Michele Degges mdeggies

## validate_slack_request_source.py
def validate_request_source(request):
    """Validate that the incoming request is from our own slack instance in Python3
       Returns True if the request is valid, False otherwise"""
    try:
        if 'X-Slack-Request-Timestamp' in request.headers and 'X-Slack-Signature' in request.headers:
            timestamp = request.headers['X-Slack-Request-Timestamp']
            expected_signature = request.headers['X-Slack-Signature']
            # Reject replay attacks
            if (int(timestamp) + (60 * 5)) < int(time()):
                return False

## README.md

      
              4 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                mdeggies
                / README.md
            
            
              Last active
              November 8, 2019 18:09
            
          
    Quick bash script that shows how to use the gon CLI tool on a remote OSX box to sign, package, staple, and notarize a product from releases.hashicorp.com. It also validates that the binary has been signed and notarized properly and can run on OSX 10.15.
Pre-reqs:

Your OSX box should have OSX 10.15+, wget, Xcode 11.1+, and SSH access enabled
Create a developer ID cert and add it to your login keychain on your OSX box
Set the following environment variables locally: SSH_USER, SSH_PWD, and REMOTE_IP
Edit config.json locally and replace the variables with real values
Ensure config.json, script.sh, and remote_script.sh are all in the same local dir

To run:

  
## login.html
<!doctype html>
<html lang="en-us">
<head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Example Okta Sign-In Widget</title>

  <!--[if lt IE 9]>
  <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.2/html5shiv.min.js"></script>

## shiro-hash-validation.java
// GIST shows how to validate a shiro1 password hash in Java.
// The original mcf_string was created via the Shiro Command Liner Hasher: https://shiro.apache.org/command-line-hasher.html
// With these args: java -jar shiro-tools-hasher-1.3.2-cli.jar --algorithm SHA-512 --nogensalt --saltbytes <BASE64_ENCODED_SALT> --iterations 500000 --password Jenydoby6!

import org.apache.shiro.crypto.hash.Sha512Hash;
import java.util.Base64;

// Extract the password hash. Below is an example hash
String mcf_string = "$shiro1$SHA-512$500000$ctYP52a2Sp2yIjzzlJAuPg==$ctZ4gQtNd7bKI0SWtktRAiP4Xzgk66sabg3pj0pQBmKZmgG7KAXZqAhBJJ3cCTqenfqi4LTgeZnh4waL6oMH+w==";

## shiro-hash-validation.php
<?php

// GIST shows how to validate a shiro1 password hash in Java.
// The original mcf_string was created via the Shiro Command Liner Hasher: https://shiro.apache.org/command-line-hasher.html
// With these args: java -jar shiro-tools-hasher-1.3.2-cli.jar --algorithm SHA-512 --nogensalt --saltbytes <BASE64_ENCODED_SALT> --iterations 500000 --password Jenydoby6!
// Extract the password hash. Below is an example hash

$mcf_string = '$shiro1$SHA-512$500000$ctYP52a2Sp2yIjzzlJAuPg==$ctZ4gQtNd7bKI0SWtktRAiP4Xzgk66sabg3pj0pQBmKZmgG7KAXZqAhBJJ3cCTqenfqi4LTgeZnh4waL6oMH+w==';

$parts = \explode('$', $mcf_string);

## pwd-import-java.java
"""
    password-import.java
    ~~~~~~~~~
    A super basic script that shows how to import a user with a freshly SHA-1 hashed password into Stormpath
    and authenticate him using the Java SDK (version 1.5.5): https://github.com/stormpath/stormpath-sdk-java

    NOTE: You will need to add the apache commons codec jar (version 1.10) to your project in order to use DigestUtils
"""

public class Quickstart {

## pwd-import-python.py
"""
    password-import.py
    ~~~~~~~~~
    A super basic script that shows how to import a user with a freshly SHA-1 hashed password into Stormpath
    and authenticate him using the Python SDK: https://docs.stormpath.com/python/
"""

from base64 import b64encode
from hashlib import sha1
from stormpath.client import Client

## server.js
/*** Sources: https://github.com/stormpath/stormpath-sdk-node/blob/master/lib/resource/Application.js#L122
              https://docs.stormpath.com/rest/product-guide/latest/idsite.html ***/

'use strict';

var stormpath = require('stormpath');
var http = require('http');
var Router = require('router');
var finalhandler = require('finalhandler');
	def validate_request_source(request):
	"""Validate that the incoming request is from our own slack instance in Python3
	Returns True if the request is valid, False otherwise"""
	try:
	if 'X-Slack-Request-Timestamp' in request.headers and 'X-Slack-Signature' in request.headers:
	timestamp = request.headers['X-Slack-Request-Timestamp']
	expected_signature = request.headers['X-Slack-Signature']
	# Reject replay attacks
	if (int(timestamp) + (60 * 5)) < int(time()):
	return False
	<!doctype html>
	<html lang="en-us">
	<head>
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Example Okta Sign-In Widget</title>

	<!--[if lt IE 9]>
	<script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.2/html5shiv.min.js"></script>
	// GIST shows how to validate a shiro1 password hash in Java.
	// The original mcf_string was created via the Shiro Command Liner Hasher: https://shiro.apache.org/command-line-hasher.html
	// With these args: java -jar shiro-tools-hasher-1.3.2-cli.jar --algorithm SHA-512 --nogensalt --saltbytes <BASE64_ENCODED_SALT> --iterations 500000 --password Jenydoby6!

	import org.apache.shiro.crypto.hash.Sha512Hash;
	import java.util.Base64;

	// Extract the password hash. Below is an example hash
	String mcf_string = "$shiro1$SHA-512$500000$ctYP52a2Sp2yIjzzlJAuPg==$ctZ4gQtNd7bKI0SWtktRAiP4Xzgk66sabg3pj0pQBmKZmgG7KAXZqAhBJJ3cCTqenfqi4LTgeZnh4waL6oMH+w==";
	<?php

	// GIST shows how to validate a shiro1 password hash in Java.
	// The original mcf_string was created via the Shiro Command Liner Hasher: https://shiro.apache.org/command-line-hasher.html
	// With these args: java -jar shiro-tools-hasher-1.3.2-cli.jar --algorithm SHA-512 --nogensalt --saltbytes <BASE64_ENCODED_SALT> --iterations 500000 --password Jenydoby6!
	// Extract the password hash. Below is an example hash

	$mcf_string = '$shiro1$SHA-512$500000$ctYP52a2Sp2yIjzzlJAuPg==$ctZ4gQtNd7bKI0SWtktRAiP4Xzgk66sabg3pj0pQBmKZmgG7KAXZqAhBJJ3cCTqenfqi4LTgeZnh4waL6oMH+w==';

	$parts = \explode('$', $mcf_string);
	"""
	password-import.java
	~~~~~~~~~
	A super basic script that shows how to import a user with a freshly SHA-1 hashed password into Stormpath
	and authenticate him using the Java SDK (version 1.5.5): https://github.com/stormpath/stormpath-sdk-java

	NOTE: You will need to add the apache commons codec jar (version 1.10) to your project in order to use DigestUtils
	"""

	public class Quickstart {
	"""
	password-import.py
	~~~~~~~~~
	A super basic script that shows how to import a user with a freshly SHA-1 hashed password into Stormpath
	and authenticate him using the Python SDK: https://docs.stormpath.com/python/
	"""

	from base64 import b64encode
	from hashlib import sha1
	from stormpath.client import Client
	/*** Sources: https://github.com/stormpath/stormpath-sdk-node/blob/master/lib/resource/Application.js#L122
	https://docs.stormpath.com/rest/product-guide/latest/idsite.html ***/

	'use strict';

	var stormpath = require('stormpath');
	var http = require('http');
	var Router = require('router');
	var finalhandler = require('finalhandler');