Documentation ¶
Index ¶
- Constants
- Variables
- func AuthenticationLoggingInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, ...) (interface{}, error)
- func GetAuthenticationCustomMetadataInterceptor(authCtx interfaces.AuthenticationContext) grpc.UnaryServerInterceptor
- func GetAuthenticationInterceptor(authContext interfaces.AuthenticationContext) func(context.Context) (context.Context, error)
- func GetCallbackHandler(ctx context.Context, authContext interfaces.AuthenticationContext) http.HandlerFunc
- func GetLoginHandler(ctx context.Context, authContext interfaces.AuthenticationContext) http.HandlerFunc
- func GetMeEndpointHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc
- func GetMetadataEndpointRedirectHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc
- func GetOauth2Config(options config.OAuthOptions) (oauth2.Config, error)
- func GetRefreshedToken(ctx context.Context, oauth *oauth2.Config, accessToken, refreshToken string) (*oauth2.Token, error)
- func HashCsrfState(csrf string) string
- func NewCsrfCookie() http.Cookie
- func NewCsrfToken(seed int64) string
- func NewRedirectCookie(ctx context.Context, redirectURL string) *http.Cookie
- func NewSecureCookie(cookieName, value string, hashKey, blockKey []byte) (http.Cookie, error)
- func ParseAndValidate(ctx context.Context, claims config.Claims, accessToken string, ...) (*oidc.IDToken, error)
- func ReadSecureCookie(ctx context.Context, cookie http.Cookie, hashKey, blockKey []byte) (string, error)
- func RefreshTokensIfExists(ctx context.Context, authContext interfaces.AuthenticationContext, ...) http.HandlerFunc
- func VerifyCsrfCookie(ctx context.Context, request *http.Request) error
- func WithUserEmail(ctx context.Context, email string) context.Context
- type Context
- func (c Context) Claims() config.Claims
- func (c Context) CookieManager() interfaces.CookieHandler
- func (c Context) GetBaseURL() *url.URL
- func (c Context) GetHTTPClient() *http.Client
- func (c Context) GetMetadataURL() *url.URL
- func (c Context) GetUserInfoURL() *url.URL
- func (c Context) OAuth2Config() *oauth2.Config
- func (c Context) OidcProvider() *oidc.Provider
- func (c Context) Options() config.OAuthOptions
- type CookieManager
- type CorsHandlerDecorator
- type HTTPRequestToMetadataAnnotator
- type UserInfoResponse
Constants ¶
const ( ErrAuthContext errors.ErrorCode = "AUTH_CONTEXT_SETUP_FAILED" ErrConfigFileRead errors.ErrorCode = "CONFIG_OPTION_FILE_READ_FAILED" )
const ( ErrSecureCookie errors.ErrorCode = "SECURE_COOKIE_ERROR" // #nosec ErrInvalidCsrfToken errors.ErrorCode = "CSRF_TOKEN_VALIDATION_FAILED" )
const ( ErrB64Decoding errors.ErrorCode = "BINARY_DECODING_FAILED" // #nosec ErrTokenNil errors.ErrorCode = "EMPTY_OAUTH_TOKEN" )
const ( ErrRefreshingToken errors.ErrorCode = "TOKEN_REFRESH_FAILURE" ErrTokenExpired errors.ErrorCode = "JWT_EXPIRED" ErrJwtValidation errors.ErrorCode = "JWT_VERIFICATION_FAILED" )
const AuthorizationResponseCodeType = "code"
const BearerScheme = "Bearer"
const CsrfFormKey = "state"
OAuth2 Parameters
const DefaultAuthorizationHeader = "authorization"
const (
ErrIdpClient errors.ErrorCode = "IDP_REQUEST_FAILED"
)
const (
IdpConnectionTimeout = 10 * time.Second
)
const (
LoginRedirectURLParameter = "redirect_url"
)
const MetadataEndpoint = ".well-known/oauth-authorization-server"
https://tools.ietf.org/html/rfc8414 This should be defined without a leading slash. If there is one, the url library's ResolveReference will make it a root path
const OfflineAccessType = "offline_access"
IDP specific
const OidcScope = "openid"
const ProfileScope = "profile"
const RefreshToken = "refresh_token"
Variables ¶
var AllowedChars = []rune("abcdefghijklmnopqrstuvwxyz1234567890")
Functions ¶
func AuthenticationLoggingInterceptor ¶
func AuthenticationLoggingInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error)
func GetAuthenticationCustomMetadataInterceptor ¶
func GetAuthenticationCustomMetadataInterceptor(authCtx interfaces.AuthenticationContext) grpc.UnaryServerInterceptor
This function produces a gRPC middleware interceptor intended to be used when running authentication with non-default gRPC headers (metadata). Because the default `authorization` header is reserved for use by Envoy, clients wishing to pass tokens to Admin will need to use a different string, specified in this package's Config object. This interceptor will scan for that arbitrary string, and then rename it to the default string, which the downstream auth/auditing interceptors will detect and validate.
func GetAuthenticationInterceptor ¶
func GetAuthenticationInterceptor(authContext interfaces.AuthenticationContext) func(context.Context) (context.Context, error)
This function will only look for a token from the request metadata, verify it, and extract the user email if valid. Unless there is an error, it will not return an unauthorized status. That is up to subsequent functions to decide, based on configuration. We don't want to require authentication for all endpoints.
func GetCallbackHandler ¶
func GetCallbackHandler(ctx context.Context, authContext interfaces.AuthenticationContext) http.HandlerFunc
func GetLoginHandler ¶
func GetLoginHandler(ctx context.Context, authContext interfaces.AuthenticationContext) http.HandlerFunc
func GetMeEndpointHandler ¶
func GetMeEndpointHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc
TODO: Add this to the Admin service IDL in Flyte IDL so that this can be exposed from gRPC as well. This returns a handler that will retrieve user info, from the OAuth2 authorization server. See the OpenID Connect spec at https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse for more information.
func GetMetadataEndpointRedirectHandler ¶
func GetMetadataEndpointRedirectHandler(ctx context.Context, authCtx interfaces.AuthenticationContext) http.HandlerFunc
This returns a handler that will redirect (303) to the well-known metadata endpoint for the OAuth2 authorization server See https://tools.ietf.org/html/rfc8414 for more information.
func GetOauth2Config ¶
func GetOauth2Config(options config.OAuthOptions) (oauth2.Config, error)
This creates a oauth2 library config object, with values from the Flyte Admin config
func GetRefreshedToken ¶
func GetRefreshedToken(ctx context.Context, oauth *oauth2.Config, accessToken, refreshToken string) (*oauth2.Token, error)
Refresh a JWT
func HashCsrfState ¶
func NewCsrfCookie ¶
func NewCsrfToken ¶
func NewRedirectCookie ¶
This function takes in a string and returns a cookie that's used to keep track of where to send the user after the OAuth2 login flow is complete.
func NewSecureCookie ¶
func ParseAndValidate ¶
func ReadSecureCookie ¶
func RefreshTokensIfExists ¶
func RefreshTokensIfExists(ctx context.Context, authContext interfaces.AuthenticationContext, handlerFunc http.HandlerFunc) http.HandlerFunc
Look for access token and refresh token, if both are present and the access token is expired, then attempt to refresh. Otherwise do nothing and proceed to the next handler. If successfully refreshed, proceed to the landing page.
Types ¶
type Context ¶
type Context struct {
// contains filtered or unexported fields
}
Please see the comment on the corresponding AuthenticationContext for more information.
func (Context) CookieManager ¶
func (c Context) CookieManager() interfaces.CookieHandler
func (Context) GetBaseURL ¶
func (Context) GetHTTPClient ¶
func (Context) GetMetadataURL ¶
func (Context) GetUserInfoURL ¶
func (Context) OAuth2Config ¶
func (Context) OidcProvider ¶
func (c Context) OidcProvider() *oidc.Provider
func (Context) Options ¶
func (c Context) Options() config.OAuthOptions
type CookieManager ¶
type CookieManager struct {
// contains filtered or unexported fields
}
func NewCookieManager ¶
func NewCookieManager(ctx context.Context, hashKeyEncoded, blockKeyEncoded string) (CookieManager, error)
func (CookieManager) RetrieveTokenValues ¶
func (c CookieManager) RetrieveTokenValues(ctx context.Context, request *http.Request) (accessToken string, refreshToken string, err error)
TODO: Separate refresh token from access token, remove named returns, and use stdlib errors.
func (CookieManager) SetTokenCookies ¶
func (c CookieManager) SetTokenCookies(ctx context.Context, writer http.ResponseWriter, token *oauth2.Token) error
type CorsHandlerDecorator ¶
These are here for CORS handling. Actual serving of the OPTIONS request will be done by the gorilla/handlers package
func GetCorsDecorator ¶
func GetCorsDecorator(ctx context.Context, allowedOrigins, allowedHeaders []string) CorsHandlerDecorator
This produces a decorator that, when applied to an existing Handler, will first test if the request is an appropriate options request, and if so, serve it. If not, the underlying handler will be called.
type HTTPRequestToMetadataAnnotator ¶
func GetHTTPRequestCookieToMetadataHandler ¶
func GetHTTPRequestCookieToMetadataHandler(authContext interfaces.AuthenticationContext) HTTPRequestToMetadataAnnotator
This is effectively middleware for the grpc gateway, it allows us to modify the translation between HTTP request and gRPC request. There are two potential sources for bearer tokens, it can come from an authorization header (not yet implemented), or encrypted cookies. Note that when deploying behind Envoy, you have the option to look for a configurable, non-standard header name. The token is extracted and turned into a metadata object which is then attached to the request, from which the token is extracted later for verification.
type UserInfoResponse ¶
type UserInfoResponse struct { Sub string `json:"sub"` Name string `json:"name"` PreferredUsername string `json:"preferred_username"` GivenName string `json:"given_name"` FamilyName string `json:"family_name"` Email string `json:"email"` Picture string `json:"picture"` }
This struct represents what should be returned by an IDP according to the specification at
https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
Keep in mind that not all fields are necessarily populated, and additional fields may be present as well. This is a sample response object returned from Okta for instance
{ "sub": "abc123", "name": "John Smith", "locale": "US", "preferred_username": "jsmith123@company.com", "given_name": "John", "family_name": "Smith", "zoneinfo": "America/Los_Angeles", "updated_at": 1568750854 }