cfb756b9ba
This commit implements multi-tenancy. A tenant is defined based on a value from JWT claims. The key of this value must be specified in the configuration file. This allows us to pick different values when using multiple SSOs. Let me explain more in depth how this works: Cloud API gets a new compose request. Firstly, it extracts a tenant name from JWT claims. The considered claims are configured as an array in cloud_api.jwt.tenant_provider_fields in composer's config file. The channel name for all jobs belonging to this compose is created by `"org-" + tenant`. Why is the channel prefixed by "org-"? To give us options in the future. I can imagine the request having a channel override. This basically means that multiple tenants can share a channel. A real use-case for this is multiple Fedora projects sharing one pool of workers. Why this commit adds a whole new cloud_api section to the config? Because the current config is a mess and we should stop adding new stuff into the koji section. As the Koji API is basically deprecated, we will need to remove it soon nevertheless. Signed-off-by: Ondřej Budai <ondrej@budai.cz>
39 lines
932 B
Go
39 lines
932 B
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"github.com/golang-jwt/jwt"
|
|
"github.com/openshift-online/ocm-sdk-go/authentication"
|
|
)
|
|
|
|
var NoJWTError = errors.New("request doesn't contain JWT")
|
|
var NoKeyError = errors.New("cannot find key in jwt claims")
|
|
|
|
// GetFromClaims returns a value of JWT claim with the specified key
|
|
//
|
|
// Caller can specify multiple keys. The value of first one that exists and is
|
|
// non-empty is returned.
|
|
//
|
|
// If no claim is found, NoKeyError is returned
|
|
func GetFromClaims(ctx context.Context, keys []string) (string, error) {
|
|
token, err := authentication.TokenFromContext(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
} else if token == nil {
|
|
return "", NoJWTError
|
|
}
|
|
|
|
claims := token.Claims.(jwt.MapClaims)
|
|
for _, f := range keys {
|
|
value, exists := claims[f]
|
|
valueStr, isString := value.(string)
|
|
if exists && isString && valueStr != "" {
|
|
return valueStr, nil
|
|
}
|
|
|
|
}
|
|
|
|
return "", NoKeyError
|
|
}
|