Arsharth
/
dex
forked from mystiq/dex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #998 from rithujohn191/fix-key-rotation 

server/rotation.go: Fix key rotation with multiple dex instances.
This commit is contained in:
rithu leena john 2017-07-19 11:07:48 -07:00 committed by GitHub
parent 2f0ac68d8f 753526a506
commit 0e0b4c53ef
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
server/rotation.go
View File

@ -5,6 +5,7 @@ import (
"crypto/rand"
"crypto/rsa"
"encoding/hex"
"errors"
"fmt"
"io"
"time"
@ -15,6 +16,8 @@ import (
"github.com/coreos/dex/storage"
)
var errAlreadyRotated = errors.New("keys already rotated by another server instance")
// rotationStrategy describes a strategy for generating cryptographic keys, how
// often to rotate them, and how long they can validate signatures after rotation.
type rotationStrategy struct {
@ -70,7 +73,11 @@ func (s *Server) startKeyRotation(ctx context.Context, strategy rotationStrategy
// Try to rotate immediately so properly configured storages will have keys.
if err := rotater.rotate(); err != nil {
s.logger.Errorf("failed to rotate keys: %v", err)
if err == errAlreadyRotated {
s.logger.Infof("Key rotation not needed: %v", err)
} else {
s.logger.Errorf("failed to rotate keys: %v", err)
}
}
go func() {
@ -128,7 +135,7 @@ func (k keyRotater) rotate() error {
// if you are running multiple instances of dex, another instance
// could have already rotated the keys.
if tNow.Before(keys.NextRotation) {
return storage.Keys{}, nil
return storage.Keys{}, errAlreadyRotated
}
expired := func(key storage.VerificationKey) bool {