diff --git a/sobigdata-manila/nginx.conf.j2 b/sobigdata-manila/nginx.conf.j2 new file mode 100644 index 0000000..b079900 --- /dev/null +++ b/sobigdata-manila/nginx.conf.j2 @@ -0,0 +1,45 @@ +# Added to load njs module +load_module modules/ngx_http_js_module.so; + +user nginx; +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + + # added to import pep script + js_import pep.js; + + # added to bind enforce function + js_set $authorization pep.enforce; + + # added to create cache for tokens and auth calls + proxy_cache_path /var/cache/nginx/pep keys_zone=token_responses:1m max_size=2m; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; +} + diff --git a/sobigdata-manila/nginx.default.conf.j2 b/sobigdata-manila/nginx.default.conf.j2 new file mode 100644 index 0000000..0d45274 --- /dev/null +++ b/sobigdata-manila/nginx.default.conf.j2 @@ -0,0 +1,69 @@ +upstream service { + ip_hash; + server {{ sobigdata_manila_docker_stack_name }}_{{ sobigdata_manila_docker_service_server_name }}:{{ sobigdata_manila_service_port }}; +} + +# added to import pep script +js_import pep.js; + +# added to bind enforce function +js_set $authorization pep.enforce; + +# variables computed by njs and which may possibly be passed among locations +js_var $auth_token; +js_var $account_record; + +proxy_cache_path /tmp levels=1:2 keys_zone=social_cache:10m max_size=10g inactive=60m use_temp_path=off; + +server { + + listen *:80; + listen [::]:80; + + server_name {{ sobigdata_manila_service_host }}; + + subrequest_output_buffer_size 200k; + + location /health { + add_header Content-Length 0; + add_header Content-Type "text/plain"; + return 200; + } + + location / { + proxy_read_timeout 300; + proxy_send_timeout 300; + js_content pep.enforce; + } + + location /gcube_user_info { + internal; + gunzip on; + proxy_method GET; + proxy_http_version 1.1; + proxy_set_header gcube-token "$auth_token"; + proxy_pass https://api.d4science.org/rest/2/people/profile; + + proxy_cache social_cache; + proxy_cache_key $auth_token; + } + + location /_backend { + internal; + proxy_read_timeout 300; + proxy_send_timeout 300; + resolver 146.48.122.10; + proxy_http_version 1.1; + proxy_set_header gcube-token "$auth_token"; + proxy_pass http://service$request_uri; + } + + location /_accounting { + internal; + proxy_method POST; + proxy_http_version 1.1; + proxy_set_header gcube-token "$auth_token"; + proxy_set_header Content-Type "application/json"; + proxy_pass https://accounting-service.d4science.org/accounting-service/record; + } +} diff --git a/sobigdata-manila/pep.js.j2 b/sobigdata-manila/pep.js.j2 new file mode 100644 index 0000000..eeb6b1a --- /dev/null +++ b/sobigdata-manila/pep.js.j2 @@ -0,0 +1,109 @@ +export default { enforce }; + +function log(c, s){ + c.request.error(s) +} + +function debug(c, s){ + return {{ nginx_pep_debug_enabled }} ? c.request.error(s) : null +} + +function enforce(r) { + + var context = { + request: r + } + + var allowedcontexts = ["{{ sobigdata_manila_authorized_scopes }}"] + + log(context, "Inside NJS enforce for " + r.method + " @ " + r.headersIn.host + "/" + r.uri) + + const token = getGCubeToken(context) + if(token != null){ + debug(context, "[PEP] token is " + token) + exportVariable(context, "auth_token", token) + context.request.subrequest("/gcube_user_info") + .then(reply=>{ + if (reply.status === 200) { + debug(context, "[Social Service] got response " + reply.responseBody) + var response = JSON.parse(reply.responseBody); + if(allowedcontexts.indexOf(response.result.context) === -1){ + debug(context, "[PEP] Unathorized context " + response.result.context) + throw new Error("Unauthorized") + } + return response + } else { + debug(context, "[Social Service] failed " + reply.status + ":" + reply.responseBody) + throw new Error("Unauthorized") + } + }).then(userinfo => { + debug(context, "[Social Service] username is " + userinfo.result.username) + context.userinfo = userinfo + context.record = buildAccountingRecord(context) + return context.request.subrequest("/_backend", { method : context.request.method, args : context.request.args, headers : context.request.headersIn}) + }).then(reply=>{ + debug(context, "[REL] response status: " + reply.status) + closeAccountingRecord(context.record, (reply.status === 200 || reply.status === 201 || reply.status === 204)) + context.request.subrequest("/_accounting", { detached : true, body : JSON.stringify([context.record]) }) + r.return(reply.status, reply.responseBody) + }).catch(e => { log(context, "Error .... " + njs.dump(e)); context.request.return(e.message === "Unauthorized" ? 403 : 500)} ) + + return + } + + r.return(401, "Authorization required") +} + +function getGCubeToken(context){ + if(context.request.args.token){ + return context.request.args.token; + }else if (context.request.headersIn['gcube-token']){ + return context.request.headersIn['gcube-token']; + } + return null; +} + +function buildAccountingRecord(context){ + const t = (new Date()).getTime() + return { + "recordType": "ServiceUsageRecord", + "operationCount": 1, + "creationTime": t, + "callerHost": context.request.remoteAddress, + "serviceClass": "Application", + "callerQualifier": "TOKEN", + "consumerId": context.userinfo.result.username, + "aggregated": true, + "serviceName": "MANILA", + "duration": 0, + "maxInvocationTime": 0, + "scope": "{{ sobigdata_manila_authorized_scopes }}", + "host": "{{ sobigdata_manila_service_host }}", + "startTime": t, + "id": uuid(), + "calledMethod": context.request.method + " " + context.request.uri, + "endTime": 0, + "minInvocationTime": 0, + "operationResult": null + } +} + +function closeAccountingRecord(record, success){ + const t = (new Date()).getTime() + record.duration = t - record.startTime + record.endTime = t + record.minInvocationTime = record.duration + record.operationResult = success ? "SUCCESS" : "FAILED"; +} + +function uuid() { + return 'xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx'.replace(/[x]/g, function (c) { + const r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8); + return v.toString(16); + }); +} + +function exportVariable(context, name, value){ + context.request.variables[name] = value + return context +}