This repository has been archived by the owner on Jan 19, 2022. It is now read-only.
/
duo.go
67 lines (62 loc) · 1.79 KB
/
duo.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
package main
import (
"encoding/json"
"fmt"
"net/http"
"net/url"
"github.com/duosecurity/duo_api_golang"
)
// DuoAuth inserts a Duo auth middleware before next.
func DuoAuth(next http.Handler, duoIKey, duoSKey, duoAPIHost string) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
staffid, _, ok := req.BasicAuth()
if !ok {
if !ok {
http.Error(w, "Forbidden", 403)
return
}
}
if err := duoAuth(staffid, duoIKey, duoSKey, duoAPIHost); err != nil {
http.Error(w, err.Error(), 403)
return
}
next.ServeHTTP(w, req)
})
}
func duoAuth(staffid, duoIKey, duoSKey, duoAPIHost string) error {
const userAgent = "kubetoken/1.0"
duo := duoapi.NewDuoApi(duoIKey, duoSKey, duoAPIHost, userAgent)
params := make(url.Values)
params.Add("username", staffid)
params.Add("factor", "auto")
params.Add("device", "auto")
resp, body, err := duo.SignedCall("POST", "/auth/v2/auth", params, duoapi.UseTimeout)
if err != nil {
return err
}
if resp.StatusCode != 200 {
return fmt.Errorf("expected 200, got %v: %s", resp.Status, body)
}
// you'd think at this point that the request was approved, oh no, not so grasshopper.
// duo returns a 200 with a json body which contains a result key which has the words
// "allow", "deny", so we must inspect that
var result struct {
Stat string `json:"stat"`
Response struct {
Result string `json:"result"`
Status string `json:"status"`
Message string `json:"status_msg"`
} `json:"response"`
}
err = json.Unmarshal(body, &result)
if err != nil {
return err
}
if result.Stat != "OK" {
return fmt.Errorf("request failed: %s", body)
}
if result.Response.Result != "allow" {
return fmt.Errorf("request denied: %s: %s", result.Response.Status, result.Response.Message)
}
return nil
}