SSO Authentication flow

[elisaado]

SOMToday has introduced a new way of authentication, and there are already several organisations that have enabled it and disabled username/password authentication. I found this out when #6 was opened.

I am afraid that it is not possible to retrieve tokens this way but I hope that there is still hope for us.

What I need:

• Either someone to provide me with a school, username and password of an account that can use SSO. (I understand that this is very sketchy) I will use them to analyse the requests made by the SOMToday app via a proxy, and will add the requests to this documentation.
• Or someone to provide me with the requests made by the app when using SSO.

I have created a gitter room for further informal discussion:
https://gitter.im/somtoday-api-docs/community

[ChielChiel]

I have recently tried to use a proxy to analyse the data requests made. However the SOMToday app and website, at least on iOS, do not allow custom certificates, which makes it impossible to see all of the networks requests and responses.

Do you know a quick fix that might be of help?

[elisaado]

Yeah the app uses certificate pinning, I know how this can be bypassed on android but not on iOS, the search term you need on Google is "disable certificate pinning iOS".

Thanks for wanting to help though :)

[ChielChiel]

How would the refresh token look like? Because it might be that the SSO login just returns a refresh token, from which the somtoday fetches the acces token for example. Or is that a crazy thought? Because today I came this far in intercepting the network requests made in the login process:

After login, the login.microsoftonline.com does the following get request:

GET https://somtoday.nl/oidc?code=0.ASEAv2TsGHBKb0OpDES5ibWnWpu4KK264sBLou9F0vkGQ7khAIk.AQABAAIAAAAm-06blBE1TpVMil8KPQ41w9B6RzkC9WfFOcRnPO-ZEoud6Ma5rn2WD0b4M8V-64aKic_fNgLbgdN-gS1aGNzQRWcrVG9socY61R4_Ii3pJLSKgDCAEDI57ShCUpfvuvgYuATrtt76zFwRodj--34G1w5hQxWdOXHrncMEWFG5qpU5MY84t1p3ECcVrlhFq9p9vUQbvn09DeVgSpFy4UYtqzLWZE1wR4VrWNknrZUA11xMP7FPHU32DHpJCwhfubY8J0vbKrNAtQg5FEKBOwV806dpLg9Z-ETdt8Riy4_gTm8iYfPJHboAL-yvjT4cIclWAgXAH7RsC1Z73rSajCx8q08SZikcQkd2BK_M1qA2LgjvJQSY47SorgXCOtZmKzp0MyiFkwY6rQJBBpgHvTfHInSRh1sXb_ljrMtAH9uTLxSwcUVwKuZSu_6SP17VPNFv4e86ez89fbVLkXw_bKvuzdubcDiIFRgyU5tFsznTHTZERv5IP3OPMgRjsZddHMEZ21sM80tIHESwUEZm_SV6Ddlx3P7fBz6L0Ea3oG1AZwog8_Kb1xlTmdyYguGkp6mIBXta7WFEFiRlXRZDIKot4ByVWlP9ME6upVahYZUL6xyCE2XpUr3hO3i7X1jLj5iy1LKVUkB1NEOS-ve1aYuoQ42YdlzEPyjt8tDmUFGKSyg4dMIbJ2EQy1U-w5EvxswMmJvWjvULxYDVJbu-Vgcg2N8FdZ307WPmvT8wtBNC7iA9FmaLCttVGu4I-pkpHg7MKw2jSTKVVnVzXqiui-zPUc9bxvFlUNTvQdfxAthDFSAA&state=tZCQGq72SYkbjckPjvgAcZZYnYGOCpSnIeTBKQphzQQ&session_state=3f5b0921-93d3-47e7-8f77-d5fae175580c HTTP/1.1

Which gives the following response

HTTP/1.1 302 Found
Date: Fri, 12 Jun 2020 19:59:33 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Frame-Options: SAMEORIGIN
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
X-Frame-Options: DENY
X-Frame-Options: DENY
Location: somtodayleerling://oauth:443/callback?code=eyJ6aXAiOiJERUYiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..VdR_CESqKlkK4Xzw.BZyamfT4hehkFmX1_JLux0cJNTtRQUWPRI4OLLKX20ZlNL4WzLW5ym9C7xCPcWSQaq6rwoqsD23AWggb7jN2QrjLelGJmEsuEovVXL0LKls1ypVC2xt51KGficjWjvPMZDZsm1yjtbGb-NeuXlHvz8kb9N0j7kG2FiuJs5H2fAZwomsAWNpDLFu4FpqnLJhbuUi6mMaLh8BC1z7af_Cd1QXrHs4iWuFdeu6D17MWLcpVEO0jweWJn_c7t6B0D02u5y9uO9e-rHMxmXDdbt_Klhvw04rvPSOUnvOkSB0tytXj-X6JlOThp7fQMjjZ83AXD0WY0uSnBftH9Q_zZDhQ4ImcX3qEHyB_jJAK-xatdwpQmblVZ56VSgcrLXYAfilBo31hPLkzPo3Vx9J7kV9TSDhGIKoTIf9xqUulRr0XRBnrxOTpRDx29HDEguLvgW-uwn8T1MIEeh85_NG2rPqIRqVoh0LDEUAEozDIkNgNe_7wYCFblVfxuDdDKUpXj6xHzNIG6EefdCBNu7f2wsnY0bu6z6cZOke8M2Uj3lnXTg5t42kWVOGminvheKGYTw5Lkd8LN0UAqudd1UQRAVCT4t62zMwgj4poHe10KN243S9zLfcGRQzhXmwbcyv8Xn6w7dSRPIQIAt2X-ARByp-EzojfY3jnbEnYjOz-6ERsXMu1e7fLWUAMtCb22ZvkRnkGRUAg5K2K8dqgUkWQoCTu8QYDTztjBDzE5HFC_DAcIMVWgXvIp0VIyQLBeumdUB562u6e0LkSWegbuAVAz59hFwshIXEFLXNKNbDkM0Zy_LLer3YpHFpNxeNvQ1VEPuGEPWC6HftjI68M3HWJ0Bh0vaaSzTJ5Ny6lp1xhrKCLYuFAHNX5FMktIembMNVyv_8Sm9K2oXhdvkClNE0LnEJNN9c54FIVFxDEEzh03D-tiqaYucAOjrdDZ20x0NnNGaBDflj3HSWOuGsCh_cz44xX3WbyCJiHWQ_LgJ6JrPD8-WXnLsH-iXBwuOqsRcFf29lC.AKx_1wrE1iOccXhutWeywQ
Content-Length: 0
Set-Cookie: authentication=; Path=/oidc; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:00 GMT
X-Robots-Tag: none
X-UA-Compatible: IE=Edge
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive

With somtodayleerling:// presumably being the target url of the app.

[elisaado]

That's very interesting, it could be the access token, a refresh token or an ID token.
Was this request made with the app or with the browser?

[ChielChiel]

Well, at least on iOS, in the app, it opens a safari webview in which the entire login process takes place. From this webview the somtodayleerling:// request is made.

[elisaado]

I see, I have found a new grant_type called authorization_code which is linked to this!

[elisaado]

When I try to use your code I get:

{
    "error_description": "Invalid grant: Token has expired",
    "error": "invalid_grant"
}

So I think the code you mentioned can actually be used to fetch an access_token

[elisaado]

I get the same request made on my android when I try to use our school's new SSO function, I will try to throttle the connection so I get to use the code myself.

[elisaado]

I think it will still be possible to authenticate even with SSO, but it will be very ugly (saving Set-Cookie headers, etc)

[elisaado]

The tenant cookie is just base64 of the school uuid :)
We only need to save JSESSIONID :)

[ChielChiel]

Wow great to see all these updates! Good work!

[elisaado]

This is the problem I'm having: everything is different for every school
the microsoft oauth service works very differently from the idpcluster of stichtingcarmelcollege

There is no easy way to fix this issue

[ChielChiel]

Right, i see. Btw wjat exactly do you mean with “idpcluster”?

Secondly, can’t we let the admin, who will use these api to log users in, specify some of the username and password field names, so you can post that data easily?

Not sure if possible, but most request libraries allow you to follow redirects and post data on the way.