forked from openshift/origin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
basic_auth.go
163 lines (130 loc) · 3.9 KB
/
basic_auth.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
package integration
import (
"crypto/tls"
"encoding/base64"
"encoding/json"
"io"
"net/http"
"net/http/httputil"
"net/url"
"strings"
"github.com/golang/glog"
"github.com/gorilla/context"
"k8s.io/kubernetes/pkg/util"
)
type User struct {
ID string
Password string
Name string
Email string
}
type BasicAuthChallenger struct {
realm string
users map[string]User
authenticatedHandler http.Handler
}
// NewBasicAuthChallenger provides a simple basic auth server that is compatible with our basic auth password validator
func NewBasicAuthChallenger(realm string, users []User, authenticatedHandler http.Handler) BasicAuthChallenger {
userMap := make(map[string]User, len(users))
for _, user := range users {
userMap[user.ID] = user
}
return BasicAuthChallenger{realm, userMap, authenticatedHandler}
}
func (challenger BasicAuthChallenger) ServeHTTP(w http.ResponseWriter, r *http.Request) {
glog.Infof("--- %v\n", r.URL)
authHeader := r.Header["Authorization"]
if len(authHeader) == 0 {
challenger.Challenge(w)
return
}
auth := strings.SplitN(authHeader[0], " ", 2)
if len(auth) != 2 || auth[0] != "Basic" {
Error("bad syntax", http.StatusBadRequest, w)
return
}
payload, err := base64.StdEncoding.DecodeString(auth[1])
if err != nil {
Error("bad syntax", http.StatusBadRequest, w)
return
}
pair := strings.SplitN(string(payload), ":", 2)
if len(pair) != 2 {
Error("bad syntax", http.StatusBadRequest, w)
return
}
if !challenger.Validate(pair[0], pair[1]) {
challenger.Challenge(w)
return
}
context.Set(r, "username", challenger.users[pair[0]])
challenger.authenticatedHandler.ServeHTTP(w, r)
}
func (challenger *BasicAuthChallenger) Challenge(w http.ResponseWriter) {
glog.Infof("Sending challenge\n")
w.Header().Set("WWW-Authenticate", "Basic realm=\""+challenger.realm+"\"")
Error("Authorization failed", http.StatusUnauthorized, w)
}
func Error(message string, status int, w http.ResponseWriter) {
glog.Infof("Writing error: %s\n", message)
data := map[string]string{"error": message}
json, _ := json.Marshal(data)
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(status)
io.WriteString(w, string(json))
}
func (challenger *BasicAuthChallenger) Validate(username, password string) bool {
knownUser, exists := challenger.users[username]
if !exists {
return false
}
if knownUser.Password == password {
glog.Infof("Validated user: %s\n", username)
return true
}
glog.Infof("Rejected user: %s\n", username)
return false
}
type identifyingHandler struct {
}
func (handler *identifyingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
user := context.Get(r, "username")
if user == nil {
Error("No user found", http.StatusBadRequest, w)
return
}
w.Header().Set("Content-Type", "application/json")
result, _ := json.Marshal(user)
io.WriteString(w, string(result))
}
func NewIdentifyingHandler() http.Handler {
return &identifyingHandler{}
}
type xRemoteUserProxyingHandler struct {
proxier *httputil.ReverseProxy
}
func (handler *xRemoteUserProxyingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
user := context.Get(r, "username")
if user == nil {
Error("No user found", http.StatusBadRequest, w)
return
}
r.Header.Add("X-Remote-User", user.(User).ID)
handler.proxier.ServeHTTP(w, r)
}
func NewXRemoteUserProxyingHandler(rawURL string) http.Handler {
parsedURL, _ := url.Parse(rawURL)
proxier := httputil.NewSingleHostReverseProxy(parsedURL)
proxier.Transport = insecureTransport()
// proxier.Transport = NewBasicAuthRoundTripper(http.DefaultTransport)
return &xRemoteUserProxyingHandler{proxier}
}
func insecureTransport() *http.Transport {
return util.SetTransportDefaults(&http.Transport{
TLSClientConfig: &tls.Config{
// Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability)
MinVersion: tls.VersionTLS10,
InsecureSkipVerify: true,
},
})
}