Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2860768

Browse files
adamjmcgrathadamjmcgrath
authored
[SDK-4394] Add organization name validation (auth0#507)
2 parents c5131b6 + 423f9b3 commit 2860768

File tree

3 files changed

+70
-15
lines changed

3 files changed

+70
-15
lines changed

‎auth0/authentication/async_token_verifier.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ async def verify(
176176
token (str): The JWT to verify.
177177
nonce (str, optional): The nonce value sent during authentication.
178178
max_age (int, optional): The max_age value sent during authentication.
179-
organization (str, optional): The expected organization ID (org_id) claim value. This should be specified
179+
organization (str, optional): The expected organization ID (org_id) or orgnization name (org_name) claim value. This should be specified
180180
when logging in to an organization.
181181
182182
Returns:

‎auth0/authentication/token_verifier.py

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ def verify(
299299
token (str): The JWT to verify.
300300
nonce (str, optional): The nonce value sent during authentication.
301301
max_age (int, optional): The max_age value sent during authentication.
302-
organization (str, optional): The expected organization ID (org_id) claim value. This should be specified
302+
organization (str, optional): The expected organization ID (org_id) or orgnization name (org_name) claim value. This should be specified
303303
when logging in to an organization.
304304
305305
Returns:
@@ -402,16 +402,30 @@ def _verify_payload(
402402

403403
# Organization
404404
if organization:
405-
if "org_id" not in payload or not isinstance(payload["org_id"], str):
406-
raise TokenValidationError(
407-
"Organization (org_id) claim must be a string present in the ID"
408-
" token"
409-
)
410-
if payload["org_id"] != organization:
411-
raise TokenValidationError(
412-
"Organization (org_id) claim mismatch in the ID token; expected"
413-
' "{}", found "{}"'.format(organization, payload["org_id"])
414-
)
405+
if organization.startswith("org_"):
406+
if "org_id" not in payload or not isinstance(payload["org_id"], str):
407+
raise TokenValidationError(
408+
"Organization (org_id) claim must be a string present in the ID"
409+
" token"
410+
)
411+
if payload["org_id"] != organization:
412+
raise TokenValidationError(
413+
"Organization (org_id) claim mismatch in the ID token; expected"
414+
' "{}", found "{}"'.format(organization, payload["org_id"])
415+
)
416+
else:
417+
if "org_name" not in payload or not isinstance(
418+
payload["org_name"], str
419+
):
420+
raise TokenValidationError(
421+
"Organization (org_name) claim must be a string present in the ID"
422+
" token"
423+
)
424+
if payload["org_name"] != organization.lower():
425+
raise TokenValidationError(
426+
"Organization (org_name) claim mismatch in the ID token; expected"
427+
' "{}", found "{}"'.format(organization, payload["org_name"])
428+
)
415429

416430
# Authorized party
417431
if isinstance(payload["aud"], list) and len(payload["aud"]) > 1:

‎auth0/test/authentication/test_token_verifier.py

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,48 @@ def test_passes_when_org_present_and_matches(self):
506506
tv._clock = MOCKED_CLOCK
507507
tv.verify(token, organization="org_123")
508508

509-
def test_fails_when_org_specified_but_not_present(self):
509+
def test_fails_when_org_name_specified_but_not_present(self):
510+
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJpc3MiOiJodHRwczovL3Rva2Vucy10ZXN0LmF1dGgwLmNvbS8iLCJleHAiOjE1ODc3NjUzNjEsImlhdCI6MTU4NzU5MjU2MX0.wotJnUdD5IfdZMewF_-BnHc0pI56uwzwr5qaSXvSu9w"
511+
self.assert_fails_with_error(
512+
token,
513+
"Organization (org_name) claim must be a string present in the ID token",
514+
signature_verifier=SymmetricSignatureVerifier(HMAC_SHARED_SECRET),
515+
organization="org-123",
516+
)
517+
518+
def test_fails_when_org_name_specified_but_not_string(self):
519+
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJvcmdfbmFtZSI6NDIsImlzcyI6Imh0dHBzOi8vdG9rZW5zLXRlc3QuYXV0aDAuY29tLyIsImV4cCI6MTU4Nzc2NTM2MSwiaWF0IjoxNTg3NTkyNTYxfQ.RXu-dz1u2pftk_iInk1To8z9g1B6TVA-5FAwoCx85T0"
520+
self.assert_fails_with_error(
521+
token,
522+
"Organization (org_name) claim must be a string present in the ID token",
523+
signature_verifier=SymmetricSignatureVerifier(HMAC_SHARED_SECRET),
524+
organization="org-123",
525+
)
526+
527+
def test_fails_when_org_name_specified_but_does_not_match(self):
528+
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJvcmdfbmFtZSI6Im9yZy1hYmMiLCJpc3MiOiJodHRwczovL3Rva2Vucy10ZXN0LmF1dGgwLmNvbS8iLCJleHAiOjE1ODc3NjUzNjEsImlhdCI6MTU4NzU5MjU2MX0.P_ldJGEaFg58cARwGMtog_KTsqv7cGJZXoS9xdTEkvQ"
529+
self.assert_fails_with_error(
530+
token,
531+
'Organization (org_name) claim mismatch in the ID token; expected "org-123",'
532+
' found "org-abc"',
533+
signature_verifier=SymmetricSignatureVerifier(HMAC_SHARED_SECRET),
534+
organization="org-123",
535+
)
536+
537+
def test_succeeds_when_org_name_specified_matches(self):
538+
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJvcmdfbmFtZSI6Im9yZy0xMjMiLCJpc3MiOiJodHRwczovL3Rva2Vucy10ZXN0LmF1dGgwLmNvbS8iLCJleHAiOjE1ODc3NjUzNjEsImlhdCI6MTU4NzU5MjU2MX0.P8Kba8Fgamyiw1qw_lBfp2OAzWn6NOLL6fBCDQhGvyc"
539+
sv = SymmetricSignatureVerifier(HMAC_SHARED_SECRET)
540+
tv = TokenVerifier(
541+
signature_verifier=sv,
542+
issuer=expectations["issuer"],
543+
audience=expectations["audience"],
544+
)
545+
tv._clock = MOCKED_CLOCK
546+
response = tv.verify(token)
547+
self.assertIn("org_name", response)
548+
self.assertEqual("org-123", response["org_name"])
549+
550+
def test_fails_when_org_id_specified_but_not_present(self):
510551
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJpc3MiOiJodHRwczovL3Rva2Vucy10ZXN0LmF1dGgwLmNvbS8iLCJleHAiOjE1ODc3NjUzNjEsImlhdCI6MTU4NzU5MjU2MX0.wotJnUdD5IfdZMewF_-BnHc0pI56uwzwr5qaSXvSu9w"
511552
self.assert_fails_with_error(
512553
token,
@@ -515,7 +556,7 @@ def test_fails_when_org_specified_but_not_present(self):
515556
organization="org_123",
516557
)
517558

518-
def test_fails_when_org_specified_but_not_(self):
559+
def test_fails_when_org_id_specified_but_not_string(self):
519560
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJvcmdfaWQiOjQyLCJpc3MiOiJodHRwczovL3Rva2Vucy10ZXN0LmF1dGgwLmNvbS8iLCJleHAiOjE1ODc3NjUzNjEsImlhdCI6MTU4NzU5MjU2MX0.fGL1_akaHikdovS7NRYla3flne1xdtCjP0ei_CRxO6k"
520561
self.assert_fails_with_error(
521562
token,
@@ -524,7 +565,7 @@ def test_fails_when_org_specified_but_not_(self):
524565
organization="org_123",
525566
)
526567

527-
def test_fails_when_org_specified_but_does_not_match(self):
568+
def test_fails_when_org_id_specified_but_does_not_match(self):
528569
token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhdXRoMHxzZGs0NThma3MiLCJhdWQiOiJ0b2tlbnMtdGVzdC0xMjMiLCJvcmdfaWQiOiJvcmdfMTIzIiwiaXNzIjoiaHR0cHM6Ly90b2tlbnMtdGVzdC5hdXRoMC5jb20vIiwiZXhwIjoxNTg3NzY1MzYxLCJpYXQiOjE1ODc1OTI1NjF9.hjSPgJpg0Dn2z0giCdGqVLD5Kmqy_yMYlSkgwKD7ahQ"
529570
self.assert_fails_with_error(
530571
token,

0 commit comments

Comments
 (0)