portainer/api/jwt/jwt.go

175 lines
4.7 KiB
Go
Raw Normal View History

2016-12-18 05:21:29 +00:00
package jwt
import (
"errors"
2016-12-18 05:21:29 +00:00
"fmt"
"time"
2016-12-18 05:21:29 +00:00
"github.com/dgrijalva/jwt-go"
"github.com/gorilla/securecookie"
portainer "github.com/portainer/portainer/api"
2016-12-18 05:21:29 +00:00
)
// scope represents JWT scopes that are supported in JWT claims.
type scope string
2016-12-18 05:21:29 +00:00
// Service represents a service for managing JWT tokens.
type Service struct {
secrets map[scope][]byte
userSessionTimeout time.Duration
dataStore portainer.DataStore
2016-12-18 05:21:29 +00:00
}
type claims struct {
UserID int `json:"id"`
Username string `json:"username"`
Role int `json:"role"`
Scope scope `json:"scope"`
2016-12-18 05:21:29 +00:00
jwt.StandardClaims
}
var (
errSecretGeneration = errors.New("Unable to generate secret key")
errInvalidJWTToken = errors.New("Invalid JWT token")
)
const (
defaultScope = scope("default")
kubeConfigScope = scope("kubeconfig")
)
2016-12-18 05:21:29 +00:00
// NewService initializes a new service. It will generate a random key that will be used to sign JWT tokens.
func NewService(userSessionDuration string, dataStore portainer.DataStore) (*Service, error) {
userSessionTimeout, err := time.ParseDuration(userSessionDuration)
if err != nil {
return nil, err
}
2016-12-18 05:21:29 +00:00
secret := securecookie.GenerateRandomKey(32)
if secret == nil {
return nil, errSecretGeneration
2016-12-18 05:21:29 +00:00
}
kubeSecret, err := getOrCreateKubeSecret(dataStore)
if err != nil {
return nil, err
}
2016-12-18 05:21:29 +00:00
service := &Service{
map[scope][]byte{
defaultScope: secret,
kubeConfigScope: kubeSecret,
},
userSessionTimeout,
dataStore,
2016-12-18 05:21:29 +00:00
}
return service, nil
}
func getOrCreateKubeSecret(dataStore portainer.DataStore) ([]byte, error) {
settings, err := dataStore.Settings().Settings()
if err != nil {
return nil, err
}
kubeSecret := settings.OAuthSettings.KubeSecretKey
if kubeSecret == nil {
kubeSecret = securecookie.GenerateRandomKey(32)
if kubeSecret == nil {
return nil, errSecretGeneration
}
settings.OAuthSettings.KubeSecretKey = kubeSecret
err = dataStore.Settings().UpdateSettings(settings)
if err != nil {
return nil, err
}
}
return kubeSecret, nil
}
func (service *Service) defaultExpireAt() int64 {
return time.Now().Add(service.userSessionTimeout).Unix()
}
2016-12-18 05:21:29 +00:00
// GenerateToken generates a new JWT token.
func (service *Service) GenerateToken(data *portainer.TokenData) (string, error) {
return service.generateSignedToken(data, service.defaultExpireAt(), defaultScope)
}
2016-12-18 05:21:29 +00:00
// GenerateTokenForOAuth generates a new JWT token for OAuth login
// token expiry time response from OAuth provider is considered
func (service *Service) GenerateTokenForOAuth(data *portainer.TokenData, expiryTime *time.Time) (string, error) {
expireAt := service.defaultExpireAt()
if expiryTime != nil && !expiryTime.IsZero() {
expireAt = expiryTime.Unix()
}
return service.generateSignedToken(data, expireAt, defaultScope)
2016-12-18 05:21:29 +00:00
}
// ParseAndVerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
func (service *Service) ParseAndVerifyToken(token string) (*portainer.TokenData, error) {
scope := parseScope(token)
secret := service.secrets[scope]
parsedToken, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
2016-12-18 05:21:29 +00:00
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
msg := fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
2016-12-18 05:21:29 +00:00
return nil, msg
}
return secret, nil
2016-12-18 05:21:29 +00:00
})
if err == nil && parsedToken != nil {
if cl, ok := parsedToken.Claims.(*claims); ok && parsedToken.Valid {
return &portainer.TokenData{
ID: portainer.UserID(cl.UserID),
Username: cl.Username,
Role: portainer.UserRole(cl.Role),
}, nil
}
2016-12-18 05:21:29 +00:00
}
return nil, errInvalidJWTToken
2016-12-18 05:21:29 +00:00
}
// parse a JWT token, fallback to defaultScope if no scope is present in the JWT
func parseScope(token string) scope {
unverifiedToken, _, _ := new(jwt.Parser).ParseUnverified(token, &claims{})
if unverifiedToken != nil {
if cl, ok := unverifiedToken.Claims.(*claims); ok {
if cl.Scope == kubeConfigScope {
return kubeConfigScope
}
}
}
return defaultScope
}
// SetUserSessionDuration sets the user session duration
func (service *Service) SetUserSessionDuration(userSessionDuration time.Duration) {
service.userSessionTimeout = userSessionDuration
}
func (service *Service) generateSignedToken(data *portainer.TokenData, expiresAt int64, scope scope) (string, error) {
secret, found := service.secrets[scope]
if !found {
return "", fmt.Errorf("invalid scope: %v", scope)
}
cl := claims{
UserID: int(data.ID),
Username: data.Username,
Role: int(data.Role),
Scope: scope,
StandardClaims: jwt.StandardClaims{
ExpiresAt: expiresAt,
},
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, cl)
signedToken, err := token.SignedString(secret)
if err != nil {
return "", err
}
return signedToken, nil
}