refactor idm

Signed-off-by: Christian Richter <crichter@owncloud.com>

extensions/idm/pkg/command/health.go

@@ -0,0 +1,53 @@
+package command
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/owncloud/ocis/extensions/idm/pkg/config"
+	"github.com/owncloud/ocis/extensions/idm/pkg/config/parser"
+	"github.com/owncloud/ocis/extensions/idm/pkg/logging"
+	"github.com/urfave/cli/v2"
+)
+
+// Health is the entrypoint for the health command.
+func Health(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "health",
+		Usage:    "check health status",
+		Category: "info",
+		Before: func(c *cli.Context) error {
+			return parser.ParseConfig(cfg)
+		},
+		Action: func(c *cli.Context) error {
+			logger := logging.Configure(cfg.Service.Name, cfg.Log)
+
+			resp, err := http.Get(
+				fmt.Sprintf(
+					"http://%s/healthz",
+					cfg.Debug.Addr,
+				),
+			)
+
+			if err != nil {
+				logger.Fatal().
+					Err(err).
+					Msg("Failed to request health check")
+			}
+
+			defer resp.Body.Close()
+
+			if resp.StatusCode != http.StatusOK {
+				logger.Fatal().
+					Int("code", resp.StatusCode).
+					Msg("Health seems to be in bad state")
+			}
+
+			logger.Debug().
+				Int("code", resp.StatusCode).
+				Msg("Health got a good state")
+
+			return nil
+		},
+	}
+}

extensions/idm/pkg/command/root.go

@@ -0,0 +1,64 @@
+package command
+
+import (
+	"context"
+	"os"
+
+	"github.com/owncloud/ocis/extensions/idm/pkg/config"
+	"github.com/owncloud/ocis/ocis-pkg/clihelper"
+	ociscfg "github.com/owncloud/ocis/ocis-pkg/config"
+	"github.com/thejerf/suture/v4"
+	"github.com/urfave/cli/v2"
+)
+
+// GetCommands provides all commands for this service
+func GetCommands(cfg *config.Config) cli.Commands {
+	return []*cli.Command{
+		// start this service
+		Server(cfg),
+
+		// interaction with this service
+
+		// infos about this service
+		Health(cfg),
+		Version(cfg),
+	}
+}
+
+// Execute is the entry point for the ocis-idm command.
+func Execute(cfg *config.Config) error {
+	app := clihelper.DefaultApp(&cli.App{
+		Name:     "ocis-idm",
+		Usage:    "Embedded LDAP service for oCIS",
+		Commands: GetCommands(cfg),
+	})
+
+	cli.HelpFlag = &cli.BoolFlag{
+		Name:  "help,h",
+		Usage: "Show the help",
+	}
+
+	return app.Run(os.Args)
+}
+
+// SutureService allows for the idm command to be embedded and supervised by a suture supervisor tree.
+type SutureService struct {
+	cfg *config.Config
+}
+
+// NewSutureService creates a new idm.SutureService
+func NewSutureService(cfg *ociscfg.Config) suture.Service {
+	cfg.IDM.Commons = cfg.Commons
+	return SutureService{
+		cfg: cfg.IDM,
+	}
+}
+
+func (s SutureService) Serve(ctx context.Context) error {
+	s.cfg.Context = ctx
+	if err := Execute(s.cfg); err != nil {
+		return err
+	}
+
+	return nil
+}

extensions/idm/pkg/command/server.go

@@ -0,0 +1,167 @@
+package command
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"html/template"
+	"os"
+	"strings"
+
+	"github.com/go-ldap/ldif"
+	"github.com/libregraph/idm/pkg/ldappassword"
+	"github.com/libregraph/idm/pkg/ldbbolt"
+	"github.com/libregraph/idm/server"
+	"github.com/owncloud/ocis/extensions/idm"
+	"github.com/owncloud/ocis/extensions/idm/pkg/config"
+	"github.com/owncloud/ocis/extensions/idm/pkg/config/parser"
+	"github.com/owncloud/ocis/extensions/idm/pkg/logging"
+	pkgcrypto "github.com/owncloud/ocis/ocis-pkg/crypto"
+	"github.com/owncloud/ocis/ocis-pkg/log"
+	"github.com/urfave/cli/v2"
+)
+
+// Server is the entrypoint for the server command.
+func Server(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "server",
+		Usage:    fmt.Sprintf("start %s extension without runtime (unsupervised mode)", cfg.Service.Name),
+		Category: "server",
+		Before: func(c *cli.Context) error {
+			return parser.ParseConfig(cfg)
+		},
+		Action: func(c *cli.Context) error {
+			logger := logging.Configure(cfg.Service.Name, cfg.Log)
+			ctx, cancel := func() (context.Context, context.CancelFunc) {
+				if cfg.Context == nil {
+					return context.WithCancel(context.Background())
+				}
+				return context.WithCancel(cfg.Context)
+			}()
+
+			defer cancel()
+			return start(ctx, logger, cfg)
+		},
+	}
+}
+
+func start(ctx context.Context, logger log.Logger, cfg *config.Config) error {
+	servercfg := server.Config{
+		Logger:          log.LogrusWrap(logger.Logger),
+		LDAPHandler:     "boltdb",
+		LDAPSListenAddr: cfg.IDM.LDAPSAddr,
+		TLSCertFile:     cfg.IDM.Cert,
+		TLSKeyFile:      cfg.IDM.Key,
+		LDAPBaseDN:      "o=libregraph-idm",
+		LDAPAdminDN:     "uid=libregraph,ou=sysusers,o=libregraph-idm",
+
+		BoltDBFile: cfg.IDM.DatabasePath,
+	}
+
+	if cfg.IDM.LDAPSAddr != "" {
+		// Generate a self-signing cert if no certificate is present
+		if err := pkgcrypto.GenCert(cfg.IDM.Cert, cfg.IDM.Key, logger); err != nil {
+			logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
+		}
+	}
+	if _, err := os.Stat(servercfg.BoltDBFile); errors.Is(err, os.ErrNotExist) {
+		logger.Debug().Msg("Bootstrapping IDM database")
+		if err = bootstrap(logger, cfg, servercfg); err != nil {
+			logger.Error().Err(err).Msg("failed to bootstrap idm database")
+		}
+	}
+
+	svc, err := server.NewServer(&servercfg)
+	if err != nil {
+		return err
+	}
+	return svc.Serve(ctx)
+}
+
+func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) error {
+	// Hash password if the config does not supply a hash already
+	var err error
+
+	type svcUser struct {
+		Name     string
+		Password string
+	}
+
+	serviceUsers := []svcUser{
+		{
+			Name:     "admin",
+			Password: cfg.ServiceUserPasswords.OcisAdmin,
+		},
+		{
+			Name:     "libregraph",
+			Password: cfg.ServiceUserPasswords.Idm,
+		},
+		{
+			Name:     "idp",
+			Password: cfg.ServiceUserPasswords.Idp,
+		},
+		{
+			Name:     "reva",
+			Password: cfg.ServiceUserPasswords.Reva,
+		},
+	}
+
+	bdb := &ldbbolt.LdbBolt{}
+
+	if err := bdb.Configure(srvcfg.Logger, srvcfg.LDAPBaseDN, srvcfg.BoltDBFile, nil); err != nil {
+		return err
+	}
+	defer bdb.Close()
+
+	if err := bdb.Initialize(); err != nil {
+		return err
+	}
+
+	// Prepare the initial Data from template. To be able to set the
+	// supplied service user passwords
+	tmpl, err := template.New("baseldif").Parse(idm.BaseLDIF)
+	if err != nil {
+		return err
+	}
+
+	for i := range serviceUsers {
+		if strings.HasPrefix(serviceUsers[i].Password, "$argon2id$") {
+			// password is alread hashed
+			serviceUsers[i].Password = "{ARGON2}" + serviceUsers[i].Password
+		} else {
+			if serviceUsers[i].Password, err = ldappassword.Hash(serviceUsers[i].Password, "{ARGON2}"); err != nil {
+				return err
+			}
+		}
+		// We need to treat the hash as binary in the LDIF template to avoid
+		// go-ldap/ldif to to any fancy escaping
+		serviceUsers[i].Password = base64.StdEncoding.EncodeToString([]byte(serviceUsers[i].Password))
+	}
+	var tmplWriter strings.Builder
+	err = tmpl.Execute(&tmplWriter, serviceUsers)
+	if err != nil {
+		return err
+	}
+
+	bootstrapData := tmplWriter.String()
+	if cfg.CreateDemoUsers {
+		bootstrapData = bootstrapData + "\n" + idm.DemoUsersLDIF
+	}
+
+	s := strings.NewReader(bootstrapData)
+	lf := &ldif.LDIF{}
+	err = ldif.Unmarshal(s, lf)
+	if err != nil {
+		return err
+	}
+
+	for _, entry := range lf.AllEntries() {
+		logger.Debug().Str("dn", entry.DN).Msg("Adding entry")
+		if err := bdb.EntryPut(entry); err != nil {
+			return fmt.Errorf("error adding Entry '%s': %w", entry.DN, err)
+		}
+	}
+
+	return nil
+}

extensions/idm/pkg/command/version.go

@@ -0,0 +1,19 @@
+package command
+
+import (
+	"github.com/owncloud/ocis/extensions/idm/pkg/config"
+	"github.com/urfave/cli/v2"
+)
+
+// Version prints the service versions of all running instances.
+func Version(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "version",
+		Usage:    "print the version of this binary and the running extension instances",
+		Category: "info",
+		Action: func(c *cli.Context) error {
+			// not implemented
+			return nil
+		},
+	}
+}