Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate credentials in provider configure func #579

Merged
merged 4 commits into from
Aug 13, 2021

Conversation

bendrucker
Copy link
Contributor

@bendrucker bendrucker commented Aug 13, 2021

This PR adds credential validation when the provider's configuration function is called during initialization. It calls /api/v1/users/me and returns an error when it fails, which will prevent further execution of the provider. This seems like the only API route that should be accessible regardless of administrative roles assigned to the calling user.

When using an invalid token:

curl 'https://api.okta.com/api/v1/users/me' -H "Authorization: SSWS foo"
{
  "errorCode": "E0000011",
  "errorSummary": "Invalid token provided",
  "errorLink": "E0000011",
  "errorId": "oaeKfsPfu75Ts6DqXdSZmlRXg",
  "errorCauses": []
}

This provides some assurance that the credentials are valid without causing a single failing request to crash the plugin and halt other okta_* resources, for which the credentials may be valid.

@bendrucker bendrucker changed the title Validate creds config Validate credentials in provider configure func Aug 13, 2021
@bendrucker
Copy link
Contributor Author

Here's some examples of how other providers handle this similarly:

@bogdanprodan-okta bogdanprodan-okta merged commit 8ccea2e into okta:master Aug 13, 2021
@bendrucker bendrucker deleted the validate-creds-config branch August 13, 2021 17:27
@bendrucker
Copy link
Contributor Author

Thanks for the quick turn around!

@bogdanprodan-okta
Copy link
Contributor

@bendrucker no problem! This will be released next week for sure. Thanks for the PR!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants