mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 02:46:30 +02:00
dc12947241
- all: prefer `FormValues` to `ParseForm` with subsequent `Form.Get`s - all: refactor authentication stack to be checked by middleware, and accessible via request context. - all: replace http.ServeMux with gorilla/mux’s router - all: replace custom CSRF checks with gorilla/csrf middleware - authenticate: extract callback path as constant. - internal/config: implement stringer interface for policy - internal/cryptutil: add helper func `NewBase64Key` - internal/cryptutil: rename `GenerateKey` to `NewKey` - internal/cryptutil: rename `GenerateRandomString` to `NewRandomStringN` - internal/middleware: removed alice in favor of gorilla/mux - internal/sessions: remove unused `ValidateRedirectURI` and `ValidateClientSecret` - internal/sessions: replace custom CSRF with gorilla/csrf fork that supports custom handler protection - internal/urlutil: add `SignedRedirectURL` to create hmac'd URLs - internal/urlutil: add `ValidateURL` helper to parse URL options - internal/urlutil: add `GetAbsoluteURL` which takes a request and returns its absolute URL. - proxy: remove holdover state verification checks; we no longer are setting sessions in any proxy routes so we don’t need them. - proxy: replace un-named http.ServeMux with named domain routes. Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
69 lines
2.1 KiB
Go
69 lines
2.1 KiB
Go
package authorize // import "github.com/pomerium/pomerium/authorize"
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
|
|
"github.com/pomerium/pomerium/internal/config"
|
|
"github.com/pomerium/pomerium/internal/log"
|
|
"github.com/pomerium/pomerium/internal/telemetry/metrics"
|
|
)
|
|
|
|
// ValidateOptions checks to see if configuration values are valid for the
|
|
// authorize service. Returns first error, if found.
|
|
func ValidateOptions(o config.Options) error {
|
|
decoded, err := base64.StdEncoding.DecodeString(o.SharedKey)
|
|
if err != nil {
|
|
return fmt.Errorf("authorize: `SHARED_SECRET` malformed base64: %v", err)
|
|
}
|
|
if len(decoded) != 32 {
|
|
return fmt.Errorf("authorize: `SHARED_SECRET` want 32 but got %d bytes", len(decoded))
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Authorize struct holds
|
|
type Authorize struct {
|
|
SharedKey string
|
|
|
|
identityAccess IdentityValidator
|
|
// contextValidator
|
|
// deviceValidator
|
|
}
|
|
|
|
// New validates and creates a new Authorize service from a set of Options
|
|
func New(opts config.Options) (*Authorize, error) {
|
|
if err := ValidateOptions(opts); err != nil {
|
|
return nil, err
|
|
}
|
|
// errors handled by validate
|
|
sharedKey, _ := base64.StdEncoding.DecodeString(opts.SharedKey)
|
|
return &Authorize{
|
|
SharedKey: string(sharedKey),
|
|
identityAccess: NewIdentityWhitelist(opts.Policies, opts.Administrators),
|
|
}, nil
|
|
}
|
|
|
|
// NewIdentityWhitelist returns an indentity validator.
|
|
// todo(bdd) : a radix-tree implementation is probably more efficient
|
|
func NewIdentityWhitelist(policies []config.Policy, admins []string) IdentityValidator {
|
|
metrics.AddPolicyCountCallback("authorize", func() int64 {
|
|
return int64(len(policies))
|
|
})
|
|
return newIdentityWhitelistMap(policies, admins)
|
|
}
|
|
|
|
// ValidIdentity returns if an identity is authorized to access a route resource.
|
|
func (a *Authorize) ValidIdentity(route string, identity *Identity) bool {
|
|
return a.identityAccess.Valid(route, identity)
|
|
}
|
|
|
|
// UpdateOptions updates internal structures based on config.Options
|
|
func (a *Authorize) UpdateOptions(o config.Options) error {
|
|
if a == nil {
|
|
return nil
|
|
}
|
|
log.Info().Msg("authorize: updating options")
|
|
a.identityAccess = NewIdentityWhitelist(o.Policies, o.Administrators)
|
|
return nil
|
|
}
|