auth
auth/config.go
Make client use our auth(n/z) scheme. Our auth(n/z) scheme can be loosely defined as "encrypted tokens that nginx transforms into headers" and "scopes for bypassing ACL". Our Go client, which is what we'll be using to have services communicate with each other, follows this paradigm now by auto-injecting the headers we'll need to identify ourselves. This will work behind our firewall, but will be useless for the rest of the world, which will need to go through the nginx bastion that can strip the headers and replace them with the headers appropriate to the token attached to the request. This did involve setting a static client ID as the client for our email_verification listener. Ideally, this would cause Client registration (using that ID) when the listener starts up, ignoring ErrClientAlreadyExists. I don't want to have to write the code that will allow us to bypass the Client ACL properly right now, though, so we're just going to have to remember to manually create that Client. Or not. I don't think it will do any harm (outside the OAuth flow) to be using a Client ID that doesn't actually point to a Client. I just think it'd be good for record-keeping purposes.
| paddy@96 | 1 package auth |
| paddy@96 | 2 |
| paddy@96 | 3 import ( |
| paddy@96 | 4 "errors" |
| paddy@96 | 5 "html/template" |
| paddy@101 | 6 "log" |
| paddy@96 | 7 ) |
| paddy@96 | 8 |
| paddy@96 | 9 var ( |
| paddy@96 | 10 // ErrInvalidLoginURI is returned when a Context is instantiated with a Config object that specifies a LoginURI that can't be parsed as a URL. |
| paddy@96 | 11 ErrInvalidLoginURI = errors.New("invalid login URI") |
| paddy@102 | 12 // ErrConfigNotInitialized is returned when a Context is instantiated with a Config object that hasn't had its Init function called. |
| paddy@102 | 13 ErrConfigNotInitialized = errors.New("config not initialized") |
| paddy@171 | 14 |
| paddy@171 | 15 // Version is used to keep track of what version of the build this is |
| paddy@171 | 16 Version string |
| paddy@96 | 17 ) |
| paddy@96 | 18 |
| paddy@96 | 19 // Config holds the configuration values necessary to run a server. A Config |
| paddy@96 | 20 // instance is the only way to instantiate a Context variable. |
| paddy@96 | 21 type Config struct { |
| paddy@171 | 22 ClientStore clientStore |
| paddy@171 | 23 AuthCodeStore authorizationCodeStore |
| paddy@171 | 24 ProfileStore profileStore |
| paddy@171 | 25 TokenStore tokenStore |
| paddy@171 | 26 SessionStore sessionStore |
| paddy@171 | 27 ScopeStore scopeStore |
| paddy@171 | 28 LoginVerificationNotifier loginVerificationNotifier |
| paddy@171 | 29 Template *template.Template |
| paddy@171 | 30 LoginURI string |
| paddy@171 | 31 JWTPrivateKey []byte |
| paddy@171 | 32 iterations int |
| paddy@171 | 33 secureCookie bool |
| paddy@96 | 34 } |
| paddy@101 | 35 |
| paddy@102 | 36 // Init is a function that preps the Config object to be used for Context creation, setting variables |
| paddy@102 | 37 // that are determined at the beginning of program execution. |
| paddy@101 | 38 func (c *Config) Init() error { |
| paddy@101 | 39 scheme, ok := passphraseSchemes[CurPassphraseScheme] |
| paddy@101 | 40 if !ok { |
| paddy@101 | 41 return ErrInvalidPassphraseScheme |
| paddy@101 | 42 } |
| paddy@101 | 43 var err error |
| paddy@101 | 44 c.iterations, err = scheme.calculateIterations() |
| paddy@101 | 45 if err != nil { |
| paddy@101 | 46 return err |
| paddy@101 | 47 } |
| paddy@101 | 48 log.Printf("Generating passphrases with %d iterations...\n", c.iterations) |
| paddy@101 | 49 return nil |
| paddy@101 | 50 } |