
user_pool = None
|
||||
for p in self.user_pools.values():
|
||||
if client_id in p.clients:
|
||||
user_pool = p
|
||||
if user_pool is None:
|
||||
raise ResourceNotFoundError(client_id)
|
||||
|
||||
if username not in user_pool.users:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
user = user_pool.users[username]
|
||||
user.status = UserStatus["CONFIRMED"]
|
||||
return ""
|
||||
|
||||
def initiate_auth(self, client_id, auth_flow, auth_parameters):
|
||||
user_pool = None
|
||||
for p in self.user_pools.values():
|
||||
if client_id in p.clients:
|
||||
user_pool = p
|
||||
if user_pool is None:
|
||||
raise ResourceNotFoundError(client_id)
|
||||
|
||||
client = p.clients.get(client_id)
|
||||
|
||||
if auth_flow == "USER_SRP_AUTH":
|
||||
username = auth_parameters.get("USERNAME")
|
||||
srp_a = auth_parameters.get("SRP_A")
|
||||
if not srp_a:
|
||||
raise ResourceNotFoundError(srp_a)
|
||||
if client.generate_secret:
|
||||
secret_hash = auth_parameters.get("SECRET_HASH")
|
||||
if not check_secret_hash(
|
||||
client.secret, client.id, username, secret_hash
|
||||
):
|
||||
raise NotAuthorizedError(secret_hash)
|
||||
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
if user.status == UserStatus["UNCONFIRMED"]:
|
||||
raise UserNotConfirmedException("User is not confirmed.")
|
||||
|
||||
session = str(uuid.uuid4())
|
||||
self.sessions[session] = user_pool
|
||||
|
||||
return {
|
||||
"ChallengeName": "PASSWORD_VERIFIER",
|
||||
"Session": session,
|
||||
"ChallengeParameters": {
|
||||
"SALT": str(uuid.uuid4()),
|
||||
"SRP_B": str(uuid.uuid4()),
|
||||
"USERNAME": user.id,
|
||||
"USER_ID_FOR_SRP": user.id,
|
||||
"SECRET_BLOCK": session,
|
||||
},
|
||||
}
|
||||
elif auth_flow == "REFRESH_TOKEN":
|
||||
refresh_token = auth_parameters.get("REFRESH_TOKEN")
|
||||
if not refresh_token:
|
||||
raise ResourceNotFoundError(refresh_token)
|
||||
|
||||
client_id, username = user_pool.refresh_tokens[refresh_token]
|
||||
if not username:
|
||||
raise ResourceNotFoundError(username)
|
||||
|
||||
if client.generate_secret:
|
||||
secret_hash = auth_parameters.get("SECRET_HASH")
|
||||
if not check_secret_hash(
|
||||
client.secret, client.id, username, secret_hash
|
||||
):
|
||||
raise NotAuthorizedError(secret_hash)
|
||||
|
||||
(
|
||||
id_token,
|
||||
access_token,
|
||||
expires_in,
|
||||
) = user_pool.create_tokens_from_refresh_token(refresh_token)
|
||||
|
||||
return {
|
||||
"AuthenticationResult": {
|
||||
"IdToken": id_token,
|
||||
"AccessToken": access_token,
|
||||
"ExpiresIn": expires_in,
|
||||
}
|
||||
}
|
||||
else:
|
||||
return None
|
||||
|
||||
def associate_software_token(self, access_token):
|
||||
for user_pool in self.user_pools.values():
|
||||
if access_token in user_pool.access_tokens:
|
||||
_, username = user_pool.access_tokens[access_token]
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
return {"SecretCode": str(uuid.uuid4())}
|
||||
else:
|
||||
raise NotAuthorizedError(access_token)
|
||||
|
||||
def verify_software_token(self, access_token, user_code):
|
||||
for user_pool in self.user_pools.values():
|
||||
if access_token in user_pool.access_tokens:
|
||||
_, username = user_pool.access_tokens[access_token]
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
user.token_verified = True
|
||||
|
||||
return {"Status": "SUCCESS"}
|
||||
else:
|
||||
raise NotAuthorizedError(access_token)
|
||||
|
||||
def set_user_mfa_preference(
|
||||
self, access_token, software_token_mfa_settings, sms_mfa_settings
|
||||
):
|
||||
for user_pool in self.user_pools.values():
|
||||
if access_token in user_pool.access_tokens:
|
||||
_, username = user_pool.access_tokens[access_token]
|
||||
user = user_pool.users.get(username)
|
||||
if not user:
|
||||
raise UserNotFoundError(username)
|
||||
|
||||
if software_token_mfa_settings["Enabled"]:
|
||||
if user.token_verified:
|
||||
user.software_token_mfa_enabled = True
|
||||
else:
|
||||
raise InvalidParameterException(
|
||||
"User has not verified software token mfa"
|
||||
)
|
||||
|
||||
elif sms_mfa_settings["Enabled"]:
|
||||
user.sms_mfa_enabled = True
|
||||
|
||||
return None
|
||||
else:
|
||||
raise NotAuthorizedError(access_token)
|
||||
|
||||
|
||||
cognitoidp_backends = {}
|
||||
for region in Session().get_available_regions("cognito-idp"):
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ import json
|
|||
import os
|
||||
|
||||
from moto.core.responses import BaseResponse
|
||||
from .models import cognitoidp_backends, find_region_by_value
|
||||
from .models import cognitoidp_backends, find_region_by_value, UserStatus
|
||||
|
||||
|
||||
class CognitoIdpResponse(BaseResponse):
|
||||
|
|
@ -390,6 +390,65 @@ class CognitoIdpResponse(BaseResponse):
|
|||
)
|
||||
return json.dumps({"ResourceServer": resource_server.to_json()})
|
||||
|
||||
def sign_up(self):
|
||||
client_id = self._get_param("ClientId")
|
||||
username = self._get_param("Username")
|
||||
password = self._get_param("Password")
|
||||
user = cognitoidp_backends[self.region].sign_up(
|
||||
client_id=client_id,
|
||||
username=username,
|
||||
password=password,
|
||||
attributes=self._get_param("UserAttributes", []),
|
||||
)
|
||||
return json.dumps(
|
||||
{
|
||||
"UserConfirmed": user.status == UserStatus["CONFIRMED"],
|
||||
"UserSub": user.id,
|
||||
}
|
||||
)
|
||||
|
||||
def confirm_sign_up(self):
|
||||
client_id = self._get_param("ClientId")
|
||||
username = self._get_param("Username")
|
||||
confirmation_code = self._get_param("ConfirmationCode")
|
||||
cognitoidp_backends[self.region].confirm_sign_up(
|
||||
client_id=client_id, username=username, confirmation_code=confirmation_code,
|
||||
)
|
||||
return ""
|
||||
|
||||
def initiate_auth(self):
|
||||
client_id = self._get_param("ClientId")
|
||||
auth_flow = self._get_param("AuthFlow")
|
||||
auth_parameters = self._get_param("AuthParameters")
|
||||
|
||||
auth_result = cognitoidp_backends[self.region].initiate_auth(
|
||||
client_id, auth_flow, auth_parameters
|
||||
)
|
||||
|
||||
return json.dumps(auth_result)
|
||||
|
||||
def associate_software_token(self):
|
||||
access_token = self._get_param("AccessToken")
|
||||
result = cognitoidp_backends[self.region].associate_software_token(access_token)
|
||||
return json.dumps(result)
|
||||
|
||||
def verify_software_token(self):
|
||||
access_token = self._get_param("AccessToken")
|
||||
user_code = self._get_param("UserCode")
|
||||
result = cognitoidp_backends[self.region].verify_software_token(
|
||||
access_token, user_code
|
||||
)
|
||||
return json.dumps(result)
|
||||
|
||||
def set_user_mfa_preference(self):
|
||||
access_token = self._get_param("AccessToken")
|
||||
software_token_mfa_settings = self._get_param("SoftwareTokenMfaSettings")
|
||||
sms_mfa_settings = self._get_param("SMSMfaSettings")
|
||||
cognitoidp_backends[self.region].set_user_mfa_preference(
|
||||
access_token, software_token_mfa_settings, sms_mfa_settings
|
||||
)
|
||||
return ""
|
||||
|
||||
|
||||
class CognitoIdpJsonWebKeyResponse(BaseResponse):
|
||||
def __init__(self):
|
||||
|
|
|
|||
|
|
@ -2,9 +2,20 @@ from __future__ import unicode_literals
|
|||
import six
|
||||
import random
|
||||
import string
|
||||
import hashlib
|
||||
import hmac
|
||||
import base64
|
||||
|
||||
|
||||
def create_id():
|
||||
size = 26
|
||||
chars = list(range(10)) + list(string.ascii_lowercase)
|
||||
return "".join(six.text_type(random.choice(chars)) for x in range(size))
|
||||
|
||||
|
||||
def check_secret_hash(app_client_secret, app_client_id, username, secret_hash):
|
||||
key = bytes(str(app_client_secret).encode("latin-1"))
|
||||
msg = bytes(str(username + app_client_id).encode("latin-1"))
|
||||
new_digest = hmac.new(key, msg, hashlib.sha256).digest()
|
||||
SECRET_HASH = base64.b64encode(new_digest).decode()
|
||||
return SECRET_HASH == secret_hash
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue