port to 5000 + provision flow + windows host fix + documentation

Author: maartyman

containers/aggregator-server/main.go

@@ -6,6 +6,7 @@ import (
 	reg "aggregator/registration"
 	"context"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"strings"
@@ -32,11 +33,16 @@ func main() {
 	logrus.SetOutput(os.Stdout)
 
 	// Read Network configuration from environment variables
-	model.ExternalHost = os.Getenv("AGGREGATOR_EXTERNAL_HOST")
-	if model.ExternalHost == "" {
+	externalBase := strings.TrimSpace(os.Getenv("AGGREGATOR_EXTERNAL_HOST"))
+	if externalBase == "" {
 		logrus.Fatal("Environment variables AGGREGATOR_EXTERNAL_HOST must be set")
 	}
 	model.Protocol = "http"
+	model.ExternalHost = externalBase
+	if parsed, err := url.Parse(externalBase); err == nil && parsed.Scheme != "" {
+		model.Protocol = strings.ToLower(parsed.Scheme)
+		model.ExternalHost = parsed.Host
+	}
 
 	// Read Authorization configuration from environment variables
 	model.ClientId = os.Getenv("CLIENT_ID")
@@ -51,7 +57,9 @@ func main() {
 	model.ProvisionClientID = os.Getenv("PROVISION_CLIENT_ID")
 	model.ProvisionClientSecret = os.Getenv("PROVISION_CLIENT_SECRET")
 	model.ProvisionWebID = os.Getenv("PROVISION_WEBID")
+	model.ProvisionIDP = os.Getenv("PROVISION_IDP")
 	model.ProvisionAuthorizationServer = os.Getenv("PROVISION_AUTHORIZATION_SERVER")
+	model.IDPServerType = strings.ToLower(strings.TrimSpace(os.Getenv("IDP_SERVER_TYPE")))
 
 	allowedTypes := parseAllowedRegistrationTypes(os.Getenv("ALLOWED_REGISTRATION_TYPES"))
 	model.AllowedRegistrationTypes = allowedTypes
@@ -65,6 +73,9 @@ func main() {
 		if model.ProvisionWebID == "" {
 			logrus.Fatal("Environment variable PROVISION_WEBID must be set when provision registration is allowed")
 		}
+		if model.ProvisionIDP == "" {
+			logrus.Fatal("Environment variable PROVISION_IDP must be set when provision registration is allowed")
+		}
 		if model.ProvisionAuthorizationServer == "" {
 			logrus.Fatal("Environment variable PROVISION_AUTHORIZATION_SERVER must be set when provision registration is allowed")
 		}

containers/aggregator-server/model/registration.go

@@ -26,7 +26,6 @@ type RegistrationRequest struct {
 	State       string `json:"state,omitempty"`
 
 	// client_credentials flow
-	WebID        string `json:"webid,omitempty"`
 	ClientID     string `json:"client_id,omitempty"`
 	ClientSecret string `json:"client_secret,omitempty"`
 
@@ -39,7 +38,8 @@ type RegistrationRequest struct {
 type RegistrationResponse struct {
 	AggregatorID string `json:"aggregator_id"`
 	Aggregator   string `json:"aggregator,omitempty"`
-	WebID        string `json:"webid,omitempty"`
+	Subject      string `json:"subject,omitempty"`
+	IDP          string `json:"idp,omitempty"`
 }
 
 // AuthorizationCodeStartResponse represents the response for authorization_code start phase

containers/aggregator-server/model/vars.go

@@ -16,7 +16,9 @@ var AllowedRegistrationTypes []string
 var ProvisionClientID string
 var ProvisionClientSecret string
 var ProvisionWebID string
+var ProvisionIDP string
 var ProvisionAuthorizationServer string
+var IDPServerType string
 
 var Clientset kubernetes.Interface
 var DynamicClient *dynamic.DynamicClient

containers/aggregator-server/registration/namespace.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net"
 	"strings"
 	"time"
 
@@ -65,7 +66,7 @@ func deleteNamespaceResources(namespace string, ctx context.Context) error {
 }
 
 // deployAggregatorResources deploys the Egress UMA and Aggregator Instance
-func deployAggregatorResources(namespace string, tokenEndpoint string, accessToken string, refreshToken string, accessTokenExpiry string, ownerWebID string, authzServerURL string, ctx context.Context) error {
+func deployAggregatorResources(namespace string, tokenEndpoint string, accessToken string, refreshToken string, accessTokenExpiry string, ownerWebID string, ownerToken string, authzServerURL string, registrationType string, provisionWebID string, ctx context.Context) error {
 	replicas := int32(1)
 	useUMA := authzServerURL != ""
 	var err error
@@ -76,7 +77,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 			return fmt.Errorf("failed to ensure egress-uma RBAC: %w", err)
 		}
 
-		tokensPayload, err := buildTokensPayload(accessToken, refreshToken, accessTokenExpiry)
+		tokensPayload, err := buildTokensPayload(accessToken, refreshToken, accessTokenExpiry, ownerToken)
 		if err != nil {
 			return fmt.Errorf("failed to build egress-uma token payload: %w", err)
 		}
@@ -299,6 +300,8 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 		Resource: "ingressroutes",
 	}
 
+	hostMatch := hostWithoutPort(model.ExternalHost)
+
 	irName := "aggregator-instance-ingressroute"
 	obj := &unstructured.Unstructured{
 		Object: map[string]interface{}{
@@ -312,7 +315,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 				"entryPoints": []string{"web"},
 				"routes": []interface{}{
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && (Path(`/config/" + namespace + "`) || Path(`/config/" + namespace + "/`)) && Method(`OPTIONS`)",
+						"match": "Host(`" + hostMatch + "`) && (Path(`/config/" + namespace + "`) || Path(`/config/" + namespace + "/`)) && Method(`OPTIONS`)",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -324,7 +327,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 						"middlewares": buildCorsOnlyMiddlewares(namespace, true),
 					},
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && (Path(`/config/" + namespace + "`) || Path(`/config/" + namespace + "/`))",
+						"match": "Host(`" + hostMatch + "`) && (Path(`/config/" + namespace + "`) || Path(`/config/" + namespace + "/`))",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -336,7 +339,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 						"middlewares": buildIngressMiddlewares(useUMA, namespace, true),
 					},
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && PathPrefix(`/config/" + namespace + "/services`) && Method(`OPTIONS`)",
+						"match": "Host(`" + hostMatch + "`) && PathPrefix(`/config/" + namespace + "/services`) && Method(`OPTIONS`)",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -348,7 +351,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 						"middlewares": buildCorsOnlyMiddlewares(namespace, false),
 					},
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && PathPrefix(`/config/" + namespace + "/services`)",
+						"match": "Host(`" + hostMatch + "`) && PathPrefix(`/config/" + namespace + "/services`)",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -360,7 +363,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 						"middlewares": buildIngressMiddlewares(useUMA, namespace, false),
 					},
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && PathPrefix(`/config/" + namespace + "/transformations`) && Method(`OPTIONS`)",
+						"match": "Host(`" + hostMatch + "`) && PathPrefix(`/config/" + namespace + "/transformations`) && Method(`OPTIONS`)",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -372,7 +375,7 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 						"middlewares": buildCorsOnlyMiddlewares(namespace, true),
 					},
 					map[string]interface{}{
-						"match": "Host(`" + model.ExternalHost + "`) && PathPrefix(`/config/" + namespace + "/transformations`)",
+						"match": "Host(`" + hostMatch + "`) && PathPrefix(`/config/" + namespace + "/transformations`)",
 						"kind":  "Rule",
 						"services": []interface{}{
 							map[string]interface{}{
@@ -487,13 +490,14 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 								{ContainerPort: 5000},
 							},
 							Env: []corev1.EnvVar{
-								{Name: "AGGREGATOR_EXTERNAL_HOST", Value: model.ExternalHost},
+								{Name: "AGGREGATOR_EXTERNAL_HOST", Value: fmt.Sprintf("%s://%s", model.Protocol, model.ExternalHost)},
 								{Name: "CLIENT_ID", Value: model.ClientId},
 								{Name: "CLIENT_SECRET", Value: model.ClientSecret},
 								{Name: "LOG_LEVEL", Value: model.LogLevel.String()},
 								{Name: "USER_NAMESPACE", Value: namespace},
 								{Name: "USER_ID", Value: resolvedOwner},
 								{Name: "AS_URL", Value: authzServerURL},
+								{Name: "REGISTRATION_TYPE", Value: registrationType},
 								{Name: "DISABLE_AUTH", Value: fmt.Sprintf("%v", model.DisableAuth)},
 							},
 						},
@@ -503,6 +507,13 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 		},
 	}
 
+	if strings.TrimSpace(provisionWebID) != "" {
+		aggDeploy.Spec.Template.Spec.Containers[0].Env = append(
+			aggDeploy.Spec.Template.Spec.Containers[0].Env,
+			corev1.EnvVar{Name: "PROVISION_WEBID", Value: provisionWebID},
+		)
+	}
+
 	_, err = model.Clientset.AppsV1().Deployments(namespace).Create(ctx, aggDeploy, metav1.CreateOptions{})
 	if err != nil {
 		return fmt.Errorf("failed to create Aggregator Instance deployment: %w", err)
@@ -512,14 +523,14 @@ func deployAggregatorResources(namespace string, tokenEndpoint string, accessTok
 	return nil
 }
 
-func updateAggregatorInstanceDeployments(namespace string, accessToken string, refreshToken string, accessTokenExpiry string, ctx context.Context) error {
+func updateAggregatorInstanceDeployments(namespace string, accessToken string, refreshToken string, accessTokenExpiry string, ownerToken string, ctx context.Context) error {
 	if model.Clientset == nil {
 		logrus.Warn("Kubernetes client not initialized; skipping instance deployment updates")
 		return nil
 	}
 
 	if accessToken != "" || refreshToken != "" {
-		tokensPayload, err := buildTokensPayload(accessToken, refreshToken, accessTokenExpiry)
+		tokensPayload, err := buildTokensPayload(accessToken, refreshToken, accessTokenExpiry, ownerToken)
 		if err != nil {
 			return fmt.Errorf("failed to build egress-uma token payload: %w", err)
 		}
@@ -539,6 +550,21 @@ func updateAggregatorInstanceDeployments(namespace string, accessToken string, r
 	return nil
 }
 
+func hostWithoutPort(hostport string) string {
+	if hostport == "" {
+		return hostport
+	}
+	if host, _, err := net.SplitHostPort(hostport); err == nil {
+		return host
+	}
+	if strings.Count(hostport, ":") == 1 {
+		if idx := strings.LastIndex(hostport, ":"); idx > 0 {
+			return hostport[:idx]
+		}
+	}
+	return hostport
+}
+
 func buildIngressMiddlewares(useUMA bool, namespace string, includeStrip bool) []interface{} {
 	middlewares := make([]interface{}, 0, 3)
 	middlewares = append(middlewares, map[string]interface{}{
@@ -575,12 +601,15 @@ func buildCorsOnlyMiddlewares(namespace string, includeStrip bool) []interface{}
 	return middlewares
 }
 
-func buildTokensPayload(accessToken string, refreshToken string, accessTokenExpiry string) (map[string]string, error) {
+func buildTokensPayload(accessToken string, refreshToken string, accessTokenExpiry string, ownerToken string) (map[string]string, error) {
 	payload := map[string]string{
 		"access_token":        accessToken,
 		"refresh_token":       refreshToken,
 		"access_token_expiry": accessTokenExpiry,
 	}
+	if strings.TrimSpace(ownerToken) != "" {
+		payload["owner_token"] = ownerToken
+	}
 	data, err := json.Marshal(payload)
 	if err != nil {
 		return nil, err