Merge pull request #2676 from overleaf/ew-check-sso-cert-expirations

show expiration data and throw on date errors when loading certs

GitOrigin-RevId: d81c96c722f0ce20352f2ef9a346b6d9bfa028d1

services/web/scripts/ukamf/metadata-processor.js

@@ -3,12 +3,17 @@
 /**
  * Run with: node metadata-processor /path/ukamf.xml http://idp/entity/id
  *
+ * `npm install` must be run for scripts/ukamf first.
+ *
  * The ukamf metadata xml file can be downloaded from:
  *     http://metadata.ukfederation.org.uk/
  *
  * The entity id should be provided by the university.
  */
 
+const { Certificate } = require('@fidm/x509')
+const moment = require('moment')
+
 const UKAMFDB = require('./ukamf-db')
 
 main().catch(err => {
@@ -18,7 +23,7 @@ main().catch(err => {
 async function main() {
   const [, , file, entityId] = process.argv
 
-  console.log(`loading file ${file}`)
+  console.log(`loading file ${file}...\n`)
 
   const ukamfDB = new UKAMFDB(file)
   await ukamfDB.init()
@@ -29,6 +34,32 @@ async function main() {
   }
   const samlConfig = entity.getSamlConfig()
 
+  const certificate = Certificate.fromPEM(
+    Buffer.from(
+      `-----BEGIN CERTIFICATE-----\n${
+        samlConfig.cert
+      }\n-----END CERTIFICATE-----`,
+      'utf8'
+    )
+  )
+
+  const validFrom = moment(certificate.validFrom)
+  const validTo = moment(certificate.validTo)
+
+  if (validFrom.isAfter(moment())) {
+    throw new Error(`certificate not valid till: ${validFrom.format('LLL')}`)
+  }
+
+  if (validTo.isBefore(moment())) {
+    throw new Error(`certificate expired: ${validTo.format('LLL')}`)
+  }
+
+  console.log(
+    `!!!!!!!!!!!!!\nCERTIFICATE EXPIRES: ${validTo.format(
+      'LLL'
+    )}\n!!!!!!!!!!!!!\n`
+  )
+
   console.log(`UPDATE universities SET
   sso_entity_id = '${samlConfig.entityId}',
   sso_entry_point = '${samlConfig.entryPoint}',