forked from oracle/oci-go-sdk
-
Notifications
You must be signed in to change notification settings - Fork 0
/
resouce_principal_key_provider.go
183 lines (160 loc) · 6.75 KB
/
resouce_principal_key_provider.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
package auth
import (
"crypto/rsa"
"errors"
"fmt"
"github.com/oracle/oci-go-sdk/common"
"os"
"path"
)
const (
//ResourcePrincipalVersion2_2 supported version for resource principals
ResourcePrincipalVersion2_2 = "2.2"
//ResourcePrincipalVersionEnvVar environment var name for version
ResourcePrincipalVersionEnvVar = "OCI_RESOURCE_PRINCIPAL_VERSION"
//ResourcePrincipalRPSTEnvVar environment var name holding the token or a path to the token
ResourcePrincipalRPSTEnvVar = "OCI_RESOURCE_PRINCIPAL_RPST"
//ResourcePrincipalPrivatePEMEnvVar environment var holding a rsa private key in pem format or a path to one
ResourcePrincipalPrivatePEMEnvVar = "OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM"
//ResourcePrincipalPrivatePEMPassphraseEnvVar environment var holding the passphrase to a key or a path to one
ResourcePrincipalPrivatePEMPassphraseEnvVar = "OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM_PASSPHRASE"
//ResourcePrincipalRegionEnvVar environment variable holding a region
ResourcePrincipalRegionEnvVar = "OCI_RESOURCE_PRINCIPAL_REGION"
// TenancyOCIDClaimKey is the key used to look up the resource tenancy in an RPST
TenancyOCIDClaimKey = "res_tenant"
// CompartmentOCIDClaimKey is the key used to look up the resource compartment in an RPST
CompartmentOCIDClaimKey = "res_compartment"
)
// ConfigurationProviderWithClaimAccess mixes in a method to access the claims held on the underlying security token
type ConfigurationProviderWithClaimAccess interface {
common.ConfigurationProvider
ClaimHolder
}
// ResourcePrincipalConfigurationProvider returns a resource principal configuration provider using well known
// environment variables to look up token information. The environment variables can either paths or contain the material value
// of the keys. However in the case of the keys and tokens paths and values can not be mixed
func ResourcePrincipalConfigurationProvider() (ConfigurationProviderWithClaimAccess, error) {
var version string
var ok bool
if version, ok = os.LookupEnv(ResourcePrincipalVersionEnvVar); !ok {
return nil, fmt.Errorf("can not create resource principal, environment variable: %s, not present", ResourcePrincipalVersionEnvVar)
}
switch version {
case ResourcePrincipalVersion2_2:
rpst := requireEnv(ResourcePrincipalRPSTEnvVar)
if rpst == nil {
return nil, fmt.Errorf("can not create resource principal, environment variable: %s, not present", ResourcePrincipalRPSTEnvVar)
}
private := requireEnv(ResourcePrincipalPrivatePEMEnvVar)
if private == nil {
return nil, fmt.Errorf("can not create resource principal, environment variable: %s, not present", ResourcePrincipalPrivatePEMEnvVar)
}
passphrase := requireEnv(ResourcePrincipalPrivatePEMPassphraseEnvVar)
region := requireEnv(ResourcePrincipalRegionEnvVar)
if region == nil {
return nil, fmt.Errorf("can not create resource principal, environment variable: %s, not present", ResourcePrincipalRegionEnvVar)
}
return newResourcePrincipalKeyProvider22(
*rpst, *private, passphrase, *region)
default:
return nil, fmt.Errorf("can not create resource principal, environment variable: %s, must be valid", ResourcePrincipalVersionEnvVar)
}
}
func requireEnv(key string) *string {
if val, ok := os.LookupEnv(key); ok {
return &val
}
return nil
}
// resourcePrincipalKeyProvider22 is key provider that reads from specified the specified environment variables
// the environment variables can host the material keys/passphrases or they can be paths to files that need to be read
type resourcePrincipalKeyProvider struct {
FederationClient federationClient
KeyProviderRegion common.Region
}
func newResourcePrincipalKeyProvider22(sessionTokenLocation, privatePemLocation string,
passphraseLocation *string, region string) (*resourcePrincipalKeyProvider, error) {
//Check both the the passphrase and the key are paths
if passphraseLocation != nil && (!isPath(privatePemLocation) && isPath(*passphraseLocation) ||
isPath(privatePemLocation) && !isPath(*passphraseLocation)) {
return nil, fmt.Errorf("cant not create resource principal: both key and passphrase need to be path or none needs to be path")
}
var supplier sessionKeySupplier
var err error
//File based case
if isPath(privatePemLocation) {
supplier, err = newFileBasedKeySessionSupplier(privatePemLocation, passphraseLocation)
if err != nil {
return nil, fmt.Errorf("can not create resource principal, due to: %s ", err.Error())
}
} else {
//else the content is in the env vars
var passphrase []byte
if passphraseLocation != nil {
passphrase = []byte(*passphraseLocation)
}
supplier, err = newStaticKeySessionSupplier([]byte(privatePemLocation), passphrase)
if err != nil {
return nil, fmt.Errorf("can not create resource principal, due to: %s ", err.Error())
}
}
var fd federationClient
if isPath(sessionTokenLocation) {
fd, _ = newFileBasedFederationClient(sessionTokenLocation, supplier)
} else {
fd, err = newStaticFederationClient(sessionTokenLocation, supplier)
if err != nil {
return nil, fmt.Errorf("can not create resource principal, due to: %s ", err.Error())
}
}
rs := resourcePrincipalKeyProvider{
FederationClient: fd,
KeyProviderRegion: common.StringToRegion(region),
}
return &rs, nil
}
func (p *resourcePrincipalKeyProvider) PrivateRSAKey() (privateKey *rsa.PrivateKey, err error) {
if privateKey, err = p.FederationClient.PrivateKey(); err != nil {
err = fmt.Errorf("failed to get private key: %s", err.Error())
return nil, err
}
return privateKey, nil
}
func (p *resourcePrincipalKeyProvider) KeyID() (string, error) {
var securityToken string
var err error
if securityToken, err = p.FederationClient.SecurityToken(); err != nil {
return "", fmt.Errorf("failed to get security token: %s", err.Error())
}
return fmt.Sprintf("ST$%s", securityToken), nil
}
func (p *resourcePrincipalKeyProvider) Region() (string, error) {
return string(p.KeyProviderRegion), nil
}
var (
// ErrNonStringClaim is returned if the token has a claim for a key, but it's not a string value
ErrNonStringClaim = errors.New("claim does not have a string value")
)
func (p *resourcePrincipalKeyProvider) TenancyOCID() (string, error) {
if claim, err := p.GetClaim(TenancyOCIDClaimKey); err != nil {
return "", err
} else if tenancy, ok := claim.(string); ok {
return tenancy, nil
} else {
return "", ErrNonStringClaim
}
}
func (p *resourcePrincipalKeyProvider) GetClaim(claim string) (interface{}, error) {
return p.FederationClient.GetClaim(claim)
}
func (p *resourcePrincipalKeyProvider) KeyFingerprint() (string, error) {
return "", nil
}
func (p *resourcePrincipalKeyProvider) UserOCID() (string, error) {
return "", nil
}
// By contract for the the content of a resource principal to be considered path, it needs to be
// an absolute path.
func isPath(str string) bool {
return path.IsAbs(str)
}