platform(general): Implement SSO Relay State Parameter in Checkov Output Links #5217

SimOnPanw · 2023-06-15T13:48:14Z

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

This PR introduces an enhancement to the way Checkov generates output links. Previously, output links were generated and printed to the console without considering any specific state parameters required for Single Sign-On (SSO) procedures.

The code in this PR updates the _print_to_console method to incorporate a relay state parameter when generating output links. This is achieved through the implementation of a new method, get_sso_prismacloud_url, which calls the Prisma Cloud Platform API to get the necessary relay state from the SAML configuration. This state is then appended to the URL before it's printed to the console.

These changes ensure that the output links generated by Checkov are compatible with SSO procedures that rely on relay state parameters.

Before the merge, Checkov generate the report link without considering any specific relaystate parameters:

After the merge, Checkov will use the RelayState Parameter:

Please review and let me know if any changes are required.

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have added tests that prove my feature, policy, or fix is effective and works
New and existing tests pass locally with my changes
Any dependent changes have been merged and published in downstream modules

…smacloud

…SimOnPanw/checkov into feature/add-relaystate-from-prismacloud

…prismacloud_url function

gruebel

thanks for the contribution 💪 I added a couple of comments

checkov/common/runners/runner_registry.py

…smacloud

checkov/common/runners/runner_registry.py

gruebel · 2023-06-20T11:02:21Z

checkov/common/bridgecrew/platform_integration.py

+        if request.status == 401:
+            logging.error(f'Received 401 response from Prisma /login endpoint: {request.data.decode("utf8")}')
+            raise BridgecrewAuthError()
+        elif request.status == 403:
+            logging.error('Received 403 (Forbidden) response from Prisma /login endpoint')
+            raise BridgecrewAuthError()


@mikeurbanski1 any thoughts about raising an exception here or should we just log it and return the normal URL?

I like returning the normal URL. Then at least they can go to it after signing in separately.

@mikeurbanski1 @gruebel instead of raising an exception, I could return the normal URL as follow:

request = self.http.request("GET", url_saml_config, headers=headers, timeout=10) # type:ignore[no-untyped-call] if request.status >= 300: return report_url

With the problem that we don't trigger an exception if the BC_API_KEY is not provided. I am not sure this is better. What do you think ?

We won't get to this code if there is no BC_API_KEY though

@mikeurbanski1, of course, you are correct. I committed the change.

…tion

checkov/common/bridgecrew/platform_integration.py

Co-authored-by: Anton Grübel <[email protected]>

gruebel

nice, looks good from my side, just waiting for @mikeurbanski1 🙂

mikeurbanski1 · 2023-06-27T16:20:54Z

checkov/common/bridgecrew/platform_integration.py

@@ -572,7 +573,7 @@ def commit_repository(self, branch: str) -> str | None:
                                                                get_user_agent_header()
                                                                ))
                response = json.loads(request.data.decode("utf8"))
-                url: str = response.get("url", None)
+                url: str = self.get_sso_prismacloud_url(response.get("url", None))


@SimOnPanw what happens if SSO isn't configured?

Hello @mikeurbanski1, we will be returning the standard URL that directly points to the platform. To return the URL with RelayState parameter, you'll have to provide a prisma_api_url and ensure that your Prisma Cloud tenant is configured with both relay_state_param_name and access_saml_url.

Here is an example:

Hello @mikeurbanski1 and @gruebel, any news on this PR ?

But what does {bc_integration.prisma_api_url}/saml/config return if SSO is not configured? It looks like we are always going to try to get this, and throw an exception if it doesn't work, so I am worried that we won't fall back.

It returns a json with an empty fields for relayStateParamName and redLockAccessSamlUrl, even if a tenant has no SAML configuration.
I checked if there is any value return below in the code.

…put Links (bridgecrewio#5217) * add RelayState param from Prisma Cloud * fix flake8 issues * add the type of the input arguments and the return value for get_sso_prismacloud_url function * add exception handling and timeout to meet bandit requirements * fix flake8 * fix flake8 * move the get_sso_prismacloud_url function to platform_integration.py * call the function get_sso_prismacloud_url from commit_repository function * Update checkov/common/bridgecrew/platform_integration.py Co-authored-by: Anton Grübel <[email protected]> * Update checkov/common/bridgecrew/platform_integration.py Co-authored-by: Anton Grübel <[email protected]> * remove dot in front of type-ignore-no-untyped-call * return normal url if any errors * fix mypy issues --------- Co-authored-by: Anton Grübel <[email protected]>

SimOnPanw and others added 2 commits June 15, 2023 15:32

add RelayState param from Prisma Cloud

b8824ca

Merge branch 'bridgecrewio:main' into feature/add-relaystate-from-pri…

7ee1ab7

…smacloud

SimOnPanw temporarily deployed to scan-security June 15, 2023 13:48 — with GitHub Actions Inactive

SimOnPanw added 2 commits June 15, 2023 16:23

fix flake8 issues

8784004

Merge branch 'feature/add-relaystate-from-prismacloud' of github.com:…

75fa1f4

…SimOnPanw/checkov into feature/add-relaystate-from-prismacloud

SimOnPanw had a problem deploying to scan-security June 15, 2023 14:24 — with GitHub Actions Failure

add the type of the input arguments and the return value for get_sso_…

0742783

…prismacloud_url function

SimOnPanw temporarily deployed to scan-security June 15, 2023 14:34 — with GitHub Actions Inactive

add exception handling and timeout to meet bandit requirements

3770569

SimOnPanw had a problem deploying to scan-security June 15, 2023 15:38 — with GitHub Actions Failure

fix flake8

9cedfb3

SimOnPanw had a problem deploying to scan-security June 15, 2023 15:39 — with GitHub Actions Failure

Merge branch 'main' into feature/add-relaystate-from-prismacloud

4fe6670

SimOnPanw temporarily deployed to scan-security June 16, 2023 07:11 — with GitHub Actions Inactive

fix flake8

b100695

SimOnPanw had a problem deploying to scan-security June 16, 2023 09:40 — with GitHub Actions Failure

gruebel reviewed Jun 19, 2023

View reviewed changes

Merge branch 'bridgecrewio:main' into feature/add-relaystate-from-pri…

a711320

…smacloud

SimOnPanw had a problem deploying to scan-security June 20, 2023 07:08 — with GitHub Actions Failure

move the get_sso_prismacloud_url function to platform_integration.py

2360b62

SimOnPanw temporarily deployed to scan-security June 20, 2023 07:49 — with GitHub Actions Inactive

gruebel reviewed Jun 20, 2023

View reviewed changes

call the function get_sso_prismacloud_url from commit_repository func…

bcb528f

…tion

SimOnPanw temporarily deployed to scan-security June 20, 2023 13:31 — with GitHub Actions Inactive

gruebel reviewed Jun 20, 2023

View reviewed changes

checkov/common/bridgecrew/platform_integration.py Outdated Show resolved Hide resolved

checkov/common/bridgecrew/platform_integration.py Outdated Show resolved Hide resolved

Update checkov/common/bridgecrew/platform_integration.py

1f785e8

Co-authored-by: Anton Grübel <[email protected]>

SimOnPanw had a problem deploying to scan-security June 20, 2023 15:45 — with GitHub Actions Failure

Update checkov/common/bridgecrew/platform_integration.py

d2d306e

Co-authored-by: Anton Grübel <[email protected]>

SimOnPanw had a problem deploying to scan-security June 20, 2023 15:45 — with GitHub Actions Failure

remove dot in front of type-ignore-no-untyped-call

fa1bb6b

SimOnPanw temporarily deployed to scan-security June 20, 2023 15:59 — with GitHub Actions Inactive

gruebel approved these changes Jun 21, 2023

View reviewed changes

mikeurbanski1 reviewed Jun 27, 2023

View reviewed changes

return normal url if any errors

19d936c

SimOnPanw temporarily deployed to scan-security July 24, 2023 14:39 — with GitHub Actions Inactive

mikeurbanski1 approved these changes Jul 26, 2023

View reviewed changes

fix mypy issues

408aa70

gruebel temporarily deployed to scan-security July 27, 2023 13:02 — with GitHub Actions Inactive

gruebel merged commit fd38734 into bridgecrewio:main Jul 27, 2023
32 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

platform(general): Implement SSO Relay State Parameter in Checkov Output Links #5217

platform(general): Implement SSO Relay State Parameter in Checkov Output Links #5217

SimOnPanw commented Jun 15, 2023

gruebel left a comment

gruebel Jun 20, 2023

mikeurbanski1 Jun 27, 2023

SimOnPanw Jun 29, 2023

mikeurbanski1 Jul 24, 2023

SimOnPanw Jul 24, 2023

gruebel left a comment

mikeurbanski1 Jun 27, 2023

SimOnPanw Jun 28, 2023

SimOnPanw Jul 24, 2023

mikeurbanski1 Jul 24, 2023

SimOnPanw Jul 24, 2023

platform(general): Implement SSO Relay State Parameter in Checkov Output Links #5217

platform(general): Implement SSO Relay State Parameter in Checkov Output Links #5217

Conversation

SimOnPanw commented Jun 15, 2023

Description

Checklist:

gruebel left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gruebel left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment