helper_client.go

// Copyright © 2017 Aeneas Rekkas <aeneas+oss@aeneas.io>
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package server

import (
	"os"
	"strings"

	"net/url"

	"github.com/ory/hydra/client"
	"github.com/ory/hydra/config"
	"github.com/ory/hydra/pkg"
	"github.com/ory/ladon"
)

func (h *Handler) createRootIfNewInstall(c *config.Config) {
	ctx := c.Context()

	clients, err := h.Clients.Manager.GetClients()
	pkg.Must(err, "Could not fetch client list: %s", err)
	if len(clients) != 0 {
		return
	}

	rs, err := pkg.GenerateSecret(16)
	pkg.Must(err, "Could notgenerate secret because %s", err)
	secret := string(rs)

	id := ""
	forceRoot := os.Getenv("FORCE_ROOT_CLIENT_CREDENTIALS")
	if forceRoot != "" {
		credentials := strings.Split(forceRoot, ":")
		if len(credentials) == 2 {
			if id, err = url.QueryUnescape(credentials[0]); err != nil {
				c.GetLogger().Warn("Unable to www-url-unescape the root client id, falling back to random values.")
				secret = ""
				id = ""
			}
			if secret, err = url.QueryUnescape(credentials[1]); err != nil {
				c.GetLogger().Warn("Unable to www-url-unescape the root client secret, falling back to random values.")
				secret = ""
				id = ""
			}
		} else {
			c.GetLogger().Warnln("You passed malformed root client credentials, falling back to random values.")
		}
	}

	c.GetLogger().Warn("No clients were found. Creating a temporary root client...")
	root := &client.Client{
		ID:            id,
		Name:          "This temporary client is generated by hydra and is granted all of hydra's administrative privileges. It must be removed when everything is set up.",
		ResponseTypes: []string{"id_token", "code", "token"},
		GrantTypes:    []string{"implicit", "refresh_token", "authorization_code", "password", "client_credentials"},
		Scope:         "hydra.* openid offline hydra",
		RedirectURIs:  []string{"http://localhost:4445/callback"},
		Secret:        secret,
	}

	err = h.Clients.Manager.CreateClient(root)
	pkg.Must(err, "Could not create temporary root because %s", err)

	c.ClientID = root.ID
	c.ClientSecret = string(secret)

	c.GetLogger().Infoln("Temporary root client created.")
	if forceRoot == "" {
		c.GetLogger().Infof("client_id: %s", root.GetID())
		c.GetLogger().Infof("client_secret: %s", string(secret))
		c.GetLogger().Warn("WARNING: YOU MUST delete this client once in production, as credentials may have been leaked in your logfiles.")
	}

	err = ctx.LadonManager.Create(&ladon.DefaultPolicy{
		Description: "This is a policy created by hydra and issued to the first client. It grants all of hydra's administrative privileges to the client and enables the client_credentials response type.",
		Subjects:    []string{root.GetID()},
		Effect:      ladon.AllowAccess,
		Resources:   []string{"rn:hydra:<.*>"},
		Actions:     []string{"<.*>"},
		ID:          "default-admin-policy",
	})
	pkg.Must(err, "Could not create admin policy because %s", err)
}