2019-03-05 20:42:49 +00:00
|
|
|
package provisioner
|
|
|
|
|
|
|
|
import (
|
2019-07-29 22:54:07 +00:00
|
|
|
"context"
|
2019-03-06 22:54:56 +00:00
|
|
|
"crypto/x509"
|
2019-03-05 20:42:49 +00:00
|
|
|
"encoding/json"
|
2019-06-04 00:19:44 +00:00
|
|
|
"net/url"
|
2019-07-29 22:54:07 +00:00
|
|
|
"regexp"
|
2019-03-05 20:42:49 +00:00
|
|
|
"strings"
|
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Interface is the interface that all provisioner types must implement.
|
|
|
|
type Interface interface {
|
2019-03-06 22:54:56 +00:00
|
|
|
GetID() string
|
2019-03-05 08:07:13 +00:00
|
|
|
GetTokenID(token string) (string, error)
|
2019-03-06 22:54:56 +00:00
|
|
|
GetName() string
|
|
|
|
GetType() Type
|
2019-03-05 22:52:26 +00:00
|
|
|
GetEncryptedKey() (kid string, key string, ok bool)
|
2019-03-07 02:32:56 +00:00
|
|
|
Init(config Config) error
|
2019-07-29 22:54:07 +00:00
|
|
|
AuthorizeSign(ctx context.Context, token string) ([]SignOption, error)
|
2019-03-06 22:54:56 +00:00
|
|
|
AuthorizeRenewal(cert *x509.Certificate) error
|
|
|
|
AuthorizeRevoke(token string) error
|
2019-03-05 20:42:49 +00:00
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// Audiences stores all supported audiences by request type.
|
|
|
|
type Audiences struct {
|
|
|
|
Sign []string
|
|
|
|
Revoke []string
|
|
|
|
}
|
|
|
|
|
|
|
|
// All returns all supported audiences across all request types in one list.
|
2019-06-04 00:19:44 +00:00
|
|
|
func (a Audiences) All() []string {
|
2019-03-05 08:07:13 +00:00
|
|
|
return append(a.Sign, a.Revoke...)
|
|
|
|
}
|
|
|
|
|
2019-06-04 00:19:44 +00:00
|
|
|
// WithFragment returns a copy of audiences where the url audiences contains the
|
|
|
|
// given fragment.
|
|
|
|
func (a Audiences) WithFragment(fragment string) Audiences {
|
|
|
|
ret := Audiences{
|
|
|
|
Sign: make([]string, len(a.Sign)),
|
|
|
|
Revoke: make([]string, len(a.Revoke)),
|
|
|
|
}
|
|
|
|
for i, s := range a.Sign {
|
|
|
|
if u, err := url.Parse(s); err == nil {
|
|
|
|
ret.Sign[i] = u.ResolveReference(&url.URL{Fragment: fragment}).String()
|
|
|
|
} else {
|
|
|
|
ret.Sign[i] = s
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for i, s := range a.Revoke {
|
|
|
|
if u, err := url.Parse(s); err == nil {
|
|
|
|
ret.Revoke[i] = u.ResolveReference(&url.URL{Fragment: fragment}).String()
|
|
|
|
} else {
|
|
|
|
ret.Revoke[i] = s
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
|
|
|
// generateSignAudience generates a sign audience with the format
|
2019-06-07 18:24:56 +00:00
|
|
|
// https://<host>/1.0/sign#provisionerID
|
2019-06-04 00:19:44 +00:00
|
|
|
func generateSignAudience(caURL string, provisionerID string) (string, error) {
|
|
|
|
u, err := url.Parse(caURL)
|
|
|
|
if err != nil {
|
|
|
|
return "", errors.Wrapf(err, "error parsing %s", caURL)
|
|
|
|
}
|
|
|
|
return u.ResolveReference(&url.URL{Path: "/1.0/sign", Fragment: provisionerID}).String(), nil
|
|
|
|
}
|
|
|
|
|
2019-03-05 20:42:49 +00:00
|
|
|
// Type indicates the provisioner Type.
|
|
|
|
type Type int
|
|
|
|
|
|
|
|
const (
|
2019-03-08 00:04:29 +00:00
|
|
|
noopType Type = 0
|
2019-03-05 20:42:49 +00:00
|
|
|
// TypeJWK is used to indicate the JWK provisioners.
|
|
|
|
TypeJWK Type = 1
|
|
|
|
// TypeOIDC is used to indicate the OIDC provisioners.
|
|
|
|
TypeOIDC Type = 2
|
2019-04-18 00:28:21 +00:00
|
|
|
// TypeGCP is used to indicate the GCP provisioners.
|
|
|
|
TypeGCP Type = 3
|
2019-04-24 19:12:36 +00:00
|
|
|
// TypeAWS is used to indicate the AWS provisioners.
|
|
|
|
TypeAWS Type = 4
|
2019-04-24 21:26:37 +00:00
|
|
|
// TypeAzure is used to indicate the Azure provisioners.
|
2019-05-04 00:30:54 +00:00
|
|
|
TypeAzure Type = 5
|
2019-03-05 08:07:13 +00:00
|
|
|
|
|
|
|
// RevokeAudienceKey is the key for the 'revoke' audiences in the audiences map.
|
|
|
|
RevokeAudienceKey = "revoke"
|
|
|
|
// SignAudienceKey is the key for the 'sign' audiences in the audiences map.
|
|
|
|
SignAudienceKey = "sign"
|
2019-03-05 20:42:49 +00:00
|
|
|
)
|
|
|
|
|
2019-06-06 00:52:29 +00:00
|
|
|
// String returns the string representation of the type.
|
|
|
|
func (t Type) String() string {
|
|
|
|
switch t {
|
|
|
|
case TypeJWK:
|
|
|
|
return "JWK"
|
|
|
|
case TypeOIDC:
|
|
|
|
return "OIDC"
|
|
|
|
case TypeGCP:
|
|
|
|
return "GCP"
|
|
|
|
case TypeAWS:
|
|
|
|
return "AWS"
|
|
|
|
case TypeAzure:
|
|
|
|
return "Azure"
|
|
|
|
default:
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-03-07 02:32:56 +00:00
|
|
|
// Config defines the default parameters used in the initialization of
|
|
|
|
// provisioners.
|
|
|
|
type Config struct {
|
|
|
|
// Claims are the default claims.
|
|
|
|
Claims Claims
|
|
|
|
// Audiences are the audiences used in the default provisioner, (JWK).
|
2019-03-05 08:07:13 +00:00
|
|
|
Audiences Audiences
|
2019-03-07 02:32:56 +00:00
|
|
|
}
|
|
|
|
|
2019-03-05 20:42:49 +00:00
|
|
|
type provisioner struct {
|
|
|
|
Type string `json:"type"`
|
|
|
|
}
|
|
|
|
|
2019-03-07 21:07:39 +00:00
|
|
|
// List represents a list of provisioners.
|
|
|
|
type List []Interface
|
|
|
|
|
|
|
|
// UnmarshalJSON implements json.Unmarshaler and allows to unmarshal a list of a
|
|
|
|
// interfaces into the right type.
|
|
|
|
func (l *List) UnmarshalJSON(data []byte) error {
|
|
|
|
ps := []json.RawMessage{}
|
|
|
|
if err := json.Unmarshal(data, &ps); err != nil {
|
|
|
|
return errors.Wrap(err, "error unmarshaling provisioner list")
|
2019-03-06 22:54:56 +00:00
|
|
|
}
|
2019-03-05 22:28:32 +00:00
|
|
|
|
2019-03-08 00:04:29 +00:00
|
|
|
*l = List{}
|
2019-03-07 21:07:39 +00:00
|
|
|
for _, data := range ps {
|
|
|
|
var typ provisioner
|
|
|
|
if err := json.Unmarshal(data, &typ); err != nil {
|
|
|
|
return errors.Errorf("error unmarshaling provisioner")
|
|
|
|
}
|
|
|
|
var p Interface
|
|
|
|
switch strings.ToLower(typ.Type) {
|
|
|
|
case "jwk":
|
|
|
|
p = &JWK{}
|
|
|
|
case "oidc":
|
|
|
|
p = &OIDC{}
|
2019-04-18 00:28:21 +00:00
|
|
|
case "gcp":
|
|
|
|
p = &GCP{}
|
2019-04-24 19:12:36 +00:00
|
|
|
case "aws":
|
|
|
|
p = &AWS{}
|
2019-05-04 00:30:54 +00:00
|
|
|
case "azure":
|
|
|
|
p = &Azure{}
|
2019-03-07 21:07:39 +00:00
|
|
|
default:
|
|
|
|
return errors.Errorf("provisioner type %s not supported", typ.Type)
|
|
|
|
}
|
|
|
|
if err := json.Unmarshal(data, p); err != nil {
|
|
|
|
return errors.Errorf("error unmarshaling provisioner")
|
|
|
|
}
|
|
|
|
*l = append(*l, p)
|
2019-03-05 20:42:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
2019-07-29 23:21:22 +00:00
|
|
|
|
|
|
|
var sshUserRegex = regexp.MustCompile("^[a-z][-a-z0-9_]*$")
|
|
|
|
|
2019-07-29 23:38:57 +00:00
|
|
|
// SanitizeSSHUserPrincipal grabs an email or a string with the format
|
|
|
|
// local@domain and returns a sanitized version of the local, valid to be used
|
|
|
|
// as a user name. If the email starts with a letter between a and z, the
|
|
|
|
// resulting string will match the regular expression `^[a-z][-a-z0-9_]*$`.
|
|
|
|
func SanitizeSSHUserPrincipal(email string) string {
|
2019-07-29 23:21:22 +00:00
|
|
|
if i := strings.LastIndex(email, "@"); i >= 0 {
|
|
|
|
email = email[:i]
|
|
|
|
}
|
|
|
|
return strings.Map(func(r rune) rune {
|
|
|
|
switch {
|
|
|
|
case r >= 'a' && r <= 'z':
|
|
|
|
return r
|
|
|
|
case r >= '0' && r <= '9':
|
|
|
|
return r
|
|
|
|
case r == '-':
|
|
|
|
return '-'
|
|
|
|
case r == '.': // drop dots
|
|
|
|
return -1
|
|
|
|
default:
|
|
|
|
return '_'
|
|
|
|
}
|
|
|
|
}, strings.ToLower(email))
|
|
|
|
}
|