mirror of https://github.com/portainer/portainer
108 lines
3.4 KiB
Go
108 lines
3.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"golang.org/x/oauth2"
|
|
|
|
"github.com/asaskevich/govalidator"
|
|
httperror "github.com/portainer/libhttp/error"
|
|
"github.com/portainer/libhttp/request"
|
|
"github.com/portainer/portainer"
|
|
)
|
|
|
|
type oauthPayload struct {
|
|
Code string
|
|
}
|
|
|
|
func (payload *oauthPayload) Validate(r *http.Request) error {
|
|
if govalidator.IsNull(payload.Code) {
|
|
return portainer.Error("Invalid OAuth authorization code")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (handler *Handler) authenticateOAuth(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
|
|
var payload oauthPayload
|
|
err := request.DecodeAndValidateJSONPayload(r, &payload)
|
|
if err != nil {
|
|
return &httperror.HandlerError{http.StatusBadRequest, "Invalid request payload", err}
|
|
}
|
|
|
|
settings, err := handler.SettingsService.Settings()
|
|
if err != nil {
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to retrieve settings from the database", err}
|
|
}
|
|
|
|
if settings.AuthenticationMethod != 3 {
|
|
return &httperror.HandlerError{http.StatusForbidden, "OAuth authentication is not being used", err}
|
|
}
|
|
|
|
token, err := handler.OAuthService.GetAccessToken(payload.Code, &settings.OAuthSettings)
|
|
if err != nil {
|
|
log.Printf("[DEBUG] - Failed retrieving access token: %v", err)
|
|
return &httperror.HandlerError{http.StatusUnprocessableEntity, "Invalid access token", portainer.ErrUnauthorized}
|
|
}
|
|
|
|
username, err := handler.OAuthService.GetUsername(token, &settings.OAuthSettings)
|
|
if err != nil {
|
|
log.Printf("[DEBUG] - Failed acquiring username: %v", err)
|
|
return &httperror.HandlerError{http.StatusForbidden, "Unable to acquire username", portainer.ErrUnauthorized}
|
|
}
|
|
|
|
u, err := handler.UserService.UserByUsername(username)
|
|
if err != nil && err != portainer.ErrObjectNotFound {
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to retrieve a user with the specified username from the database", err}
|
|
}
|
|
|
|
if u == nil && !settings.OAuthSettings.OAuthAutoCreateUsers {
|
|
return &httperror.HandlerError{http.StatusForbidden, "Unregistered account", portainer.ErrUnauthorized}
|
|
}
|
|
|
|
if u == nil {
|
|
user := &portainer.User{
|
|
Username: username,
|
|
Role: portainer.StandardUserRole,
|
|
}
|
|
|
|
err = handler.UserService.CreateUser(user)
|
|
if err != nil {
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to persist user inside the database", err}
|
|
}
|
|
|
|
return handler.writeToken(w, user)
|
|
}
|
|
|
|
return handler.writeToken(w, u)
|
|
}
|
|
|
|
func (handler *Handler) loginOAuth(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
|
|
settings, err := handler.SettingsService.Settings()
|
|
if err != nil {
|
|
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to retrieve settings from the database", err}
|
|
}
|
|
|
|
if settings.AuthenticationMethod != 3 {
|
|
return &httperror.HandlerError{http.StatusForbidden, "OAuth authentication is disabled", err}
|
|
}
|
|
|
|
endpoint := oauth2.Endpoint{
|
|
AuthURL: settings.OAuthSettings.AuthorizationURI,
|
|
TokenURL: settings.OAuthSettings.AccessTokenURI,
|
|
}
|
|
|
|
oauthConfig := &oauth2.Config{
|
|
ClientID: settings.OAuthSettings.ClientID,
|
|
ClientSecret: settings.OAuthSettings.ClientSecret,
|
|
Endpoint: endpoint,
|
|
RedirectURL: settings.OAuthSettings.RedirectURI,
|
|
Scopes: strings.Split(settings.OAuthSettings.Scopes, ","),
|
|
}
|
|
|
|
url := oauthConfig.AuthCodeURL("portainer")
|
|
http.Redirect(w, r, url, http.StatusTemporaryRedirect)
|
|
return nil
|
|
}
|