changes uathentication from s3o to OKTA

Author: Sqyphen

README.md

@@ -14,7 +14,13 @@ $ npm install
 $ npm run start
 ```
 
-## Configure (via the .env file, or environment params)
+## .env 
+
+- Run `touch .env` to create the required **.env** file
+- Open your new **.env** file and add the following variables:
+
+
+### Configure (via the .env file, or environment params)
 
 ```
 ALLOWED_USERS=...          # a CSV of those who can see the extra goodies
@@ -32,4 +38,16 @@ AUDIO_RENDER_URL=...       # for generating the audio version of the translation
 AUDIO_RENDER_TOKEN=...     # ditto (lifted from the renderer's settings)
 LIMIT_TABLE=...            # table for checking api limits have not been breached
 API_CHAR_LIMITS=...        # JSON object with providers (lowerCase) as key and char limits as (Int) values
+PORT=...                   # 3010
+BASE_URL=...               # http://localhost:3010
+OKTA_CLIENT=...            # for OKTA authentication
+OKTA_ISSUER=...            # for OKTA authentication
+OKTA_SECRET=...            # for OKTA authentication
+SESSION_TOKEN=...          # for OKTA authentication
 ```
+
+#### Where to find OKTA .env vars
+
+- Get `SESSION_TOKEN` from LastPass
+- Get details for finding `OKTA_ISSUER`, `OKTA_CLIENT` & `OKTA_SECRET` in LastPass
+

bin/lib/utils/utils.js

@@ -1,18 +1,17 @@
-function getS3OUserFromCookie(cookies) {
+function getOKTAUserFromCookie(userinfo) {
 	let user = null;
 
-	const cookieList = cookies.split(';');
-
-	for(let i = 0; i < cookieList.length; ++i) {
-		let cookiePair = cookieList[i].replace(' ', '');
-		if(cookiePair.startsWith('s3o_username')) {
-			user = cookiePair.split('=')[1];
-		}
+	if(userinfo.hasOwnProperty('first_name')){
+		return `${userinfo.first_name}.${userinfo.last_name}`;
 	}
 
 	return user;
 }
 
+function getOktaUsername(userinfo) {
+	return `${userinfo.first_name}.${userinfo.last_name}`;
+}
+
 async function checkAndSplitText(text, limit, encoded = false) {
 	const stringLength = Buffer.byteLength(text, 'utf8');
 	const ratio = Math.ceil(stringLength/limit);
@@ -200,7 +199,7 @@ function configValidation(config, type, value, message) {
 }
 
 module.exports = {
-	extractUser: getS3OUserFromCookie,
+	extractUser: getOKTAUserFromCookie,
 	splitTextIntoChunks: checkAndSplitText,
 	pauseForMillis: pauseForMillis,
 	maybeAppendDot: maybeAppendDot,

index.js

@@ -1,13 +1,14 @@
 if (process.env.NODE_ENV !== 'production') require('dotenv').config();
 const Utils = require('./bin/lib/utils/utils');
-const s3o = require('@financial-times/s3o-middleware');
 const express = require('express');
 const path = require('path');
 const fs = require('fs');
 const bodyParser = require('body-parser');
 const app = express();
 const helmet = require('helmet');
 const express_enforces_ssl = require('express-enforces-ssl');
+const OktaMiddleware = require('@financial-times/okta-express-middleware');
+const session = require('cookie-session');
 const PORT = Utils.processEnv('PORT', {validateInteger: true, default: "2018"});
 const extract = require('./bin/lib/utils/extract-text');
 const hbs = require('hbs');
@@ -26,6 +27,14 @@ if (process.env.NODE_ENV === 'production') {
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({ extended: false }));
 
+const okta = new OktaMiddleware({
+	client_id: process.env.OKTA_CLIENT,
+	client_secret: process.env.OKTA_SECRET,
+	issuer: process.env.OKTA_ISSUER,
+	appBaseUrl: process.env.BASE_URL,
+	scope: 'openid offline_access'
+});
+
 const CAPI = require('./bin/lib/ft/capi').init(Utils.processEnv('FT_API_KEY'));
 const Translator = require('./bin/lib/translators/multi-translator');
 const Audio = require('./bin/lib/utils/get-audio');
@@ -73,6 +82,12 @@ app.use(function(req, res, next) {
 	next();
 });
 
+app.use(session({
+	secret: process.env.SESSION_TOKEN,
+	maxAge: 24 * 3600 * 1000, //24h
+	httpOnly: true
+}));
+
 app.post('/article/:uuid/:lang', (req, res, next) => {
 	res.uuid = req.params.uuid;
 	res.lang = req.params.lang;
@@ -302,10 +317,12 @@ app.get('/content/:uuid', (req,res) => {
 	res.render('content', data);
 });
 
-app.use(s3o);
+app.use(okta.router);
+app.use(okta.ensureAuthenticated());
+app.use(okta.verifyJwts());
 
 app.get('/', async (req, res) => {
-	const settings = await Translator.settings(Utils.extractUser(req.headers.cookie));
+	const settings = await Translator.settings(Utils.extractUser(req.userContext.userinfo));
 	return res.render('index', settings);
 });