vault-token-issuer.go

//go:generate ./build-spa.sh
//go:generate go run build_spa_vfsgen.go

package main

import (
	"bytes"
	"crypto/tls"
	"encoding/json"
	"errors"
	"flag"
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"strconv"
	"time"

	"github.com/asaskevich/govalidator"
	"github.com/bitsofinfo/vault-token-issuer/auth"
	"github.com/bitsofinfo/vault-token-issuer/util"
	log "github.com/sirupsen/logrus"
	"github.com/tidwall/gjson"

	"github.com/gorilla/mux"
)

var (
	vaultUrl           string                  // vault URL (flag opt)
	vaultAuthenticator string                  // string vault auth plugin name (flag opt)
	enableSpa          bool                    // enable the SPA (flag opt)
	tlsCertPath        string                  // path to TLS certificate (flag opt)
	tlsKeyPath         string                  // path to TLS private key (flag opt)
	listenPort         int                     // port to listen on (flag opt)
	authenticator      auth.VaultAuthenticator // the vault auth plugin
)

// the JSON payload we both consume
// from callers and relay to Vault
type createTokenPayload struct {
	Renewable bool     `json:"renewable"` // valid:required doesn't work on 'false' @see https://github.com/asaskevich/govalidator/issues/256
	Period    string   `valid:"alphanum,required" json:"period"`
	Policies  []string `valid:"ascii,required" json:"policies"`
}

// Struct for JSON we retun to caller
type createTokenResponse struct {
	Code  string `json:"code"`
	Token string `json:"token"`
	Msg   string `json:"msg"`
}

func init() {

	// cmd line args
	flag.StringVar(&vaultUrl, "vault-url", "", "Vault url where token API calls will be made. i.e. http(s)://<vault>[:port]")
	flag.StringVar(&vaultAuthenticator, "vault-authenticator", "", "The vault authenticator plugin to use: valid options: 'ldap'")
	flag.BoolVar(&enableSpa, "enable-spa", true, "Serve the SPA at /ui, default enabled")
	flag.StringVar(&tlsKeyPath, "tls-key-path", "", "Optional, path to a PEM encoded TLS private key. If omitted a self-signed cert will be auto generated in memory")
	flag.StringVar(&tlsCertPath, "tls-cert-path", "", "Optional: path to a PEM encoded TLS certificate. If omitted a self-signed cert will be auto generated in memory")
	flag.IntVar(&listenPort, "listen-port", 8443, "Optional, port to listen on, default 8443")

	// logging options
	log.SetFormatter(&log.JSONFormatter{})
	log.SetOutput(os.Stdout)
	log.SetLevel(log.DebugLevel)
}

func main() {

	flag.Parse()

	// load our plugin for the authentication backend
	if vaultAuthenticator == "ldap" {
		authenticator = &auth.LdapPlugin{VaultURL: vaultUrl}
		log.Info("VaultAuthenticator 'ldap' loaded")

	} else {
		log.Fatal("Invalid --vault-authenticator specified. Supported values: 'ldap'")
	}

	// setup our REST routes
	router := mux.NewRouter()
	router.Path("/token/create-orphan").
		Methods("POST").
		Schemes("https").
		Headers("Content-Type", "application/json").
		HandlerFunc(CreateOrphanTokenHandler)

	router.Path("/token/create-orphan").
		Methods("OPTIONS").
		Schemes("https").
		HandlerFunc(corsHandler)

	if enableSpa == true {
		log.Info("SPA enabled and available at /ui, disable w/ -enable-spa=false")

		// spaAssets are generated by vfsgen and stored in spaAssets_vfsdata.go
		spaFileServer := http.FileServer(spaAssets)

		router.Path("/ui").
			Methods("GET").
			Schemes("https").
			Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				http.Redirect(w, r, "/ui/", http.StatusSeeOther)
			}))

		router.PathPrefix("/ui/").
			Methods("GET").
			Schemes("https").
			Handler(http.StripPrefix("/ui/",
				http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
					if r.URL.Path == "/" {
						r.URL.Path = "/index.html"
					}

					spaFileServer.ServeHTTP(w, r)
				})))

	}

	// fire up the http server
	srv := &http.Server{
		Handler: router,
		Addr:    (":" + strconv.Itoa(listenPort)),

		// https://golang.org/doc/go1.6#http2 needed to disable 128b ciphers below which are required by h2
		TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 0),

		TLSConfig: &tls.Config{
			Certificates:             []tls.Certificate{getTLSCertificate()},
			MinVersion:               tls.VersionTLS12,
			PreferServerCipherSuites: true,
			CurvePreferences:         []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
			CipherSuites: []uint16{
				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
				tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
				tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
			}},
		WriteTimeout: 20 * time.Second,
		ReadTimeout:  20 * time.Second,
	}

	log.Fatal(srv.ListenAndServeTLS("", ""))
}

func getTLSCertificate() tls.Certificate {

	// load from disk
	if len(tlsCertPath) > 0 && len(tlsKeyPath) > 0 {
		cert, err := tls.LoadX509KeyPair(tlsCertPath, tlsKeyPath)
		if err != nil {
			log.Fatal("Unexpected error loading cert/key", err)
		}

		log.Info("Loaded TLS cert/key from " + tlsCertPath + " " + tlsKeyPath)

		return cert
	}

	// generate a self signed cert & key
	pemCert, pemKey := util.Generate(4096)

	// get cert from keypair
	cert, err := tls.X509KeyPair(pemCert, pemKey)
	if err != nil {
		log.Fatal("Unexpected error generating self signed cert", err)
	}

	log.Info("Successfully generated self-signed TLS cert/key")

	return cert

}

// writes an HTTP response w/ code + json result
func writeHTTPResponse(resWriter http.ResponseWriter, code string, token string, msg string, httpStatus int) {
	resWriter.Header().Set("Content-Type", "application/json")
	resWriter.WriteHeader(httpStatus)
	json.NewEncoder(resWriter).Encode(&createTokenResponse{Code: code, Token: token, Msg: msg})
}

// writes CORS response headers
func corsHandler(resWriter http.ResponseWriter, req *http.Request) {
	resWriter.Header().Set("Access-Control-Allow-Origin", "*")
	resWriter.Header().Set("Access-Control-Allow-Headers", "content-type,authorization")
	resWriter.Header().Set("Access-Control-Allow-Methods", "OPTIONS,POST")
}

// CreateOrphanTokenHandler ... http handler for creating vault orphan tokens
func CreateOrphanTokenHandler(resWriter http.ResponseWriter, req *http.Request) {

	corsHandler(resWriter, req)

	// first lets get the credentials off the request
	vaultCredentials, err := authenticator.GetCredentials(req)
	if err != nil {
		writeHTTPResponse(resWriter, "error", "", "Bad Request: auth required", http.StatusBadRequest)
		return
	}

	// lets get our createTokenPayload struct
	payload, err := extractCreateTokenPayload(&resWriter, req)
	if err != nil {
		log.Error("Invalid payload: " + err.Error())
		writeHTTPResponse(resWriter, "error", "", err.Error(), http.StatusUnauthorized)
		return
	}

	// must have at least one policy
	if len(payload.Policies) == 0 {
		writeHTTPResponse(resWriter, "error", "", "one or more vault 'policies' are required", http.StatusBadRequest)
		return
	}

	// auth the actual user against value and get
	// the client access/auth token which we can then
	// use to create the actual orphan token
	userToken, err := authenticator.Auth(vaultCredentials)
	if err != nil {
		log.Error("Failed to authenticated againsg vault w/ VaultCredentials: " + err.Error())
		writeHTTPResponse(resWriter, "error", "", err.Error(), http.StatusUnauthorized)
		return
	}

	token, err := createOrphanToken(userToken, payload)
	if err != nil {
		log.Error("Failed to create orphan token: " + err.Error())
		writeHTTPResponse(resWriter, "error", "", err.Error(), http.StatusInternalServerError)
		return
	}

	writeHTTPResponse(resWriter, "ok", token,
		fmt.Sprintf("renewable:%v period:%v policies:%v",
			payload.Renewable,
			payload.Period,
			payload.Policies), http.StatusOK)

}

// Extracts the createTokenPayload JSON payload from the Request
func extractCreateTokenPayload(resWriter *http.ResponseWriter, req *http.Request) (*createTokenPayload, error) {

	body, err := ioutil.ReadAll(req.Body)
	if err != nil {
		log.Printf("Error reading body: %v", err)
		return nil, errors.New("failed to read request body json")
	}
	var payload createTokenPayload
	json.Unmarshal(body, &payload)

	x, err := json.Marshal(&payload)
	log.Info(string(x))

	// validate
	_, err = govalidator.ValidateStruct(&payload)
	if err != nil {
		return nil, errors.New("JSON payload failed validation: " + err.Error())
	}

	return &payload, nil

}

func createOrphanToken(userToken string, payload *createTokenPayload) (string, error) {

	jsonData, err := json.Marshal(payload)
	jsonBytes := bytes.NewBuffer(jsonData)
	url := (vaultUrl + "/v1/auth/token/create-orphan")
	log.Info(url)
	req, err := http.NewRequest("POST", url, jsonBytes)
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-Vault-Token", userToken)

	client := &http.Client{}
	resp, err := client.Do(req)

	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	var clientToken string

	if resp.StatusCode == http.StatusOK {
		bodyBytes, err := ioutil.ReadAll(resp.Body)
		if err != nil {
			log.Fatal(err)
		}
		bodyString := string(bodyBytes)
		//log.Info(bodyString)

		clientToken = gjson.Get(bodyString, "auth.client_token").String()

		//fmt.Print(clientToken)

		return clientToken, nil
	}

	return "", errors.New("failed to get token")
}