-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #97 from tupyy/auth
auth: Add a simple RHSSO authentication
- Loading branch information
Showing
10 changed files
with
407 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "github.com/kubev2v/migration-planner/internal/config" | ||
| ) | ||
|
|
||
| type Authenticator interface { | ||
| Authenticator(next http.Handler) http.Handler | ||
| } | ||
|
|
||
| const ( | ||
| RHSSOAuthentication string = "rhsso" | ||
| NoneAuthentication string = "none" | ||
| ) | ||
|
|
||
| func NewAuthenticator(authConfig config.Auth) (Authenticator, error) { | ||
| switch authConfig.AuthenticationType { | ||
| case RHSSOAuthentication: | ||
| return NewRHSSOAuthenticator(authConfig.JwtCertUrl) | ||
| default: | ||
| return NewNoneAuthenticator() | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package auth_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| ) | ||
|
|
||
| func TestAuth(t *testing.T) { | ||
| RegisterFailHandler(Fail) | ||
| RunSpecs(t, "Auth Suite") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "go.uber.org/zap" | ||
| ) | ||
|
|
||
| type NoneAuthenticator struct{} | ||
|
|
||
| func NewNoneAuthenticator() (*NoneAuthenticator, error) { | ||
| return &NoneAuthenticator{}, nil | ||
| } | ||
|
|
||
| func (n *NoneAuthenticator) Authenticator(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| zap.S().Named("auth").Info("authentication disabled") | ||
|
|
||
| user := User{ | ||
| Username: "admin", | ||
| Organization: "internal", | ||
| } | ||
| ctx := newContext(r.Context(), user) | ||
| next.ServeHTTP(w, r.WithContext(ctx)) | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "net/http" | ||
| "time" | ||
|
|
||
| keyfunc "github.com/MicahParks/keyfunc/v3" | ||
| "github.com/golang-jwt/jwt/v5" | ||
| "go.uber.org/zap" | ||
| ) | ||
|
|
||
| type RHSSOAuthenticator struct { | ||
| keyFn func(t *jwt.Token) (any, error) | ||
| } | ||
|
|
||
| func NewRHSSOAuthenticatorWithKeyFn(keyFn func(t *jwt.Token) (any, error)) (*RHSSOAuthenticator, error) { | ||
| return &RHSSOAuthenticator{keyFn: keyFn}, nil | ||
| } | ||
|
|
||
| func NewRHSSOAuthenticator(jwkCertUrl string) (*RHSSOAuthenticator, error) { | ||
| ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
| defer cancel() | ||
|
|
||
| k, err := keyfunc.NewDefaultCtx(ctx, []string{jwkCertUrl}) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to get sso public keys: %w", err) | ||
| } | ||
|
|
||
| return &RHSSOAuthenticator{keyFn: k.Keyfunc}, nil | ||
| } | ||
|
|
||
| func (rh *RHSSOAuthenticator) Authenticate(token string) (User, error) { | ||
| parser := jwt.NewParser(jwt.WithValidMethods([]string{jwt.SigningMethodRS256.Name}), jwt.WithIssuedAt(), jwt.WithExpirationRequired()) | ||
| t, err := parser.Parse(token, rh.keyFn) | ||
| if err != nil { | ||
| zap.S().Errorw("failed to parse or the token is invalid", "token", token) | ||
| return User{}, fmt.Errorf("failed to authenticate token: %w", err) | ||
| } | ||
|
|
||
| if !t.Valid { | ||
| zap.S().Errorw("failed to parse or the token is invalid", "token", token) | ||
| return User{}, fmt.Errorf("failed to parse or validate token") | ||
| } | ||
|
|
||
| return rh.parseToken(t) | ||
| } | ||
|
|
||
| func (rh *RHSSOAuthenticator) parseToken(userToken *jwt.Token) (User, error) { | ||
| claims, ok := userToken.Claims.(jwt.MapClaims) | ||
| if !ok { | ||
| return User{}, errors.New("failed to parse jwt token claims") | ||
| } | ||
|
|
||
| return User{ | ||
| Username: claims["username"].(string), | ||
| Organization: claims["org_id"].(string), | ||
| ClientID: claims["client_id"].(string), | ||
| }, nil | ||
| } | ||
|
|
||
| func (rh *RHSSOAuthenticator) Authenticator(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| accessToken := r.Header.Get("Authorization") | ||
| if accessToken == "" || len(accessToken) < len("Bearer ") { | ||
| http.Error(w, "No token provided", http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| accessToken = accessToken[len("Bearer "):] | ||
| user, err := rh.Authenticate(accessToken) | ||
| if err != nil { | ||
| http.Error(w, "authentication failed", http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| ctx := newContext(r.Context(), user) | ||
| next.ServeHTTP(w, r.WithContext(ctx)) | ||
| }) | ||
| } |
Oops, something went wrong.