Index: .circleci/checksetup_answers.txt =================================================================== --- .circleci/checksetup_answers.txt +++ .circleci/checksetup_answers.txt @@ -11,5 +11,4 @@ $answer{'interdiffbin'} = '/usr/bin/interdiff'; $answer{'urlbase'} = 'http://bmo.test/'; $answer{'mail_delivery_method'} = 'Test'; -$answer{'auth_delegation'} = 1; $answer{'utf8'} = 'utf8mb4'; Index: Bugzilla/Config/Auth.pm =================================================================== --- Bugzilla/Config/Auth.pm +++ Bugzilla/Config/Auth.pm @@ -136,8 +136,6 @@ default => 'The password must be complex.', }, - {name => 'auth_delegation', type => 'b', default => 0,}, - {name => 'duo_host', type => 't', default => '',}, {name => 'duo_akey', type => 't', default => '',}, {name => 'duo_ikey', type => 't', default => '',}, Index: Bugzilla/Token.pm =================================================================== --- Bugzilla/Token.pm +++ Bugzilla/Token.pm @@ -28,7 +28,6 @@ @Bugzilla::Token::EXPORT = qw(issue_api_token issue_session_token issue_short_lived_session_token - issue_auth_delegation_token check_auth_delegation_token check_token_data delete_token issue_hash_token check_hash_token issue_hash_sig check_hash_sig @@ -59,40 +58,6 @@ return $token // _create_token($user->id, 'api_token', ''); } -sub issue_auth_delegation_token { - my ($uri) = @_; - my $dbh = Bugzilla->dbh; - my $user = Bugzilla->user; - my $checksum = hmac_sha256_base64($user->id, $uri, - Bugzilla->localconfig->site_wide_secret); - - return _create_token($user->id, 'auth_delegation', $checksum); -} - -sub check_auth_delegation_token { - my ($token, $uri) = @_; - my $dbh = Bugzilla->dbh; - my $user = Bugzilla->user; - - my ($eventdata) = $dbh->selectrow_array(" - SELECT eventdata FROM tokens - WHERE token = ? AND tokentype = 'auth_delegation' - AND (" - . $dbh->sql_date_math('issuedate', '+', (MAX_TOKEN_AGE * 24 - 12), 'HOUR') - . ") > NOW()", undef, $token); - - if ($eventdata) { - my $checksum = hmac_sha256_base64($user->id, $uri, - Bugzilla->localconfig->site_wide_secret); - if ($eventdata eq $checksum) { - delete_token($token); - return 1; - } - } - - return 0; -} - # Creates and sends a token to create a new user account. # It assumes that the login has the correct format and is not already in use. sub issue_new_user_account_token { @@ -746,23 +711,6 @@ Returns: A unique token. -=item C - - Description: Creates and returns a token used to validate auth delegation confirmations. - - Params: $uri - The uri that auth will be delegated to. - - Returns: A unique token. - -=item C - - Description: Checks if a token $token is a confirmation token for $uri. - - Params: $token - The token returned by issue_auth_delegation_token() - $uri - The uri that auth will be delegated to. - - Returns: a boolean value - =item C Description: Makes sure the $token has been created by the currently logged in Index: README.rst =================================================================== --- README.rst +++ README.rst @@ -160,7 +160,7 @@ Default: 200 BUGZILLA_ALLOW_INSECURE_HTTP - This should never be set in production. It allows auth delegation and oauth over http. + This should never be set in production. It allows oauth over http. BMO_urlbase The public URL for this instance. Note that if this begins with https:// @@ -349,23 +349,6 @@ docker-compose run bmo.test cat /app/data/mailer.testfile -Testing Auth delegation ------------------------ - -For testing auth-delegation there is included an `scripts/auth-test-app` -script that runs a webserver and implements the auth delegation protocol. - -Provided you have `Mojolicious`_ installed: - -.. code-block:: bash - - perl auth-test-app daemon - -Then just browse to `localhost:3000`_ to test creating API keys. - -.. _`Mojolicious`: https://metacpan.org/pod/Mojolicious -.. _`localhost:3000`: http://localhost:3000 - Technical Details ----------------- Index: auth.cgi =================================================================== --- auth.cgi +++ /dev/null @@ -1,137 +0,0 @@ -#!/usr/bin/env perl -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, You can obtain one at http://mozilla.org/MPL/2.0/. -# -# This Source Code Form is "Incompatible With Secondary Licenses", as -# defined by the Mozilla Public License, v. 2.0. - -use 5.10.1; -use strict; -use warnings; - -use lib qw(. lib local/lib/perl5); - -use Bugzilla; -use Bugzilla::Constants; -use Bugzilla::Error; -use Bugzilla::Hook; -use Bugzilla::Token qw(issue_auth_delegation_token check_auth_delegation_token); -use Bugzilla::Mailer qw(MessageToMTA); - -use URI; -use URI::QueryParam; -use Digest::SHA qw(sha256_hex); -use LWP::UserAgent (); -use JSON qw(decode_json encode_json); - -Bugzilla->login(LOGIN_REQUIRED); - -ThrowUserError('auth_delegation_disabled') - unless Bugzilla->params->{auth_delegation}; - -my $cgi = Bugzilla->cgi; -my $template = Bugzilla->template; -my $user = Bugzilla->user; -my $callback = $cgi->param('callback') - or ThrowUserError("auth_delegation_missing_callback"); -my $description = $cgi->param('description') - or ThrowUserError("auth_delegation_missing_description"); - -ThrowUserError("auth_delegation_invalid_description") - unless $description =~ /^[\w\s]{3,255}$/; - -my $callback_uri = URI->new($callback); - -my $legal_protocol = $ENV{BUGZILLA_ALLOW_INSECURE_HTTP} - ? qr/^https?$/i # http or https - : qr/^https$/i; # https only - -ThrowUserError( - 'auth_delegation_illegal_protocol', - {protocol => scalar $callback_uri->scheme} -) unless $callback_uri->scheme =~ $legal_protocol; -my $callback_base = $callback_uri->clone; -$callback_base->query(undef); - -my $app_id = sha256_hex($callback_base, $description); -my $skip_confirmation = 0; -my %args = ( - skip_confirmation => \$skip_confirmation, - callback => $callback_uri, - description => $description, - app_id => $app_id, - callback_base => $callback_base -); - -Bugzilla::Hook::process('auth_delegation_confirm', \%args); - -my $confirmed = lc($cgi->request_method) eq 'post' && $cgi->param('confirm'); - -if ($confirmed || $skip_confirmation) { - my $token = $cgi->param('token'); - unless ($skip_confirmation) { - ThrowUserError("auth_delegation_missing_token") unless $token; - - unless (check_auth_delegation_token($token, $callback)) { - ThrowUserError('auth_delegation_invalid_token', - {token => $token, callback => $callback}); - } - } - my $keys - = Bugzilla::User::APIKey->match({ - user_id => $user->id, app_id => $app_id, revoked => 0, - }); - - my $api_key; - if (@$keys) { - $api_key = $keys->[0]; - } - else { - $api_key - = Bugzilla::User::APIKey->create({ - user_id => $user->id, description => $description, app_id => $app_id, - }); - } - - my $ua = LWP::UserAgent->new(); - $ua->timeout(2); - $ua->protocols_allowed(['http', 'https']); - - # If the URL of the proxy is given, use it, else get this information - # from the environment variable. - if (my $proxy_url = Bugzilla->params->{'proxy_url'}) { - $ua->proxy(['http', 'https'], $proxy_url); - } - else { - $ua->env_proxy; - } - my $content = encode_json( - {client_api_key => $api_key->api_key, client_api_login => $user->login}); - my $resp = $ua->post( - $callback_uri, - 'Content-Type' => 'application/json', - Content => $content - ); - if ($resp->code == 200) { - $callback_uri->query_param(client_api_login => $user->login); - eval { - my $data = decode_json($resp->content); - $callback_uri->query_param(callback_result => $data->{result}); - }; - ThrowUserError('auth_delegation_json_error', {json_text => $resp->content}) - if $@; - - print $cgi->redirect($callback_uri); - } - else { - ThrowUserError('auth_delegation_post_error', {code => $resp->code}); - } -} -else { - $args{token} = issue_auth_delegation_token($callback); - - print $cgi->header(); - $template->process("account/auth/delegation.html.tmpl", \%args) - or ThrowTemplateError($template->error()); -} Index: conf/checksetup_answers.txt =================================================================== --- conf/checksetup_answers.txt +++ conf/checksetup_answers.txt @@ -20,7 +20,6 @@ $answer{'usestatuswhiteboard'} = 1; $answer{'usetargetmilestone'} = 1; $answer{'webdotbase'} = '/usr/bin/dot'; -$answer{'auth_delegation'} = 1; $answer{'insidergroup'} = 'admin'; $answer{'default_bug_type'} = '--'; $answer{'defaultpriority'} = '--'; Index: docs/en/rst/administering/parameters.rst =================================================================== --- docs/en/rst/administering/parameters.rst +++ docs/en/rst/administering/parameters.rst @@ -133,9 +133,6 @@ password_check_on_login If set, Bugzilla will check that the password meets the current complexity rules and minimum length requirements when the user logs into the Bugzilla web interface. If it doesn't, the user would not be able to log in, and will receive a message to reset their password. -auth_delegation - If set, Bugzilla will allow other websites to request API keys from its own users. See :ref:`auth-delegation`. - .. _param-attachments: Attachments Index: docs/en/rst/api/core/v1/general.rst =================================================================== --- docs/en/rst/api/core/v1/general.rst +++ docs/en/rst/api/core/v1/general.rst @@ -106,12 +106,8 @@ You can set up an API key by using the :ref:`API Keys tab ` in the Preferences pages. -API keys may also be requested via :ref:`Authentication Delegation `. - **WARNING**: It should be noted that additional authentication methods exist, but they are **not recommended** for use and are likely to be deprecated in future versions of BMO, due to security concerns. These additional methods include the following: - - username and password via ``Bugzilla_login`` and ``Bugzilla_password`` or simply ``login`` and ``password`` respectively in query parameters. - - username and password via ``X-BUGZILLA-LOGIN`` and ``X-BUGZILLA-PASSWORD`` headers respectively. - api key via ``Bugzilla_api_key`` or simply ``api_key`` in query parameters. Useful Parameters Index: docs/en/rst/integrating/auth-delegation.rst =================================================================== --- docs/en/rst/integrating/auth-delegation.rst +++ /dev/null @@ -1,37 +0,0 @@ -.. _auth-delegation: - -Authentication Delegation via API Keys -###################################### - -Bugzilla provides a mechanism for web apps to request (with the user's consent) -an API key. API keys allow the web app to perform any action as the user and are as -a result very powerful. Because of this power, this feature is disabled by default. - -Authentication Flow -------------------- - -The authentication process begins by directing the user to th the Bugzilla site's auth.cgi. -For the sake of this example, our application's URL is `http://app.example.org` -and the Bugzilla site is `http://bugzilla.mozilla.org`. - -1. Provide a link or redirect the user to `https://bugzilla.mozilla.org/auth.cgi?callback=http://app.example.org/callback&description=app%description` -2. Assuming the user is agreeable, the following will happen: - 1. Bugzilla will issue a POST request to `http://app.example.org/callback` - with a the request body data being a JSON object with keys `client_api_key` and `client_api_login`. - 2. The callback, when responding to the POST request must return a JSON object with a key `result`. This result - is intended to be a unique token used to identify this transaction. - 3. Bugzilla will then cause the user agent to redirect (using a GET request) to `http://app.example.org/callback` - with additional query string parameters `client_api_login` and `callback_result`. - 4. At this point, the consumer now has the api key and login information. Be sure to compare the `callback_result` to whatever result was initially sent back - to Bugzilla. -3. Finally, you should check that the API key and login are valid, using the :ref:`rest_user_whoami` REST - resource. - -Your application should take measures to ensure when receiving a user at your -callback URL that you previously redirected them to Bugzilla. The simplest method would be ensuring the callback URL always has the -hostname and path you specified, with only the query string parameters varying. - -The description should include the name of your application, in a form that will be recognizable to users. -This description is used in the :ref:`API Keys tab ` in the Preferences page. - -The API key passed to the callback will be valid until the user revokes it. Index: docs/en/rst/integrating/index.rst =================================================================== --- docs/en/rst/integrating/index.rst +++ docs/en/rst/integrating/index.rst @@ -20,5 +20,4 @@ templates extensions apis - auth-delegation auth0 Index: extensions/BMO/lib/Data.pm =================================================================== --- extensions/BMO/lib/Data.pm +++ extensions/BMO/lib/Data.pm @@ -26,21 +26,6 @@ # will result in the user being redirected to that URL when viewing the # attachment. -my $mozreview_url_re = qr{ - # begins with mozreview hostname - ^ - https?://reviewboard(?:-dev)?\.(?:allizom|mozilla)\.org - - # followed by a review path - /r/\d+ - - # ends with optional suffix - (?: / - | /diff/\#index_header - )? - $ -}ix; - sub phabricator_url_re { my $phab_uri = Bugzilla->params->{phabricator_base_uri} || 'https://example.com'; @@ -54,12 +39,6 @@ content_type => 'text/x-github-pull-request', can_review => 1, }, - reviewboard => { - title => 'MozReview', - regex => $mozreview_url_re, - content_type => 'text/x-review-board-request', - can_review => 0, - }, Phabricator => { title => 'Phabricator', regex => \&phabricator_url_re, Index: scripts/auth-test-app =================================================================== --- scripts/auth-test-app +++ /dev/null @@ -1,72 +0,0 @@ -#!/usr/bin/env perl -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, You can obtain one at http://mozilla.org/MPL/2.0/. -# -# This Source Code Form is "Incompatible With Secondary Licenses", as -# defined by the Mozilla Public License, v. 2.0. - -use 5.10.1; -use strict; -use warnings; -use Mojolicious::Lite; -use Digest::SHA qw(sha256_hex); - -my $BUGZILLA_URL = $ENV{AUTH_TEST_BUGZILLA_URL} // 'http://bmo.test/auth.cgi'; -my $APP_DESC = $ENV{AUTH_TEST_APP_DESC} // 'AuthTest'; -my %SECRETS; - -get '/' => sub { - my $c = shift; - my $callback_url = $c->url_for->to_abs->path('/callback'); - my $app_id = sha256_hex($callback_url, $APP_DESC); - $c->render( - template => 'index', - app_id => $app_id, - callback_url => $callback_url, - bugzilla_url => $BUGZILLA_URL, - app_desc => $APP_DESC, - ); -}; - -post '/callback' => sub { - my $c = shift; - %SECRETS = %{ $c->req->json }; - $c->render( json => { result => 'SECRETS' } ); -}; - -get '/callback' => sub { - my $c = shift; - my $store_key = $c->param('callback_result'); - $c->render( template => 'callback', %SECRETS ); -}; - -app->start; -__DATA__ - -@@ index.html.ep -% layout 'default'; -% title 'Configure'; - -

Test auth delegation. $app_id = <%= $app_id %>

- -
- - - - -
- -@@ callback.html.ep -% layout 'default'; -% title 'Login Result'; - -
Login <%= $client_api_login %>
-
API Key <%= $client_api_key %>
- -@@ layouts/default.html.ep - - - <%= title %> - <%= content %> - Index: scripts/c9-install =================================================================== --- scripts/c9-install +++ scripts/c9-install @@ -53,7 +53,6 @@ $answer{'usestatuswhiteboard'} = 1; $answer{'usetargetmilestone'} = 1; $answer{'webdotbase'} = '/usr/bin/dot'; -$answer{'auth_delegation'} = 1; $answer{'insidergroup'} = 'admin'; $answer{'default_bug_type'} = '--'; $answer{'defaultpriority'} = '--'; Index: template/en/default/account/auth/delegation.html.tmpl =================================================================== --- template/en/default/account/auth/delegation.html.tmpl +++ /dev/null @@ -1,40 +0,0 @@ -[%# This Source Code Form is subject to the terms of the Mozilla Public - # License, v. 2.0. If a copy of the MPL was not distributed with this - # file, You can obtain one at http://mozilla.org/MPL/2.0/. - # - # This Source Code Form is "Incompatible With Secondary Licenses", as - # defined by the Mozilla Public License, v. 2.0. - #%] - -[% PROCESS global/header.html.tmpl - title = "Auth Delegation Request" %] - -

[% title FILTER html %]

- -

A third-party website ([% callback_base FILTER html %]) - would like to have complete access to your [% terms.Bugzilla %] account.

- -

The description of the site reads: -

- [% description FILTER html %] -

- -

A new [% terms.Bugzilla %] API key[% IF description %], with the description - '[% description FILTER truncate(10) FILTER html %]'[% END %] will also be created. You can - view or update the key in - your preferences.

- -

Do you want this website to have complete access to your [% terms.Bugzilla %] - account?

- -
-
- - - - - -
-
- -[% PROCESS global/footer.html.tmpl %] Index: template/en/default/admin/params/auth.html.tmpl =================================================================== --- template/en/default/admin/params/auth.html.tmpl +++ template/en/default/admin/params/auth.html.tmpl @@ -228,10 +228,6 @@ "into the $terms.Bugzilla web interface. If it doesn't, the user would " _ "not be able to log in, and receive a message to reset their password.", - auth_delegation => - "If set, $terms.Bugzilla will allow third party applications " _ - "to request API keys for users.", - duo_host => "The 'API hostname' for Duo 2FA. This value is provided by your " _ "Duo Security administrator. Set this to a blank value to disable" _ Index: template/en/default/global/user-error.html.tmpl =================================================================== --- template/en/default/global/user-error.html.tmpl +++ template/en/default/global/user-error.html.tmpl @@ -129,49 +129,6 @@ account creation. Please contact an administrator to get a new account created. - [% ELSIF error == "auth_delegation_disabled" %] - [% title = "Can't use auth delegation" %] - This site does not have auth delegation enabled. - Please contact an administrator if you require this functionality. - - [% ELSIF error == "auth_delegation_illegal_protocol" %] - [% title = "Invalid Protocol" %] - The callback URI uses an illegal protocol: [% protocol FILTER html %]. - Only http and https are allowed. - - [% ELSIF error == "auth_delegation_missing_callback" %] - [% title = "Auth delegation impossible without callback URI" %] - It looks like auth delegation was attempted, but no callback URI was passed. - You were sent here by some other site; please contact them for support. - - [% ELSIF error == "auth_delegation_missing_description" %] - [% title = "Auth delegation impossible without description" %] - It looks like auth delegation was attempted, but no description was passed. - You were sent here by some other site; please contact them for support. - - [% ELSIF error == "auth_delegation_missing_token" %] - [% title = "Auth delegation can't be confirmed" %] - Auth delegation cannot be confirmed due to missing or invalid token. - - [% ELSIF error == "auth_delegation_invalid_description" %] - [% title = "Auth delegation suspicious description" %] - It looks like auth delegation was attempted with a suspicious description! - Auth Delegation descriptions should consist only of words, with no other punctuation. - You were sent here by some other site; please contact them for support. - - [% ELSIF error == "auth_delegation_invalid_token" %] - [% title = "Auth delegation can't be confirmed" %] - Auth delegation cannot be confirmed due to missing or invalid token. - - [% ELSIF error == "auth_delegation_json_error" %] - [% title = "Auth delegation received invalid JSON" %] - Auth delegation received an invalid JSON response from auth consumer: - 
[% json_text FILTER html %]
- - [% ELSIF error == "auth_delegation_post_error" %] - [% title = "Auth delegation received invalid status code" %] - Auth delegation received an HTTP response other than 200 OK from auth consumer. Code: [% code FILTER html %] - [% ELSIF error == "auth_failure" %] [% title = "Authorization Required" %] [% admindocslinks = {'groups.html' => 'Group Security'} %]