github/paralus
1
0
Fork 0
mirror of https://github.com/paralus/paralus.git synced 2026-08-24 15:47:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add auth service

Browse Source
This commit is contained in:
Abin Simon
2022-05-09 10:13:05 +05:30
parent 721f995db6
commit 34ff1f6e32
5 changed files with 163 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.go
+10
View File
@@ -31,6 +31,7 @@ import (
sentryrpc "github.com/RafayLabs/rcloud-base/proto/rpc/sentry"
systemrpc "github.com/RafayLabs/rcloud-base/proto/rpc/system"
userrpc "github.com/RafayLabs/rcloud-base/proto/rpc/user"
authrpc "github.com/RafayLabs/rcloud-base/proto/rpc/v3"
"github.com/RafayLabs/rcloud-base/server"
"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
kclient "github.com/ory/kratos-client-go"
@@ -577,14 +578,17 @@ func runRPC(wg *sync.WaitGroup, ctx context.Context) {
}
var opts []_grpc.ServerOption
var asv authv3.AuthService
if !dev {
_log.Infow("adding auth interceptor")
ac := authv3.NewAuthContext(kc, ks, as)
asv = authv3.NewAuthService(ac)
o := authv3.Option{
ExcludeRPCMethods: []string{
"/rafay.dev.sentry.rpc.Bootstrap/GetBootstrapAgentTemplate",
"/rafay.dev.sentry.rpc.Bootstrap/RegisterBootstrapAgent",
"/rafay.dev.sentry.rpc.KubeConfig/GetForClusterWebSession", //TODO: enable auth from prompt
"/rafay.dev.rpc.v3.Auth/IsRequestAllowed",
},
ExcludeAuthzMethods: []string{
"/rafay.dev.rpc.v3.User/GetUserInfo",
@@ -625,6 +629,12 @@ func runRPC(wg *sync.WaitGroup, ctx context.Context) {
auditrpc.RegisterAuditLogServer(s, auditLogServer)
auditrpc.RegisterRelayAuditServer(s, relayAuditServer)
if !dev {
// if !dev, we should have the asv populated
authServer := server.NewAuthServer(asv)
authrpc.RegisterAuthServer(s, authServer)
}
_log.Infow("starting rpc server", "port", rpcPort)
err = s.Serve(l)
if err != nil {
pkg/auth/v3/interceptor.go
+1 -1
View File
@@ -110,7 +110,7 @@ func (ac authContext) NewAuthUnaryInterceptor(opt Option) grpc.UnaryServerInterc
NoAuthz: noAuthz, // FIXME: any better way to do this?
}
res, err := ac.IsRequestAllowed(ctx, nil, acReq)
res, err := ac.IsRequestAllowed(ctx, acReq)
if err != nil {
_log.Errorf("Failed to authenticate a request: %s", err)
return nil, status.Error(codes.Internal, codes.Internal.String())
pkg/auth/v3/middleware.go
+111 -2
View File
@@ -9,12 +9,14 @@ import (
"github.com/RafayLabs/rcloud-base/internal/dao"
"github.com/RafayLabs/rcloud-base/pkg/common"
rpcv3 "github.com/RafayLabs/rcloud-base/proto/rpc/v3"
commonpbv3 "github.com/RafayLabs/rcloud-base/proto/types/commonpb/v3"
"github.com/uptrace/bun"
"github.com/uptrace/bun/dialect/pgdialect"
"github.com/uptrace/bun/driver/pgdriver"
"github.com/urfave/negroni"
"go.uber.org/zap"
grpc "google.golang.org/grpc"
)
type authMiddleware struct {
@@ -23,6 +25,12 @@ type authMiddleware struct {
opt Option
}
type remoteAuthMiddleware struct {
as rpcv3.AuthClient
db *bun.DB
opt Option
}
func NewAuthMiddleware(al *zap.Logger, opt Option) negroni.Handler {
// Initialize database
sqldb := sql.OpenDB(pgdriver.NewConnector(pgdriver.WithDSN(getDSN())))
@@ -33,6 +41,21 @@ func NewAuthMiddleware(al *zap.Logger, opt Option) negroni.Handler {
}
}
func NewRemoteAuthMiddleware(al *zap.Logger, as string, opt Option) negroni.Handler {
sqldb := sql.OpenDB(pgdriver.NewConnector(pgdriver.WithDSN(getDSN())))
conn, err := grpc.Dial(as, grpc.WithInsecure())
if err != nil {
_log.Fatal("Unable to connect to server", err)
}
client := rpcv3.NewAuthClient(conn)
return &remoteAuthMiddleware{
as: client,
opt: opt,
db: bun.NewDB(sqldb, pgdialect.New()),
}
}
func (am *authMiddleware) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
for _, ex := range am.opt.ExcludeURLs {
match, err := regexp.MatchString(ex, r.URL.Path)
@@ -83,7 +106,7 @@ func (am *authMiddleware) ServeHTTP(rw http.ResponseWriter, r *http.Request, nex
Project: poResp.Project,
Org: poResp.Organization,
}
res, err := am.ac.IsRequestAllowed(r.Context(), r, req)
res, err := am.ac.IsRequestAllowed(r.Context(), req)
if err != nil {
_log.Errorf("Failed to authenticate a request: %s", err)
http.Error(rw, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
@@ -93,7 +116,93 @@ func (am *authMiddleware) ServeHTTP(rw http.ResponseWriter, r *http.Request, nex
s := res.GetStatus()
switch s {
case commonpbv3.RequestStatus_RequestAllowed:
//udpate the session data response to be used within prompt
// update the session data response to be used within prompt
res.SessionData.Organization = poResp.OrganizationId
res.SessionData.Partner = poResp.PartnerId
res.SessionData.Project = &commonpbv3.ProjectData{
List: []*commonpbv3.ProjectRole{
{
ProjectId: poResp.ProjectId,
},
},
}
ctx := context.WithValue(r.Context(), common.SessionDataKey, res.SessionData)
next(rw, r.WithContext(ctx))
return
case commonpbv3.RequestStatus_RequestMethodOrURLNotAllowed:
http.Error(rw, res.GetReason(), http.StatusForbidden)
return
case commonpbv3.RequestStatus_RequestNotAuthenticated:
http.Error(rw, res.GetReason(), http.StatusUnauthorized)
return
}
// status is unknown
http.Error(rw, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
}
// Same as previous ServeHTTP, just using remoteAuthMiddleware instead of authMiddleware
func (am *remoteAuthMiddleware) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
for _, ex := range am.opt.ExcludeURLs {
match, err := regexp.MatchString(ex, r.URL.Path)
if err != nil {
_log.Errorf("failed to match URL expression", err)
http.Error(rw, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
if match {
next(rw, r)
return
}
}
// Auth is primarily done via grpc endpoints, this is only used
// for endoints which do not go through grpc As of now, it is just
// prompt.
var poResp dao.ProjectOrg
if strings.HasPrefix(r.URL.String(), "/v2/debug/prompt/project/") {
// /v2/debug/prompt/project/:project/cluster/:cluster_name
splits := strings.Split(r.URL.String(), "/")
if len(splits) > 5 {
// we have to fetch the org info for casbin
res, err := dao.GetProjectOrganization(r.Context(), am.db, splits[5])
if err != nil {
_log.Errorf("Failed to authenticate: unable to find project")
http.Error(rw, http.StatusText(http.StatusForbidden), http.StatusForbidden)
return
}
_log.Info("found project with organization ", res.Organization)
poResp = res
}
} else {
// The middleware to only used with routes which does not have
// a grpc and so fail for any other requests.
_log.Errorf("Failed to authenticate: not a prompt request")
http.Error(rw, http.StatusText(http.StatusForbidden), http.StatusForbidden)
return
}
req := &commonpbv3.IsRequestAllowedRequest{
Url: r.URL.String(),
Method: r.Method,
XSessionToken: r.Header.Get("X-Session-Token"),
XApiKey: r.Header.Get("X-API-KEYID"),
XApiToken: r.Header.Get("X-API-TOKEN"),
Cookie: r.Header.Get("Cookie"),
Project: poResp.Project,
Org: poResp.Organization,
}
res, err := am.as.IsRequestAllowed(r.Context(), req)
if err != nil {
_log.Errorf("Failed to authenticate a request: %s", err)
http.Error(rw, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
s := res.GetStatus()
switch s {
case commonpbv3.RequestStatus_RequestAllowed:
// update the session data response to be used within prompt
res.SessionData.Organization = poResp.OrganizationId
res.SessionData.Partner = poResp.PartnerId
res.SessionData.Project = &commonpbv3.ProjectData{
pkg/auth/v3/service.go
+19 -5
View File
@@ -5,7 +5,6 @@ import (
"crypto/md5"
"encoding/base64"
"errors"
"net/http"
"strings"
rpcv3 "github.com/RafayLabs/rcloud-base/proto/rpc/user"
@@ -20,14 +19,30 @@ var (
ErrInvalidSignature = errors.New("invalid signature")
)
func (ac *authContext) IsRequestAllowed(ctx context.Context, httpreq *http.Request, req *commonv3.IsRequestAllowedRequest) (*commonv3.IsRequestAllowedResponse, error) {
type authService struct {
ac authContext
}
type AuthService interface {
IsRequestAllowed(context.Context, *commonv3.IsRequestAllowedRequest) (*commonv3.IsRequestAllowedResponse, error)
}
func NewAuthService(ac authContext) AuthService {
return &authService{ac}
}
func (s *authService) IsRequestAllowed(ctx context.Context, req *commonv3.IsRequestAllowedRequest) (*commonv3.IsRequestAllowedResponse, error) {
return s.ac.IsRequestAllowed(ctx, req)
}
func (ac *authContext) IsRequestAllowed(ctx context.Context, req *commonv3.IsRequestAllowedRequest) (*commonv3.IsRequestAllowedResponse, error) {
res := &commonv3.IsRequestAllowedResponse{
Status: commonv3.RequestStatus_Unknown,
SessionData: &commonv3.SessionData{},
}
// Authenticate request
succ, err := ac.authenticate(ctx, httpreq, req, res)
succ, err := ac.authenticate(ctx, req, res)
if err != nil {
return nil, err
}
@@ -57,7 +72,7 @@ func getTokenCheckSum(body []byte) string {
// authenticate validate whether the request is from a legitimate user
// and populate relevant information in res.
func (ac *authContext) authenticate(ctx context.Context, httpreq *http.Request, req *commonv3.IsRequestAllowedRequest, res *commonv3.IsRequestAllowedResponse) (bool, error) {
func (ac *authContext) authenticate(ctx context.Context, req *commonv3.IsRequestAllowedRequest, res *commonv3.IsRequestAllowedResponse) (bool, error) {
if len(req.XApiKey) > 0 && len(req.XSessionToken) == 0 {
resp, err := ac.ks.GetByKey(ctx, &rpcv3.ApiKeyRequest{
Id: req.XApiKey,
@@ -92,7 +107,6 @@ func (ac *authContext) authenticate(ctx context.Context, httpreq *http.Request,
res.Status = commonv3.RequestStatus_RequestAllowed
res.SessionData.Account = session.Identity.GetId()
// TODO: Better way to access traits
t := session.Identity.Traits.(map[string]interface{})
res.SessionData.Username = t["email"].(string)
} else {
server/auth.go
+22
View File
@@ -0,0 +1,22 @@
package server
import (
"context"
authv3 "github.com/RafayLabs/rcloud-base/pkg/auth/v3"
rpcv3 "github.com/RafayLabs/rcloud-base/proto/rpc/v3"
v3 "github.com/RafayLabs/rcloud-base/proto/types/commonpb/v3"
)
type authServer struct {
as authv3.AuthService
}
// NewAuthServer returns new auth server implementation
func NewAuthServer(as authv3.AuthService) rpcv3.AuthServer {
return &authServer{as}
}
func (s *authServer) IsRequestAllowed(ctx context.Context, ira *v3.IsRequestAllowedRequest) (*v3.IsRequestAllowedResponse, error) {
return s.as.IsRequestAllowed(ctx, ira)
}