auth

Paddy 2015-05-17 Parent:8ecb60d29b0d Child:9e3ceddf29ad

Make client use our auth(n/z) scheme. Our auth(n/z) scheme can be loosely defined as "encrypted tokens that nginx transforms into headers" and "scopes for bypassing ACL". Our Go client, which is what we'll be using to have services communicate with each other, follows this paradigm now by auto-injecting the headers we'll need to identify ourselves. This will work behind our firewall, but will be useless for the rest of the world, which will need to go through the nginx bastion that can strip the headers and replace them with the headers appropriate to the token attached to the request. This did involve setting a static client ID as the client for our email_verification listener. Ideally, this would cause Client registration (using that ID) when the listener starts up, ignoring ErrClientAlreadyExists. I don't want to have to write the code that will allow us to bypass the Client ACL properly right now, though, so we're just going to have to remember to manually create that Client. Or not. I don't think it will do any harm (outside the OAuth flow) to be using a Client ID that doesn't actually point to a Client. I just think it'd be good for record-keeping purposes.

authd/server.go client/client.go client/login.go listeners/email_verification/listener.go profile.go

Diff to previous Statistics

     1.1 --- a/authd/server.go	Sun May 17 02:27:36 2015 -0400
     1.2 +++ b/authd/server.go	Sun May 17 03:21:17 2015 -0400
     1.3 @@ -55,7 +55,7 @@
     1.4  		panic(err)
     1.5  	}
     1.6  	err = context.CreateScopes([]auth.Scope{
     1.7 -		{ID: "testscope", Name: "Test Scope"},
     1.8 +		auth.ScopeLoginAdmin,
     1.9  	})
    1.10  	if err != nil && err != auth.ErrScopeAlreadyExists {
    1.11  		log.Fatal(err)

     2.1 --- a/client/client.go	Sun May 17 02:27:36 2015 -0400
     2.2 +++ b/client/client.go	Sun May 17 03:21:17 2015 -0400
     2.3 @@ -7,8 +7,10 @@
     2.4  	"io"
     2.5  	"net/http"
     2.6  	"strings"
     2.7 +	"time"
     2.8  
     2.9  	"code.secondbit.org/auth.hg"
    2.10 +	"code.secondbit.org/uuid.hg"
    2.11  )
    2.12  
    2.13  var (
    2.14 @@ -19,17 +21,19 @@
    2.15  type Client struct {
    2.16  	client  *http.Client
    2.17  	address string
    2.18 +	ID      uuid.ID
    2.19  }
    2.20  
    2.21 -func New(address string) *Client {
    2.22 +func New(address string, id uuid.ID) *Client {
    2.23  	address = strings.TrimRight(address, "/")
    2.24  	return &Client{
    2.25  		address: address,
    2.26  		client:  &http.Client{},
    2.27 +		ID:      id,
    2.28  	}
    2.29  }
    2.30  
    2.31 -func (c *Client) do(method, url string, request interface{}) (auth.Response, error) {
    2.32 +func (c *Client) do(method, url string, request interface{}, scopes []string, subject uuid.ID) (auth.Response, error) {
    2.33  	if c == nil {
    2.34  		return auth.Response{}, ErrNilClient
    2.35  	}
    2.36 @@ -54,6 +58,14 @@
    2.37  	if err != nil {
    2.38  		return response, err
    2.39  	}
    2.40 +	req.Header.Set("Ducky-Scope", strings.Join(scopes, " "))
    2.41 +	req.Header.Set("Ducky-Issuer", c.ID.String())
    2.42 +	if subject != nil {
    2.43 +		req.Header.Set("Ducky-Subject", subject.String())
    2.44 +	}
    2.45 +	req.Header.Set("Ducky-Expires", time.Now().Add(time.Hour).String())
    2.46 +	req.Header.Set("Ducky-Issued-At", time.Now().String())
    2.47 +	req.Header.Set("Ducky-Not-Before", time.Now().Add(-5*time.Minute).String())
    2.48  	resp, err := c.client.Do(req)
    2.49  	if err != nil {
    2.50  		return response, err
    2.51 @@ -76,6 +88,6 @@
    2.52  	return response, nil
    2.53  }
    2.54  
    2.55 -func (c *Client) Get(url string) (auth.Response, error) {
    2.56 -	return c.do("GET", url, nil)
    2.57 +func (c *Client) Get(url string, scopes []string, subject uuid.ID) (auth.Response, error) {
    2.58 +	return c.do("GET", url, nil, scopes, subject)
    2.59  }

     3.1 --- a/client/login.go	Sun May 17 02:27:36 2015 -0400
     3.2 +++ b/client/login.go	Sun May 17 03:21:17 2015 -0400
     3.3 @@ -5,7 +5,7 @@
     3.4  )
     3.5  
     3.6  func (c *Client) GetLogin(value string) (auth.Login, error) {
     3.7 -	resp, err := c.Get("/logins/" + value)
     3.8 +	resp, err := c.Get("/logins/"+value, auth.Scopes{auth.ScopeLoginAdmin}.Strings(), nil)
     3.9  	if err != nil {
    3.10  		return auth.Login{}, err
    3.11  	}

     4.1 --- a/listeners/email_verification/listener.go	Sun May 17 02:27:36 2015 -0400
     4.2 +++ b/listeners/email_verification/listener.go	Sun May 17 03:21:17 2015 -0400
     4.3 @@ -3,7 +3,6 @@
     4.4  import (
     4.5  	"bytes"
     4.6  	"encoding/json"
     4.7 -	"fmt"
     4.8  	htmltmpl "html/template"
     4.9  	"log"
    4.10  	"os"
    4.11 @@ -13,6 +12,7 @@
    4.12  	"code.secondbit.org/auth.hg"
    4.13  	"code.secondbit.org/auth.hg/client"
    4.14  	"code.secondbit.org/events.hg"
    4.15 +	"code.secondbit.org/uuid.hg"
    4.16  
    4.17  	"github.com/bitly/go-nsq"
    4.18  	"github.com/mailgun/mailgun-go"
    4.19 @@ -20,9 +20,16 @@
    4.20  
    4.21  const (
    4.22  	channel = "verification_email_sender"
    4.23 +	// BUG(paddy): we should be creating this client at startup
    4.24 +	// but doing so means allowing admin scope overrides on client creation
    4.25 +	// and I'm just not in the mood to mess with that tonight.
    4.26 +	// We can struggle along with manually instantiating the client for now.
    4.27 +	// It shouldn't make a difference, anyways, but it's a good way to do record-keeping.
    4.28 +	clientString = "5d58bb9e-e1a0-41e1-aa01-fc1961456be2"
    4.29  )
    4.30  
    4.31  var (
    4.32 +	clientID          uuid.ID
    4.33  	authClient        *client.Client
    4.34  	mgClient          mailgun.Mailgun
    4.35  	emailHTMLTemplate *htmltmpl.Template
    4.36 @@ -55,7 +62,12 @@
    4.37  	if mgTextTemplateFile == "" {
    4.38  		log.Fatal("AUTH_EMAIL_TEXT_TEMPLATE environment variable must be set.")
    4.39  	}
    4.40 -	authClient = client.New(clientAddr)
    4.41 +	var err error
    4.42 +	clientID, err = uuid.Parse(clientString)
    4.43 +	if err != nil {
    4.44 +		log.Fatal("clientString", clientString, "could not be parsed as a uuid.")
    4.45 +	}
    4.46 +	authClient = client.New(clientAddr, clientID)
    4.47  	mgClient = mailgun.NewMailgun(mgDomain, mgAPIKey, "")
    4.48  	emailHTMLTemplate = htmltmpl.Must(htmltmpl.ParseGlob(mgHTMLTemplateFile))
    4.49  	emailTextTemplate = texttmpl.Must(texttmpl.ParseGlob(mgTextTemplateFile))
    4.50 @@ -109,7 +121,6 @@
    4.51  		return err // requeue the message for later processing
    4.52  	}
    4.53  	login.Verification = verification
    4.54 -	fmt.Printf("Pretending to email %s their verification code (%s)\n", login.Value, login.Verification)
    4.55  	var body bytes.Buffer
    4.56  	var htmlBody bytes.Buffer
    4.57  	err = emailTextTemplate.Execute(&body, map[string]interface{}{

     5.1 --- a/profile.go	Sun May 17 02:27:36 2015 -0400
     5.2 +++ b/profile.go	Sun May 17 03:21:17 2015 -0400
     5.3 @@ -64,6 +64,8 @@
     5.4  	// ErrProfileLocked is returned when a user tries to log in with a profile that is locked for a certain
     5.5  	// duration, to prevent brute force attacks.
     5.6  	ErrProfileLocked = errors.New("profile locked")
     5.7 +
     5.8 +	ScopeLoginAdmin = Scope{ID: "login_admin", Name: "Administer Logins", Description: "Read and write logins, bypassing ACL."}
     5.9  )
    5.10  
    5.11  // Profile represents a single user of the service,

File	Total	Ratio
authd/server.go	2
client/client.go	20
client/login.go	2
listeners/email_verification/listener.go	17
profile.go	2