2016-12-18 05:21:29 +00:00
|
|
|
package jwt
|
|
|
|
|
|
|
|
import (
|
2020-07-07 21:57:52 +00:00
|
|
|
"errors"
|
2016-12-18 05:21:29 +00:00
|
|
|
"fmt"
|
2017-03-12 16:24:15 +00:00
|
|
|
"time"
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
"github.com/dgrijalva/jwt-go"
|
|
|
|
"github.com/gorilla/securecookie"
|
2021-11-15 21:45:20 +00:00
|
|
|
portainer "github.com/portainer/portainer/api"
|
2016-12-18 05:21:29 +00:00
|
|
|
)
|
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
// scope represents JWT scopes that are supported in JWT claims.
|
|
|
|
type scope string
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
// Service represents a service for managing JWT tokens.
|
|
|
|
type Service struct {
|
2021-11-15 21:45:20 +00:00
|
|
|
secrets map[scope][]byte
|
2020-06-09 09:55:36 +00:00
|
|
|
userSessionTimeout time.Duration
|
2021-08-31 21:23:21 +00:00
|
|
|
dataStore portainer.DataStore
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type claims struct {
|
2019-09-09 22:58:26 +00:00
|
|
|
UserID int `json:"id"`
|
|
|
|
Username string `json:"username"`
|
|
|
|
Role int `json:"role"`
|
2021-11-15 21:45:20 +00:00
|
|
|
Scope scope `json:"scope"`
|
2016-12-18 05:21:29 +00:00
|
|
|
jwt.StandardClaims
|
|
|
|
}
|
|
|
|
|
2020-07-07 21:57:52 +00:00
|
|
|
var (
|
|
|
|
errSecretGeneration = errors.New("Unable to generate secret key")
|
|
|
|
errInvalidJWTToken = errors.New("Invalid JWT token")
|
|
|
|
)
|
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
const (
|
|
|
|
defaultScope = scope("default")
|
|
|
|
kubeConfigScope = scope("kubeconfig")
|
|
|
|
)
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
// NewService initializes a new service. It will generate a random key that will be used to sign JWT tokens.
|
2021-08-31 21:23:21 +00:00
|
|
|
func NewService(userSessionDuration string, dataStore portainer.DataStore) (*Service, error) {
|
2020-06-09 09:55:36 +00:00
|
|
|
userSessionTimeout, err := time.ParseDuration(userSessionDuration)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
secret := securecookie.GenerateRandomKey(32)
|
|
|
|
if secret == nil {
|
2020-07-07 21:57:52 +00:00
|
|
|
return nil, errSecretGeneration
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
2020-06-09 09:55:36 +00:00
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
kubeSecret, err := getOrCreateKubeSecret(dataStore)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
service := &Service{
|
2021-11-15 21:45:20 +00:00
|
|
|
map[scope][]byte{
|
|
|
|
defaultScope: secret,
|
|
|
|
kubeConfigScope: kubeSecret,
|
|
|
|
},
|
2020-06-09 09:55:36 +00:00
|
|
|
userSessionTimeout,
|
2021-08-31 21:23:21 +00:00
|
|
|
dataStore,
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
return service, nil
|
|
|
|
}
|
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
func getOrCreateKubeSecret(dataStore portainer.DataStore) ([]byte, error) {
|
|
|
|
settings, err := dataStore.Settings().Settings()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
kubeSecret := settings.OAuthSettings.KubeSecretKey
|
|
|
|
if kubeSecret == nil {
|
|
|
|
kubeSecret = securecookie.GenerateRandomKey(32)
|
|
|
|
if kubeSecret == nil {
|
|
|
|
return nil, errSecretGeneration
|
|
|
|
}
|
|
|
|
settings.OAuthSettings.KubeSecretKey = kubeSecret
|
|
|
|
err = dataStore.Settings().UpdateSettings(settings)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return kubeSecret, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (service *Service) defaultExpireAt() int64 {
|
2021-08-31 21:23:21 +00:00
|
|
|
return time.Now().Add(service.userSessionTimeout).Unix()
|
|
|
|
}
|
|
|
|
|
2016-12-18 05:21:29 +00:00
|
|
|
// GenerateToken generates a new JWT token.
|
|
|
|
func (service *Service) GenerateToken(data *portainer.TokenData) (string, error) {
|
2021-11-15 21:45:20 +00:00
|
|
|
return service.generateSignedToken(data, service.defaultExpireAt(), defaultScope)
|
2021-06-10 22:09:04 +00:00
|
|
|
}
|
2016-12-18 05:21:29 +00:00
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
// GenerateTokenForOAuth generates a new JWT token for OAuth login
|
|
|
|
// token expiry time response from OAuth provider is considered
|
2021-06-10 22:09:04 +00:00
|
|
|
func (service *Service) GenerateTokenForOAuth(data *portainer.TokenData, expiryTime *time.Time) (string, error) {
|
2021-08-31 21:23:21 +00:00
|
|
|
expireAt := service.defaultExpireAt()
|
|
|
|
if expiryTime != nil && !expiryTime.IsZero() {
|
|
|
|
expireAt = expiryTime.Unix()
|
|
|
|
}
|
2021-11-15 21:45:20 +00:00
|
|
|
return service.generateSignedToken(data, expireAt, defaultScope)
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
|
|
|
|
2017-03-12 16:24:15 +00:00
|
|
|
// ParseAndVerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
|
|
|
|
func (service *Service) ParseAndVerifyToken(token string) (*portainer.TokenData, error) {
|
2021-11-15 21:45:20 +00:00
|
|
|
scope := parseScope(token)
|
|
|
|
secret := service.secrets[scope]
|
2017-03-12 16:24:15 +00:00
|
|
|
parsedToken, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
|
2016-12-18 05:21:29 +00:00
|
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
2021-11-15 21:45:20 +00:00
|
|
|
msg := fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
2016-12-18 05:21:29 +00:00
|
|
|
return nil, msg
|
|
|
|
}
|
2021-11-15 21:45:20 +00:00
|
|
|
return secret, nil
|
2016-12-18 05:21:29 +00:00
|
|
|
})
|
2021-11-15 21:45:20 +00:00
|
|
|
|
2017-03-12 16:24:15 +00:00
|
|
|
if err == nil && parsedToken != nil {
|
|
|
|
if cl, ok := parsedToken.Claims.(*claims); ok && parsedToken.Valid {
|
2021-11-15 21:45:20 +00:00
|
|
|
return &portainer.TokenData{
|
2019-09-09 22:58:26 +00:00
|
|
|
ID: portainer.UserID(cl.UserID),
|
|
|
|
Username: cl.Username,
|
|
|
|
Role: portainer.UserRole(cl.Role),
|
2021-11-15 21:45:20 +00:00
|
|
|
}, nil
|
2017-03-12 16:24:15 +00:00
|
|
|
}
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
2020-07-07 21:57:52 +00:00
|
|
|
return nil, errInvalidJWTToken
|
2016-12-18 05:21:29 +00:00
|
|
|
}
|
2020-06-09 09:55:36 +00:00
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
// parse a JWT token, fallback to defaultScope if no scope is present in the JWT
|
|
|
|
func parseScope(token string) scope {
|
|
|
|
unverifiedToken, _, _ := new(jwt.Parser).ParseUnverified(token, &claims{})
|
|
|
|
if unverifiedToken != nil {
|
|
|
|
if cl, ok := unverifiedToken.Claims.(*claims); ok {
|
|
|
|
if cl.Scope == kubeConfigScope {
|
|
|
|
return kubeConfigScope
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return defaultScope
|
|
|
|
}
|
|
|
|
|
2020-06-09 09:55:36 +00:00
|
|
|
// SetUserSessionDuration sets the user session duration
|
|
|
|
func (service *Service) SetUserSessionDuration(userSessionDuration time.Duration) {
|
|
|
|
service.userSessionTimeout = userSessionDuration
|
|
|
|
}
|
2021-06-10 22:09:04 +00:00
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
func (service *Service) generateSignedToken(data *portainer.TokenData, expiresAt int64, scope scope) (string, error) {
|
|
|
|
secret, found := service.secrets[scope]
|
|
|
|
if !found {
|
|
|
|
return "", fmt.Errorf("invalid scope: %v", scope)
|
|
|
|
}
|
|
|
|
|
2021-06-10 22:09:04 +00:00
|
|
|
cl := claims{
|
|
|
|
UserID: int(data.ID),
|
|
|
|
Username: data.Username,
|
|
|
|
Role: int(data.Role),
|
2021-11-15 21:45:20 +00:00
|
|
|
Scope: scope,
|
2021-06-10 22:09:04 +00:00
|
|
|
StandardClaims: jwt.StandardClaims{
|
2021-08-31 21:23:21 +00:00
|
|
|
ExpiresAt: expiresAt,
|
2021-06-10 22:09:04 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2021-11-15 21:45:20 +00:00
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, cl)
|
|
|
|
signedToken, err := token.SignedString(secret)
|
2021-06-10 22:09:04 +00:00
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
|
|
|
|
return signedToken, nil
|
|
|
|
}
|