Implement a nonce

Add a cryptographic nonce to the authentication header to ensure that it can only be used once.

• Create a system property called glide.authenticate.header.nonce_key and set its value to whatever variable name you're using for the nonce, such as NONCE or NCE.
• Create a new table called u_authentication_nonce. Add a field to the table called u_nonce.
• Go to System Properties > Installation Exits and create an item called DigestSingleSignOnNonce which overrides ExternalAuthentication (glide.authenticate.external_property).
• Add the following code to the script portion of the newly created DigestSingleSignOnNonce.

  
  gs.include("PrototypeServer");
  
  var DigestSingleSignOnNonce = Class.create();
  DigestSingleSignOnNonce.prototype = {
  	
  	process : function() {
  		
  		var headerKey = GlideProperties.get("glide.authenticate.header.key", "SM_USER");
  		var headerDigestKey = GlideProperties.get("glide.authenticate.header.encrypted_key", "DIGEST");
  		var headerNonceKey = GlideProperties.get("glide.authenticate.header.nonce_key", "NCE");
  		var fieldName = GlideProperties.get("glide.authenticate.header.value", "user_name");
  		var fkey = GlideProperties.get("glide.authenticate.secret_key");
  		
  		// Look in the Headers
  		var data = request.getHeader(headerKey);
  		var encdata = request.getHeader(headerDigestKey);
  		var nonce = request.getHeader(headerNonceKey);
  		
  		// If not, then check the URL Parameters
  		if (data == null || encdata == null || nonce == null) {
  			data = request.getParameter(headerKey);
  			encdata = request.getParameter(headerDigestKey);
  			nonce = request.getParameter(headerNonceKey);
  		}
  		
  		// then maybe its a cookie
  		if (data == null || encdata == null || nonce == null) {
  			var cookies = request.getCookies();
  			data = GlideCookieMan.getCookieValue(cookies, headerKey);
  			encdata = GlideCookieMan.getCookieValue(cookies, headerDigestKey);
  			nonce = GlideCookieMan.getCookieValue(cookies, headerNonceKey);
  		}
  		
  		// if found run encryption
  		if (data != null && encdata != null && nonce != null) {
  			try {
  				
  				// Replace all spaces with plus(+)'s, converted in url
  				encdata = encdata.replaceAll(' ', '+');
  				
  				// ----- Encrypt the username|nonce
  				var key = this.getDigest( data + "|" + nonce, fkey);
  				
  				// Check for match of received encoded data
  				// and your encoding of user name
  				if (encdata == key) {
  					var ugr = new GlideRecord("sys_user");
  					ugr.initialize();
  					if (!ugr.isValidField(fieldName)) {
  						GlideLog.warn("External authorization is set to use field: '"+ fieldName + "' which doesn't exist");
  						return "failed_missing_requirement";
  					}
  					ugr.addQuery(fieldName, data);
  					ugr.query();
  					if (!ugr.next()) {
  						var userLoad = GlideUser.getUser(data);
  						if (userLoad == null)
  							return "failed_authentication";
  						
  						ugr.initialize();
  						ugr.addQuery(fieldName, data);
  						ugr.query();
  						if (!ugr.next())
  							return "failed_authentication";
  						
  					}
  					
  					if (this.processNonce(nonce)){
  						var userName = ugr.getValue("user_name");
  						return userName;
  					}
  					else return "failed_missing_requirement";
  					}
  				else {
  					
  					return "failed_authentication";
  				}
  			} catch(e) {
  				gs.log(e);
  				return "failed_authentication";
  			}
  			// Encoded data didn't match recieved Encoded data
  		} else {
  			
  			return "failed_missing_requirement";
  		}
  	},
  	
  	getDigest : function( data, fkey ) {
  		try {
  			// default to something JDK 1.4 has
  			var MAC_ALG = "HmacSHA1";
  			return SncAuthentication.encode(data, fkey, MAC_ALG);
  			
  		} catch (e) {
  			gs.log(e.toString());
  			throw 'failed_missing_requirement';
  		}
  	} ,
  	
  	processNonce : function( sentNonce ) {
  		var ngr = new GlideRecord("u_authentication_nonce");
  		
  		ngr.addQuery("u_nonce", sentNonce);
  		ngr.query();
  		if (ngr.next()) {
  			gs.log("This SSO entry has already been processed! (Nonce: " + sentNonce + ")");
  			return false;
  		}
  		var ngrNew = new GlideRecord("u_authentication_nonce");
  		ngrNew.initialize();
  		ngrNew.u_nonce = sentNonce;
  		ngrNew.insert();
  		gs.log("Inserted new nonce: " + sentNonce);
  		return true;
  	}
  };      
       

• Once you've saved your new installation exit, go to the DigestSingleSignOn installation exit and make sure that it is set Active=false.

Your instance should now be configured to implement a nonce.