First share of shinyproxy PEP
This commit is contained in:
dcore94
parent
8938d18b6c
commit
a291962444
|
|
@ -0,0 +1,45 @@
|
|||
# Added to load njs module
|
||||
load_module modules/ngx_http_js_module.so;
|
||||
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log notice;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
|
||||
http {
|
||||
|
||||
# added to import pep script
|
||||
js_import pep.js;
|
||||
|
||||
# added to bind enforce function
|
||||
js_set $authorization pep.enforce;
|
||||
|
||||
# added to create cache for tokens and auth calls
|
||||
proxy_cache_path /var/cache/nginx/pep keys_zone=token_responses:1m max_size=2m;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
upstream service {
|
||||
ip_hash;
|
||||
#server {{ shinyproxy_docker_stack_name }}_{{ shinyproxy_docker_service_server_name }}:{{ shinyproxy_service_port }};
|
||||
}
|
||||
|
||||
# added to import pep script
|
||||
js_import pep.js;
|
||||
|
||||
# added to bind enforce function
|
||||
js_set $authorization pep.enforce;
|
||||
|
||||
# variables computed by njs and which may possibly be passed among locations
|
||||
js_var $auth_token;
|
||||
js_var $account_record;
|
||||
|
||||
proxy_cache_path /tmp levels=1:2 keys_zone=social_cache:10m max_size=10g inactive=60m use_temp_path=off;
|
||||
|
||||
server {
|
||||
|
||||
listen *:80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name {{ shinyproxy_service_host }};
|
||||
|
||||
subrequest_output_buffer_size 200k;
|
||||
|
||||
location /health {
|
||||
add_header Content-Length 0;
|
||||
add_header Content-Type "text/plain";
|
||||
return 200;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
js_content pep.enforce;
|
||||
}
|
||||
|
||||
# location /gcube_user_info {
|
||||
# internal;
|
||||
# gunzip on;
|
||||
# proxy_method GET;
|
||||
# proxy_http_version 1.1;
|
||||
# proxy_set_header gcube-token "$auth_token";
|
||||
# proxy_pass https://api.d4science.org/rest/2/people/profile;
|
||||
#
|
||||
# proxy_cache social_cache;
|
||||
# proxy_cache_key $auth_token;
|
||||
# }
|
||||
|
||||
location /_backend {
|
||||
internal;
|
||||
proxy_read_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
resolver 146.48.122.10;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Authorization "$auth_token";
|
||||
proxy_pass http://service$request_uri;
|
||||
}
|
||||
|
||||
location /_accounting {
|
||||
internal;
|
||||
proxy_method POST;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Authorization $auth_token
|
||||
proxy_set_header Content-Type "application/json";
|
||||
proxy_pass https://accounting-service.d4science.org/accounting-service/record;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
version: '3.6'
|
||||
|
||||
services:
|
||||
pep-rel:
|
||||
image: nginx:stable-alpine
|
||||
networks:
|
||||
- {{ shinyproxy_docker_network }}
|
||||
- haproxy-public
|
||||
deploy:
|
||||
replicas: 1
|
||||
placement:
|
||||
constraints: [node.role == worker]
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
delay: 10s
|
||||
window: 120s
|
||||
configs:
|
||||
- source: nginxconf
|
||||
target: /etc/nginx/templates/default.conf.template
|
||||
- source: nginxbaseconf
|
||||
target: /etc/nginx/nginx.conf
|
||||
- source: pep
|
||||
target: /etc/nginx/pep.js
|
||||
|
||||
networks:
|
||||
{{ shinyproxy_docker_network }}:
|
||||
haproxy-public:
|
||||
external: true
|
||||
|
||||
configs:
|
||||
nginxconf:
|
||||
file: ./nginx.default.conf
|
||||
nginxbaseconf:
|
||||
file: ./nginx.conf
|
||||
pep:
|
||||
file: ./pep.js
|
||||
|
|
@ -0,0 +1,137 @@
|
|||
export default { enforce };
|
||||
|
||||
function log(c, s){
|
||||
c.request.error(s)
|
||||
}
|
||||
|
||||
function debug(c, s){
|
||||
return {{ nginx_pep_debug_enabled }} ? c.request.error(s) : null
|
||||
}
|
||||
|
||||
function enforce(r) {
|
||||
|
||||
var context = {
|
||||
request: r
|
||||
}
|
||||
|
||||
var allowedcontexts = ["{{ shinyproxy_authorized_scopes }}"]
|
||||
|
||||
log(context, "Inside NJS enforce for " + r.method + " @ " + r.headersIn.host + "/" + r.uri)
|
||||
context.authn = {}
|
||||
context.authn.token = getBearerToken(context)
|
||||
if(context.authn.token != null){
|
||||
debug(context, "[PEP] token is " + context.authn.token)
|
||||
exportVariable(context, "auth_token", context.authn.token)
|
||||
verifyToken(context)
|
||||
.then(ctx=>{
|
||||
const jwt = context.authn.verified_token
|
||||
debug(context, "[PEP] Token is valid:" + njs.dump(jwt))
|
||||
if(allowedcontexts.indexOf(jwt.aud) === -1){
|
||||
debug(context, "[PEP] Unathorized context " + jwt.aud)
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
context.userinfo = { username : jwt.preferred_username }
|
||||
return Promise.resolve(context)
|
||||
} else {
|
||||
debug(context, "[PEP] failed " + reply.status + ":" + reply.responseBody)
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
}).then(ctx => {
|
||||
debug(context, "[HOMESERV] creating home for username " + context.userinfo.username)
|
||||
return context.request.subrequest("/_homeserv", {"body" : "user=" + context.userinfo.username })
|
||||
}).then(reply => {
|
||||
if(reply.status !== 200){
|
||||
throw new Error("Unauthorized: Unable to create home for user")
|
||||
}
|
||||
context.record = buildAccountingRecord(context)
|
||||
return context.request.subrequest("/_backend", { method : context.request.method, args : context.request.args, headers : context.request.headersIn})
|
||||
}).then(reply=>{
|
||||
debug(context, "[SHINYPROXY] response status: " + reply.status)
|
||||
closeAccountingRecord(context.record, (reply.status === 200 || reply.status === 201 || reply.status === 204))
|
||||
context.request.subrequest("/_accounting", { detached : true, body : JSON.stringify(context.record) })
|
||||
r.return(reply.status, reply.responseBody)
|
||||
}).catch(e => { log(context, "Error .... " + njs.dump(e)); context.request.return(e.message === "Unauthorized" ? 403 : 500)} )
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
r.return(401, "Authorization required")
|
||||
}
|
||||
|
||||
function getBearerToken(context){
|
||||
if (context.request.headersIn['Authorization']){
|
||||
return context.request.headersIn['Authorization'].split(/Bearer\s+/)[1];
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function buildAccountingRecord(context){
|
||||
const t = (new Date()).getTime()
|
||||
return {
|
||||
"recordType": "ServiceUsageRecord",
|
||||
"operationCount": 1,
|
||||
"creationTime": t,
|
||||
"callerHost": context.request.remoteAddress,
|
||||
"serviceClass": "ShinyApp",
|
||||
"callerQualifier": "TOKEN",
|
||||
"consumerId": context.userinfo.username,
|
||||
"aggregated": true,
|
||||
"serviceName": context.request.uri.split("app/")[1],
|
||||
"duration": 0,
|
||||
"maxInvocationTime": 0,
|
||||
"scope": "{{ shinyproxy_authorized_scopes }}",
|
||||
"host": "{{ shinyproxy_service_host }}",
|
||||
"startTime": t,
|
||||
"id": uuid(),
|
||||
"calledMethod": context.request.method + " " + context.request.uri,
|
||||
"endTime": 0,
|
||||
"minInvocationTime": 0,
|
||||
"operationResult": null
|
||||
}
|
||||
}
|
||||
|
||||
function closeAccountingRecord(record, success){
|
||||
const t = (new Date()).getTime()
|
||||
record.duration = t - record.startTime
|
||||
record.endTime = t
|
||||
record.minInvocationTime = record.duration
|
||||
record.operationResult = success ? "SUCCESS" : "FAILED";
|
||||
}
|
||||
|
||||
function uuid() {
|
||||
return 'xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx'.replace(/[x]/g, function (c) {
|
||||
const r = Math.random() * 16 | 0, v = c == 'x' ? r : (r & 0x3 | 0x8);
|
||||
return v.toString(16);
|
||||
});
|
||||
}
|
||||
|
||||
function exportVariable(context, name, value){
|
||||
context.request.variables[name] = value
|
||||
return context
|
||||
}
|
||||
|
||||
function verifyToken(context){
|
||||
debug(context, "Inside verifyToken")
|
||||
var options = {
|
||||
"body" : "token=" + context.authn.token + "&token_type_hint=access_token"
|
||||
}
|
||||
return context.request.subrequest("/jwt_verify_request", options)
|
||||
.then(reply=>{
|
||||
if (reply.status === 200) {
|
||||
debug(context, reply.responseBody)
|
||||
var response = JSON.parse(reply.responseBody);
|
||||
if (response.active === true) {
|
||||
return response
|
||||
} else {
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
} else {
|
||||
throw new Error("Unauthorized")
|
||||
}
|
||||
}).then(verified_token => {
|
||||
context.authn.verified_token =
|
||||
JSON.parse(Buffer.from(context.authn.token.split('.')[1], 'base64url').toString())
|
||||
return context
|
||||
})
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue