mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-01 03:16:31 +02:00
* databroker: add databroker, identity manager, update cache (#864) * databroker: add databroker, identity manager, update cache * fix cache tests * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * authorize: use databroker data for rego policy (#904) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix gitlab test * use v4 backoff * authenticate: databroker changes (#914) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix dashboard * delete session on logout * permanently delete sessions once they are marked as deleted * remove permanent delete * fix tests * remove groups and refresh test * databroker: remove dead code, rename cache url, move dashboard (#925) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix dashboard * delete session on logout * permanently delete sessions once they are marked as deleted * remove permanent delete * fix tests * remove cache service * remove kv * remove refresh docs * remove obsolete cache docs * add databroker url option * cache: use memberlist to detect multiple instances * add databroker service url * remove cache service * remove kv * remove refresh docs * remove obsolete cache docs * add databroker url option * cache: use memberlist to detect multiple instances * add databroker service url * wip * remove groups and refresh test * fix redirect, signout * remove databroker client from proxy * remove unused method * remove user dashboard test * handle missing session ids * session: reject sessions with no id * sessions: invalidate old sessions via databroker server version (#930) * session: add a version field tied to the databroker server version that can be used to invalidate sessions * fix tests * add log * authenticate: create user record immediately, call "get" directly in authorize (#931)
121 lines
3.1 KiB
Go
121 lines
3.1 KiB
Go
package manager
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/golang/protobuf/ptypes"
|
|
structpb "github.com/golang/protobuf/ptypes/struct"
|
|
"golang.org/x/oauth2"
|
|
"google.golang.org/protobuf/types/known/anypb"
|
|
"google.golang.org/protobuf/types/known/wrapperspb"
|
|
|
|
"github.com/pomerium/pomerium/internal/grpc/session"
|
|
)
|
|
|
|
func toAny(value interface{}) (*anypb.Any, error) {
|
|
switch v := value.(type) {
|
|
case bool:
|
|
return ptypes.MarshalAny(&wrapperspb.BoolValue{Value: v})
|
|
case []byte:
|
|
return ptypes.MarshalAny(&wrapperspb.BytesValue{Value: v})
|
|
case float64:
|
|
return ptypes.MarshalAny(&wrapperspb.DoubleValue{Value: v})
|
|
case float32:
|
|
return ptypes.MarshalAny(&wrapperspb.FloatValue{Value: v})
|
|
case int32:
|
|
return ptypes.MarshalAny(&wrapperspb.Int32Value{Value: v})
|
|
case int64:
|
|
return ptypes.MarshalAny(&wrapperspb.Int64Value{Value: v})
|
|
case string:
|
|
return ptypes.MarshalAny(&wrapperspb.StringValue{Value: v})
|
|
case uint32:
|
|
return ptypes.MarshalAny(&wrapperspb.UInt32Value{Value: v})
|
|
case uint64:
|
|
return ptypes.MarshalAny(&wrapperspb.UInt64Value{Value: v})
|
|
|
|
case []interface{}:
|
|
lst := &structpb.ListValue{}
|
|
for _, c := range v {
|
|
if cv, err := toValue(c); err == nil {
|
|
lst.Values = append(lst.Values, cv)
|
|
}
|
|
}
|
|
return ptypes.MarshalAny(lst)
|
|
}
|
|
return nil, fmt.Errorf("unknown type %T", value)
|
|
}
|
|
|
|
func toValue(value interface{}) (*structpb.Value, error) {
|
|
switch v := value.(type) {
|
|
case bool:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_BoolValue{BoolValue: v},
|
|
}, nil
|
|
case float64:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: v},
|
|
}, nil
|
|
case float32:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: float64(v)},
|
|
}, nil
|
|
case int32:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: float64(v)},
|
|
}, nil
|
|
case int64:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: float64(v)},
|
|
}, nil
|
|
case string:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_StringValue{StringValue: v},
|
|
}, nil
|
|
case uint32:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: float64(v)},
|
|
}, nil
|
|
case uint64:
|
|
return &structpb.Value{
|
|
Kind: &structpb.Value_NumberValue{NumberValue: float64(v)},
|
|
}, nil
|
|
|
|
}
|
|
return nil, fmt.Errorf("unknown type %T", value)
|
|
}
|
|
|
|
func toSessionSchedulerKey(userID, sessionID string) string {
|
|
return userID + "\037" + sessionID
|
|
}
|
|
|
|
func fromSessionSchedulerKey(key string) (userID, sessionID string) {
|
|
idx := strings.Index(key, "\037")
|
|
if idx >= 0 {
|
|
userID = key[:idx]
|
|
sessionID = key[idx+1:]
|
|
} else {
|
|
userID = key
|
|
}
|
|
return userID, sessionID
|
|
}
|
|
|
|
func fromOAuthToken(token *session.OAuthToken) *oauth2.Token {
|
|
expiry, _ := ptypes.Timestamp(token.GetExpiresAt())
|
|
return &oauth2.Token{
|
|
AccessToken: token.GetAccessToken(),
|
|
TokenType: token.GetTokenType(),
|
|
RefreshToken: token.GetRefreshToken(),
|
|
Expiry: expiry,
|
|
}
|
|
}
|
|
|
|
func toOAuthToken(token *oauth2.Token) *session.OAuthToken {
|
|
expiry, _ := ptypes.TimestampProto(token.Expiry)
|
|
return &session.OAuthToken{
|
|
AccessToken: token.AccessToken,
|
|
TokenType: token.TokenType,
|
|
RefreshToken: token.RefreshToken,
|
|
ExpiresAt: expiry,
|
|
}
|
|
}
|