|
|
|
|
@ -24,6 +24,7 @@ import (
|
|
|
|
|
"encoding/base64"
|
|
|
|
|
"errors"
|
|
|
|
|
"fmt"
|
|
|
|
|
"log/slog"
|
|
|
|
|
"net/http"
|
|
|
|
|
"net/url"
|
|
|
|
|
"os"
|
|
|
|
|
@ -36,7 +37,6 @@ import (
|
|
|
|
|
"github.com/knadh/koanf/parsers/toml"
|
|
|
|
|
"github.com/knadh/koanf/providers/confmap"
|
|
|
|
|
hydra "github.com/ory/hydra-client-go/v2"
|
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
|
|
|
|
|
|
"code.cacert.org/cacert/oidc-idp/internal/handlers"
|
|
|
|
|
"code.cacert.org/cacert/oidc-idp/internal/services"
|
|
|
|
|
@ -55,6 +55,8 @@ const (
|
|
|
|
|
|
|
|
|
|
sessionKeyLength = 32
|
|
|
|
|
sessionAuthKeyLength = 64
|
|
|
|
|
|
|
|
|
|
minCSRFKeyLength = 64
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
var (
|
|
|
|
|
@ -64,42 +66,61 @@ var (
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
func main() {
|
|
|
|
|
logger := log.New()
|
|
|
|
|
var (
|
|
|
|
|
logLevel = new(slog.LevelVar)
|
|
|
|
|
logHandler slog.Handler
|
|
|
|
|
logger *slog.Logger
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
logHandler = slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel})
|
|
|
|
|
logger = slog.New(logHandler)
|
|
|
|
|
slog.SetDefault(logger)
|
|
|
|
|
|
|
|
|
|
config, err := services.ConfigureApplication(logger, "IDP", services.DefaultConfig)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("error loading configuration")
|
|
|
|
|
logger.Error("error loading configuration", "err", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if level := config.String("log.level"); level != "" {
|
|
|
|
|
logLevel, err := log.ParseLevel(level)
|
|
|
|
|
if level := config.Bytes("log.level"); level != nil {
|
|
|
|
|
err := logLevel.UnmarshalText(level)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not parse log level")
|
|
|
|
|
logger.Error("could not parse log level", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
logger.SetLevel(logLevel)
|
|
|
|
|
slog.SetLogLoggerLevel(logLevel.Level())
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if config.Bool("log.json") {
|
|
|
|
|
logger.SetFormatter(&log.JSONFormatter{})
|
|
|
|
|
logHandler = slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel})
|
|
|
|
|
logger = slog.New(logHandler)
|
|
|
|
|
slog.SetDefault(logger)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
logger.WithFields(log.Fields{
|
|
|
|
|
"version": version, "commit": commit, "date": date,
|
|
|
|
|
}).Info("Starting CAcert OpenID Connect Identity Provider")
|
|
|
|
|
logger.Infoln("Server is starting")
|
|
|
|
|
logger.Info("Starting CAcert OpenID Connect Identity Provider",
|
|
|
|
|
"version", version, "commit", commit, "date", date,
|
|
|
|
|
)
|
|
|
|
|
logger.Info("Server is starting")
|
|
|
|
|
i18nService := services.InitI18n(logger, config.Strings("i18n.languages"))
|
|
|
|
|
|
|
|
|
|
if err = i18nService.AddMessages(); err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not add messages for i18n")
|
|
|
|
|
logger.Error("could not add messages for i18n", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sessionAuthKey, sessionEncKey, csrfKey, err := configureSessionParameters(config)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.Error("could not configure session parameters", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sessionAuthKey, sessionEncKey := configureSessionParameters(config)
|
|
|
|
|
services.InitSessionStore(sessionAuthKey, sessionEncKey)
|
|
|
|
|
|
|
|
|
|
clientTransport, err := configureAdminClient(config)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not configure Hydra admin client")
|
|
|
|
|
logger.Error("could not configure Hydra admin client", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
tc := handlers.PopulateTemplateCache()
|
|
|
|
|
@ -132,11 +153,6 @@ func main() {
|
|
|
|
|
router.Handle("/css/", staticFiles)
|
|
|
|
|
router.Handle("/js/", staticFiles)
|
|
|
|
|
|
|
|
|
|
csrfKey, err := base64.StdEncoding.DecodeString(config.MustString("security.csrf.key"))
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not parse CSRF key bytes")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
nextRequestID := func() string {
|
|
|
|
|
return fmt.Sprintf("%d", time.Now().UnixNano())
|
|
|
|
|
}
|
|
|
|
|
@ -152,12 +168,17 @@ func main() {
|
|
|
|
|
|
|
|
|
|
errorMiddleware, err := handlers.ErrorHandling(logger, tc, i18nService)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not initialize request error handling")
|
|
|
|
|
logger.Error("could not initialize request error handling", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
handlerChain := tracing(logging(hsts(errorMiddleware(csrfProtect(router)))))
|
|
|
|
|
|
|
|
|
|
startServer(logger, config, handlerChain)
|
|
|
|
|
err = startServer(logger, config, handlerChain)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.Error("server start failed", "error", err)
|
|
|
|
|
os.Exit(1)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func configureAdminClient(config *koanf.Koanf) (*hydra.APIClient, error) {
|
|
|
|
|
@ -197,7 +218,7 @@ func configureAdminClient(config *koanf.Koanf) (*hydra.APIClient, error) {
|
|
|
|
|
return c, nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func startServer(logger *log.Logger, config *koanf.Koanf, handlerChain http.Handler) {
|
|
|
|
|
func startServer(logger *slog.Logger, config *koanf.Koanf, handlerChain http.Handler) error {
|
|
|
|
|
clientCertificateCAFile := config.MustString("security.client.ca-file")
|
|
|
|
|
serverBindAddress := config.String("server.bind_address")
|
|
|
|
|
serverName := config.String("server.name")
|
|
|
|
|
@ -207,7 +228,7 @@ func startServer(logger *log.Logger, config *koanf.Koanf, handlerChain http.Hand
|
|
|
|
|
|
|
|
|
|
pemBytes, err := os.ReadFile(clientCertificateCAFile)
|
|
|
|
|
if err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("could not load client CA certificates")
|
|
|
|
|
return fmt.Errorf("could not load client CA certificates: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
clientCertPool.AppendCertsFromPEM(pemBytes)
|
|
|
|
|
@ -233,7 +254,7 @@ func startServer(logger *log.Logger, config *koanf.Koanf, handlerChain http.Hand
|
|
|
|
|
|
|
|
|
|
go func() {
|
|
|
|
|
<-quit
|
|
|
|
|
logger.Infoln("Server is shutting down...")
|
|
|
|
|
logger.Info("Server is shutting down...")
|
|
|
|
|
atomic.StoreInt32(&handlers.Healthy, 0)
|
|
|
|
|
|
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), ShutdownTimeout)
|
|
|
|
|
@ -242,27 +263,30 @@ func startServer(logger *log.Logger, config *koanf.Koanf, handlerChain http.Hand
|
|
|
|
|
server.SetKeepAlivesEnabled(false)
|
|
|
|
|
|
|
|
|
|
if err := server.Shutdown(ctx); err != nil {
|
|
|
|
|
logger.WithError(err).Fatal("Could not gracefully shutdown the server")
|
|
|
|
|
logger.Error("could not shutdown server gracefully", "error", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
close(done)
|
|
|
|
|
}()
|
|
|
|
|
|
|
|
|
|
logger.WithFields(log.Fields{
|
|
|
|
|
"address": server.Addr, "url": publicAddress(serverName, serverPort),
|
|
|
|
|
}).Info("Server is ready to handle requests")
|
|
|
|
|
logger.Info(
|
|
|
|
|
"Server is ready to handle requests",
|
|
|
|
|
"address", server.Addr, "url", publicAddress(serverName, serverPort),
|
|
|
|
|
)
|
|
|
|
|
atomic.StoreInt32(&handlers.Healthy, 1)
|
|
|
|
|
|
|
|
|
|
if err := server.ListenAndServeTLS(
|
|
|
|
|
config.String("server.certificate"), config.String("server.key"),
|
|
|
|
|
); err != nil && !errors.Is(err, http.ErrServerClosed) {
|
|
|
|
|
logger.WithError(err).WithField(
|
|
|
|
|
"server_addr", server.Addr,
|
|
|
|
|
).Fatal("Could not listen on configured server address")
|
|
|
|
|
logger.Error("could not listen on configured server address", "server_addr", server.Addr)
|
|
|
|
|
|
|
|
|
|
return fmt.Errorf("could not create listener: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
<-done
|
|
|
|
|
logger.Infoln("Server stopped")
|
|
|
|
|
logger.Info("Server stopped")
|
|
|
|
|
|
|
|
|
|
return nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func publicAddress(serverName string, serverPort int) string {
|
|
|
|
|
@ -273,42 +297,66 @@ func publicAddress(serverName string, serverPort int) string {
|
|
|
|
|
return fmt.Sprintf("https://%s/", serverName)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func configureSessionParameters(config *koanf.Koanf) ([]byte, []byte) {
|
|
|
|
|
func configureSessionParameters(config *koanf.Koanf) ([]byte, []byte, []byte, error) { //nolint:cyclop
|
|
|
|
|
sessionAuthKey, err := base64.StdEncoding.DecodeString(config.String("session.auth-key"))
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.WithError(err).Fatal("could not decode session auth key")
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not decode session auth key: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sessionEncKey, err := base64.StdEncoding.DecodeString(config.String("session.enc-key"))
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.WithError(err).Fatal("could not decode session encryption key")
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not decode session encryption key: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
csrfKey, err := base64.StdEncoding.DecodeString(config.String("security.csrf.key"))
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not decode CSRF key bytes: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
generated := false
|
|
|
|
|
|
|
|
|
|
if len(sessionAuthKey) != sessionAuthKeyLength {
|
|
|
|
|
sessionAuthKey = services.GenerateKey(sessionAuthKeyLength)
|
|
|
|
|
sessionAuthKey, err = services.GenerateKey(sessionAuthKeyLength)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not generate session authentication key: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
generated = true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if len(sessionEncKey) != sessionKeyLength {
|
|
|
|
|
sessionEncKey = services.GenerateKey(sessionKeyLength)
|
|
|
|
|
sessionEncKey, err = services.GenerateKey(sessionKeyLength)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not generate session encryption key: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
generated = true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if len(csrfKey) < minCSRFKeyLength {
|
|
|
|
|
csrfKey, err = services.GenerateKey(minCSRFKeyLength)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not generate CSRF key: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
generated = true
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if generated {
|
|
|
|
|
_ = config.Load(confmap.Provider(map[string]interface{}{
|
|
|
|
|
"session.auth-key": sessionAuthKey,
|
|
|
|
|
"session.enc-key": sessionEncKey,
|
|
|
|
|
"session.auth-key": base64.StdEncoding.EncodeToString(sessionAuthKey),
|
|
|
|
|
"session.enc-key": base64.StdEncoding.EncodeToString(sessionEncKey),
|
|
|
|
|
"security.csrf.key": base64.StdEncoding.EncodeToString(csrfKey),
|
|
|
|
|
}, "."), nil)
|
|
|
|
|
|
|
|
|
|
tomlData, err := config.Marshal(toml.Parser())
|
|
|
|
|
if err != nil {
|
|
|
|
|
log.WithError(err).Fatal("could not encode session config")
|
|
|
|
|
return nil, nil, nil, fmt.Errorf("could not encode session config: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log.Infof("put the following in your resource_app.toml:\n%s", string(tomlData))
|
|
|
|
|
slog.Info("generated configuration values, put the following into your idp.toml")
|
|
|
|
|
fmt.Printf("------\n%s------\n", string(tomlData)) //nolint:forbidigo
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return sessionAuthKey, sessionEncKey
|
|
|
|
|
return sessionAuthKey, sessionEncKey, csrfKey, nil
|
|
|
|
|
}
|
|
|
|
|
|
