var FederatedLoginService=function(){return function(){var b=this;b.isFederated=function(a,c,f){l(a,!1,function(e){c(0<e.type,e.type)},f)};b._handleError=function(a,c){a&&a(c?c.toString():"");c&&setTimeout(function(){throw c;},0)};b._getAuthInfo=function(a,c,f,e){l(a,!1,function(d){b._ajax({type:"GET",dataType:"json",url:d.IdentityProviderURL+"/auth/saml2/getauthinfo/"+c,success:f,error:k(e)})},e)};b._initiate=function(a,c,f,e){l(a,c,function(d,g){switch(d.type){case 3:f(d,null,g);break;case 2:t(a,
d,function(h){f(d,h,g)},e);break;case 1:f(d,null,g);break;default:b._handleError(e,Error("User is not provisioned for federated login"))}},e)};b._decryptK1WithPrivateKey=function(a,c){return c.decrypt(a,"RSA-OAEP",{md:forge.md.sha384.create()})};b._assemblePassword=function(a,c,f,e,d){var g=atob(f.k1),h=atob(f.k2);c&&(g=b._decryptK1WithPrivateKey(g,c.privateKey));var m=n(g,h);b._ajax({type:"POST",dataType:"json",contentType:"application/json",url:"lmiapi/login/getLocalKeyPart",data:{username:a,keyHash:p(m),
authSessionId:f.authSessionId},success:function(q){q&&q.localKey?e(p(n(m,atob(q.localKey))),n(m,atob(q.localKey))):b._handleError(d,Error("Could not retrieve local key"))},error:k(d)})};b.OIDC_PROVIDERS={Azure:0,Okta:1,OktaWithoutAuthorizationServer:2,Google:3,PingOne:4,OneLogin:5};b.GRAPH_API_HOST={Com:"graph.microsoft.com",Us:"graph.microsoft.us"};b.processMicrosoftGraphApiResponse=function(a){a="string"===typeof a?JSON.parse(a):a;if(a.extensions)for(var c=0;c<a.extensions.length;c++)if("com.lastpass.keys"===
a.extensions[c].id)return a.extensions[c].LastPassK1};b._getKeysForAzure=function(a,c,f,e,d){var g=b.GRAPH_API_HOST.Com;null!=a.graphApiHost&&(g=a.graphApiHost);b._ajax({type:"GET",url:"https://"+g+"/v1.0/me?$select=id,displayName,mail&$expand=extensions",beforeSend:function(h){h.setRequestHeader("Authorization","Bearer "+a.accessToken)},success:function(h){(h=b.processMicrosoftGraphApiResponse(h))?c(h,a,f,e,d):b._handleError(e,Error("Could not retrieve K1 from Azure"))},error:k(e)})};b._getGlobalKeysForIdp=
function(a,c,f,e,d){var g=a.k1;g?c(btoa(g),a,f,e,d):b._handleError(e,Error("Could not retrieve K1 from "+b.getOIDCProviderName(a.provider)))};b._getKeysForPingOne=function(a,c,f,e,d){var g=a.k1;g?c(g,a,f,e,d):b._handleError(e,Error("Could not retrieve K1 from PingOne"))};b._getKeysForGoogle=function(a,c,f,e,d){var g=googleApiHelpers(b._ajax,a.accessToken);g.getGoogleDriveFile("k1.lp","appDataFolder",function(h){h&&h.id&&g.getGoogleDriveFileContent(h.id,function(m){m&&c(m,a,f,e,d)})})};b._getK2FromAlp=
function(a,c,f,e,d){b._ajax({type:"POST",dataType:"json",contentType:"application/json",url:c.alpUrl+"/federatedlogin/api/v1/getkey",data:JSON.stringify({company_id:c.companyId,id_token:c.idToken}),success:function(g){g&&g.k2?f(p(n(atob(a),atob(g.k2))),n(atob(a),atob(g.k2)),d,void 0,g.fragment_id,p(atob(a)),atob(a)):b._handleError(e,Error("Could not retrieve K2 from ALP"))},error:k(e)})};b._assemblePasswordForOIDC=function(a,c,f,e){var d=function(){f(gs("Unknown OpenIDConnect provider")+" "+provider)};
if(a.provider===b.OIDC_PROVIDERS.Azure)d=b._getKeysForAzure;else if(a.provider===b.OIDC_PROVIDERS.Google)d=b._getKeysForGoogle;else if(a.provider===b.OIDC_PROVIDERS.PingOne)d=b._getKeysForPingOne;else if(a.provider===b.OIDC_PROVIDERS.Okta||a.provider===b.OIDC_PROVIDERS.OktaWithoutAuthorizationServer||a.provider===b.OIDC_PROVIDERS.OneLogin)d=b._getGlobalKeysForIdp;d(a,b._getK2FromAlp,c,f,e)};b.getScopes=function(a,c){switch(a){case b.OIDC_PROVIDERS.Azure:return c?"openid email profile user.readwrite":
"openid email profile";case b.OIDC_PROVIDERS.OktaWithoutAuthorizationServer:return"openid email profile groups";case b.OIDC_PROVIDERS.PingOne:return c?"openid email profile p1:update:user":"openid email profile lastpass";case b.OIDC_PROVIDERS.Google:return"openid https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/drive.appdata https://www.googleapis.com/auth/drive.install https://www.googleapis.com/auth/drive.file";default:return"openid email profile"}};
b.getOIDCProviderName=function(a){switch(a){case 0:return"Azure AD";case 1:case 2:return"Okta";case 3:return"Google";case 4:return"PingOne";case 5:return"OneLogin";default:return""}};b._keypairSaved=function(){};b._cache={};b.clearCache=function(){b._cache={}};var l=function(){"undefined"!==typeof g_oldFederatedEmail&&(g_oldFederatedEmail="");"undefined"!==typeof g_newFederatedEmail&&(g_newFederatedEmail="");return function(a,c,f,e){b._cache[a]?f(b._cache[a]):b._ajax({type:"GET",dataType:"json",url:"lmiapi/login/type",
data:{username:a},success:function(d){d?(d.OldEmail&&""!==d.OldEmail?"undefined"!==typeof g_oldFederatedEmail&&(g_oldFederatedEmail=d.OldEmail,g_newFederatedEmail=a):b._cache[a]=d,f(d,c)):b._handleError(e,Error("Could not retrieve login data: "+d))},error:k(e)})}}(),k=function(a){return function(c,f,e){b._handleError(a,Error(e))}},r=function(a){forge.rsa.generateKeyPair({bits:2048,workers:2},function(c,f){a(c,f)})},t=function(a,c,f,e){r(function(d,g){d?e(d):b._ajax({type:"POST",dataType:"json",contentType:"application/json",
url:"lmiapi/federated/key",data:{email:a,publickey:u(g).publicKey},success:function(){b._keypairSaved(g,c);f(g)},error:k(e)})})},p=function(a){var c=forge.md.sha256.create();c.update(a);return btoa(c.digest().bytes())},n=function(a,c){return forge.util.xorBytes(a,c,a.length<c.length?a.length:c.length)},u=function(a){return a?{privateKey:btoa(forge.asn1.toDer(forge.pki.privateKeyToAsn1(a.privateKey)).getBytes()),publicKey:btoa(forge.asn1.toDer(forge.pki.publicKeyToAsn1(a.publicKey)).getBytes())}:a}}}();var FederatedLogin=function(){return new function(){var b=this;FederatedLoginService.call(b);b._ajax=function(l){$.ajax(l)};b.getPassword=function(l,k,r){"object"===typeof ext&&ext?ext.FederatedLogin.getPassword(l,k,r):b._handleError(r,Error("Web Federated Login is not enabled!"))}}}();MessageBoxErrorHandler=function(b){b=b?b.toString():"";lpmessagebox(gs("An Error Occurred"),b)};
//# sourceMappingURL=federatedlogin.js.map