-
Notifications
You must be signed in to change notification settings - Fork 182
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1009 from owncloud/ocis-1132
- Loading branch information
Showing
18 changed files
with
322 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| Enhancement: Add www-authenticate based on user agent | ||
|
|
||
| Tags: reva, proxy | ||
|
|
||
| We now comply with HTTP spec by adding Www-Authenticate headers on every `401` request. Furthermore, we not only take care of such a thing at the Proxy but also Reva will take care of it. In addition, we now are able to lock-in a set of User-Agent to specific challenges. | ||
|
|
||
| Admins can use this feature by configuring OCIS + Reva following this approach: | ||
|
|
||
| ``` | ||
| STORAGE_FRONTEND_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT="mirall:basic, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0:bearer" \ | ||
| PROXY_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT="mirall:basic, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0:bearer" \ | ||
| PROXY_ENABLE_BASIC_AUTH=true \ | ||
| go run cmd/ocis/main.go server | ||
| ``` | ||
|
|
||
| We introduced two new environment variables: | ||
|
|
||
| `STORAGE_FRONTEND_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT` as well as `PROXY_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT`, The reason they have the same value is not to rely on the os env on a distributed environment, so in redundancy we trust. They both configure the same on the backend storage and OCIS Proxy. | ||
|
|
||
| https://github.com/owncloud/ocis/pull/1009 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| package middleware | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "net/http" | ||
| "regexp" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| var ( | ||
| // SupportedAuthStrategies stores configured challenges. | ||
| SupportedAuthStrategies []string | ||
|
|
||
| // ProxyWwwAuthenticate is a list of endpoints that do not rely on reva underlying authentication, such as ocs. | ||
| // services that fallback to reva authentication are declared in the "frontend" command on OCIS. It is a list of strings | ||
| // to be regexp compiled. | ||
| ProxyWwwAuthenticate = []string{"/ocs/v[12].php/cloud/"} | ||
|
|
||
| // WWWAuthenticate captures the Www-Authenticate header string. | ||
| WWWAuthenticate = "Www-Authenticate" | ||
| ) | ||
|
|
||
| // userAgentLocker aids in dependency injection for helper methods. The set of fields is arbitrary and the only relation | ||
| // they share is to fulfill their duty and lock a User-Agent to its correct challenge if configured. | ||
| type userAgentLocker struct { | ||
| w http.ResponseWriter | ||
| r *http.Request | ||
| locks map[string]string // locks represents a reva user-agent:challenge mapping. | ||
| fallback string | ||
| } | ||
|
|
||
| // Authentication is a higher order authentication middleware. | ||
| func Authentication(opts ...Option) func(next http.Handler) http.Handler { | ||
| options := newOptions(opts...) | ||
|
|
||
| configureSupportedChallenges(options) | ||
| oidc := newOIDCAuth(options) | ||
| basic := newBasicAuth(options) | ||
|
|
||
| return func(next http.Handler) http.Handler { | ||
| return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| if options.OIDCIss != "" && options.EnableBasicAuth { | ||
| oidc(basic(next)).ServeHTTP(w, r) | ||
| } | ||
|
|
||
| if options.OIDCIss != "" && !options.EnableBasicAuth { | ||
| oidc(next).ServeHTTP(w, r) | ||
| } | ||
|
|
||
| if options.OIDCIss == "" && options.EnableBasicAuth { | ||
| basic(next).ServeHTTP(w, r) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| // configureSupportedChallenges adds known authentication challenges to the current session. | ||
| func configureSupportedChallenges(options Options) { | ||
| if options.OIDCIss != "" { | ||
| SupportedAuthStrategies = append(SupportedAuthStrategies, "bearer") | ||
| } | ||
|
|
||
| if options.EnableBasicAuth { | ||
| SupportedAuthStrategies = append(SupportedAuthStrategies, "basic") | ||
| } | ||
| } | ||
|
|
||
| func writeSupportedAuthenticateHeader(w http.ResponseWriter, r *http.Request) { | ||
| for i := 0; i < len(SupportedAuthStrategies); i++ { | ||
| w.Header().Add(WWWAuthenticate, fmt.Sprintf("%v realm=\"%s\", charset=\"UTF-8\"", strings.Title(SupportedAuthStrategies[i]), r.Host)) | ||
| } | ||
| } | ||
|
|
||
| func removeSuperfluousAuthenticate(w http.ResponseWriter) { | ||
| w.Header().Del(WWWAuthenticate) | ||
| } | ||
|
|
||
| // userAgentAuthenticateLockIn sets Www-Authenticate according to configured user agents. This is useful for the case of | ||
| // legacy clients that do not support protocols like OIDC or OAuth and want to lock a given user agent to a challenge | ||
| // such as basic. For more context check https://github.com/cs3org/reva/pull/1350 | ||
| func userAgentAuthenticateLockIn(w http.ResponseWriter, r *http.Request, locks map[string]string, fallback string) { | ||
| u := userAgentLocker{ | ||
| w: w, | ||
| r: r, | ||
| locks: locks, | ||
| fallback: fallback, | ||
| } | ||
|
|
||
| for i := 0; i < len(ProxyWwwAuthenticate); i++ { | ||
| evalRequestURI(&u, i) | ||
| } | ||
| } | ||
|
|
||
| func evalRequestURI(l *userAgentLocker, i int) { | ||
| r := regexp.MustCompile(ProxyWwwAuthenticate[i]) | ||
| if r.Match([]byte(l.r.RequestURI)) { | ||
| for k, v := range l.locks { | ||
| if strings.Contains(k, l.r.UserAgent()) { | ||
| removeSuperfluousAuthenticate(l.w) | ||
| l.w.Header().Add(WWWAuthenticate, fmt.Sprintf("%v realm=\"%s\", charset=\"UTF-8\"", strings.Title(v), l.r.Host)) | ||
| return | ||
| } | ||
| } | ||
| l.w.Header().Add(WWWAuthenticate, fmt.Sprintf("%v realm=\"%s\", charset=\"UTF-8\"", strings.Title(l.fallback), l.r.Host)) | ||
| } | ||
| } | ||
|
|
||
| // newOIDCAuth returns a configured oidc middleware | ||
| func newOIDCAuth(options Options) func(http.Handler) http.Handler { | ||
| return OIDCAuth( | ||
| Logger(options.Logger), | ||
| OIDCProviderFunc(options.OIDCProviderFunc), | ||
| HTTPClient(options.HTTPClient), | ||
| OIDCIss(options.OIDCIss), | ||
| TokenCacheSize(options.UserinfoCacheSize), | ||
| TokenCacheTTL(time.Second*time.Duration(options.UserinfoCacheTTL)), | ||
| CredentialsByUserAgent(options.CredentialsByUserAgent), | ||
| ) | ||
| } | ||
|
|
||
| // newBasicAuth returns a configured basic middleware | ||
| func newBasicAuth(options Options) func(http.Handler) http.Handler { | ||
| return BasicAuth( | ||
| Logger(options.Logger), | ||
| EnableBasicAuth(options.EnableBasicAuth), | ||
| AccountsClient(options.AccountsClient), | ||
| OIDCIss(options.OIDCIss), | ||
| CredentialsByUserAgent(options.CredentialsByUserAgent), | ||
| ) | ||
| } |
Oops, something went wrong.