Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create trigger for verifying cloud.gov origin #153

Merged
merged 12 commits into from Jan 6, 2017
Merged

Create trigger for verifying cloud.gov origin #153

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
7375615
Create trigger for verifying cloud.gov origin;
rogeruiz Dec 23, 2016
626a238
Invert the condition my condition is in :sunglasses:
rogeruiz Dec 23, 2016
ca62f02
Stop relying on the UAA documentation
rogeruiz Dec 23, 2016
86fb787
Only trigger on update and statements
rogeruiz Dec 27, 2016
8322ef0
Drop the trigger before creating it;
rogeruiz Dec 27, 2016
e164e3c
Add constraint for username record keeping :book: :eyeglasses:
rogeruiz Dec 27, 2016
59207aa
Make commands more readable
rogeruiz Dec 27, 2016
7cac43f
Remove the -c flag because Heredocs don't need it
rogeruiz Dec 28, 2016
8a48949
Ensure that drop & create are one transaction;
rogeruiz Dec 28, 2016
2aaae05
Make changes to totp_seed in a single transaction
rogeruiz Jan 4, 2017
f31f25b
Make it a single transaction and explain myself
rogeruiz Jan 4, 2017
7bbfbd7
Fix up syntax after running/rerunning locally
rogeruiz Jan 4, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
24 changes: 24 additions & 0 deletions ci/scripts/create-and-update-db.sh
View file
Open in desktop
Expand Up @@ -23,9 +23,33 @@ for db in ${DATABASES}; do

# Special case for uaadb, create totp seed table for use with MFA
# Special case for Shibboleth, create storage records table for use with multi-zone Shibboleth
# Special case for Shibboleth, create function and trigger that verifies origin uaa is set to cloud.gov IdP
if [ "${db}" = "uaadb" ]; then
psql_adm -d "${db}" -c "CREATE TABLE IF NOT EXISTS totp_seed ( username varchar(255) PRIMARY KEY, seed varchar(36), backup_code varchar(36) )"
psql_adm -d "${db}" -c "CREATE TABLE IF NOT EXISTS storagerecords ( context varchar(255) NOT NULL, id varchar(255) NOT NULL, expires bigint DEFAULT NULL, value text NOT NULL, version bigint NOT NULL, PRIMARY KEY (context, id) )"

psql_adm -d "${db}" -c << EOT
CREATE OR REPLACE FUNCTION "f_isValidEmail"( text ) RETURNS BOOLEAN AS '
SELECT $1 ~ ''^[^@\s]+@[^@\s]+(\.[^@\s]+)+$'' AS RESULT
' LANGUAGE sql
EOT
psql_adm -d "${db}" -c << EOT
CREATE OR REPLACE FUNCTION "f_enforceCloudGovOrigin"( text ) RETURNS TRIGGER AS $$
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your call on this, since I don't know the UAA internals, but some inline docs might be useful here. For example, it's not obvious to me why we need the email check, or what exactly the date comparison does.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, added a comment above the psql_adm command.

BEGIN
UPDATE users
SET ( origin, externalId ) = ( 'cloud.gov', username )
WHERE "f_isValidEmail"( username ) AND
origin = 'uaa' AND
verified = false AND
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be:

verified = true AND
created::date != passwd_lastmodified::date

That would indicate that the user has accepted the invite after those two conditions, yeah?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤦‍♂️ YES

created::date = passwd_lastmodified::date;
END;
$$ LANGUAGE plpgsql
EOT
psql_adm -d "${db}" -c << EOT
CREATE TRIGGER enforce_cloud_gov_idp_origin_trigger
AFTER INSERT OR UPDATE ON users
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be done just on UPDATE? since UAA inserts the user when it invites (and we never want to do anything then), and then presumably does an UPDATE to set their password / verified flag which is when we want to catch this?

FOR EACH ROW EXECUTE PROCEDURE "f_enforceCloudGovOrigin"()
EOT
fi

done