admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source 
Signed-off-by: hongming <talonwan@yunify.com>
This commit is contained in:
hongming
2020-03-26 18:42:01 +08:00
parent 9b9d4021ec
commit 96a1d3825e
10 changed files with 187 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
pkg/apiserver/authentication/oauth/github.go → pkg/apiserver/authentication/identityprovider/github/github.go
View File

@@ -16,14 +16,17 @@
* /
*/
package oauth
package github
import (
"context"
"encoding/json"
"golang.org/x/oauth2"
"gopkg.in/yaml.v2"
"io/ioutil"
"k8s.io/apiserver/pkg/authentication/user"
"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
"time"
)
@@ -98,6 +101,44 @@ type GithubIdentity struct {
Collaborators int `json:"collaborators"`
}
func init() {
identityprovider.RegisterOAuthProviderCodec(&codec{t: "github"})
}
type codec struct {
t string
}
func (c codec) Type() string {
return c.t
}
func (codec) Encode(provider identityprovider.OAuthProvider) (*oauth.DynamicOptions, error) {
data, err := yaml.Marshal(provider)
if err != nil {
return nil, err
}
var options oauth.DynamicOptions
err = yaml.Unmarshal(data, &options)
if err != nil {
return nil, err
}
return &options, nil
}
func (codec) Decode(options *oauth.DynamicOptions) (identityprovider.OAuthProvider, error) {
data, err := yaml.Marshal(options)
if err != nil {
return nil, err
}
var provider Github
err = yaml.Unmarshal(data, &provider)
if err != nil {
return nil, err
}
return &provider, nil
}
func (g GithubIdentity) GetName() string {
return g.Login
}

42
pkg/apiserver/authentication/identityprovider/identity_provider.go
View File

@@ -18,8 +18,46 @@
package identityprovider
import "k8s.io/apiserver/pkg/authentication/user"
import (
"errors"
"k8s.io/apiserver/pkg/authentication/user"
"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
)
type OAuth2Interface interface {
var (
ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
ErrorAlreadyRegistered = errors.New("the identity provider was not found")
oauthProviderCodecs = map[string]OAuthProviderCodec{}
)
type OAuthProvider interface {
IdentityExchange(code string) (user.Info, error)
}
type OAuthProviderCodec interface {
Type() string
Decode(options *oauth.DynamicOptions) (OAuthProvider, error)
Encode(provider OAuthProvider) (*oauth.DynamicOptions, error)
}
func ResolveOAuthProvider(providerType string, options *oauth.DynamicOptions) (OAuthProvider, error) {
if codec, ok := oauthProviderCodecs[providerType]; ok {
return codec.Decode(options)
}
return nil, ErrorIdentityProviderNotFound
}
func ResolveOAuthOptions(providerType string, provider OAuthProvider) (*oauth.DynamicOptions, error) {
if codec, ok := oauthProviderCodecs[providerType]; ok {
return codec.Encode(provider)
}
return nil, ErrorIdentityProviderNotFound
}
func RegisterOAuthProviderCodec(codec OAuthProviderCodec) error {
if _, ok := oauthProviderCodecs[codec.Type()]; ok {
return ErrorAlreadyRegistered
}
oauthProviderCodecs[codec.Type()] = codec
return nil
}

59
pkg/apiserver/authentication/oauth/oauth_options.go
View File

@@ -20,8 +20,8 @@ package oauth
import (
"errors"
"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
"kubesphere.io/kubesphere/pkg/utils/sliceutil"
"time"
)
type GrantHandlerType string
@@ -43,26 +43,23 @@ const (
MappingMethodLookup MappingMethod = "lookup"
// MappingMethodMixed A user entity can be mapped with multiple identifyProvider.
MappingMethodMixed MappingMethod = "mixed"
IdentityProviderTypeGithub = "github"
)
var (
ErrorClientNotFound = errors.New("the OAuth client was not found")
ErrorRedirectURLNotAllowed = errors.New("redirect URL is not allowed")
ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
ErrorClientNotFound = errors.New("the OAuth client was not found")
ErrorRedirectURLNotAllowed = errors.New("redirect URL is not allowed")
)
type Options struct {
// LDAPPasswordIdentityProvider provider is used by default.
IdentityProviders []IdentityProvider `json:"identityProviders,omitempty" yaml:"identityProviders,omitempty"`
IdentityProviders []IdentityProviderOptions `json:"identityProviders,omitempty" yaml:"identityProviders,omitempty"`
// Register additional OAuth clients.
Clients []Client `json:"clients,omitempty" yaml:"clients,omitempty"`
// AccessTokenMaxAgeSeconds control the lifetime of access tokens. The default lifetime is 24 hours.
// 0 means no expiration.
AccessTokenMaxAgeSeconds int `json:"accessTokenMaxAgeSeconds" yaml:"accessTokenMaxAgeSeconds"`
AccessTokenMaxAge time.Duration `json:"accessTokenMaxAge" yaml:"accessTokenMaxAge"`
// Inactivity timeout for tokens
// The value represents the maximum amount of time that can occur between
@@ -72,12 +69,14 @@ type Options struct {
// This value needs to be set only if the default set in configuration is
// not appropriate for this client. Valid values are:
// - 0: Tokens for this client never time out
// - X: Tokens time out if there is no activity for X seconds
// The current minimum allowed value for X is 300 (5 minutes)
AccessTokenInactivityTimeoutSeconds int `json:"accessTokenInactivityTimeoutSeconds" yaml:"accessTokenInactivityTimeoutSeconds"`
// - X: Tokens time out if there is no activity
// The current minimum allowed value for X is 5 minutes
AccessTokenInactivityTimeout time.Duration `json:"accessTokenInactivityTimeout" yaml:"accessTokenInactivityTimeout"`
}
type IdentityProvider struct {
type DynamicOptions map[string]interface{}
type IdentityProviderOptions struct {
// The provider name.
Name string `json:"name" yaml:"name"`
@@ -96,8 +95,8 @@ type IdentityProvider struct {
// The type of identify provider
Type string `json:"type" yaml:"type"`
// Provider options
Github *Github `json:"github" yaml:"github" `
// The options of identify provider
Provider *DynamicOptions `json:"provider,omitempty" yaml:"provider,omitempty"`
}
type Token struct {
@@ -145,15 +144,15 @@ type Client struct {
// If no restriction matches, then the scope is denied.
ScopeRestrictions []string `json:"scopeRestrictions,omitempty" yaml:"scopeRestrictions,omitempty"`
// AccessTokenMaxAgeSeconds overrides the default access token max age for tokens granted to this client.
AccessTokenMaxAgeSeconds *int `json:"accessTokenMaxAgeSeconds,omitempty" yaml:"accessTokenMaxAgeSeconds,omitempty"`
// AccessTokenMaxAge overrides the default access token max age for tokens granted to this client.
AccessTokenMaxAge *time.Duration `json:"accessTokenMaxAge,omitempty" yaml:"accessTokenMaxAge,omitempty"`
// AccessTokenInactivityTimeoutSeconds overrides the default token
// AccessTokenInactivityTimeout overrides the default token
// inactivity timeout for tokens granted to this client.
AccessTokenInactivityTimeoutSeconds *int `json:"accessTokenInactivityTimeoutSeconds,omitempty" yaml:"accessTokenInactivityTimeoutSeconds,omitempty"`
AccessTokenInactivityTimeout *time.Duration `json:"accessTokenInactivityTimeout,omitempty" yaml:"accessTokenInactivityTimeout,omitempty"`
}
func (o *Options) GetOAuthClient(name string) (Client, error) {
func (o *Options) OAuthClient(name string) (Client, error) {
for _, found := range o.Clients {
if found.Name == name {
return found, nil
@@ -161,13 +160,13 @@ func (o *Options) GetOAuthClient(name string) (Client, error) {
}
return Client{}, ErrorClientNotFound
}
func (o *Options) GetIdentityProvider(name string) (IdentityProvider, error) {
func (o *Options) IdentityProviderOptions(name string) (IdentityProviderOptions, error) {
for _, found := range o.IdentityProviders {
if found.Name == name {
return found, nil
}
}
return IdentityProvider{}, ErrorClientNotFound
return IdentityProviderOptions{}, ErrorClientNotFound
}
func (c Client) ResolveRedirectURL(expectURL string) (string, error) {
@@ -183,21 +182,11 @@ func (c Client) ResolveRedirectURL(expectURL string) (string, error) {
return "", ErrorRedirectURLNotAllowed
}
func (i IdentityProvider) GetOAuth2IdentityProviderInstance() (identityprovider.OAuth2Interface, error) {
switch i.Type {
case IdentityProviderTypeGithub:
if i.Github != nil {
return i.Github, nil
}
}
return nil, ErrorIdentityProviderNotFound
}
func NewOptions() *Options {
return &Options{
IdentityProviders: make([]IdentityProvider, 0),
Clients: make([]Client, 0),
AccessTokenMaxAgeSeconds: 86400,
AccessTokenInactivityTimeoutSeconds: 0,
IdentityProviders: make([]IdentityProviderOptions, 0),
Clients: make([]Client, 0),
AccessTokenMaxAge: time.Hour * 24,
AccessTokenInactivityTimeout: 0,
}
}

4
pkg/apiserver/authentication/token/issuer.go
View File

@@ -18,10 +18,12 @@
package token
import "time"
// Issuer issues token to user, tokens are required to perform mutating requests to resources
type Issuer interface {
// IssueTo issues a token a User, return error if issuing process failed
IssueTo(user User, expiresInSecond int) (string, error)
IssueTo(user User, expiresIn time.Duration) (string, error)
// Verify verifies a token, and return a User if it's a valid token, otherwise return error
Verify(string) (User, error)

8
pkg/apiserver/authentication/token/jwt.go
View File

@@ -72,7 +72,7 @@ func (s *jwtTokenIssuer) Verify(tokenString string) (User, error) {
return &iam.User{Name: clm.Username, UID: clm.UID}, nil
}
func (s *jwtTokenIssuer) IssueTo(user User, expiresInSecond int) (string, error) {
func (s *jwtTokenIssuer) IssueTo(user User, expiresIn time.Duration) (string, error) {
clm := &Claims{
Username: user.GetName(),
UID: user.GetUID(),
@@ -83,8 +83,8 @@ func (s *jwtTokenIssuer) IssueTo(user User, expiresInSecond int) (string, error)
},
}
if expiresInSecond > 0 {
clm.ExpiresAt = clm.IssuedAt + int64(expiresInSecond)
if expiresIn > 0 {
clm.ExpiresAt = clm.IssuedAt + int64(expiresIn.Seconds())
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, clm)
@@ -95,7 +95,7 @@ func (s *jwtTokenIssuer) IssueTo(user User, expiresInSecond int) (string, error)
return "", err
}
s.cache.Set(tokenCacheKey(tokenString), tokenString, time.Second*time.Duration(expiresInSecond))
s.cache.Set(tokenCacheKey(tokenString), tokenString, expiresIn)
return tokenString, nil
}