339 lines
9.4 KiB
Go
339 lines
9.4 KiB
Go
/*
|
|
Copyright CAcert Inc
|
|
SPDX-License-Identifier: Apache-2.0
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
|
|
"code.cacert.org/cacert/oidc-demo-app/ui"
|
|
"github.com/knadh/koanf"
|
|
"github.com/knadh/koanf/parsers/toml"
|
|
"github.com/knadh/koanf/providers/confmap"
|
|
|
|
"code.cacert.org/cacert/oidc-demo-app/internal/handlers"
|
|
"code.cacert.org/cacert/oidc-demo-app/internal/services"
|
|
)
|
|
|
|
const (
|
|
defaultReadTimeout = 5 * time.Second
|
|
defaultWriteTimeout = 10 * time.Second
|
|
defaultIdleTimeout = 15 * time.Second
|
|
|
|
sessionKeyLength = 32
|
|
sessionAuthKeyLength = 64
|
|
)
|
|
|
|
var (
|
|
version = "local"
|
|
commit = "unknown"
|
|
date = "unknown"
|
|
)
|
|
|
|
type StaticFSWrapper struct {
|
|
http.FileSystem
|
|
ModTime time.Time
|
|
}
|
|
|
|
func (f *StaticFSWrapper) Open(name string) (http.File, error) {
|
|
file, err := f.FileSystem.Open(name)
|
|
|
|
return &StaticFileWrapper{File: file, fixedModTime: f.ModTime}, err //nolint:wrapcheck
|
|
}
|
|
|
|
type StaticFileWrapper struct {
|
|
http.File
|
|
fixedModTime time.Time
|
|
}
|
|
|
|
func (f *StaticFileWrapper) Stat() (os.FileInfo, error) {
|
|
fileInfo, err := f.File.Stat()
|
|
|
|
return &StaticFileInfoWrapper{FileInfo: fileInfo, fixedModTime: f.fixedModTime}, err //nolint:wrapcheck
|
|
}
|
|
|
|
type StaticFileInfoWrapper struct {
|
|
os.FileInfo
|
|
fixedModTime time.Time
|
|
}
|
|
|
|
func (f *StaticFileInfoWrapper) ModTime() time.Time {
|
|
return f.fixedModTime
|
|
}
|
|
|
|
func main() {
|
|
var (
|
|
logLevel = new(slog.LevelVar)
|
|
logHandler slog.Handler
|
|
logger *slog.Logger
|
|
)
|
|
|
|
logHandler = slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel})
|
|
logger = slog.New(logHandler)
|
|
slog.SetDefault(logger)
|
|
|
|
config, err := services.ConfigureApplication("RESOURCE_APP", services.DefaultConfiguration)
|
|
if err != nil {
|
|
logger.Error("error loading configuration", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
oidcServer := config.MustString("oidc.server")
|
|
oidcClientID := config.MustString("oidc.client-id")
|
|
oidcClientSecret := config.MustString("oidc.client-secret")
|
|
|
|
if level := config.Bytes("log.level"); level != nil {
|
|
if err := logLevel.UnmarshalText(level); err != nil {
|
|
logger.Error("could not parse log level", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
slog.SetLogLoggerLevel(logLevel.Level())
|
|
}
|
|
|
|
if config.Bool("log.json") {
|
|
logHandler = slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel})
|
|
logger = slog.New(logHandler)
|
|
slog.SetDefault(logger)
|
|
}
|
|
|
|
logLogger := slog.NewLogLogger(logger.Handler(), logLevel.Level())
|
|
|
|
logger.Info(
|
|
"Starting CAcert OpenID Connect demo application",
|
|
"version", version, "commit", commit, "date", date,
|
|
)
|
|
logger.Info("Server is starting")
|
|
|
|
bundle, catalog := services.InitI18n(logger, config.Strings("i18n.languages"))
|
|
|
|
services.AddMessages(catalog)
|
|
|
|
tlsClientConfig, err := getTLSConfig(config)
|
|
if err != nil {
|
|
logger.Error("error loading tls config", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
apiTransport := &http.Transport{TLSClientConfig: tlsClientConfig}
|
|
apiClient := &http.Client{Transport: apiTransport}
|
|
|
|
oidcInfo, err := services.DiscoverOIDC(logger, &services.OidcParams{
|
|
OidcServer: oidcServer,
|
|
OidcClientID: oidcClientID,
|
|
OidcClientSecret: oidcClientSecret,
|
|
APIClient: apiClient,
|
|
})
|
|
if err != nil {
|
|
logger.Error("OpenID Connect discovery failed", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
sessionPath, sessionAuthKey, sessionEncKey, err := configureSessionParameters(logger, config)
|
|
if err := services.InitSessionStore(logger, sessionPath, sessionAuthKey, sessionEncKey); err != nil {
|
|
logger.Error("could not initialize session store", "error", err)
|
|
|
|
os.Exit(1)
|
|
}
|
|
|
|
authMiddleware := handlers.Authenticate(logger, oidcInfo.OAuth2Config)
|
|
|
|
publicURL := buildPublicURL(config.MustString("server.name"), config.MustInt("server.port"))
|
|
|
|
tokenInfoService, err := services.InitTokenInfoService(logger, oidcInfo)
|
|
if err != nil {
|
|
logger.Error("could not initialize token info service", "error", err)
|
|
|
|
os.Exit(1)
|
|
}
|
|
|
|
indexHandler, err := handlers.NewIndexHandler(logger, bundle, catalog, oidcInfo, publicURL, tokenInfoService)
|
|
if err != nil {
|
|
logger.Error("could not initialize index handler", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
protectedResource, err := handlers.NewProtectedResourceHandler(
|
|
logger, bundle, catalog, oidcInfo, publicURL, tokenInfoService,
|
|
)
|
|
if err != nil {
|
|
logger.Error("could not initialize protected resource handler", "error", err)
|
|
}
|
|
|
|
callbackHandler := handlers.NewCallbackHandler(logger, oidcInfo.KeySet, oidcInfo.OAuth2Config)
|
|
afterLogoutHandler := handlers.NewAfterLogoutHandler(logger)
|
|
|
|
staticFiles, err := staticFileHandler()
|
|
if err != nil {
|
|
logger.Error("could not initialize static file handler", "error", err)
|
|
|
|
os.Exit(1)
|
|
}
|
|
|
|
router := http.NewServeMux()
|
|
router.Handle("/", indexHandler)
|
|
router.Handle("/login", authMiddleware(handlers.NewLoginHandler()))
|
|
router.Handle("/protected", authMiddleware(protectedResource))
|
|
router.Handle("/callback", callbackHandler)
|
|
router.Handle("/after-logout", afterLogoutHandler)
|
|
router.Handle("/health", handlers.NewHealthHandler())
|
|
router.HandleFunc("/images/", staticFiles)
|
|
router.HandleFunc("/css/", staticFiles)
|
|
router.HandleFunc("/js/", staticFiles)
|
|
|
|
nextRequestID := func() string {
|
|
return fmt.Sprintf("%d", time.Now().UnixNano())
|
|
}
|
|
|
|
tracing := handlers.Tracing(nextRequestID)
|
|
logging := handlers.Logging(logLogger)
|
|
hsts := handlers.EnableHSTS()
|
|
|
|
errorMiddleware, err := handlers.ErrorHandling(logger, bundle, catalog)
|
|
if err != nil {
|
|
logger.Error("could not initialize request error handling", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
tlsConfig := &tls.Config{
|
|
ServerName: config.String("server.name"),
|
|
MinVersion: tls.VersionTLS12,
|
|
}
|
|
|
|
server := &http.Server{
|
|
Addr: fmt.Sprintf("%s:%d", config.String("server.bind_address"), config.Int("server.port")),
|
|
Handler: tracing(logging(hsts(errorMiddleware(router)))),
|
|
ReadTimeout: defaultReadTimeout,
|
|
WriteTimeout: defaultWriteTimeout,
|
|
IdleTimeout: defaultIdleTimeout,
|
|
TLSConfig: tlsConfig,
|
|
}
|
|
|
|
if err := handlers.StartApplication(context.Background(), logger, server, publicURL, config); err != nil {
|
|
logger.Error("could not start application", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func staticFileHandler() (func(w http.ResponseWriter, r *http.Request), error) {
|
|
stat, err := os.Stat(os.Args[0])
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not use stat on binary: %w", err)
|
|
}
|
|
|
|
fileServer := http.FileServer(&StaticFSWrapper{FileSystem: http.FS(ui.Static), ModTime: stat.ModTime()})
|
|
|
|
staticFiles := func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Del("Expires")
|
|
w.Header().Del("Pragma")
|
|
w.Header().Set("Cache-Control", "max-age=3600")
|
|
|
|
fileServer.ServeHTTP(w, r)
|
|
}
|
|
|
|
return staticFiles, nil
|
|
}
|
|
|
|
func getTLSConfig(config *koanf.Koanf) (*tls.Config, error) {
|
|
tlsClientConfig := &tls.Config{
|
|
MinVersion: tls.VersionTLS12,
|
|
}
|
|
|
|
if config.Exists("api-client.rootCAs") {
|
|
rootCAFile := config.MustString("api-client.rootCAs")
|
|
caCertPool := x509.NewCertPool()
|
|
|
|
pemBytes, err := os.ReadFile(rootCAFile)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not read CA certificate file: %w", err)
|
|
}
|
|
|
|
caCertPool.AppendCertsFromPEM(pemBytes)
|
|
tlsClientConfig.RootCAs = caCertPool
|
|
}
|
|
|
|
return tlsClientConfig, nil
|
|
}
|
|
|
|
func buildPublicURL(hostname string, port int) string {
|
|
const defaultHTTPSPort = 443
|
|
|
|
if port != defaultHTTPSPort {
|
|
return fmt.Sprintf("https://%s:%d", hostname, port)
|
|
}
|
|
|
|
return fmt.Sprintf("https://%s", hostname)
|
|
}
|
|
|
|
func configureSessionParameters(logger *slog.Logger, config *koanf.Koanf) (string, []byte, []byte, error) {
|
|
sessionPath := config.MustString("session.path")
|
|
|
|
sessionAuthKey, err := base64.StdEncoding.DecodeString(config.String("session.auth-key"))
|
|
if err != nil {
|
|
return "", nil, nil, fmt.Errorf("could not decode session authentication key: %w", err)
|
|
}
|
|
|
|
sessionEncKey, err := base64.StdEncoding.DecodeString(config.String("session.enc-key"))
|
|
if err != nil {
|
|
return "", nil, nil, fmt.Errorf("could not decode session encryption key: %w", err)
|
|
}
|
|
|
|
generated := false
|
|
|
|
if len(sessionAuthKey) != sessionAuthKeyLength {
|
|
sessionAuthKey, err = services.GenerateKey(sessionAuthKeyLength)
|
|
if err != nil {
|
|
return "", nil, nil, fmt.Errorf("could not generate session authentication key: %w", err)
|
|
}
|
|
|
|
generated = true
|
|
}
|
|
|
|
if len(sessionEncKey) != sessionKeyLength {
|
|
sessionEncKey, err = services.GenerateKey(sessionKeyLength)
|
|
if err != nil {
|
|
return "", nil, nil, fmt.Errorf("could not generate session encryption key: %w", err)
|
|
}
|
|
|
|
generated = true
|
|
}
|
|
|
|
if generated {
|
|
_ = config.Load(confmap.Provider(map[string]interface{}{
|
|
"session.auth-key": sessionAuthKey,
|
|
"session.enc-key": sessionEncKey,
|
|
}, "."), nil)
|
|
|
|
tomlData, err := config.Marshal(toml.Parser())
|
|
if err != nil {
|
|
return "", nil, nil, fmt.Errorf("could not encode session configuration: %w", err)
|
|
}
|
|
|
|
logger.Info("put the following in your resource_app.toml")
|
|
fmt.Print(string(tomlData)) //nolint:forbidigo
|
|
}
|
|
|
|
return sessionPath, sessionAuthKey, sessionEncKey, nil
|
|
}
|