5a9d8c792b
V2 is compliant with api.openshift.com design guidelines. Errors are predefined, have codes, and are queryable. All requests have an operationId set: a unique identifier which is sortable by time. This is added to the response in case of an error. All returned objects have the href, id, and kind field set.
67 lines
1.6 KiB
Go
67 lines
1.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"net/http"
|
|
|
|
"github.com/openshift-online/ocm-sdk-go/authentication"
|
|
"github.com/openshift-online/ocm-sdk-go/logging"
|
|
|
|
"github.com/osbuild/osbuild-composer/internal/common"
|
|
)
|
|
|
|
// When using this handler for auth, it should be run as high up as possible.
|
|
// Exceptions can be registered in the `exclude` slice
|
|
func BuildJWTAuthHandler(keysURL, caFile, aclFile string, exclude []string, next http.Handler) (handler http.Handler, err error) {
|
|
logBuilder := logging.NewGoLoggerBuilder()
|
|
if caFile != "" {
|
|
logBuilder = logBuilder.Debug(true)
|
|
}
|
|
|
|
logger, err := logBuilder.Build()
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
logger.Info(context.Background(), aclFile)
|
|
|
|
builder := authentication.NewHandler().
|
|
Logger(logger).
|
|
KeysURL(keysURL)
|
|
|
|
// Used during testing
|
|
if caFile != "" {
|
|
logger.Warn(context.Background(),
|
|
"A custom CA is specified to verify jwt tokens, this shouldn't be enabled in a production setting.")
|
|
caPEM, err := ioutil.ReadFile(caFile)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
pool := x509.NewCertPool()
|
|
ok := pool.AppendCertsFromPEM(caPEM)
|
|
if !ok {
|
|
return nil, fmt.Errorf("Unable to load jwt ca cert %s.", caFile)
|
|
}
|
|
builder = builder.KeysCAs(pool)
|
|
}
|
|
|
|
if aclFile != "" {
|
|
builder = builder.ACLFile(aclFile)
|
|
}
|
|
|
|
for _, e := range exclude {
|
|
builder = builder.Public(e)
|
|
}
|
|
|
|
// In case authentication fails, attach an OperationID
|
|
builder = builder.OperationID(func(r *http.Request) string {
|
|
return common.GenerateOperationID()
|
|
})
|
|
|
|
handler, err = builder.Next(next).Build()
|
|
return
|
|
}
|