Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SAML SLO support #45379

Merged
merged 3 commits into from
Aug 12, 2024
Merged

SAML SLO support #45379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
682c689
extended auth provider types with flags for logout all support, i.e. …
andreas-kupries May 6, 2024
3f0c1b7
fixup: CI error `pkg/auth/providers/saml/saml_provider.go:152:4: fmt.…
andreas-kupries Aug 6, 2024
3b5168e
address comments - more internal docs, simplification, readability
andreas-kupries Aug 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 6 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,9 @@ toolchain go1.22.3

replace (
github.com/containerd/containerd => github.com/containerd/containerd v1.6.27 // for compatibilty with docker 20.10.x
github.com/crewjam/saml => github.com/rancher/saml v0.4.14-rancher3
andreas-kupries marked this conversation as resolved.
Show resolved Hide resolved
github.com/docker/distribution => github.com/docker/distribution v2.8.2+incompatible // rancher-machine requires a replace is set
github.com/docker/docker => github.com/docker/docker v20.10.27+incompatible // rancher-machine requires a repalce is set
github.com/docker/docker => github.com/docker/docker v20.10.27+incompatible // rancher-machine requires a replace is set

github.com/knative/pkg => github.com/rancher/pkg v0.0.0-20190514055449-b30ab9de040e
github.com/matryer/moq => github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77
Expand Down Expand Up @@ -89,7 +90,7 @@ require (
github.com/coreos/go-oidc/v3 v3.9.0
github.com/coreos/go-semver v0.3.1
github.com/creasty/defaults v1.5.2
github.com/crewjam/saml v0.4.14
github.com/crewjam/saml v0.0.0-00010101000000-000000000000
github.com/docker/distribution v2.8.3+incompatible
github.com/docker/docker v25.0.3+incompatible
github.com/docker/go-connections v0.5.0
Expand Down Expand Up @@ -285,7 +286,7 @@ require (
github.com/adrg/xdg v0.4.0 // indirect
github.com/apparentlymart/go-cidr v1.1.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/beevik/etree v1.1.0 // indirect
github.com/beevik/etree v1.2.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
Expand Down Expand Up @@ -338,7 +339,7 @@ require (
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/jmoiron/sqlx v1.3.5 // indirect
github.com/jonboulle/clockwork v0.2.2 // indirect
github.com/jonboulle/clockwork v0.3.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/compress v1.17.7 // indirect
Expand Down Expand Up @@ -382,7 +383,7 @@ require (
github.com/rogpeppe/go-internal v1.12.0 // indirect
github.com/rs/xid v1.2.1 // indirect
github.com/rubenv/sql-migrate v1.5.2 // indirect
github.com/russellhaering/goxmldsig v1.3.0 // indirect
github.com/russellhaering/goxmldsig v1.4.0
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/spf13/cast v1.6.0 // indirect
Expand Down
14 changes: 8 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -921,8 +921,9 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudr
github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
Expand Down Expand Up @@ -1021,8 +1022,6 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
github.com/creasty/defaults v1.5.2 h1:/VfB6uxpyp6h0fr7SPp7n8WJBoV8jfxQXPCnkVSjyls=
github.com/creasty/defaults v1.5.2/go.mod h1:FPZ+Y0WNrbqOVw+c6av63eyHUAl6pMHZwqLPvXUZGfY=
github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo=
github.com/cyphar/filepath-securejoin v0.2.5/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
Expand Down Expand Up @@ -1445,8 +1444,9 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfC
github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/jonboulle/clockwork v0.3.0 h1:9BSCMi8C+0qdApAp4auwX0RkLGUjs956h0EkuQymUhg=
github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
Expand Down Expand Up @@ -1793,6 +1793,8 @@ github.com/rancher/remotedialer v0.4.0 h1:T9yC5bFMsZFVQ6rK0dNrRg6rRb6Zr/4vsig8S0
github.com/rancher/remotedialer v0.4.0/go.mod h1:Ys004RpJuTLSm+k4aYUCoFiOOad37ubYev3TkOFg/5w=
github.com/rancher/rke v1.6.0 h1:fHdygmtPF1cWXuiYXfwgG4hKvt0n4l57SwCxquRJSfs=
github.com/rancher/rke v1.6.0/go.mod h1:5xRbf3L8PxqJRhABjYRfaBqbpVqAnqyH3maUNQEuwvk=
github.com/rancher/saml v0.4.14-rancher3 h1:2NN6cPqm9FJeiT25x8+gLHWGdulsEak33cHRkGaJ5v0=
github.com/rancher/saml v0.4.14-rancher3/go.mod h1:S4+611dxnKt8z/ulbvaJzcgSHsuhjVc1QHNTcr1R7Fw=
github.com/rancher/shepherd v0.0.0-20240802212035-bdce62c2bc80 h1:/dkxdx/BGZOp7jN0QMUFHrldDOSV3UfxxPdDCjGMZrQ=
github.com/rancher/shepherd v0.0.0-20240802212035-bdce62c2bc80/go.mod h1:7qf+6wlqrQ2Bver/WPCFrT6ZnC0V3KLllOmd1pr8Was=
github.com/rancher/steve v0.0.0-20240709130809-47871606146c h1:PIaN0/KUyGcqEcT6GyjUidld2lgGkGxS4dmC3Je3dFs=
Expand Down Expand Up @@ -1825,8 +1827,8 @@ github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzFtS0=
github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
github.com/russellhaering/goxmldsig v1.3.0 h1:DllIWUgMy0cRUMfGiASiYEa35nsieyD3cigIwLonTPM=
github.com/russellhaering/goxmldsig v1.3.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
Expand Down
33 changes: 28 additions & 5 deletions pkg/apis/management.cattle.io/v3/authn_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,11 +201,16 @@ type AuthConfig struct {
metav1.TypeMeta `json:",inline" mapstructure:",squash"`
metav1.ObjectMeta `json:"metadata,omitempty" mapstructure:"metadata"`

Type string `json:"type" norman:"noupdate"`
Enabled bool `json:"enabled,omitempty"`
AccessMode string `json:"accessMode,omitempty" norman:"required,notnullable,type=enum,options=required|restricted|unrestricted"`
AllowedPrincipalIDs []string `json:"allowedPrincipalIds,omitempty" norman:"type=array[reference[principal]]"`
Status AuthConfigStatus `json:"status"`
Type string `json:"type" norman:"noupdate"`
Enabled bool `json:"enabled,omitempty"`
AccessMode string `json:"accessMode,omitempty" norman:"required,notnullable,type=enum,options=required|restricted|unrestricted"`
AllowedPrincipalIDs []string `json:"allowedPrincipalIds,omitempty" norman:"type=array[reference[principal]]"`

// Flag. True when the auth provider supports a `Logout All` operation.
// Currently only the SAML providers do, with their `Single Log Out` flow.
LogoutAllSupported bool `json:"logoutAllSupported,omitempty"`

Status AuthConfigStatus `json:"status"`
}

type AuthConfigStatus struct {
Expand Down Expand Up @@ -475,6 +480,16 @@ type FreeIpaTestAndApplyInput struct {
type SamlConfig struct {
AuthConfig `json:",inline" mapstructure:",squash"`

// Flag. True when the auth provider is configured to accept a `Logout All`
// operation. Can be set if and only if the provider supports `Logout All`
// (see AuthConfig.LogoutAllSupported).
LogoutAllEnabled bool `json:"logoutAllEnabled,omitempty"`

// Flag. Can be set if and only if `LogoutAllEnabled` (above) is set.
// When set `Logout All` is the only kind of logout accepted. A regular
// logout request will be rejected.
LogoutAllForced bool `json:"logoutAllForced,omitempty"`

IDPMetadataContent string `json:"idpMetadataContent" norman:"required"`
SpCert string `json:"spCert" norman:"required"`
SpKey string `json:"spKey" norman:"required,type=password"`
Expand All @@ -494,6 +509,14 @@ type SamlConfigTestOutput struct {
IdpRedirectURL string `json:"idpRedirectUrl"`
}

type SamlConfigLogoutInput struct {
FinalRedirectURL string `json:"finalRedirectUrl"`
}

type SamlConfigLogoutOutput struct {
IdpRedirectURL string `json:"idpRedirectUrl"`
}

type PingConfig struct {
SamlConfig `json:",inline" mapstructure:",squash"`
}
Expand Down
32 changes: 32 additions & 0 deletions pkg/apis/management.cattle.io/v3/zz_generated_deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

23 changes: 16 additions & 7 deletions pkg/auth/data/authconfig_data.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,23 +40,23 @@ func AuthConfigs(management *config.ManagementContext) error {
return err
}

if err := addAuthConfig(saml.PingName, client.PingConfigType, false, management); err != nil {
if err := addAuthConfigWithSLO(saml.PingName, client.PingConfigType, false, management); err != nil {
return err
}

if err := addAuthConfig(saml.ADFSName, client.ADFSConfigType, false, management); err != nil {
if err := addAuthConfigWithSLO(saml.ADFSName, client.ADFSConfigType, false, management); err != nil {
return err
}

if err := addAuthConfig(saml.KeyCloakName, client.KeyCloakConfigType, false, management); err != nil {
if err := addAuthConfigWithSLO(saml.KeyCloakName, client.KeyCloakConfigType, false, management); err != nil {
return err
}

if err := addAuthConfig(saml.OKTAName, client.OKTAConfigType, false, management); err != nil {
if err := addAuthConfigWithSLO(saml.OKTAName, client.OKTAConfigType, false, management); err != nil {
return err
}

if err := addAuthConfig(saml.ShibbolethName, client.ShibbolethConfigType, false, management); err != nil {
if err := addAuthConfigWithSLO(saml.ShibbolethName, client.ShibbolethConfigType, false, management); err != nil {
return err
}

Expand All @@ -80,6 +80,14 @@ func AuthConfigs(management *config.ManagementContext) error {
}

func addAuthConfig(name, aType string, enabled bool, management *config.ManagementContext) error {
return addAuthConfigCore(name, aType, enabled, false, management)
}

func addAuthConfigWithSLO(name, aType string, enabled bool, management *config.ManagementContext) error {
return addAuthConfigCore(name, aType, enabled, true, management)
}

func addAuthConfigCore(name, aType string, enabled, sloSupported bool, management *config.ManagementContext) error {
annotations := make(map[string]string)
if name == azure.Name {
annotations[azure.GraphEndpointMigratedAnnotation] = "true"
Expand All @@ -91,8 +99,9 @@ func addAuthConfig(name, aType string, enabled bool, management *config.Manageme
Name: name,
Annotations: annotations,
},
Type: aType,
Enabled: enabled,
Type: aType,
Enabled: enabled,
LogoutAllSupported: sloSupported,
})
if err != nil && !apierrors.IsAlreadyExists(err) {
return err
Expand Down
4 changes: 4 additions & 0 deletions pkg/auth/providers/providers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,10 @@ func Configure(ctx context.Context, mgmt *config.ScaledContext) {
defer confMu.Unlock()
userMGR := mgmt.UserManager
tokenMGR := tokens.NewManager(ctx, mgmt)

tokens.OnLogoutAll(saml.PerformSamlLogoutAll)
tokens.OnLogout(saml.PerformSamlLogout)

var p common.AuthProvider

p = local.Configure(ctx, mgmt, tokenMGR)
Expand Down
5 changes: 5 additions & 0 deletions pkg/auth/providers/saml/saml_actions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,10 +59,15 @@ func (s *Provider) testAndEnable(actionName string, action *types.Action, reques
}

logrus.Debugf("SAML [testAndEnable]: Setting clientState for SAML service provider %v", s.name)

finalRedirectURL := samlLogin.FinalRedirectURL
logrus.Debugf("SAML [testAndEnable]: Final redirect will be (%v)", finalRedirectURL)

provider.clientState.SetPath(provider.serviceProvider.AcsURL.Path)
provider.clientState.SetState(request.Response, request.Request, "Rancher_UserID", provider.userMGR.GetUser(request))
provider.clientState.SetState(request.Response, request.Request, "Rancher_FinalRedirectURL", finalRedirectURL)
provider.clientState.SetState(request.Response, request.Request, "Rancher_Action", testAndEnableAction)

idpRedirectURL, err := provider.HandleSamlLogin(request.Response, request.Request)
if err != nil {
return err
Expand Down