2015-08-18 05:57:27 +05:30
|
|
|
package server
|
|
|
|
|
|
|
|
import (
|
2016-02-10 01:52:40 +05:30
|
|
|
"encoding/json"
|
2015-08-18 05:57:27 +05:30
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"html/template"
|
|
|
|
"net/url"
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
texttemplate "text/template"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/coreos/go-oidc/key"
|
2016-02-10 04:36:07 +05:30
|
|
|
"github.com/coreos/go-oidc/oidc"
|
2015-08-18 05:57:27 +05:30
|
|
|
"github.com/coreos/pkg/health"
|
|
|
|
|
|
|
|
"github.com/coreos/dex/connector"
|
|
|
|
"github.com/coreos/dex/db"
|
|
|
|
"github.com/coreos/dex/email"
|
2016-02-10 00:40:28 +05:30
|
|
|
sessionmanager "github.com/coreos/dex/session/manager"
|
2015-08-18 05:57:27 +05:30
|
|
|
"github.com/coreos/dex/user"
|
|
|
|
useremail "github.com/coreos/dex/user/email"
|
2016-02-10 00:40:28 +05:30
|
|
|
usermanager "github.com/coreos/dex/user/manager"
|
2015-08-18 05:57:27 +05:30
|
|
|
)
|
|
|
|
|
|
|
|
type ServerConfig struct {
|
2016-01-22 05:37:41 +05:30
|
|
|
IssuerURL string
|
|
|
|
IssuerName string
|
|
|
|
IssuerLogoURL string
|
|
|
|
TemplateDir string
|
|
|
|
EmailTemplateDirs []string
|
|
|
|
EmailFromAddress string
|
|
|
|
EmailerConfigFile string
|
|
|
|
StateConfig StateConfigurer
|
|
|
|
EnableRegistration bool
|
|
|
|
EnableClientRegistration bool
|
2015-08-18 05:57:27 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
type StateConfigurer interface {
|
|
|
|
Configure(*Server) error
|
|
|
|
}
|
|
|
|
|
|
|
|
type SingleServerConfig struct {
|
|
|
|
ClientsFile string
|
|
|
|
ConnectorsFile string
|
|
|
|
UsersFile string
|
|
|
|
}
|
|
|
|
|
|
|
|
type MultiServerConfig struct {
|
2015-08-26 05:14:38 +05:30
|
|
|
KeySecrets [][]byte
|
2015-08-18 05:57:27 +05:30
|
|
|
DatabaseConfig db.Config
|
2015-10-29 05:19:25 +05:30
|
|
|
UseOldFormat bool
|
2015-08-18 05:57:27 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
func (cfg *ServerConfig) Server() (*Server, error) {
|
|
|
|
iu, err := url.Parse(cfg.IssuerURL)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2015-10-01 05:05:58 +05:30
|
|
|
tpl, err := getTemplates(cfg.IssuerName, cfg.IssuerLogoURL, cfg.EnableRegistration, cfg.TemplateDir)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
km := key.NewPrivateKeyManager()
|
|
|
|
srv := Server{
|
|
|
|
IssuerURL: *iu,
|
|
|
|
KeyManager: km,
|
|
|
|
Templates: tpl,
|
|
|
|
|
|
|
|
HealthChecks: []health.Checkable{km},
|
|
|
|
Connectors: []connector.Connector{},
|
2015-10-01 05:05:58 +05:30
|
|
|
|
2016-01-22 05:37:41 +05:30
|
|
|
EnableRegistration: cfg.EnableRegistration,
|
|
|
|
EnableClientRegistration: cfg.EnableClientRegistration,
|
2015-08-18 05:57:27 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
err = cfg.StateConfig.Configure(&srv)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
err = setTemplates(&srv, tpl)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2015-10-31 03:30:40 +05:30
|
|
|
err = setEmailer(&srv, cfg.IssuerName, cfg.EmailFromAddress, cfg.EmailerConfigFile, cfg.EmailTemplateDirs)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &srv, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (cfg *SingleServerConfig) Configure(srv *Server) error {
|
|
|
|
k, err := key.GeneratePrivateKey()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
dbMap := db.NewMemDB()
|
|
|
|
|
2015-08-18 05:57:27 +05:30
|
|
|
ks := key.NewPrivateKeySet([]*key.PrivateKey{k}, time.Now().Add(24*time.Hour))
|
|
|
|
kRepo := key.NewPrivateKeySetRepo()
|
|
|
|
if err = kRepo.Set(ks); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2016-02-10 05:48:05 +05:30
|
|
|
clients, err := loadClients(cfg.ClientsFile)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to read clients from file %s: %v", cfg.ClientsFile, err)
|
|
|
|
}
|
2016-02-10 04:36:07 +05:30
|
|
|
ciRepo, err := db.NewClientIdentityRepoFromClients(dbMap, clients)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to create client identity repo: %v", err)
|
|
|
|
}
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-01-19 22:29:34 +05:30
|
|
|
f, err := os.Open(cfg.ConnectorsFile)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
2016-01-19 22:29:34 +05:30
|
|
|
return fmt.Errorf("opening connectors file: %v", err)
|
2015-08-18 05:57:27 +05:30
|
|
|
}
|
2016-01-19 22:29:34 +05:30
|
|
|
defer f.Close()
|
|
|
|
cfgs, err := connector.ReadConfigs(f)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("decoding connector configs: %v", err)
|
|
|
|
}
|
2016-02-10 05:14:38 +05:30
|
|
|
cfgRepo := db.NewConnectorConfigRepo(dbMap)
|
|
|
|
if err := cfgRepo.Set(cfgs); err != nil {
|
|
|
|
return fmt.Errorf("failed to set connectors: %v", err)
|
|
|
|
}
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
sRepo := db.NewSessionRepo(dbMap)
|
|
|
|
skRepo := db.NewSessionKeyRepo(dbMap)
|
2016-02-10 00:40:28 +05:30
|
|
|
sm := sessionmanager.NewSessionManager(sRepo, skRepo)
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
users, err := loadUsers(cfg.UsersFile)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to read users from file: %v", err)
|
|
|
|
}
|
2016-02-10 01:52:40 +05:30
|
|
|
userRepo, err := db.NewUserRepoFromUsers(dbMap, users)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-02-10 02:27:42 +05:30
|
|
|
pwiRepo := db.NewPasswordInfoRepo(dbMap)
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
refTokRepo := db.NewRefreshTokenRepo(dbMap)
|
2015-08-18 05:57:27 +05:30
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
txnFactory := db.TransactionFactory(dbMap)
|
2016-02-10 00:40:28 +05:30
|
|
|
userManager := usermanager.NewUserManager(userRepo, pwiRepo, cfgRepo, txnFactory, usermanager.ManagerOptions{})
|
2015-08-18 05:57:27 +05:30
|
|
|
srv.ClientIdentityRepo = ciRepo
|
|
|
|
srv.KeySetRepo = kRepo
|
|
|
|
srv.ConnectorConfigRepo = cfgRepo
|
|
|
|
srv.UserRepo = userRepo
|
|
|
|
srv.UserManager = userManager
|
|
|
|
srv.PasswordInfoRepo = pwiRepo
|
|
|
|
srv.SessionManager = sm
|
|
|
|
srv.RefreshTokenRepo = refTokRepo
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-02-10 01:52:40 +05:30
|
|
|
func loadUsers(filepath string) (users []user.UserWithRemoteIdentities, err error) {
|
|
|
|
f, err := os.Open(filepath)
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer f.Close()
|
|
|
|
err = json.NewDecoder(f).Decode(&users)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2016-02-10 05:48:05 +05:30
|
|
|
func loadClients(filepath string) ([]oidc.ClientIdentity, error) {
|
|
|
|
f, err := os.Open(filepath)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
defer f.Close()
|
|
|
|
var c []struct {
|
|
|
|
ID string `json:"id"`
|
|
|
|
Secret string `json:"secret"`
|
|
|
|
RedirectURLs []string `json:"redirectURLs"`
|
|
|
|
}
|
|
|
|
if err := json.NewDecoder(f).Decode(&c); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
clients := make([]oidc.ClientIdentity, len(c))
|
|
|
|
for i, client := range c {
|
|
|
|
redirectURIs := make([]url.URL, len(client.RedirectURLs))
|
|
|
|
for j, u := range client.RedirectURLs {
|
|
|
|
uri, err := url.Parse(u)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
redirectURIs[j] = *uri
|
|
|
|
}
|
|
|
|
|
|
|
|
clients[i] = oidc.ClientIdentity{
|
|
|
|
Credentials: oidc.ClientCredentials{
|
|
|
|
ID: client.ID,
|
|
|
|
Secret: client.Secret,
|
|
|
|
},
|
|
|
|
Metadata: oidc.ClientMetadata{
|
|
|
|
RedirectURIs: redirectURIs,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return clients, nil
|
|
|
|
}
|
|
|
|
|
2015-08-18 05:57:27 +05:30
|
|
|
func (cfg *MultiServerConfig) Configure(srv *Server) error {
|
2015-08-26 05:14:38 +05:30
|
|
|
if len(cfg.KeySecrets) == 0 {
|
2015-08-18 05:57:27 +05:30
|
|
|
return errors.New("missing key secret")
|
|
|
|
}
|
|
|
|
|
|
|
|
if cfg.DatabaseConfig.DSN == "" {
|
|
|
|
return errors.New("missing database connection string")
|
|
|
|
}
|
|
|
|
|
|
|
|
dbc, err := db.NewConnection(cfg.DatabaseConfig)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to initialize database connection: %v", err)
|
|
|
|
}
|
|
|
|
|
2015-10-29 05:19:25 +05:30
|
|
|
kRepo, err := db.NewPrivateKeySetRepo(dbc, cfg.UseOldFormat, cfg.KeySecrets...)
|
2015-08-18 05:57:27 +05:30
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("unable to create PrivateKeySetRepo: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ciRepo := db.NewClientIdentityRepo(dbc)
|
|
|
|
sRepo := db.NewSessionRepo(dbc)
|
|
|
|
skRepo := db.NewSessionKeyRepo(dbc)
|
|
|
|
cfgRepo := db.NewConnectorConfigRepo(dbc)
|
|
|
|
userRepo := db.NewUserRepo(dbc)
|
|
|
|
pwiRepo := db.NewPasswordInfoRepo(dbc)
|
2016-02-10 00:40:28 +05:30
|
|
|
userManager := usermanager.NewUserManager(userRepo, pwiRepo, cfgRepo, db.TransactionFactory(dbc), usermanager.ManagerOptions{})
|
2015-08-18 05:57:27 +05:30
|
|
|
refreshTokenRepo := db.NewRefreshTokenRepo(dbc)
|
|
|
|
|
2016-02-10 00:40:28 +05:30
|
|
|
sm := sessionmanager.NewSessionManager(sRepo, skRepo)
|
2015-08-18 05:57:27 +05:30
|
|
|
|
|
|
|
srv.ClientIdentityRepo = ciRepo
|
|
|
|
srv.KeySetRepo = kRepo
|
|
|
|
srv.ConnectorConfigRepo = cfgRepo
|
|
|
|
srv.UserRepo = userRepo
|
|
|
|
srv.UserManager = userManager
|
|
|
|
srv.PasswordInfoRepo = pwiRepo
|
|
|
|
srv.SessionManager = sm
|
|
|
|
srv.RefreshTokenRepo = refreshTokenRepo
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2015-10-01 05:37:00 +05:30
|
|
|
func getTemplates(issuerName, issuerLogoURL string,
|
|
|
|
enableRegister bool, dir string) (*template.Template, error) {
|
2015-09-01 04:32:47 +05:30
|
|
|
tpl := template.New("").Funcs(map[string]interface{}{
|
|
|
|
"issuerName": func() string {
|
|
|
|
return issuerName
|
|
|
|
},
|
|
|
|
"issuerLogoURL": func() string {
|
|
|
|
return issuerLogoURL
|
|
|
|
},
|
2015-10-01 05:05:58 +05:30
|
|
|
"enableRegister": func() bool {
|
|
|
|
return enableRegister
|
|
|
|
},
|
2015-09-01 04:32:47 +05:30
|
|
|
})
|
|
|
|
|
|
|
|
return tpl.ParseGlob(dir + "/*.html")
|
2015-08-18 05:57:27 +05:30
|
|
|
}
|
|
|
|
|
|
|
|
func setTemplates(srv *Server, tpls *template.Template) error {
|
|
|
|
ltpl, err := findTemplate(LoginPageTemplateName, tpls)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
srv.LoginTemplate = ltpl
|
|
|
|
|
|
|
|
rtpl, err := findTemplate(RegisterTemplateName, tpls)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
srv.RegisterTemplate = rtpl
|
|
|
|
|
|
|
|
vtpl, err := findTemplate(VerifyEmailTemplateName, tpls)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
srv.VerifyEmailTemplate = vtpl
|
|
|
|
|
|
|
|
srtpl, err := findTemplate(SendResetPasswordEmailTemplateName, tpls)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
srv.SendResetPasswordEmailTemplate = srtpl
|
|
|
|
|
|
|
|
rpwtpl, err := findTemplate(ResetPasswordTemplateName, tpls)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
srv.ResetPasswordTemplate = rpwtpl
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2015-10-31 03:30:40 +05:30
|
|
|
func setEmailer(srv *Server, issuerName, fromAddress, emailerConfigFile string, emailTemplateDirs []string) error {
|
2015-08-18 05:57:27 +05:30
|
|
|
|
|
|
|
cfg, err := email.NewEmailerConfigFromFile(emailerConfigFile)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
emailer, err := cfg.Emailer()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
getFileNames := func(dir, ext string) ([]string, error) {
|
|
|
|
fns, err := filepath.Glob(dir + "/*." + ext)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return fns, nil
|
|
|
|
}
|
|
|
|
getTextFiles := func(dir string) ([]string, error) {
|
|
|
|
return getFileNames(dir, "txt")
|
|
|
|
}
|
|
|
|
getHTMLFiles := func(dir string) ([]string, error) {
|
|
|
|
return getFileNames(dir, "html")
|
|
|
|
}
|
|
|
|
|
|
|
|
textTemplates := texttemplate.New("textTemplates")
|
|
|
|
htmlTemplates := template.New("htmlTemplates")
|
|
|
|
for _, dir := range emailTemplateDirs {
|
|
|
|
textFileNames, err := getTextFiles(dir)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if len(textFileNames) != 0 {
|
|
|
|
textTemplates, err = textTemplates.ParseFiles(textFileNames...)
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
htmlFileNames, err := getHTMLFiles(dir)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if len(htmlFileNames) != 0 {
|
|
|
|
htmlTemplates, err = htmlTemplates.ParseFiles(htmlFileNames...)
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
tMailer := email.NewTemplatizedEmailerFromTemplates(textTemplates, htmlTemplates, emailer)
|
2015-10-31 03:30:40 +05:30
|
|
|
tMailer.SetGlobalContext(map[string]interface{}{
|
|
|
|
"issuer_name": issuerName,
|
|
|
|
})
|
2015-08-18 05:57:27 +05:30
|
|
|
|
|
|
|
ue := useremail.NewUserEmailer(srv.UserRepo,
|
|
|
|
srv.PasswordInfoRepo,
|
|
|
|
srv.KeyManager.Signer,
|
|
|
|
srv.SessionManager.ValidityWindow,
|
|
|
|
srv.IssuerURL,
|
|
|
|
tMailer,
|
|
|
|
fromAddress,
|
|
|
|
srv.absURL(httpPathResetPassword),
|
2015-11-10 04:05:11 +05:30
|
|
|
srv.absURL(httpPathEmailVerify),
|
|
|
|
srv.absURL(httpPathAcceptInvitation),
|
|
|
|
)
|
2015-08-18 05:57:27 +05:30
|
|
|
|
|
|
|
srv.UserEmailer = ue
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func findTemplate(name string, tpls *template.Template) (*template.Template, error) {
|
|
|
|
tpl := tpls.Lookup(name)
|
|
|
|
if tpl == nil {
|
|
|
|
return nil, fmt.Errorf("unable to find template: %q", name)
|
|
|
|
}
|
|
|
|
return tpl, nil
|
|
|
|
}
|