-
Notifications
You must be signed in to change notification settings - Fork 0
/
login.go
180 lines (159 loc) · 5.73 KB
/
login.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
package publicapi
import (
"context"
"encoding/json"
"io/ioutil"
"net/http"
"github.com/rancher/norman/httperror"
"github.com/rancher/norman/types"
"github.com/rancher/rancher/pkg/auth/providers"
"github.com/rancher/rancher/pkg/auth/providers/activedirectory"
"github.com/rancher/rancher/pkg/auth/providers/azure"
"github.com/rancher/rancher/pkg/auth/providers/github"
"github.com/rancher/rancher/pkg/auth/providers/ldap"
"github.com/rancher/rancher/pkg/auth/providers/local"
"github.com/rancher/rancher/pkg/auth/providers/saml"
"github.com/rancher/rancher/pkg/auth/tokens"
"github.com/rancher/types/apis/management.cattle.io/v3"
"github.com/rancher/types/apis/management.cattle.io/v3public"
"github.com/rancher/types/apis/management.cattle.io/v3public/schema"
"github.com/rancher/types/client/management/v3public"
"github.com/rancher/types/config"
"github.com/rancher/types/user"
"github.com/sirupsen/logrus"
)
const (
CookieName = "R_SESS"
)
func newLoginHandler(ctx context.Context, mgmt *config.ScaledContext) *loginHandler {
return &loginHandler{
userMGR: mgmt.UserManager,
tokenMGR: tokens.NewManager(ctx, mgmt),
}
}
type loginHandler struct {
userMGR user.Manager
tokenMGR *tokens.Manager
}
func (h *loginHandler) login(actionName string, action *types.Action, request *types.APIContext) error {
if actionName != "login" {
return httperror.NewAPIError(httperror.ActionNotAvailable, "")
}
w := request.Response
token, responseType, err := h.createLoginToken(request)
if err != nil {
// if user fails to authenticate, hide the details of the exact error. bad credentials will already be APIErrors
// otherwise, return a generic error message
if httperror.IsAPIError(err) {
return err
}
return httperror.WrapAPIError(err, httperror.ServerError, "Server error while authenticating")
}
if responseType == "cookie" {
tokenCookie := &http.Cookie{
Name: CookieName,
Value: token.ObjectMeta.Name + ":" + token.Token,
Secure: true,
Path: "/",
HttpOnly: true,
}
http.SetCookie(w, tokenCookie)
} else if responseType == "saml" {
return nil
} else {
tokenData, err := tokens.ConvertTokenResource(request.Schemas.Schema(&schema.PublicVersion, client.TokenType), token)
if err != nil {
return httperror.WrapAPIError(err, httperror.ServerError, "Server error while authenticating")
}
tokenData["token"] = token.ObjectMeta.Name + ":" + token.Token
request.WriteResponse(http.StatusCreated, tokenData)
}
return nil
}
func (h *loginHandler) createLoginToken(request *types.APIContext) (v3.Token, string, error) {
var userPrincipal v3.Principal
var groupPrincipals []v3.Principal
var providerToken string
logrus.Debugf("Create Token Invoked")
bytes, err := ioutil.ReadAll(request.Request.Body)
if err != nil {
logrus.Errorf("login failed with error: %v", err)
return v3.Token{}, "", httperror.NewAPIError(httperror.InvalidBodyContent, "")
}
generic := &v3public.GenericLogin{}
err = json.Unmarshal(bytes, generic)
if err != nil {
logrus.Errorf("unmarshal failed with error: %v", err)
return v3.Token{}, "", httperror.NewAPIError(httperror.InvalidBodyContent, "")
}
responseType := generic.ResponseType
description := generic.Description
ttl := generic.TTLMillis
var input interface{}
var providerName string
switch request.Type {
case client.LocalProviderType:
input = &v3public.BasicLogin{}
providerName = local.Name
case client.GithubProviderType:
input = &v3public.GithubLogin{}
providerName = github.Name
case client.ActiveDirectoryProviderType:
input = &v3public.BasicLogin{}
providerName = activedirectory.Name
case client.AzureADProviderType:
input = &v3public.AzureADLogin{}
providerName = azure.Name
case client.OpenLdapProviderType:
input = &v3public.BasicLogin{}
providerName = ldap.OpenLdapName
case client.FreeIpaProviderType:
input = &v3public.BasicLogin{}
providerName = ldap.FreeIpaName
case client.PingProviderType:
input = &v3public.SamlLoginInput{}
providerName = saml.PingName
case client.ADFSProviderType:
input = &v3public.SamlLoginInput{}
providerName = saml.ADFSName
case client.KeyCloakProviderType:
input = &v3public.SamlLoginInput{}
providerName = saml.KeyCloakName
case client.OKTAProviderType:
input = &v3public.SamlLoginInput{}
providerName = saml.OKTAName
default:
return v3.Token{}, "", httperror.NewAPIError(httperror.ServerError, "unknown authentication provider")
}
err = json.Unmarshal(bytes, input)
if err != nil {
logrus.Errorf("unmarshal failed with error: %v", err)
return v3.Token{}, "", httperror.NewAPIError(httperror.InvalidBodyContent, "")
}
// Authenticate User
// SAML's login flow is different from the other providers. Unlike the other providers, it gets the logged in user's data via a POST from
// the identity provider on a separate endpoint specifically for that.
if providerName == saml.PingName || providerName == saml.ADFSName || providerName == saml.KeyCloakName ||
providerName == saml.OKTAName {
err = saml.PerformSamlLogin(providerName, request, input)
return v3.Token{}, "saml", err
}
userPrincipal, groupPrincipals, providerToken, err = providers.AuthenticateUser(input, providerName)
if err != nil {
return v3.Token{}, "", err
}
logrus.Debug("User Authenticated")
displayName := userPrincipal.DisplayName
if displayName == "" {
displayName = userPrincipal.LoginName
}
user, err := h.userMGR.EnsureUser(userPrincipal.Name, displayName)
if err != nil {
return v3.Token{}, "", err
}
if user.Enabled != nil && !*user.Enabled {
return v3.Token{}, "", httperror.NewAPIError(httperror.PermissionDenied, "Permission Denied")
}
rToken, err := h.tokenMGR.NewLoginToken(user.Name, userPrincipal, groupPrincipals, providerToken, ttl, description)
return rToken, responseType, err
}