Module sso 

Login with single sign-on: enroll this device with the approval of an enrolled one, then sign in with the credentials it hands over.

Modules

cpace 🔒

The CPace exchange that hands the credentials of an enrolled device to a new one, reverse engineered from 1Password’s WASM module: the local crypto, and the requests that carry it.

enrollment 🔒

Enrolling this device as a trusted one: ask the server to start an enrollment, wait for the user to approve it on an enrolled device, then take the credentials that device shares.

ui

Public callback contracts the SSO login flow drives.

Structs

SsoAccount 🔒

What an SSO login needs from the login info of the account.

Timing 🔒

The timing knobs of the SSO network flows, grouped so the tests can shrink them.

Constants

DEVICE_NOT_ENROLLED 🔒

SSO_START_ENDPOINT 🔒

SSO_VERIFY_ENDPOINT 🔒

Functions

complete_auth 🔒

has_allowed_scheme 🔒

Requests to a server supplied URL carry credentials and the user opens one in a browser, so only https will do. The fake servers of the tests have no TLS, hence http under test.

is_redirect_uri 🔒

The identity provider sends the user back here. For the desktop client 1Password picks its own app scheme, onepassword://, which the UI catches before anything opens it.

is_web_url 🔒

login 🔒

Signs in with the sign-in token the SSO login earned, proving knowledge of the SRP x from the credential bundle. Returns the session key and a client that signs its requests with it.

non_empty 🔒

perform_sso_login 🔒

Has the user log in with the identity provider, and returns the authorization code and the state it redirects back with.

require_sso 🔒

Checks that the account signs in with SSO and that its login info says who the user is and where the SSO endpoints are.

sso_login 🔒

Signs in with single sign-on. Returns the signed session and the account unlock key that opens the account’s keysets.

start_auth 🔒

start_sso_login 🔒

Asks for the URL of the identity provider login.

url_parameter 🔒

The form-decoded value of the first parameter called name in the query or the fragment of url, as OAuth encodes the redirect. A missing or empty value is None.

validate_sign_in_address 🔒

The server picks this address and every SSO request goes to it, so it has to be a plain https address the API path can be appended to. The address is not echoed in the error: it can carry credentials.

verify_sso_login 🔒

Exchanges the authorization code for an SSO session.