💥 integrate with AlibabaCloud

LICENSE.md

@@ -1,11 +1,11 @@
 The MIT License (MIT)
 =====================
 
-Copyright (c) 2016 Versent
+Copyright (c) 2020 AlibabaCloud
 --------------------------------------------
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

@@ -1,6 +1,6 @@
-NAME=saml2aws
+NAME=saml2alibabacloud
 ARCH=$(shell uname -m)
-VERSION=2.27.1
+VERSION=0.0.1
 ITERATION := 1
 
 SOURCE_FILES?=$$(go list ./... | grep -v /vendor/)
@@ -46,7 +46,7 @@ fmt:
 	find . -name '*.go' -not -wholename './vendor/*' | while read -r file; do gofmt -w -s "$$file"; goimports -w "$$file"; done
 
 install:
-	go install ./cmd/saml2aws
+	go install ./cmd/saml2alibabacloud
 
 dist:
 	$(eval FILES := $(shell ls build))
@@ -58,7 +58,7 @@ dist:
 	done
 
 release:
-	@$(BIN_DIR)/github-release "v$(VERSION)" dist/* --commit "$(git rev-parse HEAD)" --github-repository versent/$(NAME)
+	@$(BIN_DIR)/github-release "v$(VERSION)" dist/* --commit "$(git rev-parse HEAD)" --github-repository aliyun/$(NAME)
 
 test:
 	@$(BIN_DIR)/gocov test $(SOURCE_FILES) | $(BIN_DIR)/gocov report
@@ -69,7 +69,7 @@ clean:
 packages:
 	rm -rf package && mkdir package
 	rm -rf stage && mkdir -p stage/usr/bin
-	cp build/saml2aws_*_linux_amd64/saml2aws stage/usr/bin
+	cp build/saml2alibabacloud_*_linux_amd64/saml2alibabacloud stage/usr/bin
 	fpm --name $(NAME) -a x86_64 -t rpm -s dir --version $(VERSION) --iteration $(ITERATION) -C stage -p package/$(NAME)-$(VERSION)_$(ITERATION).rpm usr
 	fpm --name $(NAME) -a x86_64 -t deb -s dir --version $(VERSION) --iteration $(ITERATION) -C stage -p package/$(NAME)-$(VERSION)_$(ITERATION).deb usr
 	shasum -a 512 package/$(NAME)-$(VERSION)_$(ITERATION).rpm > package/$(NAME)-$(VERSION)_$(ITERATION).rpm.sha512

alibabacloud_account.go

@@ -0,0 +1,91 @@
+package saml2alibabacloud
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/PuerkitoBio/goquery"
+	"github.com/pkg/errors"
+)
+
+// AlibabaCloudAccount holds the AlibabaCloud account name and roles
+type AlibabaCloudAccount struct {
+	Name  string
+	Roles []*RamRole
+}
+
+// ParseAlibabaCloudAccounts extract the AlibabaCloud accounts from the saml assertion
+func ParseAlibabaCloudAccounts(audience string, samlAssertion string) ([]*AlibabaCloudAccount, error) {
+	res, err := http.PostForm(audience, url.Values{"SAMLResponse": {samlAssertion}})
+	if err != nil {
+		return nil, errors.Wrap(err, "error retrieving AlibabaCloud login form")
+	}
+
+	data, err := ioutil.ReadAll(res.Body)
+	if err != nil {
+		return nil, errors.Wrap(err, "error retrieving AlibabaCloud login body")
+	}
+
+	return ExtractAlibabaCloudAccounts(data)
+}
+
+// ExtractAlibabaCloudAccounts extract the accounts from the AlibabaCloud login html page
+func ExtractAlibabaCloudAccounts(data []byte) ([]*AlibabaCloudAccount, error) {
+	accounts := []*AlibabaCloudAccount{}
+
+	doc, err := goquery.NewDocumentFromReader(bytes.NewBuffer(data))
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to build document from response")
+	}
+
+	doc.Find("#samlRoleForm > div.form-group > div.col-sm-4 > label").Each(func(i int, s *goquery.Selection) {
+		account := new(AlibabaCloudAccount)
+		name := s.Text()
+		parts := strings.Split(name, ":")
+		account.Name = strings.TrimSpace(parts[1])
+		s.Parent().Parent().Next().Find("input[name='roleAttribute']").Each(func(i int, s *goquery.Selection) {
+			role := new(RamRole)
+			label := s.Parent()
+			role.Name = strings.TrimSpace(label.Text())
+			value, _ := s.Attr("value")
+			parts = strings.Split(value, ",")
+			role.RoleARN = strings.TrimSpace(parts[0])
+			role.PrincipalARN = strings.TrimSpace(parts[1])
+			account.Roles = append(account.Roles, role)
+		})
+		accounts = append(accounts, account)
+	})
+
+	return accounts, nil
+}
+
+// AssignPrincipals assign principal from roles
+func AssignPrincipals(ramRoles []*RamRole, alibabacloudAccounts []*AlibabaCloudAccount) {
+
+	principalARNs := make(map[string]string)
+	for _, ramRole := range ramRoles {
+		principalARNs[ramRole.RoleARN] = ramRole.PrincipalARN
+	}
+
+	for _, account := range alibabacloudAccounts {
+		for _, ramRole := range account.Roles {
+			ramRole.PrincipalARN = principalARNs[ramRole.RoleARN]
+		}
+	}
+
+}
+
+// LocateRole locate role by name
+func LocateRole(ramRoles []*RamRole, roleName string) (*RamRole, error) {
+	for _, ramRole := range ramRoles {
+		if ramRole.RoleARN == roleName {
+			return ramRole, nil
+		}
+	}
+
+	return nil, fmt.Errorf("Supplied RoleArn not found in saml assertion: %s", roleName)
+}

alibabacloud_account_test.go

@@ -0,0 +1,78 @@
+package saml2alibabacloud
+
+import (
+	"io/ioutil"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestExtractAlibabaCloudAccounts(t *testing.T) {
+	data, err := ioutil.ReadFile("testdata/saml.html")
+	assert.Nil(t, err)
+
+	accounts, err := ExtractAlibabaCloudAccounts(data)
+	assert.Nil(t, err)
+	assert.Len(t, accounts, 2)
+
+	account := accounts[0]
+	assert.Equal(t, account.Name, "Account: account-alias (000000000001)")
+
+	assert.Len(t, account.Roles, 2)
+	role := account.Roles[0]
+	assert.Equal(t, role.RoleARN, "acs:ram::000000000001:role/Development")
+	assert.Equal(t, role.Name, "Development")
+	role = account.Roles[1]
+	assert.Equal(t, role.RoleARN, "acs:ram::000000000001:role/Production")
+	assert.Equal(t, role.Name, "Production")
+
+	account = accounts[1]
+	assert.Equal(t, account.Name, "Account: 000000000002")
+
+	assert.Len(t, account.Roles, 1)
+	role = account.Roles[0]
+	assert.Equal(t, role.RoleARN, "acs:ram::000000000002:role/Production")
+	assert.Equal(t, role.Name, "Production")
+}
+
+func TestAssignPrincipals(t *testing.T) {
+	ramRoles := []*RamRole{
+		{
+			PrincipalARN: "acs:ram::000000000001:saml-provider/test-idp",
+			RoleARN:      "acs:ram::000000000001:role/Development",
+		},
+	}
+
+	alibabacloudAccounts := []*AlibabaCloudAccount{
+		{
+			Roles: []*RamRole{
+				{
+					RoleARN: "acs:ram::000000000001:role/Development",
+				},
+			},
+		},
+	}
+
+	AssignPrincipals(ramRoles, alibabacloudAccounts)
+
+	assert.Equal(t, "acs:ram::000000000001:saml-provider/test-idp", alibabacloudAccounts[0].Roles[0].PrincipalARN)
+}
+
+func TestLocateRole(t *testing.T) {
+	ramRoles := []*RamRole{
+		{
+			PrincipalARN: "acs:ram::000000000001:saml-provider/test-idp",
+			RoleARN:      "acs:ram::000000000001:role/Development",
+		},
+		{
+			PrincipalARN: "acs:ram::000000000002:saml-provider/test-idp",
+			RoleARN:      "acs:ram::000000000002:role/Development",
+		},
+	}
+
+	role, err := LocateRole(ramRoles, "acs:ram::000000000001:role/Development")
+
+	assert.Empty(t, err)
+
+	assert.Equal(t, "acs:ram::000000000001:role/Development", role.RoleARN)
+}