Skip to content

ee/psso: prepare backchannel browser #708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BeryJu wants to merge 3 commits into
base: main
Choose a base branch
from
Open

ee/psso: prepare backchannel browser #708

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
83acded
update url
BeryJu Mar 8, 2026
492b064
cleanup
BeryJu Mar 8, 2026
45f3d3a
specific implementation for macos and other :eyes:
BeryJu Mar 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 11 additions & 45 deletions ee/psso/PSSO/EnterpriseSSO.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,12 @@ import Bridge
extension AuthenticationViewController: ASAuthorizationProviderExtensionAuthorizationRequestHandler
{

static let ssoExtURLPath = "/endpoint/agent/apple_ssoext/"
static let queryChallenge = "challenge"
static let queryResponse = "response"
static let ssoExtURLPath = "/endpoints/agent/browser-backchannel/"
static let queryChallenge = "xak-agent-challenge"
static let queryResponse = "xak-agent-response"

private func shouldSkip(request: ASAuthorizationProviderExtensionAuthorizationRequest) -> Bool {
// if !(request.loginManager?.isDeviceRegistered ?? false)
// || !(request.loginManager?.isUserRegistered ?? false)
// {
// self.logger.info("SSOE: Skipping due to unregistered user or device")
// return true
// }
// We specifically don't check for PSSO registration status as this functionality doesn't require PSSO
let callerBundle = request.callerBundleIdentifier
if let exclusions = request.extensionData["ExcludedApps"] as? [String],
exclusions.contains(callerBundle)
Expand All @@ -26,21 +21,7 @@ extension AuthenticationViewController: ASAuthorizationProviderExtensionAuthoriz
self.logger.info("SSOE: No login manager, skipping")
return true
}
// guard let base = URL(string: config.BaseURL) else {
// self.logger.info("SSOE: Unable to parse base URL")
// return true
// }
// if request.url.scheme != base.scheme
// || request.url
// .host()
// != base
// .host()
// || !request.url.path().starts(with: base.path())
// {
// self.logger.info("SSOE: Skipping due to mismatching base URL")
// return true
// }
if request.url.valueOf(AuthenticationViewController.queryResponse) == nil {
if request.url.valueOf(AuthenticationViewController.queryResponse) != nil {
self.logger.info("SSOE: Skipping due to existing response")
return true
}
Expand All @@ -66,6 +47,12 @@ extension AuthenticationViewController: ASAuthorizationProviderExtensionAuthoriz
request.doNotHandle()
return
}
#if os(macOS)
return getSignedResponseMac(challenge: challenge, request: request)
#endif
}

public func getSignedResponseMac(challenge: String, request: ASAuthorizationProviderExtensionAuthorizationRequest) {
Task {
do {
let header = try await SysdBridge.shared.platformSignedEndpointHeader(
Expand All @@ -92,25 +79,4 @@ extension AuthenticationViewController: ASAuthorizationProviderExtensionAuthoriz
}
}
}

private func injectSession(
with request: ASAuthorizationProviderExtensionAuthorizationRequest
) -> Bool {
let sessionKey = request.loginManager?.ssoTokens?["session_key"]
if let sk = sessionKey as? String {
self.logger.debug("SSOE: Injecting session \(sk)")
let url = request.url.appending(queryItems: [URLQueryItem(name: "ak-ssoe", value: "1")])
let headers: [String: String] = [
"Location": url.absoluteString,
"Set-Cookie": "authentik_session=\(sk); Path=/; Secure; HttpOnly",
]
if let response = HTTPURLResponse.init(
url: request.url, statusCode: 302, httpVersion: nil, headerFields: headers)
{
request.complete(httpResponse: response, httpBody: nil)
return true
}
}
return false
}
}
Loading