Add config for local JWT tokens

python/nav/etc/jwt.conf

@@ -1,7 +1,19 @@
-# This file contains configuration for JWT issuers that this NAV instance
-# should accept tokens from.
-
-# Each issuer is defined in a section. The name of the section should be
+# This file contains configuration for JWT tokens.
+# This includes tokens generated by NAV itself and external issuers.
+
+# The settings in the `nav` section are for tokens issued by NAV itself.
+# Comment this in and fill out the values if you want to activate local JWT tokens.
+# The section name should NOT be changed.
+
+#[nav]
+# Absolute path to private key in PEM format
+#private_key=
+# Absolute path to public key in PEM format.
+#public_key=
+# Used for the 'iss' and 'aud' claims of generated tokens.
+#name=
+
+# Custom JWT issuers can be defined in a section. The name of the section should be
 # the issuers name, the same value as the 'iss' claim will be in tokens
 # generated by this issuer. This value is often a URL, but does not
 # have to be.

python/nav/jwtconf.py

@@ -11,32 +11,58 @@ class JWTConf(NAVConfigParser):
     """jwt.conf config parser"""
 
     DEFAULT_CONFIG_FILES = ('jwt.conf',)
+    NAV_SECTION = "nav"
 
     def get_issuers_setting(self):
-        issuers_settings = dict()
-        for section in self.sections():
-            try:
+        try:
+            external_settings = self._get_settings_for_external_tokens()
+            local_settings = self._get_settings_for_nav_issued_tokens()
+            external_settings.update(local_settings)
+            return external_settings
+        except ConfigurationError as error:
+            _logger.error('Error reading jwtconfig: %s', error)
+            return dict()
+
+    def _get_settings_for_external_tokens(self):
+        settings = dict()
+        try:
+            for section in self.sections():
+                if section == self.NAV_SECTION:
+                    continue
                 get = partial(self.get, section)
+                issuer = self._validate_issuer(section)
                 key = self._validate_key(get('key'))
                 aud = self._validate_audience(get('aud'))
                 key_type = self._validate_type(get('keytype'))
                 if key_type == 'PEM':
-                    key = self._read_file(key)
+                    key = self._read_key_from_path(key)
                 claims_options = {
                     'aud': {'values': [aud], 'essential': True},
                 }
-                issuers_settings[section] = {
+                settings[issuer] = {
                     'key': key,
                     'type': key_type,
                     'claims_options': claims_options,
                 }
-            except (configparser.Error, ConfigurationError) as error:
-                _logger.error('Error collecting stats for %s: %s', section, error)
-        return issuers_settings
+        except (
+            configparser.NoSectionError,
+            configparser.NoOptionError,
+        ) as error:
+            raise ConfigurationError(error)
+        return settings
 
-    def _read_file(self, file):
-        with open(file, "r") as f:
-            return f.read()
+    def _read_key_from_path(self, path):
+        try:
+            with open(path, "r") as f:
+                return f.read()
+        except FileNotFoundError:
+            raise ConfigurationError(
+                "Could not find file %s to read PEM key from", path
+            )
+        except PermissionError:
+            raise ConfigurationError(
+                "Could not access file %s to read PEM key from", path
+            )
 
     def _validate_key(self, key):
         if not key:
@@ -50,7 +76,63 @@ def _validate_type(self, key_type):
             )
         return key_type
 
+    def _validate_issuer(self, section):
+        if not section:
+            raise ConfigurationError("Invalid 'issuer': 'issuer' must not be empty")
+        try:
+            nav_name = self.get_nav_name()
+        except ConfigurationError:
+            pass
+        else:
+            if section == nav_name:
+                raise ConfigurationError(
+                    "Invalid 'issuer': %s collides with internal issuer name %s",
+                    section,
+                )
+        return section
+
     def _validate_audience(self, audience):
         if not audience:
             raise ConfigurationError("Invalid 'aud': 'aud' must not be empty")
         return audience
+
+    def _get_nav_token_config_option(self, option):
+        try:
+            get = partial(self.get, self.NAV_SECTION)
+            return get(option)
+        except (
+            configparser.NoSectionError,
+            configparser.NoOptionError,
+        ) as error:
+            raise ConfigurationError(error)
+
+    def get_nav_private_key(self):
+        path = self._get_nav_token_config_option('private_key')
+        return self._read_key_from_path(path)
+
+    def get_nav_public_key(self):
+        path = self._get_nav_token_config_option('public_key')
+        return self._read_key_from_path(path)
+
+    def get_nav_name(self):
+        name = self._get_nav_token_config_option('name')
+        if not name:
+            raise ConfigurationError("Invalid 'name': 'name' must not be empty")
+        return name
+
+    def _get_settings_for_nav_issued_tokens(self):
+        if not self.has_section(self.NAV_SECTION):
+            return {}
+        name = self.get_nav_name()
+        claims_options = {
+            'aud': {'values': [name], 'essential': True},
+            'token_type': {'values': ['access_token'], 'essential': True},
+        }
+        settings = {
+            name: {
+                'type': "PEM",
+                'key': self.get_nav_public_key(),
+                'claims_options': claims_options,
+            }
+        }
+        return settings