OP#792 initial commit after fork
This commit is contained in:
514
internal/config/identity/plugin/config.go
Normal file
514
internal/config/identity/plugin/config.go
Normal file
@@ -0,0 +1,514 @@
|
||||
// Copyright (c) 2015-2022 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package plugin
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/sha1"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/minio/minio/internal/arn"
|
||||
"github.com/minio/minio/internal/config"
|
||||
"github.com/minio/minio/internal/logger"
|
||||
"github.com/minio/pkg/v3/env"
|
||||
xnet "github.com/minio/pkg/v3/net"
|
||||
)
|
||||
|
||||
func authNLogIf(ctx context.Context, err error) {
|
||||
logger.LogIf(ctx, "authN", err)
|
||||
}
|
||||
|
||||
// Authentication Plugin config and env variables
|
||||
const (
|
||||
URL = "url"
|
||||
AuthToken = "auth_token"
|
||||
RolePolicy = "role_policy"
|
||||
RoleID = "role_id"
|
||||
|
||||
EnvIdentityPluginURL = "MINIO_IDENTITY_PLUGIN_URL"
|
||||
EnvIdentityPluginAuthToken = "MINIO_IDENTITY_PLUGIN_AUTH_TOKEN"
|
||||
EnvIdentityPluginRolePolicy = "MINIO_IDENTITY_PLUGIN_ROLE_POLICY"
|
||||
EnvIdentityPluginRoleID = "MINIO_IDENTITY_PLUGIN_ROLE_ID"
|
||||
)
|
||||
|
||||
var (
|
||||
// DefaultKVS - default config for AuthN plugin config
|
||||
DefaultKVS = config.KVS{
|
||||
config.KV{
|
||||
Key: URL,
|
||||
Value: "",
|
||||
},
|
||||
config.KV{
|
||||
Key: AuthToken,
|
||||
Value: "",
|
||||
},
|
||||
config.KV{
|
||||
Key: RolePolicy,
|
||||
Value: "",
|
||||
},
|
||||
config.KV{
|
||||
Key: RoleID,
|
||||
Value: "",
|
||||
},
|
||||
}
|
||||
|
||||
defaultHelpPostfix = func(key string) string {
|
||||
return config.DefaultHelpPostfix(DefaultKVS, key)
|
||||
}
|
||||
|
||||
// Help for Identity Plugin
|
||||
Help = config.HelpKVS{
|
||||
config.HelpKV{
|
||||
Key: URL,
|
||||
Description: `plugin hook endpoint (HTTP(S)) e.g. "http://localhost:8181/path/to/endpoint"` + defaultHelpPostfix(URL),
|
||||
Type: "url",
|
||||
},
|
||||
config.HelpKV{
|
||||
Key: AuthToken,
|
||||
Description: "authorization token for plugin hook endpoint" + defaultHelpPostfix(AuthToken),
|
||||
Optional: true,
|
||||
Type: "string",
|
||||
Sensitive: true,
|
||||
Secret: true,
|
||||
},
|
||||
config.HelpKV{
|
||||
Key: RolePolicy,
|
||||
Description: "policies to apply for plugin authorized users" + defaultHelpPostfix(RolePolicy),
|
||||
Type: "string",
|
||||
},
|
||||
config.HelpKV{
|
||||
Key: RoleID,
|
||||
Description: "unique ID to generate the ARN" + defaultHelpPostfix(RoleID),
|
||||
Optional: true,
|
||||
Type: "string",
|
||||
},
|
||||
config.HelpKV{
|
||||
Key: config.Comment,
|
||||
Description: config.DefaultComment,
|
||||
Optional: true,
|
||||
Type: "sentence",
|
||||
},
|
||||
}
|
||||
)
|
||||
|
||||
// Allows only Base64 URL encoding characters.
|
||||
var validRoleIDRegex = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
|
||||
|
||||
// Args for authentication plugin.
|
||||
type Args struct {
|
||||
URL *xnet.URL
|
||||
AuthToken string
|
||||
Transport http.RoundTripper
|
||||
CloseRespFn func(r io.ReadCloser)
|
||||
|
||||
RolePolicy string
|
||||
RoleARN arn.ARN
|
||||
}
|
||||
|
||||
// Validate - validate configuration params.
|
||||
func (a *Args) Validate() error {
|
||||
req, err := http.NewRequest(http.MethodPost, a.URL.String(), bytes.NewReader([]byte("")))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
if a.AuthToken != "" {
|
||||
req.Header.Set("Authorization", a.AuthToken)
|
||||
}
|
||||
|
||||
client := &http.Client{Transport: a.Transport}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer a.CloseRespFn(resp.Body)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
type serviceRTTMinuteStats struct {
|
||||
statsTime time.Time
|
||||
rttMsSum, maxRttMs float64
|
||||
successRequestCount int64
|
||||
failedRequestCount int64
|
||||
}
|
||||
|
||||
type metrics struct {
|
||||
sync.Mutex
|
||||
LastCheckSuccess time.Time
|
||||
LastCheckFailure time.Time
|
||||
lastFullMinute serviceRTTMinuteStats
|
||||
currentMinute serviceRTTMinuteStats
|
||||
}
|
||||
|
||||
func (h *metrics) setConnSuccess(reqStartTime time.Time) {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
h.LastCheckSuccess = reqStartTime
|
||||
}
|
||||
|
||||
func (h *metrics) setConnFailure(reqStartTime time.Time) {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
h.LastCheckFailure = reqStartTime
|
||||
}
|
||||
|
||||
func (h *metrics) updateLastFullMinute(currReqMinute time.Time) {
|
||||
// Assumes the caller has h.Lock()'ed
|
||||
h.lastFullMinute = h.currentMinute
|
||||
h.currentMinute = serviceRTTMinuteStats{
|
||||
statsTime: currReqMinute,
|
||||
}
|
||||
}
|
||||
|
||||
func (h *metrics) accumRequestRTT(reqStartTime time.Time, rttMs float64, isSuccess bool) {
|
||||
h.Lock()
|
||||
defer h.Unlock()
|
||||
|
||||
// Update connectivity times
|
||||
if isSuccess {
|
||||
if reqStartTime.After(h.LastCheckSuccess) {
|
||||
h.LastCheckSuccess = reqStartTime
|
||||
}
|
||||
} else {
|
||||
if reqStartTime.After(h.LastCheckFailure) {
|
||||
h.LastCheckFailure = reqStartTime
|
||||
}
|
||||
}
|
||||
|
||||
// Round the request time *down* to whole minute.
|
||||
reqTimeMinute := reqStartTime.Truncate(time.Minute)
|
||||
if reqTimeMinute.After(h.currentMinute.statsTime) {
|
||||
// Drop the last full minute now, since we got a request for a time we
|
||||
// are not yet tracking.
|
||||
h.updateLastFullMinute(reqTimeMinute)
|
||||
}
|
||||
var entry *serviceRTTMinuteStats
|
||||
switch {
|
||||
case reqTimeMinute.Equal(h.currentMinute.statsTime):
|
||||
entry = &h.currentMinute
|
||||
case reqTimeMinute.Equal(h.lastFullMinute.statsTime):
|
||||
entry = &h.lastFullMinute
|
||||
default:
|
||||
// This request is too old, it should never happen, ignore it as we
|
||||
// cannot return an error.
|
||||
return
|
||||
}
|
||||
|
||||
// Update stats
|
||||
if isSuccess {
|
||||
if entry.maxRttMs < rttMs {
|
||||
entry.maxRttMs = rttMs
|
||||
}
|
||||
entry.rttMsSum += rttMs
|
||||
entry.successRequestCount++
|
||||
} else {
|
||||
entry.failedRequestCount++
|
||||
}
|
||||
}
|
||||
|
||||
// AuthNPlugin - implements pluggable authentication via webhook.
|
||||
type AuthNPlugin struct {
|
||||
args Args
|
||||
client *http.Client
|
||||
shutdownCtx context.Context
|
||||
serviceMetrics *metrics
|
||||
}
|
||||
|
||||
// Enabled returns if AuthNPlugin is enabled.
|
||||
func Enabled(kvs config.KVS) bool {
|
||||
return kvs.Get(URL) != ""
|
||||
}
|
||||
|
||||
// LookupConfig lookup AuthNPlugin from config, override with any ENVs.
|
||||
func LookupConfig(kv config.KVS, transport *http.Transport, closeRespFn func(io.ReadCloser), serverRegion string) (Args, error) {
|
||||
args := Args{}
|
||||
|
||||
if err := config.CheckValidKeys(config.IdentityPluginSubSys, kv, DefaultKVS); err != nil {
|
||||
return args, err
|
||||
}
|
||||
|
||||
pluginURL := env.Get(EnvIdentityPluginURL, kv.Get(URL))
|
||||
if pluginURL == "" {
|
||||
return args, nil
|
||||
}
|
||||
|
||||
authToken := env.Get(EnvIdentityPluginAuthToken, kv.Get(AuthToken))
|
||||
|
||||
u, err := xnet.ParseHTTPURL(pluginURL)
|
||||
if err != nil {
|
||||
return args, err
|
||||
}
|
||||
|
||||
rolePolicy := env.Get(EnvIdentityPluginRolePolicy, kv.Get(RolePolicy))
|
||||
if rolePolicy == "" {
|
||||
return args, config.Errorf("A role policy must be specified for Identity Management Plugin")
|
||||
}
|
||||
|
||||
resourceID := "idmp-"
|
||||
roleID := env.Get(EnvIdentityPluginRoleID, kv.Get(RoleID))
|
||||
if roleID == "" {
|
||||
// We use a hash of the plugin URL so that the ARN remains
|
||||
// constant across restarts.
|
||||
h := sha1.New()
|
||||
h.Write([]byte(pluginURL))
|
||||
bs := h.Sum(nil)
|
||||
resourceID += base64.RawURLEncoding.EncodeToString(bs)
|
||||
} else {
|
||||
// Check that the roleID is restricted to URL safe characters
|
||||
// (base64 URL encoding chars).
|
||||
if !validRoleIDRegex.MatchString(roleID) {
|
||||
return args, config.Errorf("Role ID must match the regexp `^[a-zA-Z0-9_-]+$`")
|
||||
}
|
||||
|
||||
// Use the user provided ID here.
|
||||
resourceID += roleID
|
||||
}
|
||||
|
||||
roleArn, err := arn.NewIAMRoleARN(resourceID, serverRegion)
|
||||
if err != nil {
|
||||
return args, config.Errorf("unable to generate ARN from the plugin config: %v", err)
|
||||
}
|
||||
|
||||
args = Args{
|
||||
URL: u,
|
||||
AuthToken: authToken,
|
||||
Transport: transport,
|
||||
CloseRespFn: closeRespFn,
|
||||
RolePolicy: rolePolicy,
|
||||
RoleARN: roleArn,
|
||||
}
|
||||
if err = args.Validate(); err != nil {
|
||||
return args, err
|
||||
}
|
||||
return args, nil
|
||||
}
|
||||
|
||||
// New - initializes Authorization Management Plugin.
|
||||
func New(shutdownCtx context.Context, args Args) *AuthNPlugin {
|
||||
if args.URL == nil || args.URL.Scheme == "" && args.AuthToken == "" {
|
||||
return nil
|
||||
}
|
||||
plugin := AuthNPlugin{
|
||||
args: args,
|
||||
client: &http.Client{Transport: args.Transport},
|
||||
shutdownCtx: shutdownCtx,
|
||||
serviceMetrics: &metrics{
|
||||
Mutex: sync.Mutex{},
|
||||
LastCheckSuccess: time.Unix(0, 0),
|
||||
LastCheckFailure: time.Unix(0, 0),
|
||||
lastFullMinute: serviceRTTMinuteStats{},
|
||||
currentMinute: serviceRTTMinuteStats{},
|
||||
},
|
||||
}
|
||||
go plugin.doPeriodicHealthCheck()
|
||||
return &plugin
|
||||
}
|
||||
|
||||
// AuthNSuccessResponse - represents the response from the authentication plugin
|
||||
// service.
|
||||
type AuthNSuccessResponse struct {
|
||||
User string `json:"user"`
|
||||
MaxValiditySeconds int `json:"maxValiditySeconds"`
|
||||
Claims map[string]any `json:"claims"`
|
||||
}
|
||||
|
||||
// AuthNErrorResponse - represents an error response from the authN plugin.
|
||||
type AuthNErrorResponse struct {
|
||||
Reason string `json:"reason"`
|
||||
}
|
||||
|
||||
// AuthNResponse - represents a result of the authentication operation.
|
||||
type AuthNResponse struct {
|
||||
Success *AuthNSuccessResponse
|
||||
Failure *AuthNErrorResponse
|
||||
}
|
||||
|
||||
const (
|
||||
minValidityDurationSeconds int = 900
|
||||
maxValidityDurationSeconds int = 365 * 24 * 3600
|
||||
)
|
||||
|
||||
// Authenticate authenticates the token with the external hook endpoint and
|
||||
// returns a parent user, max expiry duration for the authentication and a set
|
||||
// of claims.
|
||||
func (o *AuthNPlugin) Authenticate(roleArn arn.ARN, token string) (AuthNResponse, error) {
|
||||
if o == nil {
|
||||
return AuthNResponse{}, nil
|
||||
}
|
||||
|
||||
if roleArn != o.args.RoleARN {
|
||||
return AuthNResponse{}, fmt.Errorf("Invalid role ARN value: %s", roleArn.String())
|
||||
}
|
||||
|
||||
u := url.URL(*o.args.URL)
|
||||
q := u.Query()
|
||||
q.Set("token", token)
|
||||
u.RawQuery = q.Encode()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, u.String(), nil)
|
||||
if err != nil {
|
||||
return AuthNResponse{}, err
|
||||
}
|
||||
|
||||
if o.args.AuthToken != "" {
|
||||
req.Header.Set("Authorization", o.args.AuthToken)
|
||||
}
|
||||
|
||||
reqStartTime := time.Now()
|
||||
resp, err := o.client.Do(req)
|
||||
if err != nil {
|
||||
o.serviceMetrics.accumRequestRTT(reqStartTime, 0, false)
|
||||
return AuthNResponse{}, err
|
||||
}
|
||||
defer o.args.CloseRespFn(resp.Body)
|
||||
reqDurNanos := time.Since(reqStartTime).Nanoseconds()
|
||||
o.serviceMetrics.accumRequestRTT(reqStartTime, float64(reqDurNanos)/1e6, true)
|
||||
|
||||
switch resp.StatusCode {
|
||||
case 200:
|
||||
var result AuthNSuccessResponse
|
||||
if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
||||
return AuthNResponse{}, err
|
||||
}
|
||||
|
||||
if result.MaxValiditySeconds < minValidityDurationSeconds || result.MaxValiditySeconds > maxValidityDurationSeconds {
|
||||
return AuthNResponse{}, fmt.Errorf("Plugin returned an invalid validity duration (%d) - should be between %d and %d",
|
||||
result.MaxValiditySeconds, minValidityDurationSeconds, maxValidityDurationSeconds)
|
||||
}
|
||||
|
||||
return AuthNResponse{
|
||||
Success: &result,
|
||||
}, nil
|
||||
|
||||
case 403:
|
||||
var result AuthNErrorResponse
|
||||
if err = json.NewDecoder(resp.Body).Decode(&result); err != nil {
|
||||
return AuthNResponse{}, err
|
||||
}
|
||||
return AuthNResponse{
|
||||
Failure: &result,
|
||||
}, nil
|
||||
|
||||
default:
|
||||
return AuthNResponse{}, fmt.Errorf("Invalid status code %d from auth plugin", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
// GetRoleInfo - returns ARN to policies map.
|
||||
func (o *AuthNPlugin) GetRoleInfo() map[arn.ARN]string {
|
||||
return map[arn.ARN]string{
|
||||
o.args.RoleARN: o.args.RolePolicy,
|
||||
}
|
||||
}
|
||||
|
||||
// checkConnectivity returns true if we are able to connect to the plugin
|
||||
// service.
|
||||
func (o *AuthNPlugin) checkConnectivity(ctx context.Context) bool {
|
||||
ctx, cancel := context.WithTimeout(ctx, healthCheckTimeout)
|
||||
defer cancel()
|
||||
u := url.URL(*o.args.URL)
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodHead, u.String(), nil)
|
||||
if err != nil {
|
||||
authNLogIf(ctx, err)
|
||||
return false
|
||||
}
|
||||
|
||||
if o.args.AuthToken != "" {
|
||||
req.Header.Set("Authorization", o.args.AuthToken)
|
||||
}
|
||||
|
||||
resp, err := o.client.Do(req)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
defer o.args.CloseRespFn(resp.Body)
|
||||
return true
|
||||
}
|
||||
|
||||
var (
|
||||
healthCheckInterval = 1 * time.Minute
|
||||
healthCheckTimeout = 5 * time.Second
|
||||
)
|
||||
|
||||
func (o *AuthNPlugin) doPeriodicHealthCheck() {
|
||||
ticker := time.NewTicker(healthCheckInterval)
|
||||
defer ticker.Stop()
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ticker.C:
|
||||
now := time.Now()
|
||||
isConnected := o.checkConnectivity(o.shutdownCtx)
|
||||
if isConnected {
|
||||
o.serviceMetrics.setConnSuccess(now)
|
||||
} else {
|
||||
o.serviceMetrics.setConnFailure(now)
|
||||
}
|
||||
case <-o.shutdownCtx.Done():
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Metrics contains metrics about the authentication plugin service.
|
||||
type Metrics struct {
|
||||
LastReachableSecs, LastUnreachableSecs float64
|
||||
|
||||
// Last whole minute stats
|
||||
TotalRequests, FailedRequests int64
|
||||
AvgSuccRTTMs float64
|
||||
MaxSuccRTTMs float64
|
||||
}
|
||||
|
||||
// Metrics reports metrics related to plugin service reachability and stats for the last whole minute
|
||||
func (o *AuthNPlugin) Metrics() Metrics {
|
||||
if o == nil {
|
||||
// Return empty metrics when not configured.
|
||||
return Metrics{}
|
||||
}
|
||||
o.serviceMetrics.Lock()
|
||||
defer o.serviceMetrics.Unlock()
|
||||
l := &o.serviceMetrics.lastFullMinute
|
||||
var avg float64
|
||||
if l.successRequestCount > 0 {
|
||||
avg = l.rttMsSum / float64(l.successRequestCount)
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
return Metrics{
|
||||
LastReachableSecs: now.Sub(o.serviceMetrics.LastCheckSuccess).Seconds(),
|
||||
LastUnreachableSecs: now.Sub(o.serviceMetrics.LastCheckFailure).Seconds(),
|
||||
TotalRequests: l.failedRequestCount + l.successRequestCount,
|
||||
FailedRequests: l.failedRequestCount,
|
||||
AvgSuccRTTMs: avg,
|
||||
MaxSuccRTTMs: l.maxRttMs,
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user