sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

directly talk to accounts

Browse Source 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
Jörn Friedrich Dreyer
2020-06-17 17:25:32 +02:00
parent 44e252306a
commit 0d71588498
9 changed files with 791 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/command/server.go
+31 -98
View File
@@ -2,25 +2,29 @@ package command
import (
"context"
"github.com/owncloud/ocis-glauth/pkg/crypto"
"os"
"os/signal"
"strings"
"time"
"github.com/owncloud/ocis-glauth/pkg/crypto"
"contrib.go.opencensus.io/exporter/jaeger"
"contrib.go.opencensus.io/exporter/ocagent"
"contrib.go.opencensus.io/exporter/zipkin"
glauthcfg "github.com/glauth/glauth/pkg/config"
glauth "github.com/glauth/glauth/pkg/server"
"github.com/micro/cli/v2"
"github.com/micro/go-micro/v2"
"github.com/micro/go-micro/v2/client"
"github.com/oklog/run"
openzipkin "github.com/openzipkin/zipkin-go"
zipkinhttp "github.com/openzipkin/zipkin-go/reporter/http"
accounts "github.com/owncloud/ocis-accounts/pkg/proto/v0"
"github.com/owncloud/ocis-glauth/pkg/config"
"github.com/owncloud/ocis-glauth/pkg/flagset"
"github.com/owncloud/ocis-glauth/pkg/mlogr"
"github.com/owncloud/ocis-glauth/pkg/server/debug"
"github.com/owncloud/ocis-glauth/pkg/server/glauth"
"go.opencensus.io/stats/view"
"go.opencensus.io/trace"
)
@@ -36,8 +40,6 @@ func Server(cfg *config.Config) *cli.Command {
cfg.HTTP.Root = strings.TrimSuffix(cfg.HTTP.Root, "/")
}
cfg.Backend.Servers = c.StringSlice("backend-server")
return ParseConfig(c, cfg)
},
Action: func(c *cli.Context) error {
@@ -136,7 +138,6 @@ func Server(cfg *config.Config) *cli.Command {
defer cancel()
{
log := mlogr.New(&logger)
cfg := glauthcfg.Config{
LDAP: glauthcfg.LDAP{
Enabled: cfg.Ldap.Enabled,
@@ -149,101 +150,11 @@ func Server(cfg *config.Config) *cli.Command {
Key: cfg.Ldaps.Key,
},
Backend: glauthcfg.Backend{
Datastore: cfg.Backend.Datastore,
BaseDN: cfg.Backend.BaseDN,
Insecure: cfg.Backend.Insecure,
NameFormat: cfg.Backend.NameFormat,
GroupFormat: cfg.Backend.GroupFormat,
Servers: cfg.Backend.Servers,
SSHKeyAttr: cfg.Backend.SSHKeyAttr,
UseGraphAPI: cfg.Backend.UseGraphAPI,
},
// TODO read users for the config backend from config file
Users: []glauthcfg.User{
glauthcfg.User{
Name: "einstein",
GivenName: "Albert",
SN: "Einstein",
UnixID: 20000,
PrimaryGroup: 30000,
OtherGroups: []int{30001, 30002, 30007},
Mail: "einstein@example.org",
PassSHA256: "69bf3575281a970f46e37ecd28b79cfbee6a46e55c10dc91dd36a43410387ab8", // relativity
},
glauthcfg.User{
Name: "marie",
GivenName: "Marie",
SN: "Curie",
UnixID: 20001,
PrimaryGroup: 30000,
OtherGroups: []int{30003, 30004, 30007},
Mail: "marie@example.org",
PassSHA256: "149a807f82e22b796942efa1010063f4a278cf078ff56ef1d3fc6c156037cef9", // radioactivity
},
glauthcfg.User{
Name: "feynman",
GivenName: "Richard",
SN: "Feynman",
UnixID: 20002,
PrimaryGroup: 30000,
OtherGroups: []int{30005, 30006, 30007},
Mail: "feynman@example.org",
PassSHA256: "1e2183d3a6017bb01131e27204bb66d3c5fa273acf421c8f9bd4bd633e3d70a8", // superfluidity
},
// technical users for ocis
glauthcfg.User{
Name: "konnectd",
UnixID: 10000,
PrimaryGroup: 15000,
Mail: "idp@example.org",
PassSHA256: "e1b6c4460fda166b70f77093f8a2f9b9e0055a5141ed8c6a67cf1105b1af23ca", // konnectd
},
glauthcfg.User{
Name: "reva",
UnixID: 10001,
PrimaryGroup: 15000,
Mail: "storage@example.org",
PassSHA256: "60a43483d1a41327e689c3ba0451c42661d6a101151e041aa09206305c83e74b", // reva
},
},
Groups: []glauthcfg.Group{
glauthcfg.Group{
Name: "users",
UnixID: 30000,
},
glauthcfg.Group{
Name: "sailing-lovers",
UnixID: 30001,
},
glauthcfg.Group{
Name: "violin-haters",
UnixID: 30002,
},
glauthcfg.Group{
Name: "radium-lovers",
UnixID: 30003,
},
glauthcfg.Group{
Name: "polonium-lovers",
UnixID: 30004,
},
glauthcfg.Group{
Name: "quantum-lovers",
UnixID: 30005,
},
glauthcfg.Group{
Name: "philosophy-haters",
UnixID: 30006,
},
glauthcfg.Group{
Name: "physics-lovers",
UnixID: 30007,
},
glauthcfg.Group{
Name: "sysusers",
UnixID: 15000,
},
},
}
@@ -254,8 +165,14 @@ func Server(cfg *config.Config) *cli.Command {
}
}
server, err := glauth.NewServer(
glauth.Logger(log),
as, err := getAccountsService()
if err != nil {
return err
}
server, err := glauth.Server(
glauth.AccountsService(as),
glauth.Logger(logger),
glauth.Config(&cfg),
)
@@ -362,3 +279,19 @@ func Server(cfg *config.Config) *cli.Command {
},
}
}
// getAccountsService returns an ocis-accounts service
func getAccountsService() (accounts.AccountsService, error) {
service := micro.NewService()
// parse command line flags
service.Init()
err := service.Client().Init(
client.ContentType("application/json"),
)
if err != nil {
return nil, err
}
return accounts.NewAccountsService("com.owncloud.api.accounts", service.Client()), nil
}
pkg/config/config.go
-3
View File
@@ -46,14 +46,11 @@ type Ldaps struct {
// Backend defined the available backend configuration.
type Backend struct {
Datastore string
BaseDN string
Insecure bool
NameFormat string
GroupFormat string
Servers []string
SSHKeyAttr string
UseGraphAPI bool
}
// Config combines all available configuration parts.
pkg/flagset/flagset.go
-20
View File
@@ -160,13 +160,6 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
Destination: &cfg.Ldaps.Key,
},
&cli.StringFlag{
Name: "backend-datastore",
Value: "config",
Usage: "datastore to use as the backend. one of config, ldap or owncloud",
EnvVars: []string{"GLAUTH_BACKEND_DATASTORE"},
Destination: &cfg.Backend.Datastore,
},
&cli.StringFlag{
Name: "backend-basedn",
Value: "dc=example,dc=org",
@@ -195,12 +188,6 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
EnvVars: []string{"GLAUTH_BACKEND_GROUP_FORMAT"},
Destination: &cfg.Backend.GroupFormat,
},
&cli.StringSliceFlag{
Name: "backend-server",
Value: cli.NewStringSlice("https://demo.owncloud.com"),
Usage: `--backend-servers http://internal1.example.com [--backend-servers http://internal2.example.com]`,
EnvVars: []string{"GLAUTH_BACKEND_SERVERS"},
},
&cli.StringFlag{
Name: "backend-ssh-key-attr",
Value: "sshPublicKey",
@@ -208,12 +195,5 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
EnvVars: []string{"GLAUTH_BACKEND_SSH_KEY_ATTR"},
Destination: &cfg.Backend.SSHKeyAttr,
},
&cli.BoolFlag{
Name: "backend-use-graphapi",
Value: true,
Usage: "use Graph API, only for owncloud datastore",
EnvVars: []string{"GLAUTH_BACKEND_USE_GRAPHAPI"},
Destination: &cfg.Backend.UseGraphAPI,
},
}
}
pkg/server/glauth/handler.go
+184
View File
@@ -0,0 +1,184 @@
package glauth
import (
"context"
"crypto/sha256"
"errors"
"fmt"
"net"
"strconv"
"strings"
"github.com/glauth/glauth/pkg/config"
"github.com/glauth/glauth/pkg/handler"
"github.com/glauth/glauth/pkg/stats"
"github.com/nmcclain/ldap"
accounts "github.com/owncloud/ocis-accounts/pkg/proto/v0"
"github.com/owncloud/ocis-pkg/v2/log"
)
type ocisHandler struct {
as accounts.AccountsService
log log.Logger
cfg *config.Config
}
func (h ocisHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (ldap.LDAPResultCode, error) {
bindDN = strings.ToLower(bindDN)
baseDN := strings.ToLower("," + h.cfg.Backend.BaseDN)
h.log.Debug().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Interface("src", conn.RemoteAddr()).Msg("Bind request")
stats.Frontend.Add("bind_reqs", 1)
// parse the bindDN - ensure that the bindDN ends with the BaseDN
if !strings.HasSuffix(bindDN, baseDN) {
h.log.Error().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Interface("src", conn.RemoteAddr()).Msg("BindDN not part of our BaseDN")
return ldap.LDAPResultInvalidCredentials, nil
}
parts := strings.Split(strings.TrimSuffix(bindDN, baseDN), ",")
if len(parts) > 2 {
h.log.Error().Str("binddn", bindDN).Int("numparts", len(parts)).Interface("src", conn.RemoteAddr()).Msg("BindDN should have only one or two parts")
return ldap.LDAPResultInvalidCredentials, nil
}
userName := strings.TrimPrefix(parts[0], "cn=")
// check password
_, err := h.as.ListAccounts(context.TODO(), &accounts.ListAccountsRequest{
//Query: fmt.Sprintf("username eq '%s'", username),
// TODO this allows lookung up users when you know the username using basic auth
// adding the password to the query is an option but sending the sover the wira a la scim seems ugly
// but to set passwords our accounts need it anyway
Query: fmt.Sprintf("login eq '%s' and password eq '%s'", userName, bindSimplePw),
})
if err != nil {
h.log.Error().Str("username", userName).Str("binddn", bindDN).Interface("src", conn.RemoteAddr()).Msg("Login failed")
return ldap.LDAPResultInvalidCredentials, nil
}
stats.Frontend.Add("bind_successes", 1)
h.log.Debug().Str("binddn", bindDN).Interface("src", conn.RemoteAddr()).Msg("Bind success")
return ldap.LDAPResultSuccess, nil
}
func (h ocisHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (ldap.ServerSearchResult, error) {
bindDN = strings.ToLower(bindDN)
baseDN := strings.ToLower("," + h.cfg.Backend.BaseDN)
searchBaseDN := strings.ToLower(searchReq.BaseDN)
h.log.Debug().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Str("filter", searchReq.Filter).Interface("src", conn.RemoteAddr()).Msg("Search request")
stats.Frontend.Add("search_reqs", 1)
// validate the user is authenticated and has appropriate access
if len(bindDN) < 1 {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("search error: Anonymous BindDN not allowed %s", bindDN)
}
if !strings.HasSuffix(bindDN, baseDN) {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("search error: BindDN %s not in our BaseDN %s", bindDN, h.cfg.Backend.BaseDN)
}
if !strings.HasSuffix(searchBaseDN, h.cfg.Backend.BaseDN) {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("search error: search BaseDN %s is not in our BaseDN %s", searchBaseDN, h.cfg.Backend.BaseDN)
}
// return all users in the config file - the LDAP library will filter results for us
entries := []*ldap.Entry{}
filterEntity, err := ldap.GetFilterObjectClass(searchReq.Filter)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("search error: error parsing filter: %s", searchReq.Filter)
}
switch filterEntity {
default:
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("search error: unhandled filter type: %s [%s]", filterEntity, searchReq.Filter)
case "posixgroup":
/*
groups, err := session.getGroups()
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("search error: error getting groups")
}
for _, g := range groups {
attrs := []*ldap.EntryAttribute{}
attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*g.ID}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}})
// attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
if g.Members != nil {
members := make([]string, len(g.Members))
for i, v := range g.Members {
members[i] = *v.ID
}
attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: members})
}
dn := fmt.Sprintf("cn=%s,%s=groups,%s", *g.ID, h.cfg.Backend.GroupFormat, h.cfg.Backend.BaseDN)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
}
*/
case "posixaccount", "":
userName := ""
if searchBaseDN != strings.ToLower(h.cfg.Backend.BaseDN) {
parts := strings.Split(strings.TrimSuffix(searchBaseDN, baseDN), ",")
if len(parts) >= 1 {
userName = strings.TrimPrefix(parts[0], "cn=")
}
}
accounts, err := h.as.ListAccounts(context.TODO(), &accounts.ListAccountsRequest{
Query: fmt.Sprintf("preferred_name eq '%s'", strings.ReplaceAll(userName, "'", "''")),
})
if err != nil {
h.log.Error().Err(err).Str("username", userName).Interface("src", conn.RemoteAddr()).Msg("Could not list accounts")
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("search error: error getting users")
}
for i := range accounts.Accounts {
attrs := []*ldap.EntryAttribute{
{Name: "objectClass", Values: []string{"posixAccount", "inetOrgPerson", "organizationalPerson", "Person", "top"}},
{Name: "cn", Values: []string{accounts.Accounts[i].PreferredName}},
{Name: "uid", Values: []string{accounts.Accounts[i].PreferredName}},
{Name: "sn", Values: []string{accounts.Accounts[i].PreferredName}}, // must be set for a valid person
}
if accounts.Accounts[i].DisplayName != "" {
attrs = append(attrs, &ldap.EntryAttribute{Name: "displayName", Values: []string{accounts.Accounts[i].DisplayName}})
}
if accounts.Accounts[i].Mail != "" {
attrs = append(attrs, &ldap.EntryAttribute{Name: "mail", Values: []string{accounts.Accounts[i].Mail}})
}
if accounts.Accounts[i].UidNumber != 0 { // TODO no root?
attrs = append(attrs, &ldap.EntryAttribute{Name: "uidnumber", Values: []string{strconv.FormatInt(accounts.Accounts[i].UidNumber, 10)}})
}
if accounts.Accounts[i].GidNumber != 0 {
attrs = append(attrs, &ldap.EntryAttribute{Name: "gidnumber", Values: []string{strconv.FormatInt(accounts.Accounts[i].GidNumber, 10)}})
}
if accounts.Accounts[i].Description != "" {
attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{accounts.Accounts[i].Description}})
}
dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.cfg.Backend.NameFormat, accounts.Accounts[i].PreferredName, h.cfg.Backend.GroupFormat, "users", h.cfg.Backend.BaseDN)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
}
}
stats.Frontend.Add("search_successes", 1)
h.log.Debug().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Str("filter", searchReq.Filter).Interface("src", conn.RemoteAddr()).Msg("AP: Search OK")
return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
}
func (h ocisHandler) Close(boundDN string, conn net.Conn) error {
stats.Frontend.Add("closes", 1)
return nil
}
// helper functions
func connID(conn net.Conn) string {
h := sha256.New()
h.Write([]byte(conn.LocalAddr().String() + conn.RemoteAddr().String()))
sha := fmt.Sprintf("% x", h.Sum(nil))
return string(sha)
}
func NewOCISHandler(opts ...Option) handler.Handler {
options := newOptions(opts...)
handler := ocisHandler{
log: options.Logger,
cfg: options.Config,
as: options.AccountsService,
}
return handler
}
pkg/server/glauth/option.go
+59
View File
@@ -0,0 +1,59 @@
package glauth
import (
"context"
"github.com/glauth/glauth/pkg/config"
accounts "github.com/owncloud/ocis-accounts/pkg/proto/v0"
"github.com/owncloud/ocis-pkg/v2/log"
)
// Option defines a single option function.
type Option func(o *Options)
// Options defines the available options for this package.
type Options struct {
Logger log.Logger
Context context.Context
Config *config.Config
AccountsService accounts.AccountsService
}
// newOptions initializes the available default options.
func newOptions(opts ...Option) Options {
opt := Options{}
for _, o := range opts {
o(&opt)
}
return opt
}
// Logger provides a function to set the logger option.
func Logger(val log.Logger) Option {
return func(o *Options) {
o.Logger = val
}
}
// Context provides a function to set the context option.
func Context(val context.Context) Option {
return func(o *Options) {
o.Context = val
}
}
// Config provides a function to set the config option.
func Config(val *config.Config) Option {
return func(o *Options) {
o.Config = val
}
}
// AccountsService provides an AccountsService client to set the AccountsService option.
func AccountsService(val accounts.AccountsService) Option {
return func(o *Options) {
o.AccountsService = val
}
}
pkg/server/glauth/server.go
+76
View File
@@ -0,0 +1,76 @@
package glauth
import (
"errors"
"github.com/GeertJohan/yubigo"
"github.com/glauth/glauth/pkg/config"
"github.com/glauth/glauth/pkg/handler"
"github.com/go-logr/logr"
"github.com/nmcclain/ldap"
"github.com/owncloud/ocis-glauth/pkg/mlogr"
)
// LdapSvc holds the ldap server struct
type LdapSvc struct {
log logr.Logger
c *config.Config
yubiAuth *yubigo.YubiAuth
l *ldap.Server
}
// Server initializes the debug service and server.
func Server(opts ...Option) (*LdapSvc, error) {
options := newOptions(opts...)
s := LdapSvc{
log: mlogr.New(&options.Logger),
c: options.Config,
}
var err error
if len(s.c.YubikeyClientID) > 0 && len(s.c.YubikeySecret) > 0 {
s.yubiAuth, err = yubigo.NewYubiAuth(s.c.YubikeyClientID, s.c.YubikeySecret)
if err != nil {
return nil, errors.New("Yubikey Auth failed")
}
}
// configure the backend
s.l = ldap.NewServer()
s.l.EnforceLDAP = true
var h handler.Handler
h = NewOCISHandler(
AccountsService(options.AccountsService),
Logger(options.Logger),
Config(s.c),
)
s.l.BindFunc("", h)
s.l.SearchFunc("", h)
s.l.CloseFunc("", h)
return &s, nil
}
// ListenAndServe listens on the TCP network address s.c.LDAP.Listen
func (s *LdapSvc) ListenAndServe() error {
s.log.V(3).Info("LDAP server listening", "address", s.c.LDAP.Listen)
return s.l.ListenAndServe(s.c.LDAP.Listen)
}
// ListenAndServeTLS listens on the TCP network address s.c.LDAPS.Listen
func (s *LdapSvc) ListenAndServeTLS() error {
s.log.V(3).Info("LDAPS server listening", "address", s.c.LDAPS.Listen)
return s.l.ListenAndServeTLS(
s.c.LDAPS.Listen,
s.c.LDAPS.Cert,
s.c.LDAPS.Key,
)
}
// Shutdown ends listeners by sending true to the ldap serves quit channel
func (s *LdapSvc) Shutdown() {
s.l.Quit <- true
}