OAuth Example Two - Okta OpenID Connect Integration

import base64
from pathlib import Path

import requests
from maltego_trx.entities import Phrase
from maltego_trx.maltego import UIM_TYPES
from maltego_trx.oauth import MaltegoOauth
from maltego_trx.transform import DiscoverableTransform


class OktaOpenID(DiscoverableTransform):
    """
    Decrypts Okta Access Token and check if it is valid and verifies if a user belongs to free or paid groups
    """

    @classmethod
    def create_entities(cls, request, response):
        # variables for making a POST verification api call to OKTA
        introspect_url = "https://dev-<name>.okta.com/oauth2/default/v1/introspect?token="
        client_id = "<ID>"
        client_secret = "<SECRET>"
        payload = {}
        headers = {'Content-Type': 'application/x-www-form-urlencoded'}
        b64_auth_bytes = base64.b64encode(
            (client_id + ":" + client_secret).encode("utf-8"))
        b64_encoded_auth = str(b64_auth_bytes, "utf-8")

        try:
            # get the encrypted token from the client, this is the Access Token Variable Name set in the iTDS
            encrypted_secrets = request.getTransformSetting(
                'maltego.web.api.key.okta')
            private_key_path = Path("private_key.pem").resolve()
            token_fields = MaltegoOauth.decrypt_secrets(private_key_path,
                                                        encrypted_secrets)
            token = token_fields['token']
            token_verification_url = introspect_url + token + "&token_type_hint=access_token"
            headers['Authorization'] = 'Basic ' + b64_encoded_auth
            result = requests.request("POST", token_verification_url,
                                      headers=headers,
                                      data=payload)
            """ The following output is how the response from Okta looks like
                 {
                        "active": true,
                        "scope": "openid",
                        "username": "example@maltego.com",
                        "exp": 1596735524,
                        "iat": 1596731924,
                        "sub": "tm@maltego.com",
                        "aud": "api://default",
                        "iss": "https://dev-<name>.okta.com/oauth2/default",
                        "jti": "JWT",
                        "token_type": "Bearer",
                        "client_id": "ID",
                        "uid": "UID",
                        "groups": [
                            "Everyone",
                            "paid"
                        ]
                    }
                """
            active = result.json()['active']
            if (active):
                cls.checkUserType(result.json(), response)
            else:
                response.addUIMessage("Token Expired please login again",
                                      UIM_TYPES["partial"])
        except Exception as e:
            response.addUIMessage("Error" + str(e),
                                  UIM_TYPES["partial"])

    @classmethod
    def checkUserType(cls, token_payload, response):
        groups = token_payload['groups']
        print(groups)
        if "paid" in groups:
            text = "free user: " + str(token_payload)
            paid_response = response.addEntity(Phrase, text)
        elif "free" in groups:
            text = "free user: " + str(token_payload)
            free_response = response.addEntity(Phrase, text)
        else:
            text = "unknown user group"
            unknown_response = response.addEntity(Phrase, text)

8.5.1 Create file : okta_openid_project /private key.pem

    Add the contents of the private key to this PEM file. It is possible to just upload/save the actual PEM file to this location if

    you have it as a PEM file.

8.6 Navigate to okta_openid_project /

8.7 Run the maltego-trx project with:

(oauth-venv)python project.py runserver

If all went well, you should see something like this:

8.8 Deploy the entire project folder / okta_openid_project to a remote VPS/VM/Dockerized environment. 

More details on how to deploy for production can be found here for standard web deployment and here for Docker containerized deployment. The simplest method for this tutorial is to upload the folder to a remote server through git or ftp.

8.9 Navigating to your VPS IP http://<ip-address>/run/oktaopenid in a browser you should the following output. If it doesn’t not work check that you have opened the necessary, port on the firewall.

9. Configure Seed and pair with Transform

Now that we have our Transform up and running, we need to create a Seed to distribute the Transform. The TDS will generate a random alphanumeric Seed name for you, but you can also use one of your choosing.

10.1 Add Transform and OAuth Settings to Seed.

Next, we need to add the Transform, we also add the OAuth setting and the Input Entity and Seed.

10.2 Install Seed in the Maltego Client

After we have added the Transform, we can now install our Seed in Maltego.

10.3 Verify the OAuth Settings in the Service Manager

We can view the OAuth Authenticator settings in the Service Manager by selecting the Manage Services options in the Transforms menu. Cross-check that the protocol set in step 2.3 is the same as those shown here. The settings the Service Manager correspond should correspond to the callback URL set in the provider Application.

10.4 Run the Transform

Drag a Phrase Entity onto an empty graph, right click and run the Transform.

Upon running the Transform, a prompt will appear asking you to sign in to use the Transform. Click Sign In. A browser page will be opened with the URL http://127.0.0.1:63141/signin. We are redirected to the Okta login page, please note you might observe a warning sign in the browser, ignore it and proceed.

The application we created will accept logins from the users registered with Okta and added to the application we created earlier. In an organizational setup the privileges will be set by the admin.

Following successful login, a user can now make a query and the Transform will check if they are allowed to run the Transform. Our example Transform checks the group a user belongs to. E.g. when a user in the free group logs in, they would only receive the details applicable to free users.

When the token expires, a warning message will appear informing the user that they are required to sign in again.