First commit. src files partly taken from Antonio Calanducci's repository.
This commit is contained in:
parent
5795566c5d
commit
29ae2314e2
GPG Key ID:
147ABE6CEB9E20FF
|
|
@ -0,0 +1,22 @@
|
|||
FROM nginx:stable-alpine
|
||||
|
||||
# The following variables are used to keep the ansible modifications to a minumum.
|
||||
|
||||
ENV DOCKER_FULL_STACK_SERVICE_NAME="localhost"
|
||||
ENV DOCKER_SERVICE_PORT=8080
|
||||
ENV SERVICE_HOST="localhost"
|
||||
ENV KEYCLOACK_SERVER="localhost"
|
||||
ENV ACCOUNTING_SERVICE_BASEURL="https://localhost"
|
||||
ENV SUBREQUEST_OUTPUT_BUFFER_SIZE="8192k"
|
||||
ENV SHINYPROXY_PROMETHEUS_PORT="9090"
|
||||
ENV D4SCIENCE_API_ENDPOINT="https://localhost"
|
||||
|
||||
|
||||
# config.js and nginx.default.conf.template must be overwritten at deployment time
|
||||
# with the correct files for the scenario
|
||||
#
|
||||
COPY src/nginx.conf /etc/nginx/nginx.conf
|
||||
COPY src/config.js /etc/nginx/config.js
|
||||
COPY src/nginx.default.conf.template /etc/nginx/templates/default.conf.template
|
||||
COPY src/pep.js /etc/nginx/pep.js
|
||||
|
||||
|
|
@ -9,18 +9,19 @@ pipeline {
|
|||
label 'docker'
|
||||
}
|
||||
environment {
|
||||
imagename = "" //TO FILL WITH THE RIGHT VALUE (RepositoryName) e.g. d4science/RepositoryName
|
||||
registryCredential = 'e348bfab-5580-4db6-b0e0-d854966bde08'
|
||||
dockerImage = ''
|
||||
git_url='' // SET HERE THE URL OF YOUR NEW GIT PROJECT
|
||||
imagename = "pep/nginx-pep"
|
||||
hubname = "hub.dev.d4science.org"
|
||||
registryUrl = "https://hub.dev.d4science.org"
|
||||
registryCredential = 'c4ece6a2-3488-43c4-b74d-714b057845d1'
|
||||
dockerImage = ''
|
||||
git_url='https://code-repo.d4science.org/D4Science/pep-container-image.git'
|
||||
}
|
||||
stages {
|
||||
stage('Cloning Git') {
|
||||
steps {
|
||||
git([url: git_url, branch: 'master', credentialsId: '88b54962-1c0e-49cb-8155-22276860f346'])
|
||||
|
||||
}
|
||||
}
|
||||
// stage('Cloning Git') {
|
||||
// steps {
|
||||
// git([url: git_url, branch: 'main', credentialsId: ''])
|
||||
// }
|
||||
// }
|
||||
stage('Building image') {
|
||||
steps{
|
||||
script {
|
||||
|
|
@ -31,18 +32,17 @@ pipeline {
|
|||
stage('Deploy Image') {
|
||||
steps{
|
||||
script {
|
||||
docker.withRegistry( '', registryCredential ) {
|
||||
docker.withRegistry( registryUrl, registryCredential ) {
|
||||
dockerImage.push("$BUILD_NUMBER")
|
||||
dockerImage.push('latest')
|
||||
|
||||
dockerImage.push('latest')
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
stage('Remove Unused docker image') {
|
||||
steps{
|
||||
sh "docker rmi $imagename:$BUILD_NUMBER"
|
||||
sh "docker rmi $imagename:latest"
|
||||
sh "docker rmi $hubname/$imagename:$BUILD_NUMBER"
|
||||
sh "docker rmi $hubname/$imagename:latest"
|
||||
|
||||
}
|
||||
}
|
||||
|
|
|
|||
14
README.md
14
README.md
|
|
@ -1,12 +1,10 @@
|
|||
# Pipeline-Docker-Template
|
||||
# PEP image, nginx based
|
||||
|
||||
This is a template useful for building docker images and push to dockerhub.
|
||||
There is a jenkinsjob template on our jenkins with the same name.
|
||||
This is a nginx image with some bits of a javascript based PEP.
|
||||
Two files:
|
||||
|
||||
* nginx.default.conf.template
|
||||
* config.js
|
||||
|
||||
## USAGE TIPS:
|
||||
must be overwritten (via ansible): `config.js` as *secret*, `nginx.default.conf.template` as *config*.
|
||||
|
||||
* REMEMBER TO FILL the jenkinsfile environment section with your values. The following field should be properly filled: imagename, git_url
|
||||
* REMEMBER TO PUT your Dockerfile in the root folder of your new project
|
||||
|
||||
* You can find the related jenkinsjob template here: https://jenkins.d4science.org/job/Pipeline-Docker-Template/
|
||||
|
|
|
|||
|
|
@ -0,0 +1,33 @@
|
|||
export default { config };
|
||||
|
||||
var config = {
|
||||
"pep_credentials" : "pep_credentials",
|
||||
"debug": true,
|
||||
"accounting": {
|
||||
"scope": "authorized_scope",
|
||||
"service_name": "docker_stack_name",
|
||||
"host": "service_hostname"
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"host": ["service_hostname"],
|
||||
"audience": "oidc_client_id",
|
||||
"allow-basic-auth": "true/false",
|
||||
"paths": [
|
||||
{
|
||||
"name": "oidc_client_resource_name",
|
||||
"path": "^/?.*$",
|
||||
"methods": [
|
||||
{
|
||||
"method": "GET"
|
||||
},
|
||||
{
|
||||
"method": "POST"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# Added to load njs module
|
||||
load_module modules/ngx_http_js_module.so;
|
||||
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log info;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
# declare environmental variable to get credentials requiredd to access keycloak
|
||||
env PEP_CREDENTIALS;
|
||||
|
||||
http {
|
||||
|
||||
# added to import pep script
|
||||
js_import pep.js;
|
||||
|
||||
# added to bind enforce function
|
||||
js_set $authorization pep.enforce_legacy;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
# Websockets
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
# Prometheus metrics
|
||||
upstream prometheus {
|
||||
ip_hash;
|
||||
server {{ shinyproxy_as_docker_stack_name }}_{{ shinyproxy_as_docker_service_name }}:{{ shinyproxy_prometheus_port }};
|
||||
}
|
||||
|
||||
# backend service
|
||||
upstream service {
|
||||
ip_hash;
|
||||
server ${DOCKER_FULL_STACK_SERVICE_NAME}:${DOCKER_SERVICE_PORT};
|
||||
}
|
||||
|
||||
|
||||
# variables computed by njs and which may possibly be passed among locations
|
||||
js_var $auth_token;
|
||||
js_var $account_record;
|
||||
js_var $pep_credentials;
|
||||
|
||||
proxy_cache_path /tmp levels=1:2 keys_zone=social_cache:10m max_size=10g inactive=60m use_temp_path=off;
|
||||
|
||||
|
||||
server {
|
||||
|
||||
listen *:80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name ${SERVICE_HOST};
|
||||
|
||||
subrequest_output_buffer_size ${SUBREQUEST_OUTPUT_BUFFER_SIZE};
|
||||
|
||||
proxy_hide_header X-Frame-Options;
|
||||
add_header X-Frame-Options "";
|
||||
proxy_hide_header Content-Security-Policy;
|
||||
add_header Content-Security-Policy "";
|
||||
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
location /health {
|
||||
add_header Content-Length 0;
|
||||
add_header Content-Type "text/plain";
|
||||
return 200;
|
||||
}
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Host "$remote_addr";
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header nginx-request-uri $request_uri;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering on;
|
||||
proxy_buffer_size 8k;
|
||||
proxy_buffers 4 8k;
|
||||
proxy_busy_buffers_size 16k;
|
||||
proxy_temp_file_write_size 16k;
|
||||
proxy_redirect off;
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 2400s;
|
||||
proxy_send_timeout 120s;
|
||||
|
||||
|
||||
location ~ /app/ {
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
js_content pep.enforce_legacy;
|
||||
}
|
||||
|
||||
|
||||
|
||||
location /gcube_user_info {
|
||||
internal;
|
||||
gunzip on;
|
||||
proxy_method GET;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header gcube-token "$auth_token";
|
||||
proxy_pass https://api.d4science.org/rest/2/people/profile;
|
||||
|
||||
proxy_cache social_cache;
|
||||
proxy_cache_key $auth_token;
|
||||
}
|
||||
|
||||
|
||||
location / {
|
||||
access_log /var/log/nginx/proxy.access.log;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-NginX-Proxy true;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
# resolver 127.0.0.11;
|
||||
proxy_pass http://service$request_uri;
|
||||
}
|
||||
|
||||
|
||||
# internal location that redirects to backend will only be called from PEP JS code when all checks are passed
|
||||
location /_backend {
|
||||
internal;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-NginX-Proxy true;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
# proxy_redirect off;
|
||||
proxy_pass http://service$request_uri;
|
||||
}
|
||||
|
||||
|
||||
# internal location that redirects to Keycloak in order to verify a token's validity. This will be called only from PEP JS code
|
||||
location /jwt_verify_request {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Authorization $pep_credentials;
|
||||
proxy_set_header Content-Type "application/x-www-form-urlencoded";
|
||||
proxy_pass "https://${KEYCLOACK_SERVER}/auth/realms/d4science/protocol/openid-connect/token/introspect";
|
||||
|
||||
proxy_ignore_headers Cache-Control Expires Set-Cookie;
|
||||
gunzip on;
|
||||
}
|
||||
|
||||
# internal location that redirects to Keycloak in order to exchange Basic auth credentials with token. This will be called only from PEP JS code
|
||||
location /jwt_request {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Authorization $pep_credentials;
|
||||
proxy_set_header Content-Type "application/x-www-form-urlencoded";
|
||||
proxy_pass "https://${KEYCLOACK_SERVER}/auth/realms/d4science/protocol/openid-connect/token";
|
||||
gunzip on;
|
||||
}
|
||||
|
||||
# internal location that redirects to Keycloak in order to perform a specific authorization request. This will be called only from PEP JS code
|
||||
location /permission_request {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Content-Type "application/x-www-form-urlencoded";
|
||||
proxy_set_header Authorization "Bearer $auth_token";
|
||||
proxy_pass "https://${KEYCLOACK_SERVER}/auth/realms/d4science/protocol/openid-connect/token";
|
||||
gunzip on;
|
||||
}
|
||||
|
||||
# internal location that sends a record to accounting service. This will be called only from PEP JS code if requested.
|
||||
location /accounting {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Authorization "Bearer $auth_token";
|
||||
proxy_set_header Content-Type "application/json";
|
||||
proxy_pass "${ACCOUNTING_SERVICE_BASEURL}/record";
|
||||
}
|
||||
|
||||
location /_accounting_legacy {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header gcube-token "$auth_token";
|
||||
proxy_set_header Content-Type "application/json";
|
||||
proxy_pass ${ACCOUNTING_SERVICE_BASEURL}/record;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,563 @@
|
|||
export default { enforce_legacy };
|
||||
|
||||
import defaultExport from './config.js';
|
||||
|
||||
function log(c, s) {
|
||||
c.request.log(s)
|
||||
}
|
||||
|
||||
var _debug = defaultExport["config"]["debug"]
|
||||
var _debug = true
|
||||
|
||||
njs.dump(_debug);
|
||||
|
||||
function debug(c, s) {
|
||||
if (_debug === true) {
|
||||
log(c, s)
|
||||
}
|
||||
}
|
||||
|
||||
function enforce(r) {
|
||||
|
||||
var context = {
|
||||
request: r,
|
||||
config: defaultExport["config"],
|
||||
backend: (defaultExport.backend ? defaultExport.backend : "/_backend")
|
||||
}
|
||||
|
||||
log(context, "Inside NJS enforce for " + r.method + " @ " + r.headersIn.host + r.uri)
|
||||
|
||||
context = computeProtection(context)
|
||||
|
||||
wkf.run(wkf.build(context), context)
|
||||
}
|
||||
|
||||
function enforce_legacy(r) {
|
||||
var context = {
|
||||
request: r,
|
||||
config: defaultExport["config"]
|
||||
}
|
||||
|
||||
debug(context, JSON.stringify(context.config["accounting"], null, 2));
|
||||
var allowedcontexts = [context.config["accounting"]["scope"]]
|
||||
log(context, "Inside NJS enforce for " + r.method + " @ " + r.headersIn.host + "/" + r.uri)
|
||||
debug(context, "debug is " + JSON.stringify(defaultExport["config"]))
|
||||
const token = getGCubeToken(context)
|
||||
debug(context, JSON.stringify(context, null, 2))
|
||||
debug(context, "gcube token" + token)
|
||||
if (token != null) {
|
||||
debug(context, "[PEP] token is " + token)
|
||||
exportVariable(context, "auth_token", token)
|
||||
context.request.subrequest("/_gcube_user_info")
|
||||
.then(reply => {
|
||||
if (reply.status === 200) {
|
||||
debug(context, "[Social Service] got response " + reply.responseText)
|
||||
// var response = JSON.parse(reply.responseBody);
|
||||
var response = JSON.parse(reply.responseText);
|
||||
if (allowedcontexts.indexOf(response.result.context) === -1) {
|
||||
debug(context, "[PEP] Unathorized context " + response.result.context)
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
return response
|
||||
} else {
|
||||
log(context, "[Social Service] failed " + reply.status + ":" + reply.responseText)
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
}).then(userinfo => {
|
||||
debug(context, "[Social Service] username is " + userinfo.result.username)
|
||||
debug(context, njs.dump(context));
|
||||
context.userinfo = userinfo
|
||||
context.record = buildAccountingRecord_legacy(context)
|
||||
return context.request.subrequest("/_backend", { method: context.request.method, args: JSON.stringify(context.request.args), headers: context.request.headersIn })
|
||||
}).then(reply => {
|
||||
debug(context, reply.responseText);
|
||||
debug(context, "[SHINYPROXY] response status: " + reply.status)
|
||||
copyHeaders(context, reply.headersOut, r.headersOut)
|
||||
closeAccountingRecord_legacy(context.record, (reply.status === 200 || reply.status === 201 || reply.status === 204))
|
||||
context.request.subrequest("/_accounting_legacy", { detached: true, body: JSON.stringify([context.record]) })
|
||||
// r.return(reply.status, reply.responseBody)
|
||||
debug(context, "Redirect URI: " + reply.headersOut["Location"])
|
||||
if(reply.status === 301 || reply.status === 302){
|
||||
debug(context, "sto per fare la redirect");
|
||||
r.return(reply.status, reply.headersOut["Location"])
|
||||
}else{
|
||||
r.return(reply.status, reply.responseText)
|
||||
}
|
||||
}).catch(e => { log(context, "Error .... " + njs.dump(e)); context.request.return(e.message === "Unauthorized" ? 403 : 500) })
|
||||
return
|
||||
}
|
||||
r.return(401, "Authorization required")
|
||||
}
|
||||
|
||||
function copyHeaders(context, hin, hout){
|
||||
for (var h in hin) {
|
||||
if(h !== "Location") hout[h] = hin[h];
|
||||
}
|
||||
}
|
||||
|
||||
// ######## WORKFLOW FUNCTIONS ###############
|
||||
var wkf = {
|
||||
|
||||
build: (context) => {
|
||||
var actions = [
|
||||
"export_pep_credentials",
|
||||
"parse_authentication",
|
||||
"check_authentication",
|
||||
"export_authn_token",
|
||||
// "pip",
|
||||
"pdp",
|
||||
// "export_backend_headers",
|
||||
// "pass"
|
||||
"start_accounting",
|
||||
"pass_and_wait",
|
||||
"close_accounting",
|
||||
"send_accounting",
|
||||
"respond_to_client"
|
||||
]
|
||||
/*var actions = [
|
||||
"export_pep_credentials",
|
||||
"parse_authentication",
|
||||
"check_authentication",
|
||||
"export_authn_token",
|
||||
"pip",
|
||||
"pdp",
|
||||
"export_backend_headers",
|
||||
"start_accounting",
|
||||
"pass_and_wait",
|
||||
"close_accounting",
|
||||
"respond_to_client"
|
||||
]*/
|
||||
return actions
|
||||
},
|
||||
|
||||
run: (actions, context) => {
|
||||
context.request.log("Starting workflow with " + njs.dump(actions))
|
||||
var w = actions.reduce(
|
||||
(acc, f) => { return acc.then(typeof (f) === "function" ? f : wkf[f]) },
|
||||
Promise.resolve().then(() => context)
|
||||
)
|
||||
w.catch(e => { context.request.error(njs.dump(e)); context.request.return(401) })
|
||||
},
|
||||
|
||||
export_pep_credentials: exportPepCredentials,
|
||||
export_authn_token: exportAuthToken,
|
||||
export_backend_headers: exportBackendHeaders,
|
||||
parse_authentication: parseAuthentication,
|
||||
check_authentication: checkAuthentication,
|
||||
verify_token: verifyToken,
|
||||
request_token: requestToken,
|
||||
pip: pipExecutor,
|
||||
pdp: pdpExecutor,
|
||||
pass: pass,
|
||||
pass_and_wait: pass_and_wait,
|
||||
respond_to_client: respondToClient,
|
||||
start_accounting: buildAccountingRecord,
|
||||
close_accounting: closeAccountingRecord,
|
||||
send_accounting: sendAccountingRecord
|
||||
}
|
||||
|
||||
function getGCubeToken(context) {
|
||||
if (context.request.args["gcube-token"]) {
|
||||
return context.request.args["gcube-token"];
|
||||
} else if (context.request.headersIn['gcube-token']) {
|
||||
return context.request.headersIn['gcube-token'];
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
|
||||
function getTokenField(context, f) {
|
||||
return context.authn.verified_token[f]
|
||||
}
|
||||
|
||||
function exportVariable(context, name, value) {
|
||||
context.request.variables[name] = value
|
||||
return context
|
||||
}
|
||||
|
||||
function exportBackendHeaders(context) {
|
||||
return context
|
||||
}
|
||||
|
||||
function exportPepCredentials(context) {
|
||||
if (process.env["pep_credentials"] || process.env["PEP_CREDENTIALS"]) {
|
||||
return exportVariable(context, "pep_credentials", "Basic " + process.env["PEP_CREDENTIALS"])
|
||||
} else if (context.config["pep_credentials"]) {
|
||||
return exportVariable(context, "pep_credentials", "Basic " + context.config["pep_credentials"])
|
||||
} else {
|
||||
throw new Error("Need PEP credentials")
|
||||
}
|
||||
}
|
||||
|
||||
function exportAuthToken(context) {
|
||||
return exportVariable(context, "auth_token", context.authn.token)
|
||||
}
|
||||
|
||||
function checkAuthentication(context) {
|
||||
return context.authn.type === "bearer" ? wkf.verify_token(context) : wkf.request_token(context)
|
||||
}
|
||||
|
||||
function parseAuthentication(context) {
|
||||
context.request.log("Inside parseAuthentication")
|
||||
context.request.log(JSON.stringify(context.request.args, null, 2))
|
||||
var incomingauth = context.request.headersIn["Authorization"]
|
||||
|
||||
if (!incomingauth) throw new Error("Authentication required");
|
||||
|
||||
var arr = incomingauth.trim().replace(/\s\s+/g, " ").split(" ")
|
||||
if (arr.length != 2) throw new Error("Unknown authentication scheme");
|
||||
|
||||
var type = arr[0].toLowerCase()
|
||||
if (type === "basic" && context.authz.host && (context.authz.host["allow-basic-auth"] || context.authz.host["allow_basic_auth"])) {
|
||||
var unamepass = Buffer.from(arr[1], 'base64').toString().split(":")
|
||||
if (unamepass.length != 2) return null;
|
||||
context.authn = { type: type, raw: arr[1], user: unamepass[0], password: unamepass[1] }
|
||||
return context
|
||||
} else if (type === "bearer") {
|
||||
context.authn = { type: type, raw: arr[1], token: arr[1] }
|
||||
return context
|
||||
}
|
||||
throw new Error("Unknown authentication scheme");
|
||||
}
|
||||
|
||||
function verifyToken(context) {
|
||||
log(context, "Inside verifyToken")
|
||||
debug(context, "Token is " + context.authn.token)
|
||||
var options = {
|
||||
"body": "token=" + context.authn.token + "&token_type_hint=access_token"
|
||||
}
|
||||
return context.request.subrequest("/_jwt_verify_request", options)
|
||||
.then(reply => {
|
||||
if (reply.status === 200) {
|
||||
var response = JSON.parse(reply.responseText);
|
||||
if (response.active === true) {
|
||||
return response
|
||||
} else {
|
||||
throw new Error("Unauthorized: " + reply.responseText)
|
||||
}
|
||||
} else {
|
||||
throw new Error("Unauthorized: " + reply.responseText)
|
||||
}
|
||||
}).then(verified_token => {
|
||||
context.authn.verified_token =
|
||||
JSON.parse(Buffer.from(context.authn.token.split('.')[1], 'base64url').toString())
|
||||
return context
|
||||
})
|
||||
}
|
||||
|
||||
function requestToken(context) {
|
||||
log(context, "Inside requestToken")
|
||||
var options = {
|
||||
"body": "grant_type=client_credentials&client_id=" + context.authn.user + "&client_secret=" + context.authn.password
|
||||
}
|
||||
return context.request.subrequest("/_jwt_request", options)
|
||||
.then(reply => {
|
||||
if (reply.status === 200) {
|
||||
var response = JSON.parse(reply.responseText);
|
||||
context.authn.token = response.access_token
|
||||
context.authn.verified_token =
|
||||
JSON.parse(Buffer.from(context.authn.token.split('.')[1], 'base64url').toString())
|
||||
return context
|
||||
} else if (reply.status === 400 || reply.status === 401) {
|
||||
var options = {
|
||||
"body": "grant_type=password&username=" + context.authn.user + "&password=" + context.authn.password
|
||||
}
|
||||
return context.request.subrequest("/_jwt_request", options)
|
||||
.then(reply => {
|
||||
if (reply.status === 200) {
|
||||
var response = JSON.parse(reply.responseText);
|
||||
context.authn.token = response.access_token
|
||||
context.authn.verified_token =
|
||||
JSON.parse(Buffer.from(context.authn.token.split('.')[1], 'base64url').toString())
|
||||
return context
|
||||
} else {
|
||||
throw new Error("Unauthorized " + reply.status)
|
||||
}
|
||||
})
|
||||
} else {
|
||||
throw new Error("Unauthorized " + reply.status)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
function pipExecutor(context) {
|
||||
log(context, "Inside extra claims PIP")
|
||||
context.authz.pip.forEach(extra => {
|
||||
//call extra claim pip function
|
||||
try {
|
||||
var operator = extra.operator
|
||||
var result = wkf[operator](context, extra.args)
|
||||
//ensure array and add to extra_claims
|
||||
if (!(result instanceof Array)) result = [result]
|
||||
if (!context.extra_claims) context.extra_claims = {};
|
||||
context.extra_claims[extra.claim] = result
|
||||
} catch (error) {
|
||||
log(context, "Skipping invalid extra claim " + njs.dump(error))
|
||||
}
|
||||
})
|
||||
log(context, "Extra claims are " + njs.dump(context.extra_claims))
|
||||
return context
|
||||
}
|
||||
|
||||
function pdpExecutor(context) {
|
||||
log(context, "Inside PDP")
|
||||
return context.authz.pdp(context)
|
||||
}
|
||||
|
||||
function umaCall(context) {
|
||||
log(context, "Inside UMA call")
|
||||
var options = { "body": computePermissionRequestBody(context) };
|
||||
return context.request.subrequest("/_permission_request", options)
|
||||
.then(reply => {
|
||||
if (reply.status === 200) {
|
||||
debug(context, "UMA call reply is " + reply.status)
|
||||
return context
|
||||
} else {
|
||||
throw new Error("Response for authorization request is not ok " + reply.status + " " + njs.dump(reply.responseText))
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// Call backend and return reply to client directly
|
||||
async function pass(context) {
|
||||
log(context, "Inside pass and wait");
|
||||
const r = context.request
|
||||
const reply = await r.subrequest(context.backend, { method: r.method, args: r.variables.args, headers: r.headersIn })
|
||||
debug(context, "[BACKEND] response status: " + reply.status)
|
||||
context.backendresponse = reply
|
||||
return respondToClient(context)
|
||||
}
|
||||
|
||||
// Pass to backend but instead of returning to client wait for the reply. Thi intercepts the possibility of performing extra action like closing and sending accounting record.
|
||||
async function pass_and_wait(context) {
|
||||
log(context, "Inside pass and wait");
|
||||
const r = context.request
|
||||
const reply = await r.subrequest(context.backend, { method: r.method, args: r.variables.args, headers: r.headersIn })
|
||||
debug(context, "[BACKEND] response status: " + reply.status)
|
||||
context.backendresponse = reply
|
||||
return context
|
||||
}
|
||||
|
||||
// Definetely return backend response
|
||||
function respondToClient(context) {
|
||||
log(context, "Inside respond to client" + njs.dump(context.backendresponse));
|
||||
for (let k in context.backendresponse.headersOut) {
|
||||
context.request.headersOut[k] = context.backendresponse.headersOut[k]
|
||||
}
|
||||
context.request.return(context.backendresponse.status, context.backendresponse.responseText)
|
||||
return context
|
||||
}
|
||||
|
||||
// ######## AUTHORIZATION PART ###############
|
||||
function computePermissionRequestBody(context) {
|
||||
|
||||
if (!context.authz.host || !context.authz.path) {
|
||||
throw new Error("Enforcemnt mode is always enforcing. Host or path not found...")
|
||||
}
|
||||
|
||||
var audience = computeAudience(context)
|
||||
var grant = "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket"
|
||||
var mode = "response_mode=decision"
|
||||
var permissions = computePermissions(context)
|
||||
var extra = ""
|
||||
if (context.extra_claims) {
|
||||
extra =
|
||||
"claim_token_format=urn:ietf:params:oauth:token-type:jwt&claim_token=" +
|
||||
JSON.stringify(context.extra_claims).toString("base64url")
|
||||
}
|
||||
var body = audience + "&" + grant + "&" + permissions + "&" + mode + "&" + extra
|
||||
context.request.error("Computed permission request body is " + body)
|
||||
return body
|
||||
}
|
||||
|
||||
function computeAudience(context) {
|
||||
var aud = context.request.headersIn.host
|
||||
if (context.authz.host) {
|
||||
aud = context.authz.host.audience || context.authz.host.host
|
||||
}
|
||||
return "audience=" + aud
|
||||
}
|
||||
|
||||
function computePermissions(context) {
|
||||
var resource = context.request.uri
|
||||
if (context.authz.path) {
|
||||
resource = context.authz.path.name || context.authz.path.path
|
||||
}
|
||||
var scopes = []
|
||||
if (context.authz.method && context.authz.method.scopes) {
|
||||
scopes = context.authz.method.scopes
|
||||
}
|
||||
if (scopes.length > 0) {
|
||||
return scopes.map(s => "permission=" + resource + "#" + s).join("&")
|
||||
}
|
||||
return "permission=" + resource
|
||||
}
|
||||
|
||||
function getPath(hostconfig, incomingpath, incomingmethod) {
|
||||
var paths = hostconfig.paths || []
|
||||
var matchingpaths = paths
|
||||
.filter(p => { return incomingpath.match(p.path) != null })
|
||||
.reduce((acc, p) => {
|
||||
if (!p.methods || p.methods.length === 0) acc.weak.push({ path: p });
|
||||
else {
|
||||
var matchingmethods = p.methods.filter(m => m.method.toUpperCase() === incomingmethod)
|
||||
if (matchingmethods.length > 0) acc.strong.push({ method: matchingmethods[0], path: p });
|
||||
}
|
||||
return acc;
|
||||
}, { strong: [], weak: [] })
|
||||
return matchingpaths.strong.concat(matchingpaths.weak)[0]
|
||||
}
|
||||
|
||||
function getHost(config, host) {
|
||||
var matching = config.hosts.filter(h => {
|
||||
//compare for both string and array of strings
|
||||
return ((h.host.filter && h.host.indexOf(host) !== -1) || h.host === host)
|
||||
})
|
||||
return matching.length > 0 ? matching[0] : null
|
||||
}
|
||||
|
||||
function computeProtection(context) {
|
||||
debug(context, "Getting by host " + context.request.headersIn.host)
|
||||
context.authz = {}
|
||||
context.authz.host = getHost(context.config, context.request.headersIn.host)
|
||||
if (context.authz.host !== null) {
|
||||
log(context, "Host found: " + njs.dump(context.authz.host))
|
||||
context.authz.pip = context.authz.host.pip ? context.authz.host.pip : [];
|
||||
context.authz.pdp = context.authz.host.pdp ? context.authz.host.pdp : umaCall;
|
||||
var pathandmethod = getPath(context.authz.host, context.request.uri, context.request.method);
|
||||
if (pathandmethod) {
|
||||
context.authz.path = pathandmethod.path;
|
||||
context.authz.pip = context.authz.path.pip ? context.authz.pip.concat(context.authz.path.pip) : context.authz.pip;
|
||||
context.authz.pdp = context.authz.path.pdp ? context.authz.path.pdp : context.authz.pdp;
|
||||
context.authz.method = pathandmethod.method;
|
||||
if (context.authz.method) {
|
||||
context.authz.pip = context.authz.method.pip ? context.authz.pip.concat(context.authz.method.pip) : context.authz.pip;
|
||||
context.authz.pdp = context.authz.method.pdp ? context.authz.method.pdp : context.authz.pdp;
|
||||
}
|
||||
}
|
||||
}
|
||||
debug(context, "Leaving protection computation: ")
|
||||
return context
|
||||
}
|
||||
|
||||
// ####### ACCOUNTING PART #####################
|
||||
function buildAccountingRecord(context) {
|
||||
log(context, "Inside build accounting record");
|
||||
const t = (new Date()).getTime()
|
||||
context.record = {
|
||||
"recordType": "ServiceUsageRecord",
|
||||
"operationCount": 1,
|
||||
"creationTime": t,
|
||||
"callerHost": context.request.headersIn["x-forwarded-for"],
|
||||
"serviceClass": "Application",
|
||||
"callerQualifier": "TOKEN",
|
||||
"consumerId": getTokenField(context, "preferred_username"),
|
||||
"aggregated": true,
|
||||
"serviceName": defaultExport["accounting"]["service_name"],
|
||||
"duration": 0,
|
||||
"maxInvocationTime": 0,
|
||||
"scope": defaultExport["accounting"]["scope"],
|
||||
"host": defaultExport["accounting"]["host"],
|
||||
"startTime": t,
|
||||
"id": uuid(),
|
||||
"calledMethod": context.request.method + " " + context.request.uri,
|
||||
"endTime": 0,
|
||||
"minInvocationTime": 0,
|
||||
"operationResult": null
|
||||
}
|
||||
debug(context, "Record is " + JSON.stringify(context.record))
|
||||
return context
|
||||
}
|
||||
|
||||
function __buildAccountingRecord_legacy(context) {
|
||||
log(context, "Inside build accounting record");
|
||||
const t = (new Date()).getTime()
|
||||
context.record = {
|
||||
"recordType": "ServiceUsageRecord",
|
||||
"operationCount": 1,
|
||||
"creationTime": t,
|
||||
"callerHost": context.request.headersIn["x-forwarded-for"],
|
||||
"serviceClass": "Application",
|
||||
"callerQualifier": "TOKEN",
|
||||
"consumerId": context.userinfo.username,
|
||||
"aggregated": true,
|
||||
"serviceName": context.config["accounting"]["service_name"],
|
||||
"duration": 0,
|
||||
"maxInvocationTime": 0,
|
||||
"scope": context.config["accounting"]["scope"],
|
||||
"host": context.config["accounting"]["host"],
|
||||
"startTime": t,
|
||||
"id": uuid(),
|
||||
"calledMethod": context.request.method + " " + context.request.uri,
|
||||
"endTime": 0,
|
||||
"minInvocationTime": 0,
|
||||
"operationResult": null
|
||||
}
|
||||
log(context, "Record is " + JSON.stringify(context.record))
|
||||
return context
|
||||
}
|
||||
|
||||
function buildAccountingRecord_legacy(context) {
|
||||
const t = (new Date()).getTime()
|
||||
return {
|
||||
"recordType": "ServiceUsageRecord",
|
||||
"operationCount": 1,
|
||||
"creationTime": t,
|
||||
"callerHost": context.request.remoteAddress,
|
||||
"serviceClass": "ShinyApp",
|
||||
"callerQualifier": "TOKEN",
|
||||
"consumerId": context.userinfo.username,
|
||||
"aggregated": true,
|
||||
"serviceName": context.request.uri.split("app/")[1],
|
||||
"duration": 0,
|
||||
"maxInvocationTime": 0,
|
||||
"scope": context.userinfo.context,
|
||||
"host": context.request.headersIn.host,
|
||||
"startTime": t,
|
||||
"id": uuid(),
|
||||
"calledMethod": context.request.method + " " + context.request.uri,
|
||||
"endTime": 0,
|
||||
"minInvocationTime": 0,
|
||||
"operationResult": null
|
||||
}
|
||||
}
|
||||
|
||||
function closeAccountingRecord_legacy(record, success) {
|
||||
const t = (new Date()).getTime()
|
||||
record.duration = t - record.startTime
|
||||
record.endTime = t
|
||||
record.minInvocationTime = record.duration
|
||||
record.operationResult = success ? "SUCCESS" : "FAILED";
|
||||
}
|
||||
|
||||
function closeAccountingRecord(context, success) {
|
||||
log(context, "Inside close accounting");
|
||||
const t = (new Date()).getTime()
|
||||
context.record.duration = t - context.record.startTime
|
||||
context.record.endTime = t
|
||||
context.record.minInvocationTime = context.record.duration
|
||||
context.record.operationResult = success ? "SUCCESS" : "FAILED";
|
||||
log(context, "Record is " + njs.dump(context.record))
|
||||
return context
|
||||
}
|
||||
|
||||
async function sendAccountingRecord(context) {
|
||||
log(context, "Inside send accounting");
|
||||
const detached = !_debug;
|
||||
const subreq_params = { detached: detached, body: JSON.stringify([context.record]) };
|
||||
if (_debug) {
|
||||
// debug(context, JSON.stringify(subreq_params));
|
||||
const acc_request = await context.request.subrequest("/_accounting", subreq_params);
|
||||
debug(context, "[ACCOUNTING] response status: " + JSON.stringify(acc_request));
|
||||
} else {
|
||||
context.request.subrequest("/_accounting", subreq_params);
|
||||
}
|
||||
return context
|
||||
}
|
||||
|
||||
function uuid() {
|
||||
return 'xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx'.replace(/[x]/g, function (c) {
|
||||
const r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8);
|
||||
return v.toString(16);
|
||||
});
|
||||
}
|
||||
Loading…
Reference in New Issue