-
Notifications
You must be signed in to change notification settings - Fork 197
/
local_authenticator.go
147 lines (124 loc) · 4.27 KB
/
local_authenticator.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
package auth
import (
"crypto"
"net/http"
"time"
"github.com/go-openapi/runtime"
"github.com/go-openapi/runtime/security"
"github.com/go-openapi/strfmt"
"github.com/golang-jwt/jwt/v4"
"github.com/openshift/assisted-service/internal/common"
"github.com/openshift/assisted-service/internal/gencrypto"
"github.com/openshift/assisted-service/pkg/ocm"
"github.com/patrickmn/go-cache"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"gorm.io/gorm"
)
type LocalAuthenticator struct {
cache *cache.Cache
db *gorm.DB
log logrus.FieldLogger
publicKey crypto.PublicKey
}
func NewLocalAuthenticator(cfg *Config, log logrus.FieldLogger, db *gorm.DB) (*LocalAuthenticator, error) {
if cfg.ECPublicKeyPEM == "" {
return nil, errors.Errorf("local authentication requires an ecdsa Public Key")
}
key, err := jwt.ParseECPublicKeyFromPEM([]byte(cfg.ECPublicKeyPEM))
if err != nil {
return nil, err
}
a := &LocalAuthenticator{
cache: cache.New(10*time.Minute, 30*time.Minute),
db: db,
log: log,
publicKey: key,
}
return a, nil
}
var _ Authenticator = &LocalAuthenticator{}
func (a *LocalAuthenticator) AuthType() AuthType {
return TypeLocal
}
func (a *LocalAuthenticator) EnableOrgTenancy() bool {
return false
}
func (a *LocalAuthenticator) EnableOrgBasedFeatureGates() bool {
return false
}
func (a *LocalAuthenticator) AuthAgentAuth(token string) (interface{}, error) {
t, err := validateToken(token, a.publicKey)
if err != nil {
a.log.WithError(err).Error("failed to validate token")
return nil, common.NewInfraError(http.StatusUnauthorized, err)
}
claims, ok := t.Claims.(jwt.MapClaims)
if !ok {
err := errors.Errorf("failed to parse JWT token claims")
a.log.Error(err)
return nil, common.NewInfraError(http.StatusUnauthorized, err)
}
infraEnvID, infraEnvOk := claims[string(gencrypto.InfraEnvKey)].(string)
clusterID, clusterOk := claims[string(gencrypto.ClusterKey)].(string)
if !infraEnvOk && !clusterOk {
err := errors.Errorf("claims are incorrectly formatted")
a.log.Error(err)
return nil, common.NewInfraError(http.StatusUnauthorized, err)
}
if infraEnvOk {
_, exists := a.cache.Get(infraEnvID)
if !exists {
if infraEnvExists(a.db, infraEnvID) {
a.cache.Set(infraEnvID, "", cache.DefaultExpiration)
} else {
err := errors.Errorf("infraEnv %s does not exist", infraEnvID)
return nil, common.NewInfraError(http.StatusUnauthorized, err)
}
}
a.log.Debugf("Authenticating infraEnv %s JWT", infraEnvID)
} else if clusterOk {
_, exists := a.cache.Get(clusterID)
if !exists {
if clusterExists(a.db, clusterID) {
a.cache.Set(clusterID, "", cache.DefaultExpiration)
} else {
err := errors.Errorf("Cluster %s does not exist", clusterID)
return nil, common.NewInfraError(http.StatusUnauthorized, err)
}
}
a.log.Debugf("Authenticating Cluster %s JWT", clusterID)
}
return ocm.AdminPayload(), nil
}
func (a *LocalAuthenticator) AuthUserAuth(_ string) (interface{}, error) {
return nil, common.NewInfraError(http.StatusUnauthorized, errors.Errorf("User Authentication not allowed for local auth"))
}
func (a *LocalAuthenticator) AuthURLAuth(token string) (interface{}, error) {
return a.AuthAgentAuth(token)
}
func (a *LocalAuthenticator) AuthImageAuth(_ string) (interface{}, error) {
return nil, common.NewInfraError(http.StatusUnauthorized, errors.Errorf("Image Authentication not allowed for local auth"))
}
func (a *LocalAuthenticator) CreateAuthenticator() func(_, _ string, _ security.TokenAuthentication) runtime.Authenticator {
return security.APIKeyAuth
}
func validateToken(token string, pub crypto.PublicKey) (*jwt.Token, error) {
parser := &jwt.Parser{ValidMethods: []string{jwt.SigningMethodES256.Alg()}}
parsed, err := parser.Parse(token, func(t *jwt.Token) (interface{}, error) { return pub, nil })
if err != nil {
return nil, errors.Errorf("Failed to parse token: %v\n", err)
}
if !parsed.Valid {
return nil, errors.Errorf("Invalid token")
}
return parsed, nil
}
func clusterExists(db *gorm.DB, clusterID string) bool {
_, err := common.GetClusterFromDB(db, strfmt.UUID(clusterID), common.SkipEagerLoading)
return err == nil
}
func infraEnvExists(db *gorm.DB, infraEnvID string) bool {
_, err := common.GetInfraEnvFromDB(db, strfmt.UUID(infraEnvID))
return err == nil
}