mirror of
https://github.com/pomerium/pomerium.git
synced 2025-06-05 04:13:11 +02:00
13554ec78d
## Summary Add some more metrics: - Authenticate token verification - Authorization log duration - Authorization evaluator and header evaluator - IDP token session creator HTTP and gRPC endpoints are already instrumented via middleware, which covers authenticate, proxy and databroker endpoints. Postgres is also already instrumented using `otelpgx`. ## Related issues - [ENG-2407](https://linear.app/pomerium/issue/ENG-2407/add-additional-metrics-and-tracing-spans-to-pomerium) ## Checklist - [x] reference any related issues - [ ] updated unit tests - [ ] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [x] ready for review
93 lines
2.4 KiB
Go
93 lines
2.4 KiB
Go
package authenticate
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/pomerium/pomerium/internal/httputil"
|
|
"github.com/pomerium/pomerium/internal/log"
|
|
"github.com/pomerium/pomerium/pkg/authenticateapi"
|
|
)
|
|
|
|
func (a *Authenticate) verifyAccessToken(w http.ResponseWriter, r *http.Request) error {
|
|
start := time.Now()
|
|
|
|
a.accessTokenVerificationCount.Add(r.Context(), 1)
|
|
|
|
var req authenticateapi.VerifyAccessTokenRequest
|
|
err := json.NewDecoder(r.Body).Decode(&req)
|
|
if err != nil {
|
|
return httputil.NewError(http.StatusBadRequest, err)
|
|
}
|
|
|
|
authenticator, err := a.cfg.getIdentityProvider(r.Context(), a.tracerProvider, a.options.Load(), req.IdentityProviderID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var res authenticateapi.VerifyTokenResponse
|
|
claims, err := authenticator.VerifyAccessToken(r.Context(), req.AccessToken)
|
|
if err == nil {
|
|
a.accessTokenValidVerificationCount.Add(r.Context(), 1)
|
|
res.Valid = true
|
|
res.Claims = claims
|
|
} else {
|
|
a.accessTokenInvalidVerificationCount.Add(r.Context(), 1)
|
|
res.Valid = false
|
|
log.Ctx(r.Context()).Info().
|
|
Err(err).
|
|
Str("idp", authenticator.Name()).
|
|
Msg("access token failed verification")
|
|
}
|
|
|
|
err = json.NewEncoder(w).Encode(&res)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
a.accessTokenVerificationDuration.Record(r.Context(), time.Since(start).Milliseconds())
|
|
|
|
return nil
|
|
}
|
|
|
|
func (a *Authenticate) verifyIdentityToken(w http.ResponseWriter, r *http.Request) error {
|
|
start := time.Now()
|
|
|
|
a.identityTokenVerificationCount.Add(r.Context(), 1)
|
|
|
|
var req authenticateapi.VerifyIdentityTokenRequest
|
|
err := json.NewDecoder(r.Body).Decode(&req)
|
|
if err != nil {
|
|
return httputil.NewError(http.StatusBadRequest, err)
|
|
}
|
|
|
|
authenticator, err := a.cfg.getIdentityProvider(r.Context(), a.tracerProvider, a.options.Load(), req.IdentityProviderID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var res authenticateapi.VerifyTokenResponse
|
|
claims, err := authenticator.VerifyIdentityToken(r.Context(), req.IdentityToken)
|
|
if err == nil {
|
|
a.identityTokenValidVerificationCount.Add(r.Context(), 1)
|
|
res.Valid = true
|
|
res.Claims = claims
|
|
} else {
|
|
a.identityTokenInvalidVerificationCount.Add(r.Context(), 1)
|
|
res.Valid = false
|
|
log.Ctx(r.Context()).Info().
|
|
Err(err).
|
|
Str("idp", authenticator.Name()).
|
|
Msg("identity token failed verification")
|
|
}
|
|
|
|
err = json.NewEncoder(w).Encode(&res)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
a.identityTokenVerificationDuration.Record(r.Context(), time.Since(start).Milliseconds())
|
|
|
|
return nil
|
|
}
|