mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-02 03:46:29 +02:00
5d60cff21e
* refactor backend, implement encrypted store * refactor in-memory store * wip * wip * wip * add syncer test * fix redis expiry * fix linting issues * fix test by skipping non-config records * fix backoff import * fix init issues * fix query * wait for initial sync before starting directory sync * add type to SyncLatest * add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest * update sync types and tests * add redis tests * skip macos in github actions * add comments to proto * split getBackend into separate methods * handle errors in initVersion * return different error for not found vs other errors in get * use exponential backoff for redis transaction retry * rename raw to result * use context instead of close channel * store type urls as constants in databroker * use timestampb instead of ptypes * fix group merging not waiting * change locked names * update GetAll to return latest record version * add method to grpcutil to get the type url for a protobuf type
97 lines
3.1 KiB
Go
97 lines
3.1 KiB
Go
// Package authorize is a pomerium service that is responsible for determining
|
|
// if a given request should be authorized (AuthZ).
|
|
package authorize
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"html/template"
|
|
|
|
"github.com/pomerium/pomerium/authorize/evaluator"
|
|
"github.com/pomerium/pomerium/config"
|
|
"github.com/pomerium/pomerium/internal/frontend"
|
|
"github.com/pomerium/pomerium/internal/log"
|
|
"github.com/pomerium/pomerium/internal/telemetry/metrics"
|
|
"github.com/pomerium/pomerium/internal/telemetry/trace"
|
|
"github.com/pomerium/pomerium/internal/urlutil"
|
|
"github.com/pomerium/pomerium/pkg/cryptutil"
|
|
)
|
|
|
|
// Authorize struct holds
|
|
type Authorize struct {
|
|
state *atomicAuthorizeState
|
|
store *evaluator.Store
|
|
currentOptions *config.AtomicOptions
|
|
templates *template.Template
|
|
|
|
dataBrokerInitialSync chan struct{}
|
|
}
|
|
|
|
// New validates and creates a new Authorize service from a set of config options.
|
|
func New(cfg *config.Config) (*Authorize, error) {
|
|
a := Authorize{
|
|
currentOptions: config.NewAtomicOptions(),
|
|
store: evaluator.NewStore(),
|
|
templates: template.Must(frontend.NewTemplates()),
|
|
dataBrokerInitialSync: make(chan struct{}),
|
|
}
|
|
|
|
state, err := newAuthorizeStateFromConfig(cfg, a.store)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
a.state = newAtomicAuthorizeState(state)
|
|
|
|
return &a, nil
|
|
}
|
|
|
|
// Run runs the authorize service.
|
|
func (a *Authorize) Run(ctx context.Context) error {
|
|
return newDataBrokerSyncer(a).Run(ctx)
|
|
}
|
|
|
|
// WaitForInitialSync blocks until the initial sync is complete.
|
|
func (a *Authorize) WaitForInitialSync(ctx context.Context) error {
|
|
select {
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
case <-a.dataBrokerInitialSync:
|
|
}
|
|
log.Info().Msg("initial sync from databroker complete")
|
|
return nil
|
|
}
|
|
|
|
func validateOptions(o *config.Options) error {
|
|
if _, err := cryptutil.NewAEADCipherFromBase64(o.SharedKey); err != nil {
|
|
return fmt.Errorf("authorize: bad 'SHARED_SECRET': %w", err)
|
|
}
|
|
if err := urlutil.ValidateURL(o.AuthenticateURL); err != nil {
|
|
return fmt.Errorf("authorize: invalid 'AUTHENTICATE_SERVICE_URL': %w", err)
|
|
}
|
|
if err := urlutil.ValidateURL(o.DataBrokerURL); err != nil {
|
|
return fmt.Errorf("authorize: invalid 'DATABROKER_SERVICE_URL': %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// newPolicyEvaluator returns an policy evaluator.
|
|
func newPolicyEvaluator(opts *config.Options, store *evaluator.Store) (*evaluator.Evaluator, error) {
|
|
metrics.AddPolicyCountCallback("pomerium-authorize", func() int64 {
|
|
return int64(len(opts.GetAllPolicies()))
|
|
})
|
|
ctx := context.Background()
|
|
_, span := trace.StartSpan(ctx, "authorize.newPolicyEvaluator")
|
|
defer span.End()
|
|
return evaluator.New(opts, store)
|
|
}
|
|
|
|
// OnConfigChange updates internal structures based on config.Options
|
|
func (a *Authorize) OnConfigChange(cfg *config.Config) {
|
|
log.Info().Str("checksum", fmt.Sprintf("%x", cfg.Options.Checksum())).Msg("authorize: updating options")
|
|
a.currentOptions.Store(cfg.Options)
|
|
if state, err := newAuthorizeStateFromConfig(cfg, a.store); err != nil {
|
|
log.Error().Err(err).Msg("authorize: error updating state")
|
|
} else {
|
|
a.state.Store(state)
|
|
}
|
|
}
|