3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-02 08:19:23 +02:00
Code Issues Projects Releases Packages Wiki Activity

config: remove validate side effects (#2109)

Browse source 
* config: default shared key

* handle additional errors

* update grpc addr and grpc insecure

* update google cloud service authentication service account

* fix set response headers

* fix qps

* fix test
This commit is contained in:
Caleb Doxsey 2021-04-22 15:10:50 -06:00 • committed by GitHub
parent 2806b67bee
commit b1d62bb541
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
19 changed files with 138 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

6
authorize/authorize.go
View file

@ -61,7 +61,11 @@ func (a *Authorize) WaitForInitialSync(ctx context.Context) error {
}
func validateOptions(o *config.Options) error {
if _, err := cryptutil.NewAEADCipherFromBase64(o.SharedKey); err != nil {
sharedKey, err := o.GetSharedKey()
if err != nil {
return fmt.Errorf("authorize: bad 'SHARED_SECRET': %w", err)
}
if _, err := cryptutil.NewAEADCipher(sharedKey); err != nil {
return fmt.Errorf("authorize: bad 'SHARED_SECRET': %w", err)
}
if _, err := o.GetAuthenticateURL(); err != nil {

4
authorize/evaluator/evaluator.go
View file

@ -48,7 +48,9 @@ func New(options *config.Options, store *Store) (*Evaluator, error) {
}
store.UpdateIssuer(authenticateURL.Host)
store.UpdateGoogleCloudServerlessAuthenticationServiceAccount(options.GoogleCloudServerlessAuthenticationServiceAccount)
store.UpdateGoogleCloudServerlessAuthenticationServiceAccount(
options.GetGoogleCloudServerlessAuthenticationServiceAccount(),
)
store.UpdateJWTClaimHeaders(options.JWTClaimsHeaders)
store.UpdateRoutePolicies(options.GetAllPolicies())
store.UpdateSigningKey(jwk)

7
authorize/state.go
View file

@ -1,7 +1,6 @@
package authorize
import (
"encoding/base64"
"fmt"
"sync/atomic"
@ -36,7 +35,7 @@ func newAuthorizeStateFromConfig(cfg *config.Config, store *evaluator.Store) (*a
return nil, fmt.Errorf("authorize: failed to update policy with options: %w", err)
}
state.sharedKey, err = base64.StdEncoding.DecodeString(cfg.Options.SharedKey)
state.sharedKey, err = cfg.Options.GetSharedKey()
if err != nil {
return nil, err
}
@ -46,7 +45,7 @@ func newAuthorizeStateFromConfig(cfg *config.Config, store *evaluator.Store) (*a
return nil, err
}
sharedKey, err := base64.StdEncoding.DecodeString(cfg.Options.SharedKey)
sharedKey, err := cfg.Options.GetSharedKey()
if err != nil {
return nil, err
}
@ -63,7 +62,7 @@ func newAuthorizeStateFromConfig(cfg *config.Config, store *evaluator.Store) (*a
CAFile: cfg.Options.CAFile,
RequestTimeout: cfg.Options.GRPCClientTimeout,
ClientDNSRoundRobin: cfg.Options.GRPCClientDNSRoundRobin,
WithInsecure: cfg.Options.GRPCInsecure,
WithInsecure: cfg.Options.GetGRPCInsecure(),
InstallationID: cfg.Options.InstallationID,
ServiceName: cfg.Options.Services,
SignedJWTKey: sharedKey,