Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: implement allowlist to skip authentication #9

Merged
merged 5 commits into from
Jan 12, 2022
Merged

feat: implement allowlist to skip authentication #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e955a9f
feat: implement allowlist to skip authentication
wsalles Jan 6, 2022
e8fe829
refactoring: update go-core v0.4.0
wsalles Jan 11, 2022
851f365
bug fix
wsalles Jan 12, 2022
b7fa877
renamed: from allowlist to skip
wsalles Jan 12, 2022
73cff95
fix typo
wsalles Jan 12, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,6 @@ func main() {
logger.Info("Starting: Authentication Service")

oidcClient := clients.NewOAuth2OIDCClient(logger, oidcClientConfiguration)
// Start OIDC Provider setup.
oidcClient.StartSetup()

// Initializes a storage to save temporary sessions configured with TTL.
sessionStorage := storages.NewSessionStorage()
Expand All @@ -64,7 +62,9 @@ func main() {

httpServer := server.NewServer(logger, serverConfiguration)
restController.Boot(httpServer)
httpServer.Run(context.Background())

// Run HTTP Server and start setup the OIDC Provider.
httpServer.Run(context.Background(), oidcClient.StartSetup)

// HealthCheck
httpServer.AddHealthz()
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ require (
github.com/golang-jwt/jwt/v4 v4.2.0
github.com/kelseyhightower/envconfig v1.4.0
github.com/stretchr/testify v1.7.0
github.com/ydataai/go-core v0.2.1
github.com/ydataai/go-core v0.4.0
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
)

Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -471,8 +471,8 @@ github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVM
github.com/ugorji/go/codec v1.1.7 h1:2SvQaVZ1ouYrrKKwoSk2pzd4A9evlKJb9oTL+OaLUSs=
github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
github.com/ydataai/go-core v0.2.1 h1:ZQoL04MyUa+3Qsrzzfqbg2g2NpmIeiBjCElgr3bceu8=
github.com/ydataai/go-core v0.2.1/go.mod h1:tdL95U51Wzr0GJvYsVXk4oNXz7P0NiVxc574NnhcLq4=
github.com/ydataai/go-core v0.4.0 h1:ZkI09itxvi+q5ctboTAvQWALS7lWjdedM29a+k4Vu0c=
github.com/ydataai/go-core v0.4.0/go.mod h1:zrMbN0hjPUPjs3O+z3yKwNtvsl9ioPhhn8aSBfcJ0Jw=
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
Expand Down
1 change: 1 addition & 0 deletions internal/configurations/rest_controller_configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ type RESTControllerConfiguration struct {
HTTPRequestTimeout time.Duration `envconfig:"HTTP_REQUEST_TIMEOUT" default:"30s"`
UserIDHeader string `envconfig:"USER_ID_HEADER" default:"userid"`
CookieMaxAge int `envconfig:"COOKIE_MAX_AGE" default:"86400"`
SkipURLs []string `envconfig:"SKIP_URLS" default:"/dex" split_words:"true"`
}

// LoadFromEnvVars reads all env vars.
Expand Down
22 changes: 21 additions & 1 deletion internal/controllers/rest_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"context"
"encoding/json"
"net/http"
"strings"
"time"

"github.com/gin-gonic/gin"
Expand Down Expand Up @@ -42,9 +43,14 @@ func NewRESTController(

// Boot initializes creating some routes.
func (rc RESTController) Boot(s *server.Server) {
s.Router.Use(rc.skipURLsMiddleware())

s.Router.GET(rc.configuration.AuthServiceURL, gin.WrapF(rc.CheckForAuthentication))
s.Router.GET(rc.configuration.OIDCCallbackURL, gin.WrapF(rc.OIDCProviderCallback))
s.Router.GET(rc.configuration.LogoutURL, gin.WrapF(rc.Logout))
s.Router.POST(rc.configuration.LogoutURL, gin.WrapF(rc.Logout))

s.Router.Any("/:forward", gin.WrapF(rc.CheckForAuthentication))
s.Router.Any("/:forward/*any", gin.WrapF(rc.CheckForAuthentication))
}

// CheckForAuthentication is responsible for knowing if the user already has a valid credential or not.
Expand Down Expand Up @@ -186,3 +192,17 @@ func (rc RESTController) forbiddenResponse(w http.ResponseWriter, err error) {
}
json.NewEncoder(w).Encode(jsonBody)
}

// skipURLsMiddleware is a middleware that skips all requests configured in SKIP_URL.
func (rc RESTController) skipURLsMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
for _, skipURL := range rc.configuration.SkipURLs {
if strings.HasPrefix(c.Request.URL.Path, skipURL) {
rc.logger.Infof("URL %s was skipped. Accepted without authorization.", c.Request.URL.Path)
c.Abort()
return
}
}
c.Next()
}
}