Initial QSfera import

Server/services/idp/pkg/service/v0/service.go

@@ -0,0 +1,346 @@
+package svc
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/gorilla/mux"
+	"github.com/libregraph/lico/bootstrap"
+	guestBackendSupport "github.com/libregraph/lico/bootstrap/backends/guest"
+	ldapBackendSupport "github.com/libregraph/lico/bootstrap/backends/ldap"
+	libreGraphBackendSupport "github.com/libregraph/lico/bootstrap/backends/libregraph"
+	licoconfig "github.com/libregraph/lico/config"
+	"github.com/libregraph/lico/server"
+	"github.com/qsfera/server/pkg/ldap"
+	"github.com/qsfera/server/pkg/log"
+	"github.com/qsfera/server/pkg/tracing"
+	"github.com/qsfera/server/services/idp/pkg/assets"
+	cs3BackendSupport "github.com/qsfera/server/services/idp/pkg/backends/cs3/bootstrap"
+	"github.com/qsfera/server/services/idp/pkg/config"
+	"github.com/qsfera/server/services/idp/pkg/middleware"
+	"github.com/riandyrn/otelchi"
+	"go.opentelemetry.io/otel/trace"
+	"gopkg.in/yaml.v2"
+	"stash.kopano.io/kgol/rndm"
+)
+
+// Service defines the service handlers.
+type Service interface {
+	ServeHTTP(http.ResponseWriter, *http.Request)
+}
+
+// NewService returns a service implementation for Service.
+func NewService(opts ...Option) Service {
+	ctx := context.Background()
+	options := newOptions(opts...)
+	logger := options.Logger.Logger
+	assetVFS := assets.New(
+		assets.Logger(options.Logger),
+		assets.Config(options.Config),
+	)
+
+	if err := createTemporaryClientsConfig(
+		options.Config.IDP.IdentifierRegistrationConf,
+		options.Config.Commons.QsferaURL,
+		options.Config.Clients,
+	); err != nil {
+		logger.Fatal().Err(err).Msg("could not create default config")
+	}
+
+	switch options.Config.IDP.IdentityManager {
+	case "cs3":
+		cs3BackendSupport.MustRegister()
+		if err := initCS3EnvVars(options.Config.Reva.Address, options.Config.MachineAuthAPIKey); err != nil {
+			logger.Fatal().Err(err).Msg("could not initialize cs3 backend env vars")
+		}
+	case "ldap":
+
+		if err := ldap.WaitForCA(options.Logger, options.Config.IDP.Insecure, options.Config.Ldap.TLSCACert); err != nil {
+			logger.Fatal().Err(err).Msg("The configured LDAP CA cert does not exist")
+		}
+		if options.Config.IDP.Insecure {
+			// force CACert to be empty to avoid lico try to load it
+			options.Config.Ldap.TLSCACert = ""
+		}
+
+		ldapBackendSupport.MustRegister()
+		if err := initLicoInternalLDAPEnvVars(&options.Config.Ldap); err != nil {
+			logger.Fatal().Err(err).Msg("could not initialize ldap env vars")
+		}
+	default:
+		guestBackendSupport.MustRegister()
+		libreGraphBackendSupport.MustRegister()
+	}
+
+	idpSettings := bootstrap.Settings{
+		Iss:                               options.Config.IDP.Iss,
+		IdentityManager:                   options.Config.IDP.IdentityManager,
+		URIBasePath:                       options.Config.IDP.URIBasePath,
+		SignInURI:                         options.Config.IDP.SignInURI,
+		SignedOutURI:                      options.Config.IDP.SignedOutURI,
+		AuthorizationEndpointURI:          options.Config.IDP.AuthorizationEndpointURI,
+		EndsessionEndpointURI:             options.Config.IDP.EndsessionEndpointURI,
+		Insecure:                          options.Config.IDP.Insecure,
+		TrustedProxy:                      options.Config.IDP.TrustedProxy,
+		AllowScope:                        options.Config.IDP.AllowScope,
+		AllowClientGuests:                 options.Config.IDP.AllowClientGuests,
+		AllowDynamicClientRegistration:    options.Config.IDP.AllowDynamicClientRegistration,
+		EncryptionSecretFile:              options.Config.IDP.EncryptionSecretFile,
+		Listen:                            options.Config.IDP.Listen,
+		IdentifierClientDisabled:          options.Config.IDP.IdentifierClientDisabled,
+		IdentifierClientPath:              options.Config.IDP.IdentifierClientPath,
+		IdentifierRegistrationConf:        options.Config.IDP.IdentifierRegistrationConf,
+		IdentifierScopesConf:              options.Config.IDP.IdentifierScopesConf,
+		IdentifierDefaultBannerLogo:       options.Config.IDP.IdentifierDefaultBannerLogo,
+		IdentifierDefaultSignInPageText:   options.Config.IDP.IdentifierDefaultSignInPageText,
+		IdentifierDefaultLogoTargetURI:    options.Config.IDP.IdentifierDefaultLogoTargetURI,
+		IdentifierDefaultUsernameHintText: options.Config.IDP.IdentifierDefaultUsernameHintText,
+		IdentifierUILocales:               options.Config.IDP.IdentifierUILocales,
+		SigningKid:                        options.Config.IDP.SigningKid,
+		SigningMethod:                     options.Config.IDP.SigningMethod,
+		SigningPrivateKeyFiles:            options.Config.IDP.SigningPrivateKeyFiles,
+		ValidationKeysPath:                options.Config.IDP.ValidationKeysPath,
+		CookieBackendURI:                  options.Config.IDP.CookieBackendURI,
+		CookieNames:                       options.Config.IDP.CookieNames,
+		CookieSameSite:                    options.Config.IDP.CookieSameSite,
+		AccessTokenDurationSeconds:        options.Config.IDP.AccessTokenDurationSeconds,
+		IDTokenDurationSeconds:            options.Config.IDP.IDTokenDurationSeconds,
+		RefreshTokenDurationSeconds:       options.Config.IDP.RefreshTokenDurationSeconds,
+		DyamicClientSecretDurationSeconds: options.Config.IDP.DynamicClientSecretDurationSeconds,
+	}
+	bs, err := bootstrap.Boot(ctx, &idpSettings, &licoconfig.Config{
+		Logger: log.LogrusWrap(logger),
+	})
+	if err != nil {
+		logger.Fatal().Err(err).Msg("could not bootstrap idp")
+	}
+
+	managers := bs.Managers()
+	routes := []server.WithRoutes{managers.Must("identity").(server.WithRoutes)}
+	handlers := managers.Must("handler").(http.Handler)
+
+	svc := IDP{
+		logger: options.Logger,
+		config: options.Config,
+		assets: assetVFS,
+		tp:     options.TraceProvider,
+	}
+
+	svc.initMux(ctx, routes, handlers, options)
+
+	return svc
+}
+
+type temporaryClientConfig struct {
+	Clients []config.Client `yaml:"clients"`
+}
+
+func createTemporaryClientsConfig(filePath, qsferaURL string, clients []config.Client) error {
+	folder := path.Dir(filePath)
+	if _, err := os.Stat(folder); os.IsNotExist(err) {
+		if err := os.MkdirAll(folder, 0o700); err != nil {
+			return err
+		}
+	}
+
+	for i, client := range clients {
+
+		for i, entry := range client.RedirectURIs {
+			client.RedirectURIs[i] = strings.ReplaceAll(entry, "{{OC_URL}}", strings.TrimRight(qsferaURL, "/"))
+		}
+		for i, entry := range client.Origins {
+			client.Origins[i] = strings.ReplaceAll(entry, "{{OC_URL}}", strings.TrimRight(qsferaURL, "/"))
+		}
+		clients[i] = client
+	}
+
+	c := temporaryClientConfig{
+		Clients: clients,
+	}
+
+	conf, err := yaml.Marshal(c)
+	if err != nil {
+		return err
+	}
+
+	confOnDisk, err := os.Create(filePath)
+	if err != nil {
+		return err
+	}
+
+	defer confOnDisk.Close()
+
+	err = os.WriteFile(filePath, conf, 0o600)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Init cs3 backend vars which are currently not accessible via idp api
+func initCS3EnvVars(cs3Addr, machineAuthAPIKey string) error {
+	defaults := map[string]string{
+		"CS3_GATEWAY":              cs3Addr,
+		"CS3_MACHINE_AUTH_API_KEY": machineAuthAPIKey,
+	}
+
+	for k, v := range defaults {
+		if err := os.Setenv(k, v); err != nil {
+			return fmt.Errorf("could not set cs3 env var %s=%s", k, v)
+		}
+	}
+
+	return nil
+}
+
+// Init ldap backend vars which are currently not accessible via idp api
+func initLicoInternalLDAPEnvVars(ldap *config.Ldap) error {
+	filter := fmt.Sprintf("(objectclass=%s)", ldap.ObjectClass)
+
+	var needsAnd bool
+	if ldap.Filter != "" {
+		filter += ldap.Filter
+		needsAnd = true
+	}
+
+	if ldap.UserEnabledAttribute != "" {
+		// Using a (!(enabled=FALSE)) filter here to allow user without
+		// any value for the enable flag to log in
+		filter += fmt.Sprintf("(!(%s=FALSE))", ldap.UserEnabledAttribute)
+		needsAnd = true
+	}
+
+	if needsAnd {
+		filter = fmt.Sprintf("(&%s)", filter)
+	}
+
+	defaults := map[string]string{
+		"LDAP_URI":                 ldap.URI,
+		"LDAP_BINDDN":              ldap.BindDN,
+		"LDAP_BINDPW":              ldap.BindPassword,
+		"LDAP_BASEDN":              ldap.BaseDN,
+		"LDAP_SCOPE":               ldap.Scope,
+		"LDAP_LOGIN_ATTRIBUTE":     ldap.LoginAttribute,
+		"LDAP_EMAIL_ATTRIBUTE":     ldap.EmailAttribute,
+		"LDAP_NAME_ATTRIBUTE":      ldap.NameAttribute,
+		"LDAP_UUID_ATTRIBUTE":      ldap.UUIDAttribute,
+		"LDAP_SUB_ATTRIBUTES":      ldap.UUIDAttribute,
+		"LDAP_UUID_ATTRIBUTE_TYPE": ldap.UUIDAttributeType,
+		"LDAP_FILTER":              filter,
+	}
+
+	if ldap.TLSCACert != "" {
+		defaults["LDAP_TLS_CACERT"] = ldap.TLSCACert
+	}
+
+	for k, v := range defaults {
+		if err := os.Setenv(k, v); err != nil {
+			return fmt.Errorf("could not set ldap env var %s=%s", k, v)
+		}
+	}
+
+	return nil
+}
+
+// IDP defines implements the business logic for Service.
+type IDP struct {
+	logger log.Logger
+	config *config.Config
+	mux    *chi.Mux
+	assets http.FileSystem
+	tp     trace.TracerProvider
+}
+
+// initMux initializes the internal idp gorilla mux and mounts it in to an КуСфера chi-router
+func (idp *IDP) initMux(ctx context.Context, r []server.WithRoutes, h http.Handler, options Options) {
+	gm := mux.NewRouter()
+	for _, route := range r {
+		route.AddRoutes(ctx, gm)
+	}
+
+	// Delegate rest to provider which is also a handler.
+	if h != nil {
+		gm.NotFoundHandler = h
+	}
+
+	idp.mux = chi.NewMux()
+	idp.mux.Use(options.Middleware...)
+
+	idp.mux.Use(middleware.Static(
+		"/signin/v1/",
+		assets.New(
+			assets.Logger(options.Logger),
+			assets.Config(options.Config),
+		),
+		idp.tp,
+	))
+
+	idp.mux.Use(
+		otelchi.Middleware(
+			"idp",
+			otelchi.WithChiRoutes(idp.mux),
+			otelchi.WithTracerProvider(idp.tp),
+			otelchi.WithPropagators(tracing.GetPropagator()),
+		),
+	)
+
+	// handle / | index.html with a template that needs to have the BASE_PREFIX replaced
+	idp.mux.Get("/signin/v1/identifier", idp.Index())
+	idp.mux.Get("/signin/v1/identifier/", idp.Index())
+	idp.mux.Get("/signin/v1/identifier/index.html", idp.Index())
+
+	idp.mux.Mount("/", gm)
+
+	_ = chi.Walk(idp.mux, func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error {
+		options.Logger.Debug().Str("method", method).Str("route", route).Int("middlewares", len(middlewares)).Msg("serving endpoint")
+		return nil
+	})
+}
+
+// ServeHTTP implements the Service interface.
+func (idp IDP) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	idp.mux.ServeHTTP(w, r)
+}
+
+// Index renders the static html with templated variables.
+func (idp IDP) Index() http.HandlerFunc {
+	f, err := idp.assets.Open("/identifier/index.html")
+	if err != nil {
+		idp.logger.Fatal().Err(err).Msg("Could not open index template")
+	}
+
+	template, err := io.ReadAll(f)
+	if err != nil {
+		idp.logger.Fatal().Err(err).Msg("Could not read index template")
+	}
+	if err = f.Close(); err != nil {
+		idp.logger.Fatal().Err(err).Msg("Could not close body")
+	}
+
+	// TODO add environment variable to make the path prefix configurable
+	pp := "/signin/v1"
+	indexHTML := bytes.Replace(template, []byte("__PATH_PREFIX__"), []byte(pp), 1)
+
+	background := idp.config.Asset.LoginBackgroundUrl
+	indexHTML = bytes.Replace(template, []byte("__BG_IMG_URL__"), []byte(background), 1)
+
+	nonce := rndm.GenerateRandomString(32)
+	indexHTML = bytes.Replace(indexHTML, []byte("__CSP_NONCE__"), []byte(nonce), 1)
+
+	indexHTML = bytes.Replace(indexHTML, []byte("__PASSWORD_RESET_LINK__"), []byte(idp.config.Service.PasswordResetURI), 1)
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write(indexHTML); err != nil {
+			idp.logger.Error().Err(err).Msg("could not write to response writer")
+		}
+	})
+}