From 55040c55fa0f27a4e1a517efa18425571080797a Mon Sep 17 00:00:00 2001 From: Bobby Rullo Date: Thu, 1 Oct 2015 11:34:53 -0700 Subject: [PATCH 1/2] server, integration, cmd: Protect Admin API Admin API now requires a 128 byte base64 encoded secret to be passed in Authorization header, closing up a potential security hole for those who expose this service. --- cmd/dex-overlord/main.go | 5 ++++- integration/admin_api_test.go | 35 +++++++++++++++++++++++++++++++++-- server/admin.go | 27 ++++++++++++++++++++++++--- 3 files changed, 61 insertions(+), 6 deletions(-) diff --git a/cmd/dex-overlord/main.go b/cmd/dex-overlord/main.go index f292e399..523f7bfe 100644 --- a/cmd/dex-overlord/main.go +++ b/cmd/dex-overlord/main.go @@ -41,6 +41,9 @@ func main() { adminListen := fs.String("admin-listen", "http://127.0.0.1:5557", "scheme, host and port for listening for administrative operation requests ") + adminAPISecret := pflag.NewBase64(server.AdminAPISecretLength) + fs.Var(adminAPISecret, "admin-api-secret", fmt.Sprintf("A base64-encoded %d byte string which is used to protect the Admin API.", server.AdminAPISecretLength)) + localConnectorID := fs.String("local-connector", "local", "ID of the local connector") logDebug := fs.Bool("log-debug", false, "log debug-level information") logTimestamps := fs.Bool("log-timestamps", false, "prefix log lines with timestamps") @@ -124,7 +127,7 @@ func main() { } krot := key.NewPrivateKeyRotator(kRepo, *keyPeriod) - s := server.NewAdminServer(adminAPI, krot) + s := server.NewAdminServer(adminAPI, krot, adminAPISecret.String()) h := s.HTTPHandler() httpsrv := &http.Server{ Addr: adminURL.Host, diff --git a/integration/admin_api_test.go b/integration/admin_api_test.go index f8c75764..c89b71a4 100644 --- a/integration/admin_api_test.go +++ b/integration/admin_api_test.go @@ -14,6 +14,10 @@ import ( "github.com/coreos/dex/user" ) +const ( + adminAPITestSecret = "admin_secret" +) + type adminAPITestFixtures struct { ur user.UserRepo pwr user.PasswordInfoRepo @@ -58,6 +62,15 @@ var ( } ) +type adminAPITransport struct { + secret string +} + +func (a *adminAPITransport) RoundTrip(r *http.Request) (*http.Response, error) { + r.Header.Set("Authorization", a.secret) + return http.DefaultTransport.RoundTrip(r) +} + func makeAdminAPITestFixtures() *adminAPITestFixtures { f := &adminAPITestFixtures{} @@ -65,9 +78,13 @@ func makeAdminAPITestFixtures() *adminAPITestFixtures { f.ur = ur f.pwr = pwr f.adAPI = admin.NewAdminAPI(um, f.ur, f.pwr, "local") - f.adSrv = server.NewAdminServer(f.adAPI, nil) + f.adSrv = server.NewAdminServer(f.adAPI, nil, adminAPITestSecret) f.hSrv = httptest.NewServer(f.adSrv.HTTPHandler()) - f.hc = &http.Client{} + f.hc = &http.Client{ + Transport: &adminAPITransport{ + secret: adminAPITestSecret, + }, + } f.adClient, _ = adminschema.NewWithBasePath(f.hc, f.hSrv.URL) return f @@ -129,6 +146,7 @@ func TestCreateAdmin(t *testing.T) { tests := []struct { admn *adminschema.Admin errCode int + secret string }{ { admn: &adminschema.Admin{ @@ -137,6 +155,14 @@ func TestCreateAdmin(t *testing.T) { }, errCode: -1, }, + { + admn: &adminschema.Admin{ + Email: "foo@example.com", + Password: "foopass", + }, + errCode: http.StatusUnauthorized, + secret: "bad_secret", + }, { // duplicate Email admn: &adminschema.Admin{ @@ -156,6 +182,11 @@ func TestCreateAdmin(t *testing.T) { for i, tt := range tests { func() { f := makeAdminAPITestFixtures() + if tt.secret != "" { + f.hc.Transport = &adminAPITransport{ + secret: tt.secret, + } + } defer f.close() admn, err := f.adClient.Admin.Create(tt.admn).Do() diff --git a/server/admin.go b/server/admin.go index d142516d..8295dfe6 100644 --- a/server/admin.go +++ b/server/admin.go @@ -15,7 +15,8 @@ import ( ) const ( - AdminAPIVersion = "v1" + AdminAPIVersion = "v1" + AdminAPISecretLength = 128 ) var ( @@ -28,9 +29,10 @@ var ( type AdminServer struct { adminAPI *admin.AdminAPI checker health.Checker + secret string } -func NewAdminServer(adminAPI *admin.AdminAPI, rotator *key.PrivateKeyRotator) *AdminServer { +func NewAdminServer(adminAPI *admin.AdminAPI, rotator *key.PrivateKeyRotator, secret string) *AdminServer { return &AdminServer{ adminAPI: adminAPI, checker: health.Checker{ @@ -38,6 +40,7 @@ func NewAdminServer(adminAPI *admin.AdminAPI, rotator *key.PrivateKeyRotator) *A rotator, }, }, + secret: secret, } } @@ -48,7 +51,25 @@ func (s *AdminServer) HTTPHandler() http.Handler { r.GET(AdminGetStateEndpoint, s.getState) r.Handler("GET", httpPathHealth, s.checker) r.HandlerFunc("GET", httpPathDebugVars, health.ExpvarHandler) - return r + + return authorizer(r, s.secret, httpPathHealth, httpPathDebugVars) +} + +func authorizer(h http.Handler, secret string, public ...string) http.Handler { + publicSet := map[string]struct{}{} + for _, p := range public { + publicSet[p] = struct{}{} + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + _, isPublicPath := publicSet[r.URL.Path] + + if !isPublicPath && r.Header.Get("Authorization") != secret { + writeAPIError(w, http.StatusUnauthorized, newAPIError(errorAccessDenied, "")) + return + } + h.ServeHTTP(w, r) + }) } func (s *AdminServer) getAdmin(w http.ResponseWriter, r *http.Request, ps httprouter.Params) { From 5e859dad5c72726d770a99c4e065c128866ba1ae Mon Sep 17 00:00:00 2001 From: Bobby Rullo Date: Thu, 1 Oct 2015 13:12:06 -0700 Subject: [PATCH 2/2] Documentation, contrib: Update docs with admin key --- Documentation/getting-started.md | 9 ++++++++- contrib/standup-db.sh | 3 ++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/Documentation/getting-started.md b/Documentation/getting-started.md index b582b2f6..a7328312 100644 --- a/Documentation/getting-started.md +++ b/Documentation/getting-started.md @@ -45,17 +45,24 @@ dex needs a 32 byte base64-encoded key which will be used to encrypt the private The dex overlord and workers allow multiple key secrets (separated by commas) to be passed but only the first will be used to encrypt data; the rest are there for decryption only; this scheme allows for the rotation of keys without downtime (assuming a rolling restart of workers). +# Generate an Admin API Secret + +The dex overlord has a an API which is very powerful - you can create Admin users with it, so it needs to be protected somehow. This is accomplished by requiring that a secret is passed via the Authorization header of each request. This secret is 128 bytes base64 encoded, and should be sufficiently random so as to make guessing impractical: + +`DEX_OVERLORD_ADMIN_API_SECRET=$(dd if=/dev/random bs=1 count=128 2>/dev/null | base64)` + # Start the overlord The overlord is responsible for creating and rotating keys and some other adminsitrative tasks. In addition, the overlord is responsible for creating the necessary database tables (and when you update, performing schema migrations), so it must be started before we do anything else. Debug logging is turned on so we can see more of what's going on. Start it up. -`./bin/dex-overlord --db-url=$DEX_DB_URL --key-secrets=$DEX_KEY_SECRET --log-debug=true &` +`./bin/dex-overlord --admin-api-secret=$DEX_OVERLORD_ADMIN_API_SECRET --db-url=$DEX_DB_URL --key-secrets=$DEX_KEY_SECRET --log-debug=true &` ## Environment Variables. Note that parameters can be passed as flags or environment variables to dex components; an equivalent start with environment variables would be: ``` +export DEX_OVERLORD_ADMIN_API_SECRET=$DEX_OVERLORD_ADMIN_API_SECRET export DEX_OVERLORD_DB_URL=$DEX_DB_URL export DEX_OVERLORD_KEY_SECRETS=$DEX_KEY_SECRET export DEX_OVERLORD_LOG_DEBUG=true diff --git a/contrib/standup-db.sh b/contrib/standup-db.sh index 21ee8e35..6aa62aa0 100644 --- a/contrib/standup-db.sh +++ b/contrib/standup-db.sh @@ -31,6 +31,7 @@ DEX_KEY_SECRET=$(dd if=/dev/random bs=1 count=32 2>/dev/null | base64) export DEX_OVERLORD_DB_URL=$DEX_DB_URL export DEX_OVERLORD_KEY_SECRETS=$DEX_KEY_SECRET export DEX_OVERLORD_KEY_PERIOD=1h +export DEX_OVERLORD_ADMIN_API_SECRET=$(dd if=/dev/random bs=1 count=128 2>/dev/null | base64) ./bin/dex-overlord & echo "Waiting for overlord to start..." until $(curl --output /dev/null --silent --fail http://localhost:5557/health); do @@ -79,5 +80,5 @@ done ./bin/example-app --client-id=$DEX_APP_CLIENT_ID --client-secret=$DEX_APP_CLIENT_SECRET --discovery=http://127.0.0.1:5556 & # Create Admin User - the password is a hash of the word "password" -curl -X POST --data '{"email":"admin@example.com","password":"$2a$04$J54iz31fhYfXIRVglUMmpufY6TKf/vvwc9pv8zWog7X/LFrFfkNQe" }' http://127.0.0.1:5557/api/v1/admin +curl -X POST --data '{"email":"admin@example.com","password":"$2a$04$J54iz31fhYfXIRVglUMmpufY6TKf/vvwc9pv8zWog7X/LFrFfkNQe" }' --header "Authorization: $DEX_OVERLORD_ADMIN_API_SECRET" http://127.0.0.1:5557/api/v1/admin