Go login #2010

DylanVolz · 2018-03-14T20:51:24Z

This fixes #1247

This PR implements api/1.3/user/login in go. It follows the same login flow as perl (except the token flow):
check the local user password using scrypt
check the local user password using hash1
if ldap is configured check password using ldap

if any match the user is logged in.

DylanVolz · 2018-03-14T20:53:37Z

A next step will be persisting a single connection to ldap for reuse with a singleton or similar implementation.

asfgit · 2018-03-14T21:05:35Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1237/
Test PASSed.

dewrich · 2018-03-14T22:26:21Z

Changes need to be made for the following requirements:

Deployment automation
Upgrade process (postinstall)
Startup (systemd)

dangogh

2 files missing the Apache header.
also add a note to the CHANGELOG.md

I'll test this out soon -- can't get to it today, tho..

dangogh · 2018-03-15T15:59:16Z

traffic_ops/traffic_ops_golang/auth/ldap.go

@@ -0,0 +1,101 @@
+package auth


Needs the Apache license header

dangogh · 2018-03-15T15:59:25Z

traffic_ops/traffic_ops_golang/auth/login.go

@@ -0,0 +1,111 @@
+package auth


Needs the Apache license header

asfgit · 2018-03-21T22:56:31Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1263/
Test PASSed.

asfgit · 2018-03-22T01:07:41Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1264/
Test FAILed.

asfgit · 2018-03-22T13:50:34Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1265/
Test FAILed.

asfgit · 2018-03-22T20:53:14Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1273/
Test PASSed.

asfgit · 2018-03-22T21:07:45Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1275/
Test PASSed.

asfgit · 2018-03-26T16:04:14Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1296/
Test PASSed.

asfgit · 2018-03-26T16:06:53Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1297/
Test FAILed.

asfgit · 2018-03-26T17:43:48Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1298/
Test PASSed.

asfgit · 2018-04-03T19:51:51Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1321/
Test PASSed.

dangogh · 2018-04-05T00:38:09Z

traffic_ops/install/bin/_postinstall

    for my $k (@requiredKeys) {
        if (! exists $ldapConf{$k} ) {
            errorOut("$k is a required key in $fileName");
        }
    }

+    delete $ldapConf{setupLdap}
+


syntax error here -- missing ; at the end of that delete

asfgit · 2018-04-09T14:03:27Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1365/
Test PASSed.

dangogh · 2018-04-09T19:35:17Z

traffic_ops/traffic_ops_golang/auth/login.go

+			handleErrs(http.StatusBadRequest, err)
+			return
+		}
+		authenticated, err := checkLocalUser(form, db)


this needs to check that the local user exists first without checking the password. If it doesn't exist or user's role is disallowed, immediately error out without checking LDAP.

asfgit · 2018-04-09T22:40:12Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1369/
Test PASSed.

asfgit · 2018-05-01T13:01:10Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1496/
Test PASSed.

…ndencies

asfgit · 2018-05-07T15:58:51Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1526/
Test PASSed.

asfgit · 2018-05-07T16:05:18Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1527/
Test PASSed.

rob05c · 2018-05-07T19:23:21Z

traffic_ops/traffic_ops_golang/config/config.go

+	if cfg.LDAPConfPath != "" {
+		cfg.LDAPEnabled, cfg.ConfigLDAP, err = GetLDAPConfig(cfg.LDAPConfPath)
+		if err != nil {
+			cfg.LDAPEnabled = false // probably unnecessary


I'd support removing this comment. All return values should be treated as undefined, if a returned error is not nil.

I'd rather omit the comment, than have someone remove the line because of the comment in the future.

rob05c · 2018-05-07T19:28:38Z

traffic_ops/traffic_ops_golang/auth/login.go

+	}
+	err = VerifyPassword(form.Password, hashedPassword)
+	if err != nil {
+		if hashedPassword == sha1Hex(form.Password) {


Should this be part of VerifyPassword?

I renamed VerifyPassword to VerifySCRYPTPassword since the sha1Hex check is for backwards compatibility.

asfgit · 2018-05-07T21:05:21Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1530/
Test PASSed.

rob05c

Needs to vendor gopkg.in/asn1-ber.v1

../vendor/gopkg.in/ldap.v2/add.go:16:2: cannot find package "gopkg.in/asn1-ber.v1"

asfgit · 2018-05-10T21:44:49Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1546/
Test PASSed.

rob05c · 2018-05-11T22:20:45Z

I think this needs to check for the ldap.conf file in the same way the existing Perl does
https://github.com/apache/incubator-trafficcontrol/blob/master/traffic_ops/app/lib/TrafficOps.pm#L502
https://github.com/apache/incubator-trafficcontrol/blob/master/traffic_ops/app/lib/TrafficOps.pm#L414

Making it configurable is good, but we should support the existing method too, and not require a config change on upgrade.

rob05c · 2018-05-11T22:28:58Z

traffic_ops/traffic_ops_golang/config/config.go

+}
+
+func getLDAPConf(s string) (*ConfigLDAP, error) {
+	ldapConf := ConfigLDAP{}


The LDAP timeout should have a reasonable default. It's defaulting to 0 now, and my LDAP (which is probably misconfigured) is hanging indefinitely. I'd suggest something like 10 seconds, if it isn't set in the config.

Should be accomplished by changing this to

const DefaultLDAPTimeout = time.Duration(60 * time.Second) ldapConf := ConfigLDAP{LDAPTimeoutSecs: DefaultLDAPTimeout / time.Second}

…imeout

asfgit · 2018-05-15T15:43:24Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/incubator-trafficcontrol-PR/1575/
Test PASSed.

Verified all concerns have been addressed.

rob05c · 2018-05-17T22:37:58Z

Looks good!

Tested, everything works

loads ldap config from existing config location
using non-ldap password works
using ldap password works
ldap users without TO users are not allowed to log in
TO user without corresponding ldap user login works
verified all of Dan's comments have been fixed

dangogh added the Traffic Ops API (golang) label Mar 14, 2018

dangogh added this to the 2.3 milestone Mar 14, 2018

dangogh previously requested changes Mar 15, 2018

View reviewed changes

DylanVolz force-pushed the go-login branch from 457d8f1 to a0269b1 Compare March 21, 2018 20:46

DylanVolz force-pushed the go-login branch from 97a18be to 383426c Compare March 26, 2018 15:44

DylanVolz force-pushed the go-login branch from 5b43e67 to 52cddb8 Compare April 3, 2018 19:33

dangogh reviewed Apr 5, 2018

View reviewed changes

DylanVolz force-pushed the go-login branch from 52cddb8 to 6eff712 Compare April 9, 2018 13:50

dangogh reviewed Apr 9, 2018

View reviewed changes

DylanVolz force-pushed the go-login branch from b8ae8ce to 5f1f621 Compare May 1, 2018 12:49

Dylan Volz added 3 commits May 7, 2018 09:41

implement login flow in go for local user and ldap

d731b83

move more ldap options to the ldap config and refactor connection logic

c72023c

fixup imports in auth/login.go and ldap.go

665b876

dewrich and others added 8 commits May 7, 2018 09:41

added asn1-ber.v1 for vendoring of ldap dependencies

17f7679

update client to use api/1.3/user/login

ed1e166

add new fields to ldap.conf generation in postinstall

38f5ced

properly license and exclude from rat vendored ldap and asn1-ber depe…

86cb2e8

…ndencies

place example ldap.conf properly in app/conf

0817c6d

fix syntax error in postinstall

bebf65c

address no local user and disallowed role cases in login

3959d69

add changelog entry for login endpoint

36e2118

DylanVolz force-pushed the go-login branch from 5f1f621 to 36e2118 Compare May 7, 2018 15:43

move ldap package up to traffic_ops/vendor dir

a38bf0e

rob05c reviewed May 7, 2018

View reviewed changes

rename scrypt password function to make login logic clearer

a93d259

rob05c requested changes May 9, 2018

View reviewed changes

properly vendor asn1-ber.v1 without git submodule

171c723

rob05c reviewed May 11, 2018

View reviewed changes

Dylan Volz added 2 commits May 15, 2018 09:16

change config error handling so all are logged and add default ldap t…

ac0c972

…imeout

increase logging in ldap methods for debugging

b9868c4

rob05c approved these changes May 17, 2018

View reviewed changes

rob05c merged commit 9d85130 into apache:master May 17, 2018

zrhoffman added the authentication Relating to login, registration, passwords, tokens, etc. label Jan 12, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Go login #2010

Go login #2010

DylanVolz commented Mar 14, 2018 •

edited by dangogh

Loading

DylanVolz commented Mar 14, 2018

asfgit commented Mar 14, 2018

dewrich commented Mar 14, 2018 •

edited

Loading

dangogh left a comment

dangogh Mar 15, 2018

dangogh Mar 15, 2018

asfgit commented Mar 21, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 26, 2018

asfgit commented Mar 26, 2018

asfgit commented Mar 26, 2018

asfgit commented Apr 3, 2018

dangogh Apr 5, 2018

asfgit commented Apr 9, 2018

dangogh Apr 9, 2018

asfgit commented Apr 9, 2018

asfgit commented May 1, 2018

asfgit commented May 7, 2018

asfgit commented May 7, 2018

rob05c May 7, 2018

DylanVolz May 7, 2018

rob05c May 7, 2018

DylanVolz May 7, 2018

asfgit commented May 7, 2018

rob05c left a comment

asfgit commented May 10, 2018

rob05c commented May 11, 2018

rob05c May 11, 2018

asfgit commented May 15, 2018

rob05c commented May 17, 2018 •

edited

Loading

Go login #2010

Go login #2010

Conversation

DylanVolz commented Mar 14, 2018 • edited by dangogh Loading

DylanVolz commented Mar 14, 2018

asfgit commented Mar 14, 2018

dewrich commented Mar 14, 2018 • edited Loading

dangogh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

asfgit commented Mar 21, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 22, 2018

asfgit commented Mar 26, 2018

asfgit commented Mar 26, 2018

asfgit commented Mar 26, 2018

asfgit commented Apr 3, 2018

Choose a reason for hiding this comment

asfgit commented Apr 9, 2018

Choose a reason for hiding this comment

asfgit commented Apr 9, 2018

asfgit commented May 1, 2018

asfgit commented May 7, 2018

asfgit commented May 7, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

asfgit commented May 7, 2018

rob05c left a comment

Choose a reason for hiding this comment

asfgit commented May 10, 2018

rob05c commented May 11, 2018

Choose a reason for hiding this comment

asfgit commented May 15, 2018

rob05c commented May 17, 2018 • edited Loading

DylanVolz commented Mar 14, 2018 •

edited by dangogh

Loading

dewrich commented Mar 14, 2018 •

edited

Loading

rob05c commented May 17, 2018 •

edited

Loading