forked from micro/micro
-
Notifications
You must be signed in to change notification settings - Fork 0
/
auth.go
418 lines (359 loc) · 12.1 KB
/
auth.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
package handler
import (
"context"
"encoding/json"
"fmt"
"strings"
"sync"
"time"
"github.com/google/uuid"
pb "github.com/tickoalcantara12/micro/v3/proto/auth"
"github.com/tickoalcantara12/micro/v3/service/auth"
"github.com/tickoalcantara12/micro/v3/service/errors"
"github.com/tickoalcantara12/micro/v3/service/logger"
"github.com/tickoalcantara12/micro/v3/service/store"
authns "github.com/tickoalcantara12/micro/v3/util/auth/namespace"
"github.com/tickoalcantara12/micro/v3/util/auth/token"
"github.com/tickoalcantara12/micro/v3/util/auth/token/basic"
"github.com/tickoalcantara12/micro/v3/util/namespace"
"golang.org/x/crypto/bcrypt"
)
const (
storePrefixAccounts = "account"
storePrefixRefreshTokens = "refresh"
// used to enable login with username rather than ID (username can change e.g. email, id is stable)
storePrefixAccountsByName = "accountByName"
)
var defaultAccount = auth.Account{
ID: "admin",
Type: "user",
Scopes: []string{"admin"},
Secret: "micro",
Metadata: map[string]string{},
}
// Auth processes RPC calls
type Auth struct {
Options auth.Options
TokenProvider token.Provider
namespaces map[string]bool
sync.Mutex
// Prevent the generation of default accounts
DisableAdmin bool
}
// Init the auth
func (a *Auth) Init(opts ...auth.Option) {
for _, o := range opts {
o(&a.Options)
}
// setup a token provider
if a.TokenProvider == nil {
a.TokenProvider = basic.NewTokenProvider(token.WithStore(store.DefaultStore))
}
}
func (a *Auth) setupDefaultAccount(ns string) error {
if ns != namespace.DefaultNamespace {
return nil
}
if a.DisableAdmin {
return nil
}
a.Lock()
defer a.Unlock()
// setup the namespace cache if not yet done
if a.namespaces == nil {
a.namespaces = make(map[string]bool)
}
// check to see if the default account has already been verified
if _, ok := a.namespaces[ns]; ok {
return nil
}
// check to see if we need to create the default account
prefix := strings.Join([]string{storePrefixAccounts, ns, ""}, joinKey)
recs, err := store.Read(prefix, store.ReadPrefix())
if err != nil {
return err
}
hasUser := false
for _, rec := range recs {
acc := &auth.Account{}
err := json.Unmarshal(rec.Value, acc)
if err != nil {
return err
}
if acc.Type == "user" {
hasUser = true
break
}
}
// create the account if none exist in the namespace
if !hasUser {
acc := defaultAccount
acc.Issuer = ns
acc.Metadata["created"] = fmt.Sprintf("%d", time.Now().Unix())
if err := a.createAccount(&acc); err != nil {
return err
}
}
// set the namespace in the cache
a.namespaces[ns] = true
return nil
}
// Generate an account
func (a *Auth) Generate(ctx context.Context, req *pb.GenerateRequest, rsp *pb.GenerateResponse) error {
// validate the request
if len(req.Id) == 0 {
return errors.BadRequest("auth.Auth.Generate", "ID required")
}
// set the defaults
if len(req.Type) == 0 {
req.Type = "user"
}
if len(req.Secret) == 0 {
req.Secret = uuid.New().String()
}
if req.Options == nil {
req.Options = &pb.Options{}
}
if len(req.Options.Namespace) == 0 {
req.Options.Namespace = namespace.FromContext(ctx)
}
// authorize the request
if err := authns.AuthorizeAdmin(ctx, req.Options.Namespace, "auth.Auth.Generate"); err != nil {
return err
}
// check the user does not already exists
key := strings.Join([]string{storePrefixAccounts, req.Options.Namespace, req.Id}, joinKey)
if _, err := store.Read(key); err != store.ErrNotFound {
return errors.BadRequest("auth", "Account with this ID already exists")
}
// construct the account
acc := &auth.Account{
ID: req.Id,
Type: req.Type,
Scopes: req.Scopes,
Metadata: req.Metadata,
Issuer: req.Options.Namespace,
Secret: req.Secret,
Name: req.Name,
}
// create the account
if err := a.createAccount(acc); err != nil {
return err
}
// return the account
rsp.Account = serializeAccount(acc)
rsp.Account.Secret = req.Secret // return unhashed secret
return nil
}
func (a *Auth) createAccount(acc *auth.Account) error {
// check the user does not already exists
key := strings.Join([]string{storePrefixAccounts, acc.Issuer, acc.ID}, joinKey)
if _, err := store.Read(key); err != store.ErrNotFound {
return errors.BadRequest("auth.Auth.Generate", "Account with this ID already exists")
}
if acc.Metadata == nil {
acc.Metadata = map[string]string{
"created": fmt.Sprintf("%d", time.Now().Unix()),
}
}
// set created time if not defined
if _, ok := acc.Metadata["created"]; !ok {
acc.Metadata["created"] = fmt.Sprintf("%d", time.Now().Unix())
}
if acc.Name == "" {
acc.Name = acc.ID
}
usernameKey := strings.Join([]string{storePrefixAccountsByName, acc.Issuer, acc.Name}, joinKey)
if _, err := store.Read(usernameKey); err != store.ErrNotFound {
return errors.BadRequest("auth.Auth.Generate", "Account with this Name already exists")
}
// hash the secret
secret, err := hashSecret(acc.Secret)
if err != nil {
return errors.InternalServerError("auth.Auth.Generate", "Unable to hash password: %v", err)
}
acc.Secret = secret
// marshal to json
bytes, err := json.Marshal(acc)
if err != nil {
return errors.InternalServerError("auth.Auth.Generate", "Unable to marshal json: %v", err)
}
// write to the store
if err := store.Write(&store.Record{Key: key, Value: bytes}); err != nil {
return errors.InternalServerError("auth.Auth.Generate", "Unable to write account to store: %v", err)
}
if err := store.Write(&store.Record{Key: usernameKey, Value: bytes}); err != nil {
return errors.InternalServerError("auth.Auth.Generate", "Unable to write account to store: %v", err)
}
// set a refresh token
if err := a.setRefreshToken(acc.Issuer, acc.ID, uuid.New().String()); err != nil {
return errors.InternalServerError("auth.Auth.Generate", "Unable to set a refresh token: %v", err)
}
return nil
}
// Inspect a token and retrieve the account
func (a *Auth) Inspect(ctx context.Context, req *pb.InspectRequest, rsp *pb.InspectResponse) error {
acc, err := a.TokenProvider.Inspect(req.Token)
if err == token.ErrInvalidToken || err == token.ErrNotFound {
return errors.BadRequest("auth.Auth.Inspect", err.Error())
} else if err != nil {
return errors.InternalServerError("auth.Auth.Inspect", "Unable to inspect token: %v", err)
}
rsp.Account = serializeAccount(acc)
return nil
}
// Token generation using an account ID and secret
func (a *Auth) Token(ctx context.Context, req *pb.TokenRequest, rsp *pb.TokenResponse) error {
// set defaults
if req.Options == nil {
req.Options = &pb.Options{}
}
if len(req.Options.Namespace) == 0 {
req.Options.Namespace = namespace.DefaultNamespace
}
// setup the defaults incase none exist
err := a.setupDefaultAccount(req.Options.Namespace)
if err != nil {
// failing gracefully here
logger.Errorf("Error setting up default accounts: %v", err)
}
// validate the request
if (len(req.Id) == 0 || len(req.Secret) == 0) && len(req.RefreshToken) == 0 {
return errors.BadRequest("auth.Auth.Token", "Credentials or a refresh token required")
}
// check to see if the secret is a JWT. this is a workaround to allow accounts issued
// by the runtime to be refreshed whilst keeping the private key in the server.
if a.TokenProvider.String() == "jwt" {
jwt := req.Secret
if len(req.RefreshToken) > 0 {
jwt = req.RefreshToken
}
if acc, err := a.TokenProvider.Inspect(jwt); err == nil {
expiry := time.Duration(int64(time.Second) * req.TokenExpiry)
tok, _ := a.TokenProvider.Generate(acc, token.WithExpiry(expiry))
rsp.Token = serializeToken(tok, tok.Token)
return nil
}
}
// Declare the account id and refresh token
accountID := req.Id
refreshToken := req.RefreshToken
// If the refresh token is set, check this
if len(req.RefreshToken) > 0 {
accID, err := a.accountIDForRefreshToken(req.Options.Namespace, req.RefreshToken)
if err == store.ErrNotFound {
return errors.BadRequest("auth.Auth.Token", auth.ErrInvalidToken.Error())
} else if err != nil {
return errors.InternalServerError("auth.Auth.Token", "Unable to lookup token: %v", err)
}
accountID = accID
}
acc, err := a.getAccountForID(accountID, req.Options.Namespace, "auth.Auth.Token")
if err != nil {
return err
}
// If the refresh token was not used, validate the secrets match and then set the refresh token
// so it can be returned to the user
if len(req.RefreshToken) == 0 {
if !secretsMatch(acc.Secret, req.Secret) {
return errors.BadRequest("auth.Auth.Token", "Secret not correct")
}
refreshToken, err = a.refreshTokenForAccount(req.Options.Namespace, acc.ID)
if err != nil {
return errors.InternalServerError("auth.Auth.Token", "Unable to get refresh token: %v", err)
}
}
// Generate a new access token
duration := time.Duration(req.TokenExpiry) * time.Second
tok, err := a.TokenProvider.Generate(acc, token.WithExpiry(duration))
if err != nil {
return errors.InternalServerError("auth.Auth.Token", "Unable to generate token: %v", err)
}
rsp.Token = serializeToken(tok, refreshToken)
return nil
}
func (a *Auth) getAccountForID(id, namespace, errCode string) (*auth.Account, error) {
// Lookup the account in the store
key := strings.Join([]string{storePrefixAccounts, namespace, id}, joinKey)
recs, err := store.Read(key)
if err != nil && err != store.ErrNotFound {
return nil, errors.InternalServerError(errCode, "Unable to read from store: %v", err)
}
if err == store.ErrNotFound {
// maybe id is the username and not the actual ID
key = strings.Join([]string{storePrefixAccountsByName, namespace, id}, joinKey)
recs, err = store.Read(key)
if err == store.ErrNotFound {
return nil, errors.BadRequest(errCode, "Account not found with this ID")
}
if err != nil {
return nil, errors.InternalServerError(errCode, "Unable to read from store: %v", err)
}
}
// Unmarshal the record
var acc *auth.Account
if err := json.Unmarshal(recs[0].Value, &acc); err != nil {
return nil, errors.InternalServerError(errCode, "Unable to unmarshal account: %v", err)
}
return acc, nil
}
// set the refresh token for an account
func (a *Auth) setRefreshToken(ns, id, token string) error {
key := strings.Join([]string{storePrefixRefreshTokens, ns, id, token}, joinKey)
return store.Write(&store.Record{Key: key})
}
// get the refresh token for an account
func (a *Auth) refreshTokenForAccount(ns, id string) (string, error) {
prefix := strings.Join([]string{storePrefixRefreshTokens, ns, id, ""}, joinKey)
recs, err := store.Read(prefix, store.ReadPrefix())
if err != nil {
return "", err
} else if len(recs) == 0 {
return "", store.ErrNotFound
}
comps := strings.Split(recs[0].Key, "/")
if len(comps) != 4 {
return "", store.ErrNotFound
}
return comps[3], nil
}
// get the account ID for the given refresh token
func (a *Auth) accountIDForRefreshToken(ns, token string) (string, error) {
prefix := strings.Join([]string{storePrefixRefreshTokens, ns}, joinKey)
keys, err := store.List(store.ListPrefix(prefix))
if err != nil {
return "", err
}
for _, k := range keys {
if strings.HasSuffix(k, "/"+token) {
comps := strings.Split(k, "/")
if len(comps) != 4 {
return "", store.ErrNotFound
}
return comps[2], nil
}
}
return "", store.ErrNotFound
}
func serializeToken(t *token.Token, refresh string) *pb.Token {
return &pb.Token{
Created: t.Created.Unix(),
Expiry: t.Expiry.Unix(),
AccessToken: t.Token,
RefreshToken: refresh,
}
}
func hashSecret(s string) (string, error) {
saltedBytes := []byte(s)
hashedBytes, err := bcrypt.GenerateFromPassword(saltedBytes, bcrypt.DefaultCost)
if err != nil {
return "", err
}
hash := string(hashedBytes[:])
return hash, nil
}
func secretsMatch(hash string, s string) bool {
incoming := []byte(s)
existing := []byte(hash)
return bcrypt.CompareHashAndPassword(existing, incoming) == nil
}