Merge pull request #70 from zillow/master

modernize sample for Feb 2024

Author: noycematt

cli/utils/generator.py

@@ -5,7 +5,7 @@
     "AUTH_REQUEST": {
 	    "client_id": "$CLIENT_ID_FROM_IDP",
 	    "response_type": "code",
-	    "scope": "openid email",
+	    "scope": "openid email profile",
 	    "redirect_uri": "https://$CLOUDFRONT_DIST_URL/_callback"
 	},
 	"TOKEN_REQUEST": {
@@ -19,7 +19,7 @@
 	"PRIVATE_KEY": "$PRIVATE_KEY_GOES_HERE",
 	"PUBLIC_KEY": "$PUBLIC_KEY_GOES_HERE",
 	"DISCOVERY_DOCUMENT": "https://$IDP_DOMAIN_NAME/.well-known/openid-configuration",
-	"SESSION_DURATION": 30,
+	"SESSION_DURATION": 300,
 	"BASE_URL": "https://$IDP_DOMAIN_NAME/",
 	"CALLBACK_PATH": "/_callback",
 	"AUTHZ": "$IDP_NAME"
@@ -61,7 +61,7 @@ def generate_rendered_config_file(
         "AUTH_REQUEST": {
 	        "client_id": f"{client_id}",
 	        "response_type": "code",
-	        "scope": "openid email",
+	        "scope": "openid email profile",
 	        "redirect_uri": f"https://{cloudfront_host}/_callback"
 	    },
 	    "TOKEN_REQUEST": {
@@ -75,7 +75,7 @@ def generate_rendered_config_file(
 	    "PRIVATE_KEY": f"{openssl_private_key}",
 	    "PUBLIC_KEY": f"{openssl_public_key}",
 	    "DISCOVERY_DOCUMENT": f"https://{idp_domain_name}/.well-known/openid-configuration",
-	    "SESSION_DURATION": 30,
+	    "SESSION_DURATION": 300,
 	    "BASE_URL": f"https://{idp_domain_name}/",
 	    "CALLBACK_PATH": "/_callback",
 	    "AUTHZ": f"{idp_name}"

docs/baseconfiguration.md

@@ -14,11 +14,7 @@ The first step for deploying this solution is to create a dummy configuration pl
 
 ![Placeholder Secret](images/secretsmanager/sm-kv-pair.png)
 6. Select the appropriate `Encryption key` settings for your organization's needs. The default is to use the `aws/secretsmanager` key.
-7. Provide an appropriate `Secret name` - this is your choice - along with an appropriate `Description` and a set of `Tags` that make it easy to identify the Secret. For now, you can skip `Resource permissions` - you will come back to this later.
-
-![Secrets Manager Key Name](images/secretsmanager/sm-key-name.png)
-
-**NOTE:** This Secret Name should match the name found in the [src/js/sm-key.txt file](../src/js/sm-key.txt) as seen below and as mentioned above:
+7. Provide the `Secret name` - which is "cloudfront/DISTRIBUTION_ID", along with an appropriate `Description` and a set of `Tags` that make it easy to identify the Secret. For now, you can skip `Resource permissions` - you will come back to this later.
 
 ![Secrets Manager Key File](images/secretsmanager/sm-key-name-file.png)
 

docs/cloudfront.md

@@ -15,7 +15,8 @@ If there are issues, ensure that all IdP configurations are set up correctly, in
 
 ### AWS Secrets Manager Configuration
 
-Ensure that the `src/js/sm-key.txt` file is set up with the correct AWS Secrets Manager Secret name. Also, ensure that the Key-Value pair is set up correctly in AWS Secrets Manager including a Base64-encoded value that is the JSON configuration.
+Ensure that the correct AWS Secrets Manager Secret name in use which is "cloudfront/DISTRIBUTION_ID" Also, ensure that the Key-Value pair is set up correctly in AWS Secrets Manager including a Base64-encoded value that is the JSON configuration.
+
 
 ### AWS Secrets Manager Customer-Managed KMS Key Policy
 

src/js/auth.js

@@ -1,14 +1,15 @@
 // eslint-disable-next-line import/no-extraneous-dependencies
 // Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: MIT-0
-const AWS = require('aws-sdk');
+
+const { SecretsManager } = require('@aws-sdk/client-secrets-manager');
+
 const Axios = require('axios');
 const Cookie = require('cookie');
 const Crypto = require('crypto');
 const JsonWebToken = require('jsonwebtoken');
 const JwkToPem = require('jwk-to-pem');
 const QueryString = require('querystring');
-const fs = require('fs');
 const Log = require('./lib/log');
 const Base64Url = require('base64url');
 
@@ -33,12 +34,12 @@ let pkceCodeChallenge;
  * dependencies.  If this value is specified (as it will be in tests) then deps will be
  * overwritten with the specified dependencies.
  */
-exports.handle = async (event, ctx, cb, setDeps = setDependencies) => {
+exports.handler = async (event, ctx, cb, setDeps = setDependencies) => {
 	log = new Log(event, ctx);
 	// log.info('init lambda', { event: event });
 	deps = setDeps(deps);
 	try {
-		await prepareConfigGlobals();
+		await prepareConfigGlobals(event);
 		return await authenticate(event);
 	} catch (err) {
 		log.error(err.message, { event: event }, err);
@@ -53,7 +54,7 @@ function setDependencies(dependencies) {
 		// log.info('setting up dependencies');
 		return {
 			axios: Axios,
-			sm: new AWS.SecretsManager({ apiVersion: '2017-10-17', region: 'us-east-1' })
+			sm: new SecretsManager({ region: 'us-east-1' })
 		};
 	}
 	return dependencies;
@@ -233,26 +234,25 @@ function validateNonce(nonce, hash) {
 }
 
 // fetchConfigFromSecretsManager pulls the specified configuration from SecretsManager
-async function fetchConfigFromSecretsManager() {
+async function fetchConfigFromSecretsManager(evt) {
 	// Get Secrets Manager Config Key from File since we cannot use environment variables.
 	if (secretId == undefined) {
 		try {
-			secretId = fs.readFileSync('./sm-key.txt', 'utf-8');
-			secretId = secretId.replace(/(\r\n|\n|\r)/gm, '');
+			secretId = "cloudfront/" + evt.Records[0].cf.config.distributionId;
 		} catch (err) {
 			log.error(err);
 		}
-	} // Attempted to read from CloudFront Custom Header due to Environment variable limitations // Must be an Origin Request, but we need this to be a Viewer Request.
-	const secret = await deps.sm.getSecretValue({ SecretId: secretId }).promise(); // eslint-disable-next-line no-buffer-constructor
-	const buff = new Buffer(JSON.parse(secret.SecretString).config, 'base64');
+	}
+	const secret = await deps.sm.getSecretValue({ SecretId: secretId }); // eslint-disable-next-line no-buffer-constructor
+	const buff = Buffer.from(JSON.parse(secret.SecretString).config, 'base64');
 	const decodedval = JSON.parse(buff.toString('utf-8'));
 	return decodedval;
 }
 
 // setConfig sets the config object to the value from SecretsManager if it wasn't already set.
-async function setConfig() {
+async function setConfig(event) {
 	if (config === undefined) {
-		config = await fetchConfigFromSecretsManager();
+		config = await fetchConfigFromSecretsManager(event);
 	}
 
 	// set PKCE values if client_secret is not present in configurations
@@ -306,9 +306,9 @@ async function setPkceConfigs() {
 }
 
 // prepareConfigGlobals sets up all the lambda globals if they are not already set.
-async function prepareConfigGlobals() {
+async function prepareConfigGlobals(event) {
 	await setPkceConfigs();
-	await setConfig();
+	await setConfig(event);
 	await setDiscoveryDocument();
 	await setJwks();
 }
@@ -329,6 +329,7 @@ function getRedirectPayload({ evt, queryString, decodedToken, headers }) {
 							: queryString.state
 				}
 			],
+			'login': [ { key: 'login', value: decodedToken.payload.email } ],
 			'set-cookie': [
 				{
 					key: 'Set-Cookie',

src/js/sm-key.txt

@@ -95,8 +95,8 @@ Resources:
         Properties:
           CodeUri: src/js/
           Role: !GetAtt LambdaEdgeFunctionRole.Arn
-          Runtime: nodejs14.x
-          Handler: auth.handle
+          Runtime: nodejs20.x
+          Handler: auth.handler
           Timeout: 5
           AutoPublishAlias: LIVE
     LambdaEdgeFunctionRole: