mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 10:56:28 +02:00
c13459bb88
* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details. * docs: updated `env.example` to include a `POLICY` setting example. * docs: added `IDP_SERVICE_ACCOUNT` to `env.example` . * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`. * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files. * proxy: `ROUTES` settings which has been replaced by `POLICY`. * internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. Closes #54 Closes #41 Closes #61 Closes #58
107 lines
3.1 KiB
Go
107 lines
3.1 KiB
Go
package authorize // import "github.com/pomerium/pomerium/authorize"
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/pomerium/envconfig"
|
|
"github.com/pomerium/pomerium/internal/policy"
|
|
)
|
|
|
|
// Options contains configuration settings for the authorize service.
|
|
type Options struct {
|
|
// SharedKey is used to validate requests between services
|
|
SharedKey string `envconfig:"SHARED_SECRET" required:"true"`
|
|
|
|
// Policy is a base64 encoded yaml blob which enumerates
|
|
// per-route access control policies.
|
|
Policy string `envconfig:"POLICY"`
|
|
PolicyFile string `envconfig:"POLICY_FILE"`
|
|
}
|
|
|
|
// OptionsFromEnvConfig creates an authorize service options from environmental
|
|
// variables.
|
|
func OptionsFromEnvConfig() (*Options, error) {
|
|
o := new(Options)
|
|
if err := envconfig.Process("", o); err != nil {
|
|
return nil, err
|
|
}
|
|
return o, nil
|
|
}
|
|
|
|
// Validate checks to see if configuration values are valid for the
|
|
// authorize service. Returns first error, if found.
|
|
func (o *Options) Validate() error {
|
|
decoded, err := base64.StdEncoding.DecodeString(o.SharedKey)
|
|
if err != nil {
|
|
return fmt.Errorf("authorize: `SHARED_SECRET` setting is invalid base64: %v", err)
|
|
}
|
|
if len(decoded) != 32 {
|
|
return fmt.Errorf("authorize: `SHARED_SECRET` want 32 but got %d bytes", len(decoded))
|
|
}
|
|
if o.Policy == "" && o.PolicyFile == "" {
|
|
return errors.New("authorize: either `POLICY` or `POLICY_FILE` must be non-nil")
|
|
}
|
|
if o.Policy != "" {
|
|
confBytes, err := base64.StdEncoding.DecodeString(o.Policy)
|
|
if err != nil {
|
|
return fmt.Errorf("authorize: `POLICY` is invalid base64 %v", err)
|
|
}
|
|
_, err = policy.FromConfig(confBytes)
|
|
if err != nil {
|
|
return fmt.Errorf("authorize: `POLICY` %v", err)
|
|
}
|
|
}
|
|
if o.PolicyFile != "" {
|
|
_, err = policy.FromConfigFile(o.PolicyFile)
|
|
if err != nil {
|
|
return fmt.Errorf("authorize: `POLICY_FILE` %v", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Authorize struct holds
|
|
type Authorize struct {
|
|
SharedKey string
|
|
|
|
identityAccess IdentityValidator
|
|
// contextValidator
|
|
// deviceValidator
|
|
}
|
|
|
|
// New validates and creates a new Authorize service from a set of Options
|
|
func New(opts *Options) (*Authorize, error) {
|
|
if opts == nil {
|
|
return nil, errors.New("authorize: options cannot be nil")
|
|
}
|
|
if err := opts.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
// errors handled by validate
|
|
sharedKey, _ := base64.StdEncoding.DecodeString(opts.SharedKey)
|
|
var policies []policy.Policy
|
|
if opts.Policy != "" {
|
|
confBytes, _ := base64.StdEncoding.DecodeString(opts.Policy)
|
|
policies, _ = policy.FromConfig(confBytes)
|
|
} else {
|
|
policies, _ = policy.FromConfigFile(opts.PolicyFile)
|
|
}
|
|
|
|
return &Authorize{
|
|
SharedKey: string(sharedKey),
|
|
identityAccess: NewIdentityWhitelist(policies),
|
|
}, nil
|
|
}
|
|
|
|
// ValidIdentity returns if an identity is authorized to access a route resource.
|
|
func (a *Authorize) ValidIdentity(route string, identity *Identity) bool {
|
|
return a.identityAccess.Valid(route, identity)
|
|
}
|
|
|
|
// NewIdentityWhitelist returns an indentity validator.
|
|
// todo(bdd) : a radix-tree implementation is probably more efficient
|
|
func NewIdentityWhitelist(policies []policy.Policy) IdentityValidator {
|
|
return newIdentityWhitelistMap(policies)
|
|
}
|