forked from ory/hydra
-
Notifications
You must be signed in to change notification settings - Fork 0
/
helper_client.go
121 lines (105 loc) · 4.36 KB
/
helper_client.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
/*
* Copyright © 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* @author Aeneas Rekkas <aeneas+oss@aeneas.io>
* @copyright 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
* @license Apache-2.0
*/
package server
import (
"net/url"
"os"
"strings"
"github.com/ory/hydra/client"
"github.com/ory/hydra/config"
"github.com/ory/hydra/oauth2"
"github.com/ory/hydra/pkg"
"github.com/ory/ladon"
)
func (h *Handler) createRootIfNewInstall(c *config.Config) {
ctx := c.Context()
clients, err := h.Clients.Manager.GetClients(100, 0)
pkg.Must(err, "Could not fetch client list: %s", err)
if len(clients) != 0 {
return
}
rs, err := pkg.GenerateSecret(16)
pkg.Must(err, "Could notgenerate secret because %s", err)
secret := string(rs)
id := ""
forceRoot := os.Getenv("FORCE_ROOT_CLIENT_CREDENTIALS")
if forceRoot != "" {
credentials := strings.Split(forceRoot, ":")
if len(credentials) == 2 {
if id, err = url.QueryUnescape(credentials[0]); err != nil {
c.GetLogger().Warn("Unable to www-url-unescape the root client id, falling back to random values.")
secret = ""
id = ""
}
if secret, err = url.QueryUnescape(credentials[1]); err != nil {
c.GetLogger().Warn("Unable to www-url-unescape the root client secret, falling back to random values.")
secret = ""
id = ""
}
} else {
c.GetLogger().Warnln("You passed malformed root client credentials, falling back to random values.")
}
}
c.GetLogger().Warn("No clients were found. Creating a temporary root client...")
root := &client.Client{
ID: id,
Name: "This temporary client is generated by hydra and is granted all of hydra's administrative privileges. It must be removed when everything is set up.",
ResponseTypes: []string{"id_token", "code", "token"},
GrantTypes: []string{"implicit", "refresh_token", "authorization_code", "password", "client_credentials"},
Scope: "hydra.* openid offline hydra",
RedirectURIs: []string{"http://localhost:4445/callback"},
Secret: secret,
}
err = h.Clients.Manager.CreateClient(root)
pkg.Must(err, "Could not create temporary root because %s", err)
c.ClientID = root.ID
c.ClientSecret = string(secret)
c.GetLogger().Infoln("Temporary root client created.")
if forceRoot == "" {
c.GetLogger().Infof("client_id: %s", root.GetID())
c.GetLogger().Infof("client_secret: %s", string(secret))
c.GetLogger().Warn("WARNING: YOU MUST delete this client once in production, as credentials may have been leaked in your logfiles.")
}
pkg.Must(ctx.LadonManager.Create(&ladon.DefaultPolicy{
Description: "This is a policy created by ORY Hydra and issued to the first client. It grants all of hydra's administrative privileges to the client and enables the client_credentials response type.",
Subjects: []string{root.GetID()},
Effect: ladon.AllowAccess,
Resources: []string{prefixResource(c.AccessControlResourcePrefix, "<.*>")},
Actions: []string{"<.*>"},
ID: "default-admin-policy",
}), "Could not create admin policy because %s", err)
pkg.Must(ctx.LadonManager.Create(&ladon.DefaultPolicy{
Description: "This is a policy created by ORY Hydra which allows all users, including anonymous ones, access to the /.well-known/jwks.json endpoint. This endpoint is used for verifying OpenID Connect ID Tokens.",
Subjects: []string{"<.*>"},
Effect: ladon.AllowAccess,
Resources: []string{prefixResource(c.AccessControlResourcePrefix, "keys:"+oauth2.OpenIDConnectKeyName+":public:<.*>")},
Actions: []string{"get"},
ID: "default-oidc-id-token-public-policy",
}), "Could not create wellknown JWKS policy because %s", err)
}
func prefixResource(prefix, resource string) string {
if prefix == "" {
prefix = "rn:hydra"
}
if prefix[len(prefix)-1] == ':' {
prefix = prefix[:len(prefix)-1]
}
return prefix + ":" + resource
}