Skip to content

Commit 6567d68

Browse files
lennartdohmannlennartdohmann
authored
Merge pull request #290 from GDATASoftwareAG/php/include-resource-owner-password-authenticator
Php/include resource owner password authenticator
2 parents 1858b62 + 743b054 commit 6567d68

15 files changed

+161
-3
lines changed

‎.github/workflows/ci-dotnet.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/cs')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/cs')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/cs')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-dotnet:

‎.github/workflows/ci-golang.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/go')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/go')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/go')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-golang:

‎.github/workflows/ci-java-legacy.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-java-legacy:

‎.github/workflows/ci-java.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/java')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-java:

‎.github/workflows/ci-php.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-php:

‎.github/workflows/ci-python.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/py')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/py')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/py')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-python:

‎.github/workflows/ci-ruby.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rb')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rb')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rb')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-ruby:

‎.github/workflows/ci-rust.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rs')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rs')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/rs')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-rust:

‎.github/workflows/ci-typescript.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ env:
2929
CLIENT_SECRET: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/ts')) && secrets.CLIENT_SECRET || secrets.STAGING_CLIENT_SECRET }}
3030
VAAS_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/ts')) && 'wss://gateway.production.vaas.gdatasecurity.de' || 'wss://gateway.staging.vaas.gdatasecurity.de' }}
3131
TOKEN_URL: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/ts')) && 'https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token' || 'https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token' }}
32+
VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
33+
VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
34+
VAAS_PASSWORD: ${{ (inputs.environment == 'production' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/php')) && secrets.VAAS_PASSWORD || secrets.STAGING_VAAS_PASSWORD }}
3235

3336
jobs:
3437
build-typescript:

‎php/examples/VaasExample/AuthenticationExamples.php

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?php
2+
3+
namespace VaasExamples;
4+
5+
use VaasSdk\ClientCredentialsGrantAuthenticator;
6+
use VaasSdk\Exceptions\InvalidSha256Exception;
7+
use VaasSdk\Exceptions\TimeoutException;
8+
use VaasSdk\Exceptions\VaasAuthenticationException;
9+
use VaasSdk\ResourceOwnerPasswordAuthenticator;
10+
use VaasSdk\Vaas;
11+
12+
// If you got a username and password from us, you can use the ResourceOwnerPasswordAuthenticator like this
13+
$authenticator = new ResourceOwnerPasswordAuthenticator(
14+
getenv("CLIENT_ID"),
15+
getenv("USER_NAME"),
16+
getenv("PASSWORD"),
17+
getenv("TOKEN_URL")
18+
);
19+
// If you got a client id with a link you may use self registration and create a new username and password for the
20+
// ResourceOwnerPasswordAuthenticator by yourself like the example above.
21+
22+
// If you got a client id and client secret from us, you can use the ClientCredentialsGrantAuthenticator like this
23+
$authenticator = new ClientCredentialsGrantAuthenticator(
24+
getenv("CLIENT_ID"),
25+
getenv("CLIENT_SECRET"),
26+
getenv("TOKEN_URL")
27+
);
28+
29+
$vaas = new Vaas(
30+
getenv("VAAS_URL")
31+
);
32+
33+
try {
34+
$vaas->Connect($authenticator->getToken());
35+
} catch (VaasAuthenticationException $e) {
36+
fwrite(STDERR, "Authentication failed: " . $e->getMessage() . "\n");
37+
exit(1);
38+
}
39+
40+
// Get verdict for an eicar hash
41+
try {
42+
$vaasVerdict = $vaas->ForSha256("000005c43196142f01d615a67b7da8a53cb0172f8e9317a2ec9a0a39a1da6fe8");
43+
} catch (InvalidSha256Exception $e) {
44+
fwrite(STDERR, "Invalid sha256: " . $e->getMessage() . "\n");
45+
exit(1);
46+
} catch (TimeoutException $e) {
47+
fwrite(STDERR, "Timeout: " . $e->getMessage() . "\n");
48+
exit(1);
49+
}
50+
fwrite(STDOUT, "Verdict for $vaasVerdict->Sha256 is $vaasVerdict->Verdict \n");

‎php/src/vaas/Message/Error.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ class Error
1010

1111
public string $text;
1212

13-
public ProblemDetails $problem_details;
13+
public ?ProblemDetails $problem_details;
1414

1515
public Kind $kind;
1616

‎php/src/vaas/ResourceOwnerPasswordAuthenticator.php

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?php
2+
3+
namespace VaasSdk;
4+
5+
use League\OAuth2\Client\Provider\GenericProvider;
6+
use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
7+
use VaasSdk\Exceptions\VaasAuthenticationException;
8+
9+
class ResourceOwnerPasswordAuthenticator {
10+
private string $clientId;
11+
private string $userName;
12+
private string $password;
13+
private string $tokenEndpoint;
14+
private $verify;
15+
16+
public function __construct($clientId, $userName, $password, $tokenEndpoint, $verify=true) {
17+
$this->clientId = $clientId;
18+
$this->userName = $userName;
19+
$this->password = $password;
20+
$this->tokenEndpoint = $tokenEndpoint;
21+
$this->verify = $verify;
22+
}
23+
24+
/**
25+
* @throws VaasAuthenticationException
26+
*/
27+
public function getToken() {
28+
$provider = new GenericProvider([
29+
'clientId' => $this->clientId,
30+
'urlAuthorize' => $this->tokenEndpoint,
31+
'urlAccessToken' => $this->tokenEndpoint,
32+
'urlResourceOwnerDetails' => '',
33+
'verify' => $this->verify,
34+
]);
35+
36+
try {
37+
$accessToken = $provider->getAccessToken("password", [
38+
'username' => $this->userName,
39+
'password' => $this->password
40+
]);
41+
return $accessToken->getToken();
42+
} catch (IdentityProviderException $e) {
43+
throw new VaasAuthenticationException($e->getMessage(), $e->getCode());
44+
}
45+
}
46+
}

‎php/src/vaas/composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@
1818
"textalk/websocket": "^1.6 || ^1.5",
1919
"netresearch/jsonmapper": "^4.1",
2020
"guzzlehttp/guzzle": "^7",
21-
"psr/log": "^1.1 || ^2.0 || ^3.0"
21+
"psr/log": "^1.1 || ^2.0 || ^3.0",
22+
"league/oauth2-client": "^2.4.0"
2223
},
2324
"autoload": {
2425
"psr-4": {

‎php/tests/vaas/VaasTest.php

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use VaasSdk\Exceptions\TimeoutException;
1111
use VaasSdk\Exceptions\VaasAuthenticationException;
1212
use VaasSdk\Exceptions\VaasClientException;
13+
use VaasSdk\ResourceOwnerPasswordAuthenticator;
1314
use VaasSdk\Vaas;
1415
use Dotenv\Dotenv;
1516
use Monolog\Formatter\JsonFormatter;
@@ -46,6 +47,15 @@ public function setUp(): void
4647
if (getenv("TOKEN_URL") !== false) {
4748
$_ENV["TOKEN_URL"] = getenv("TOKEN_URL");
4849
}
50+
if (getenv("VAAS_USER_NAME") !== false) {
51+
$_ENV["VAAS_USER_NAME"] = getenv("VAAS_USER_NAME");
52+
}
53+
if (getenv("VAAS_PASSWORD") !== false) {
54+
$_ENV["VAAS_PASSWORD"] = getenv("VAAS_PASSWORD");
55+
}
56+
if (getenv("VAAS_CLIENT_ID") !== false) {
57+
$_ENV["VAAS_CLIENT_ID"] = getenv("VAAS_CLIENT_ID");
58+
}
4959
}
5060

5161
private function _getDebugLogger(): LoggerInterface
@@ -78,6 +88,29 @@ private function getClientCredentialsGrantAuthenticator(): ClientCredentialsGran
7888
);
7989
}
8090

91+
private function getResourceOwnerPasswordAuthenticator(): ResourceOwnerPasswordAuthenticator
92+
{
93+
return new ResourceOwnerPasswordAuthenticator(
94+
$_ENV['VAAS_CLIENT_ID'],
95+
$_ENV['VAAS_USER_NAME'],
96+
$_ENV["VAAS_PASSWORD"],
97+
$_ENV["TOKEN_URL"]
98+
);
99+
}
100+
101+
public function testForSha256MaliciousSha256_WithResourceOwnerPasswordAuthenticator_GetsMaliciousResponse(): void
102+
{
103+
$uuid = $this->getUuid();
104+
105+
$vaas = new Vaas($_ENV["VAAS_URL"], $this->_getDebugLogger());
106+
$vaas->Connect($this->getResourceOwnerPasswordAuthenticator()->getToken());
107+
$verdict = $vaas->ForSha256(self::MALICIOUS_HASH, $uuid);
108+
109+
$this->assertEquals(Verdict::MALICIOUS, $verdict->Verdict);
110+
$this->assertEquals($uuid, $verdict->Guid);
111+
$this->assertEqualsIgnoringCase(self::MALICIOUS_HASH, $verdict->Sha256);
112+
}
113+
81114
public function testForConnectingWithInvalidToken_ThrowsVaasAccessDeniedException()
82115
{
83116
$this->expectException(VaasAuthenticationException::class);

‎php/tests/vaas/composer.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@
1313
"require": {
1414
"gdata/vaas": "999",
1515
"vlucas/phpdotenv": "^5.5",
16-
"monolog/monolog": "^3.3 || ^2.9"
16+
"monolog/monolog": "^3.3 || ^2.9",
17+
"league/oauth2-client": "^2.4.0"
1718
},
1819
"require-dev": {
1920
"phpunit/phpunit": "^9",

0 commit comments

Comments
 (0)