|
| 1 | +# OWASP Juice Shop [](https://owasp.org/projects/) [](https://github.com/OWASP/SSO_Project/releases/latest) [](https://reddit.com/r/owasp_sso) |
| 2 | + |
| 3 | +OWASP SSO is a javascript application that allows a secure-by-default self-hosted SSO experience, |
| 4 | +including phishing-proof two-factor authentication, using state-of-the-art security mechanisms. |
| 5 | + |
| 6 | +For a detailed introduction, full list of features and architecture |
| 7 | +overview please visit the official project page: |
| 8 | +<https://owasp.org/www-project-sso/> |
| 9 | + |
| 10 | +### From Sources  |
| 11 | + |
| 12 | +1. Install [node.js](#nodejs-version-compatibility) |
| 13 | +2. Run `git clone https://github.com/OWASP/SSO_Project.git` (or |
| 14 | + clone [your own fork](https://github.com/OWASP/SSO_Project/fork) |
| 15 | + of the repository) |
| 16 | + |
| 17 | +#### Set up backend |
| 18 | + |
| 19 | +1. Go into the cloned folder with `cd SSO_Project` |
| 20 | +2. Go into the backend folder with `cd js-backend` folder |
| 21 | +3. Run `npm install` to set it up the first time |
| 22 | +4. Edit the `.env` file and set all mandatory environment variables, especially your MariaDB database and SMTP server. |
| 23 | +You can use your email account like [Gmail](https://www.hostinger.com/tutorials/how-to-use-free-google-smtp-server) for testing. |
| 24 | +5. If you are on an operating system without the bash shell, you need to install it and add it to the PATH. |
| 25 | +For Windows, install [Git](https://git-scm.com/download/win) and add the `bash.exe` to your PATH environment variable. |
| 26 | +You will need to restart the command line in such case |
| 27 | +6. Generate certificates by running `bash scripts/setup.bash "OWASP SSO"`. For Windows, use `\` instead of `/` and you can put another name instead of `OWASP SSO` for branding |
| 28 | +7. Run `npm run serve` to run the backend - it is now available at <https://localhost:3000> |
| 29 | +8. Visit the page once to accept the certificate warning in your browser |
| 30 | + |
| 31 | +#### Set up frontend |
| 32 | + |
| 33 | +1. Open a new console and go into the cloned folder with `SSO_Project` |
| 34 | +2. Go into the frontend folder with `cd vue-ui` folder |
| 35 | +3. Run `npm install` to set it up the first time |
| 36 | +4. Run `npm run serve` to start a development server |
| 37 | +5. Open <https://localhost:8080> in your browser to use the application |
| 38 | + |
| 39 | +### Docker Container |
| 40 | + |
| 41 | +You can use the `docker-compose.yml` file to start a production-ready environment via `docker-compose up --build`. |
| 42 | + |
| 43 | +In the future, all components will be available to be directly pulled from the registry. |
| 44 | + |
| 45 | +## Customization |
| 46 | + |
| 47 | +Most changes to the application can be done by modifying the `.env` files or providing environment variables to the components, |
| 48 | +as existing environment variables are not overwritten. |
| 49 | + |
| 50 | +In `js-backend/websites.json` you can configure your own websites for SSO. |
| 51 | +Below you find a sample configuration. |
| 52 | + |
| 53 | +```json |
| 54 | +{ |
| 55 | + "1": { // ID of the website |
| 56 | + "jwt": "hello-world", // JWT secret for authentication flow |
| 57 | + "signedRequestsOnly": false, // If set to true, only signed login requests are allowed |
| 58 | + "name": "E Corp", // Short name of the company |
| 59 | + "redirect": "https://postman-echo.com/post", // URL to redirect to |
| 60 | + "branding": { // Allows branding the login page |
| 61 | + "backgroundColor": "#fff", // Page background color |
| 62 | + "fontColor": "#254799", // Color of the text below the login box |
| 63 | + "legalName": "E Corp", // Legal name displayed below the login box |
| 64 | + "privacyPolicy": "https://www.nbcuniversal.com/privacy", // Link to privacy policy, mandatory |
| 65 | + "imprint": "https://www.e-corp-usa.com/about.html", // Link to legal imprint, optional |
| 66 | + "logo": "https://www.e-corp-usa.com/images/e-corp-logo-blue.png" // Link to logo |
| 67 | + }, |
| 68 | + "certificates": [{ // Allow external certificate authorities, optional |
| 69 | + "authorities": ["e-corp.ca.pem"], // List of CA files in js-backend/keys/ca folder to be used for this webhook |
| 70 | + "webhook": { // Webhook settings. If not set, matching with a custom CA passes authentication |
| 71 | + "url": "https://postman-echo.com/post", // URL for the server to contact for verification |
| 72 | + "successContains": "94:0B:DE:AD:BB:80:10:BD:17:C1:48:B4:5A:B2:66:3C:B5:75:DE:7B:89:37:65:D3:60:FF:B0:09:26:27:B2:91", // If the webhook return contains this text, pass the check |
| 73 | + "successRegex": "/test/" // If the webhook return matches this regex, pass the check |
| 74 | + } |
| 75 | + }] |
| 76 | + } |
| 77 | +} |
| 78 | +``` |
| 79 | + |
| 80 | +## Login flow |
| 81 | + |
| 82 | +The OWASP SSO supports two login flows. |
| 83 | + |
| 84 | +### SAML flow |
| 85 | + |
| 86 | +Simply redirect the user using SAML GET/POST parameters to `https://example.com/#/in/saml`. |
| 87 | +You need to provide a `destination` parameter. This host will be matched against the host of websites `redirect` parameter. |
| 88 | +If one is found, this branding will be used and the user will be on checkout redirected to the URL you specified in the `destination` parameter. |
| 89 | + |
| 90 | +### JWT flow |
| 91 | + |
| 92 | +The JWT flow is intended to allow both a simple integration and advanced use cases. |
| 93 | + |
| 94 | +For an unauthenticated JWT login request, the user can simply be redirected to `https://example.com/#/in/1`, where `1` is a placeholder for the website ID. |
| 95 | +This is the easiest way to integrate OWASP SSO into a custom application. |
| 96 | + |
| 97 | +For an authenticated JWT login request, you need to create a JWT token using the shared JWT secret. |
| 98 | +The token has the following requirements: |
| 99 | + |
| 100 | +1. Maximum validity of five minutes |
| 101 | +2. Audience needs to match the hostname of the deployed SSO page |
| 102 | +3. Issuer needs to match the configured pages shortname |
| 103 | + |
| 104 | +If you specify an email address as `Subject`, the user will be automatically logged in (missing the second factor) with this address. |
| 105 | +If no user with this email address exists, it will be registered. |
| 106 | + |
| 107 | +The authenticated user flow is intended for cases where you want to manage users internally and only delegate for MFA requests to OWASP SSO. |
| 108 | + |
| 109 | +In both cases, the user will be redirected to the configured `redirect` URL with a short-lived JWT token. |
| 110 | + |
| 111 | +## Demo |
| 112 | + |
| 113 | +A demo will be provided in the future. |
| 114 | + |
| 115 | +> This is a deployment-test and sneak-peek instance only! You are __not |
| 116 | +> supposed__ to use this instance for your own hacking endeavours! No |
| 117 | +> guaranteed uptime! Guaranteed stern looks if you break it! |
| 118 | +
|
| 119 | +## Node.js version compatibility |
| 120 | + |
| 121 | + |
| 122 | + |
| 123 | + |
| 124 | +OWASP SSO officially supports the [node.js](http://nodejs.org) in line with the |
| 125 | +official [node.js LTS schedule](https://github.com/nodejs/LTS). |
| 126 | +Docker images and packaged distributions are offered accordingly. |
| 127 | + |
| 128 | +## Troubleshooting [](https://reddit.com/r/owasp_sso) |
| 129 | + |
| 130 | +If you need support to set up the application or customize it for you needs, |
| 131 | +please post your specific problem and question in the [subreddit](https://reddit.com/r/owasp_sso) |
| 132 | +where community members can best try to help you. |
| 133 | + |
| 134 | +:stop_sign: **Please avoid opening GitHub issues for support requests or |
| 135 | +questions!** |
| 136 | + |
| 137 | +## Contributing [](https://github.com/OWASP/SSO_Project/graphs/contributors)   |
| 138 | + |
| 139 | +We are always happy to get new contributors on board! Please check |
| 140 | +[CONTRIBUTING.md](CONTRIBUTING.md) to learn how to |
| 141 | +[contribute to our codebase](CONTRIBUTING.md#code-contributions) or the |
| 142 | +[translation into different languages](CONTRIBUTING.md#i18n-contributions)! |
| 143 | + |
| 144 | +## References |
| 145 | + |
| 146 | +Did you write a blog post, magazine article or do a podcast about or |
| 147 | +mentioning OWASP Single Sign-On? Or maybe you held or joined a conference |
| 148 | +talk or meetup session, a hacking workshop or public training where this |
| 149 | +project was mentioned? |
| 150 | + |
| 151 | +Add it to our ever-growing list of [REFERENCES.md](REFERENCES.md) by |
| 152 | +forking and opening a Pull Request! |
| 153 | + |
| 154 | +## Donations [](https://owasp.org/donate?reponame=www-project-sso&title=OWASP+Single+Sign-On) |
| 155 | + |
| 156 | +The OWASP Foundation gratefully accepts donations via Stripe. Projects |
| 157 | +such as Juice Shop can then request reimbursement for expenses from the |
| 158 | +Foundation. If you'd like to express your support of the Juice Shop |
| 159 | +project, please make sure to tick the "Publicly list me as a supporter |
| 160 | +of OWASP SSO" checkbox on the donation form. You can find our |
| 161 | +more about donations and how they are used [here](https://owasp.org/donate/?reponame=www-project-sso&title=OWASP+Single+Sign-On). |
| 162 | + |
| 163 | +## Contributors |
| 164 | + |
| 165 | +The OWASP Juice Shop core project team are: |
| 166 | + |
| 167 | +- [@JamesCullum](https://github.com/JamesCullum) |
| 168 | + |
| 169 | +For a list of all contributors to the OWASP SSO please visit our |
| 170 | +[Contributor list](https://github.com/OWASP/SSO_Project/graphs/contributors). |
| 171 | + |
| 172 | +All special mentions are included in the application at `/#/about`. |
| 173 | + |
| 174 | +## Licensing [](https://github.com/OWASP/SSO_Project/blob/master/LICENSE) |
| 175 | + |
| 176 | +This program is free software: You can redistribute it and/or modify it |
| 177 | +under the terms of the |
| 178 | +[GPL License](https://github.com/OWASP/SSO_Project/blob/master/LICENSE). |
0 commit comments