HandleStartAuthFlow is called to start the SAML authentication process.
(w http.ResponseWriter, r *http.Request)
| 120 | |
| 121 | // HandleStartAuthFlow is called to start the SAML authentication process. |
| 122 | func (m *Middleware) HandleStartAuthFlow(w http.ResponseWriter, r *http.Request) { |
| 123 | // If we try to redirect when the original request is the ACS URL we'll |
| 124 | // end up in a loop. This is a programming error, so we panic here. In |
| 125 | // general this means a 500 to the user, which is preferable to a |
| 126 | // redirect loop. |
| 127 | if r.URL.Path == m.ServiceProvider.AcsURL.Path { |
| 128 | panic("don't wrap Middleware with RequireAccount") |
| 129 | } |
| 130 | |
| 131 | var binding, bindingLocation string |
| 132 | if m.Binding != "" { |
| 133 | binding = m.Binding |
| 134 | bindingLocation = m.ServiceProvider.GetSSOBindingLocation(binding) |
| 135 | } else { |
| 136 | binding = saml.HTTPRedirectBinding |
| 137 | bindingLocation = m.ServiceProvider.GetSSOBindingLocation(binding) |
| 138 | if bindingLocation == "" { |
| 139 | binding = saml.HTTPPostBinding |
| 140 | bindingLocation = m.ServiceProvider.GetSSOBindingLocation(binding) |
| 141 | } |
| 142 | } |
| 143 | |
| 144 | authReq, err := m.ServiceProvider.MakeAuthenticationRequest(bindingLocation, binding, m.ResponseBinding) |
| 145 | if err != nil { |
| 146 | http.Error(w, err.Error(), http.StatusInternalServerError) |
| 147 | return |
| 148 | } |
| 149 | |
| 150 | // relayState is limited to 80 bytes but also must be integrity protected. |
| 151 | // this means that we cannot use a JWT because it is way to long. Instead |
| 152 | // we set a signed cookie that encodes the original URL which we'll check |
| 153 | // against the SAML response when we get it. |
| 154 | relayState, err := m.RequestTracker.TrackRequest(w, r, authReq.ID) |
| 155 | if err != nil { |
| 156 | http.Error(w, err.Error(), http.StatusInternalServerError) |
| 157 | return |
| 158 | } |
| 159 | |
| 160 | if binding == saml.HTTPRedirectBinding { |
| 161 | redirectURL, err := authReq.Redirect(relayState, &m.ServiceProvider) |
| 162 | if err != nil { |
| 163 | http.Error(w, err.Error(), http.StatusInternalServerError) |
| 164 | return |
| 165 | } |
| 166 | w.Header().Add("Location", redirectURL.String()) |
| 167 | w.WriteHeader(http.StatusFound) |
| 168 | return |
| 169 | } |
| 170 | if binding == saml.HTTPPostBinding { |
| 171 | w.Header().Add("Content-Security-Policy", ""+ |
| 172 | "default-src; "+ |
| 173 | "script-src 'sha256-AjPdJSbZmeWHnEc5ykvJFay8FTWeTeRbs9dutfZ0HqE='; "+ |
| 174 | "reflected-xss block; referrer no-referrer;") |
| 175 | w.Header().Add("Content-type", "text/html") |
| 176 | w.Write([]byte(`<!DOCTYPE html><html><body>`)) |
| 177 | w.Write(authReq.Post(relayState)) |
| 178 | w.Write([]byte(`</body></html>`)) |
| 179 | return |
no test coverage detected