See #25317. PEP for Jerico

bluecloud-jerico/nginx.conf.j2

@@ -0,0 +1,45 @@
+# Added to load njs module
+load_module modules/ngx_http_js_module.so;
+
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+
+    # added to import pep script
+    js_import pep.js;
+    
+    # added to bind enforce function 
+    js_set $authorization pep.enforce;
+
+    # added to create cache for tokens and auth calls
+    proxy_cache_path /var/cache/nginx/pep keys_zone=token_responses:1m max_size=2m;
+
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}
+

bluecloud-jerico/nginx.default.conf.j2

@@ -0,0 +1,69 @@
+upstream service {
+  ip_hash;
+  server {{ jerico_docker_stack_name }}_{{ jerico_docker_catalogue_service_name }}:{{ jerico_catalogue_ui_port }};
+}
+
+# added to import pep script
+js_import pep.js;
+
+# added to bind enforce function 
+js_set $authorization pep.enforce;
+
+# variables computed by njs and which may possibly be passed among locations
+js_var $auth_token;
+js_var $account_record;
+
+proxy_cache_path /tmp levels=1:2 keys_zone=social_cache:10m max_size=10g inactive=60m use_temp_path=off;
+
+server {
+
+  listen *:80;
+  listen [::]:80;
+
+  server_name {{ bluecloud_jerico_service_host }};
+
+  subrequest_output_buffer_size 200k;
+
+  location /health {
+    add_header Content-Length 0;
+    add_header Content-Type "text/plain";
+	return 200;
+  }
+
+  location / {
+  	proxy_read_timeout 300;
+    proxy_send_timeout 300;
+    js_content pep.enforce;
+  }
+
+  location /gcube_user_info {
+     internal;
+     gunzip on;
+     proxy_method      GET;
+     proxy_http_version 1.1;
+     proxy_set_header  gcube-token "$auth_token";
+     proxy_pass        https://api.d4science.org/rest/2/people/profile;
+  
+     proxy_cache social_cache;
+     proxy_cache_key $auth_token;
+  }
+ 
+  location /_backend {
+     internal;
+     proxy_read_timeout 300;
+     proxy_send_timeout 300;
+     resolver 146.48.122.10;
+     proxy_http_version 1.1;
+     proxy_set_header gcube-token "$auth_token";
+     proxy_pass http://service$request_uri;
+  }
+
+  location /_accounting {
+    internal;
+    proxy_method      POST;
+    proxy_http_version 1.1;
+    proxy_set_header  gcube-token "$auth_token";
+    proxy_set_header  Content-Type "application/json";
+    proxy_pass        https://accounting-service.d4science.org/accounting-service/record;
+  }
+}

bluecloud-jerico/pep-swarm.yml.j2

@@ -0,0 +1,37 @@
+version: '3.6'
+
+services:
+  pep-rel:
+    image: nginx:stable-alpine
+    networks:
+      - {{ sobigdata_rel_docker_network }}
+      - haproxy-public
+    deploy:
+      replicas: 1
+      placement:
+        constraints: [node.role == worker]
+      endpoint_mode: dnsrr
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        window: 120s
+    configs:
+      - source: nginxconf
+        target: /etc/nginx/templates/default.conf.template
+      - source: nginxbaseconf
+        target: /etc/nginx/nginx.conf
+      - source: pep
+        target: /etc/nginx/pep.js
+
+networks:
+  {{ sobigdata_rel_docker_network }}:
+  haproxy-public:
+    external: true
+
+configs:
+  nginxconf:
+    file: ./nginx.default.conf
+  nginxbaseconf:
+    file: ./nginx.conf
+  pep:
+    file: ./pep.js

bluecloud-jerico/pep.js.j2

@@ -0,0 +1,109 @@
+export default { enforce };
+
+function log(c, s){
+  c.request.error(s)
+}
+
+function debug(c, s){
+  return {{ nginx_pep_debug_enabled }} ? c.request.error(s) : null
+}
+
+function enforce(r) {
+
+  var context = {
+    request: r
+  }
+  
+  var allowedcontexts = ["{{ sobigdata_rel_authorized_scopes }}"]
+  
+  log(context, "Inside NJS enforce for " + r.method + " @ " + r.headersIn.host + "/" + r.uri)
+
+  const token = getGCubeToken(context)
+  if(token != null){
+    debug(context, "[PEP] token is " + token)
+    exportVariable(context, "auth_token", token)
+    context.request.subrequest("/gcube_user_info")
+    .then(reply=>{
+      if (reply.status === 200) {
+        debug(context, "[Social Service] got response " + reply.responseBody)
+        var response = JSON.parse(reply.responseBody);
+        if(allowedcontexts.indexOf(response.result.context) === -1){
+          debug(context, "[PEP] Unathorized context " + response.result.context)
+          throw new Error("Unauthorized")
+        }
+        return response
+      } else {
+        debug(context, "[Social Service] failed " + reply.status + ":" + reply.responseBody)
+        throw new Error("Unauthorized")
+      }
+    }).then(userinfo => {
+      debug(context, "[Social Service] username is " + userinfo.result.username)
+      context.userinfo = userinfo
+      context.record = buildAccountingRecord(context)
+      return context.request.subrequest("/_backend", { method : context.request.method, args : context.request.args, headers : context.request.headersIn})
+    }).then(reply=>{ 
+      debug(context, "[REL] response status: " + reply.status)
+      closeAccountingRecord(context.record, (reply.status === 200 || reply.status === 201 || reply.status === 204))
+      context.request.subrequest("/_accounting", { detached : true, body : JSON.stringify([context.record]) })
+      r.return(reply.status, reply.responseBody)
+    }).catch(e => { log(context, "Error .... " + njs.dump(e)); context.request.return(e.message === "Unauthorized" ? 403 : 500)} )
+  
+    return
+  } 
+
+  r.return(401, "Authorization required")
+}
+
+function getGCubeToken(context){
+  if(context.request.args.token){
+    return context.request.args.token;
+  }else if (context.request.headersIn['gcube-token']){
+    return context.request.headersIn['gcube-token'];
+  }
+  return null;
+}
+
+function buildAccountingRecord(context){
+  const t = (new Date()).getTime()
+  return {
+    "recordType": "ServiceUsageRecord",
+    "operationCount": 1,
+    "creationTime": t,
+    "callerHost": context.request.remoteAddress,
+    "serviceClass": "Application",
+    "callerQualifier": "TOKEN",
+    "consumerId": context.userinfo.result.username,
+    "aggregated": true,
+    "serviceName": "REL",
+    "duration": 0,
+    "maxInvocationTime": 0,
+    "scope": "{{ sobigdata_rel_authorized_scopes }}",
+    "host": "{{ sobigdata_rel_service_host }}",
+    "startTime": t,
+    "id": uuid(),
+    "calledMethod": context.request.method + " " + context.request.uri,
+    "endTime": 0,
+    "minInvocationTime": 0,
+    "operationResult": null 
+  }
+}
+
+function closeAccountingRecord(record, success){
+  const t = (new Date()).getTime()
+  record.duration = t - record.startTime
+  record.endTime = t
+  record.minInvocationTime = record.duration
+  record.operationResult = success ? "SUCCESS" : "FAILED";
+}
+
+function uuid() {
+  return 'xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx'.replace(/[x]/g, function (c) {
+    const r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8);
+    return v.toString(16);
+  });
+}
+
+function exportVariable(context, name, value){
+  context.request.variables[name] = value
+  return context
+}