Added on-prem IDM Deployment type

src/api/AuthenticateApi.test.ts

@@ -116,4 +116,31 @@ describe('AuthenticateApi', () => {
       expect(response2).toMatchSnapshot();
     });
   });
+
+  describe('authenticateIdm()', () => {
+    test('0: Method is implemented', async () => {
+      expect(AuthenticateApi.step).toBeDefined();
+    });
+
+    test('1: On-prem IDM authentication', async () => {
+      state.setHost(
+        process.env.FRODO_HOST || 'http://openidm-frodo-dev.classic.com:9080/openidm'
+      );
+      state.setUsername(process.env.FRODO_USERNAME || 'openidm-admin');
+      state.setPassword(process.env.FRODO_PASSWORD || 'openidm-admin');
+      const config = {
+        headers: {
+          'X-OpenIDM-Username': state.getUsername(),
+          'X-OpenIDM-Password': state.getPassword(),
+        },
+      };
+      const response1 = await AuthenticateApi.authenticateIdm({
+        body: {},
+        config,
+        state,
+      });
+      expect(response1.authorization.authLogin).toBeTruthy();
+      expect(response1).toMatchSnapshot();
+    });
+  });
 });

src/api/AuthenticateApi.ts

@@ -1,8 +1,9 @@
 import util from 'util';
 
 import { State } from '../shared/State';
+import { debugMessage } from '../utils/Console';
 import { getRealmPath } from '../utils/ForgeRockUtils';
-import { generateAmApi } from './BaseApi';
+import { generateAmApi, generateIdmApi } from './BaseApi';
 
 const authenticateUrlTemplate = '%s/json%s/authenticate';
 const authenticateWithServiceUrlTemplate = `${authenticateUrlTemplate}?authIndexType=service&authIndexValue=%s`;
@@ -73,3 +74,31 @@ export async function step({
   }).post(urlString, body, config);
   return data;
 }
+
+/**
+ *
+ * @param {any} body POST request body
+ * @param {any} config request config
+ * @returns Promise resolving to the authentication service response
+ */
+export async function authenticateIdm({
+  body = {},
+  config = {},
+  state,
+}: {
+  body?: object;
+  config?: object;
+  realm?: string;
+  service?: string;
+  state: State;
+}): Promise<any> {
+  debugMessage({
+    message: `AuthenticateApi.authenticateIdm: function start `,
+    state,
+  });
+  const urlString = `${state.getHost()}/authentication?_action=login`;
+  const { data } = await generateIdmApi({
+    state,
+  }).post(urlString, body, config);
+  return data;
+}

src/api/BaseApi.ts

@@ -312,6 +312,10 @@ export function generateIdmApi({
         ...(state.getBearerToken() && {
           Authorization: `Bearer ${state.getBearerToken()}`,
         }),
+        ...(!state.getBearerToken() && {
+          'X-OpenIDM-Username': state.getUsername(),
+          'X-OpenIDM-Password': state.getPassword(),
+        }),
       },
       httpAgent: getHttpAgent(),
       httpsAgent: getHttpsAgent(state.getAllowInsecureConnection()),

src/ops/AuthenticateOps.ts

@@ -2,7 +2,7 @@ import { createHash, randomBytes } from 'crypto';
 import url from 'url';
 import { v4 } from 'uuid';
 
-import { step } from '../api/AuthenticateApi';
+import { authenticateIdm, step } from '../api/AuthenticateApi';
 import { getServerInfo, getServerVersionInfo } from '../api/ServerInfoApi';
 import Constants from '../shared/Constants';
 import { State } from '../shared/State';
@@ -155,12 +155,23 @@ let adminClientId = fidcClientId;
  * @returns {string} cookie name
  */
 async function determineCookieName(state: State): Promise<string> {
-  const data = await getServerInfo({ state });
+  let cookieName = null;
+  try {
+    const data = await getServerInfo({ state });
+    cookieName = data.cookieName;
+  } catch (e) {
+    if (
+      e.response?.status !== 401 ||
+      e.response?.data.message !== 'Access Denied'
+    ) {
+      throw e;
+    }
+  }
   debugMessage({
-    message: `AuthenticateOps.determineCookieName: cookieName=${data.cookieName}`,
+    message: `AuthenticateOps.determineCookieName: cookieName=${cookieName}`,
     state,
   });
-  return data.cookieName;
+  return cookieName;
 }
 
 /**
@@ -335,6 +346,7 @@ async function determineDeploymentType(state: State): Promise<string> {
       return deploymentType;
 
     case Constants.CLASSIC_DEPLOYMENT_TYPE_KEY:
+    case Constants.IDM_DEPLOYMENT_TYPE_KEY:
       debugMessage({
         message: `AuthenticateOps.determineDeploymentType: end [type=${deploymentType}]`,
         state,
@@ -409,10 +421,45 @@ async function determineDeploymentType(state: State): Promise<string> {
               });
               deploymentType = Constants.FORGEOPS_DEPLOYMENT_TYPE_KEY;
             } else {
-              verboseMessage({
-                message: `Classic deployment`['brightCyan'] + ` detected.`,
-                state,
-              });
+              try {
+                const idmresponse = await authenticateIdm({
+                  body: {},
+                  config: {},
+                  state,
+                });
+                if (
+                  idmresponse.authorization.authLogin
+                ) {
+                  verboseMessage({
+                    message:
+                      `Ping Identity IDM deployment`['brightCyan'] +
+                      ` detected.`,
+                    state,
+                  });
+                  deploymentType = Constants.IDM_DEPLOYMENT_TYPE_KEY;
+                } else {
+                  verboseMessage({
+                    message: `Classic deployment`['brightCyan'] + ` detected.`,
+                    state,
+                  });
+                }
+              } catch (e: any) {
+                if (
+                  e.response?.status !== 401 ||
+                  e.response?.data.message !== 'Access Denied'
+                ) {
+                  debugMessage({
+                    message: `AuthenticateOps: 401 Unauthorized received – credentials may be invalid but IDM deployment is still possible.`,
+                    state,
+                  });
+                  throw e;
+                } else {
+                  verboseMessage({
+                    message: `Classic deployment`['brightCyan'] + ` detected.`,
+                    state,
+                  });
+                }
+              }
             }
           }
         }
@@ -471,7 +518,18 @@ async function getFreshUserSessionToken({
       'X-OpenAM-Password': state.getPassword(),
     },
   };
-  let response = await step({ body: {}, config, state });
+  let response;
+  try {
+    response = await step({ body: {}, config, state });
+  } catch (e) {
+    if (
+      e.response?.status !== 401 ||
+      e.response?.data.message !== 'Access Denied'
+    ) {
+      throw e;
+    }
+    return null;
+  }
 
   let skip2FA = null;
   let steps = 0;
@@ -553,6 +611,7 @@ async function getUserSessionToken(
       otpCallbackHandler: otpCallback,
       state,
     });
+    if (!token) return null;
     token.from_cache = false;
     debugMessage({
       message: `AuthenticateOps.getUserSessionToken: fresh`,
@@ -940,6 +999,7 @@ async function determineDeploymentTypeAndDefaultRealmAndVersion(
     state,
   });
   state.setDeploymentType(await determineDeploymentType(state));
+  if (state.getDeploymentType() === Constants.IDM_DEPLOYMENT_TYPE_KEY) return;
   determineDefaultRealm(state);
   debugMessage({
     message: `AuthenticateOps.determineDeploymentTypeAndDefaultRealmAndVersion: realm=${state.getRealm()}, type=${state.getDeploymentType()}`,
@@ -1162,7 +1222,7 @@ export async function getTokens({
       });
       const token = await getUserSessionToken(callbackHandler, state);
       if (token) state.setUserSessionTokenMeta(token);
-      if (usingConnectionProfile && !token.from_cache) {
+      if (usingConnectionProfile && (!token || !token.from_cache)) {
         saveConnectionProfile({ host: state.getHost(), state });
       }
       await determineDeploymentTypeAndDefaultRealmAndVersion(state);
@@ -1191,6 +1251,14 @@ export async function getTokens({
     else {
       throw new FrodoError(`Incomplete or no credentials`);
     }
+    // Return IDM tokens for IDM deployment type
+    if (state.getDeploymentType() === Constants.IDM_DEPLOYMENT_TYPE_KEY) {
+      return {
+        subject: state.getUsername(),
+        host: state.getHost(),
+        realm: state.getRealm() ? state.getRealm() : 'root',
+      };
+    }
     if (
       state.getCookieValue() ||
       (state.getUseBearerTokenForAmApis() && state.getBearerToken())