Skip to content

Commit 2d6db37

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #13513 from stlaz/direct_oidc_config_refresh_tokens
AUTH-440: OIDC: refresh sessions with a refresh token if present
2 parents 0ae84d5 + fa1bed1 commit 2d6db37

45 files changed

Lines changed: 2974 additions & 489 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cmd/bridge/config/auth/authoptions.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"k8s.io/client-go/rest"
1414
"k8s.io/klog"
1515

16+
"github.com/openshift/console/cmd/bridge/config/session"
1617
"github.com/openshift/console/pkg/auth"
1718
"github.com/openshift/console/pkg/flags"
1819
"github.com/openshift/console/pkg/proxy"
@@ -72,12 +73,12 @@ func (c *AuthOptions) AddFlags(fs *flag.FlagSet) {
7273
}
7374

7475
func (c *AuthOptions) ApplyConfig(config *serverconfig.Auth) {
75-
setIfUnset(&c.AuthType, config.AuthType)
76-
setIfUnset(&c.ClientID, config.ClientID)
77-
setIfUnset(&c.IssuerURL, config.OIDCIssuer)
78-
setIfUnset(&c.ClientSecretFilePath, config.ClientSecretFile)
79-
setIfUnset(&c.CAFilePath, config.OAuthEndpointCAFile)
80-
setIfUnset(&c.LogoutRedirect, config.LogoutRedirect)
76+
serverconfig.SetIfUnset(&c.AuthType, config.AuthType)
77+
serverconfig.SetIfUnset(&c.ClientID, config.ClientID)
78+
serverconfig.SetIfUnset(&c.IssuerURL, config.OIDCIssuer)
79+
serverconfig.SetIfUnset(&c.ClientSecretFilePath, config.ClientSecretFile)
80+
serverconfig.SetIfUnset(&c.CAFilePath, config.OAuthEndpointCAFile)
81+
serverconfig.SetIfUnset(&c.LogoutRedirect, config.LogoutRedirect)
8182

8283
if c.InactivityTimeoutSeconds == 0 {
8384
c.InactivityTimeoutSeconds = config.InactivityTimeoutSeconds
@@ -88,7 +89,7 @@ func (c *AuthOptions) ApplyConfig(config *serverconfig.Auth) {
8889
}
8990
}
9091

91-
func (c *AuthOptions) Complete(k8sAuthType string) (*CompletedOptions, error) {
92+
func (c *AuthOptions) Complete() (*CompletedOptions, error) {
9293
// default values before running validation
9394
if len(c.AuthType) == 0 {
9495
c.AuthType = "openshift"
@@ -99,7 +100,7 @@ func (c *AuthOptions) Complete(k8sAuthType string) (*CompletedOptions, error) {
99100
c.InactivityTimeoutSeconds = 0
100101
}
101102

102-
if errs := c.Validate(k8sAuthType); len(errs) > 0 {
103+
if errs := c.Validate(); len(errs) > 0 {
103104
return nil, utilerrors.NewAggregate(errs)
104105
}
105106

@@ -141,7 +142,7 @@ func (c *AuthOptions) Complete(k8sAuthType string) (*CompletedOptions, error) {
141142
}, nil
142143
}
143144

144-
func (c *AuthOptions) Validate(k8sAuthType string) []error {
145+
func (c *AuthOptions) Validate() []error {
145146
var errs []error
146147

147148
switch c.AuthType {
@@ -179,7 +180,7 @@ func (c *AuthOptions) Validate(k8sAuthType string) []error {
179180
}
180181
}
181182

182-
switch k8sAuthType {
183+
switch c.AuthType {
183184
case "oidc", "openshift":
184185
default:
185186
if c.InactivityTimeoutSeconds > 0 {
@@ -194,6 +195,7 @@ func (c *completedOptions) ApplyTo(
194195
srv *server.Server,
195196
k8sEndpoint *url.URL,
196197
caCertFilePath string,
198+
sessionConfig *session.CompletedOptions,
197199
) error {
198200
srv.InactivityTimeout = c.InactivityTimeoutSeconds
199201
srv.LogoutRedirect = c.LogoutRedirectURL
@@ -204,6 +206,7 @@ func (c *completedOptions) ApplyTo(
204206
k8sEndpoint,
205207
caCertFilePath,
206208
srv.InternalProxiedK8SClientConfig,
209+
sessionConfig,
207210
)
208211

209212
return err
@@ -214,6 +217,7 @@ func (c *completedOptions) getAuthenticator(
214217
k8sEndpoint *url.URL,
215218
caCertFilePath string,
216219
k8sClientConfig *rest.Config,
220+
sessionConfig *session.CompletedOptions,
217221
) (*auth.Authenticator, error) {
218222

219223
if c.AuthType == "disabled" {
@@ -268,9 +272,11 @@ func (c *completedOptions) getAuthenticator(
268272
ErrorURL: authLoginErrorEndpoint,
269273
SuccessURL: authLoginSuccessEndpoint,
270274

271-
CookiePath: cookiePath,
272-
RefererPath: refererPath,
273-
SecureCookies: useSecureCookies,
275+
CookiePath: cookiePath,
276+
RefererPath: refererPath,
277+
SecureCookies: useSecureCookies,
278+
CookieEncryptionKey: sessionConfig.CookieEncryptionKey,
279+
CookieAuthenticationKey: sessionConfig.CookieAuthenticationKey,
274280

275281
K8sConfig: k8sClientConfig,
276282
}
@@ -282,9 +288,3 @@ func (c *completedOptions) getAuthenticator(
282288

283289
return authenticator, nil
284290
}
285-
286-
func setIfUnset(flagVal *string, val string) {
287-
if len(*flagVal) == 0 {
288-
*flagVal = val
289-
}
290-
}

‎cmd/bridge/config/session/sessionoptions.go‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package session
2+
3+
import (
4+
"flag"
5+
"fmt"
6+
"os"
7+
8+
utilerrors "k8s.io/apimachinery/pkg/util/errors"
9+
10+
"github.com/openshift/console/pkg/serverconfig"
11+
)
12+
13+
type SessionOptions struct {
14+
CookieEncryptionKeyPath string
15+
CookieAuthenticationKeyPath string
16+
}
17+
18+
type CompletedOptions struct {
19+
*completedOptions
20+
}
21+
22+
type completedOptions struct {
23+
CookieEncryptionKey []byte
24+
CookieAuthenticationKey []byte
25+
}
26+
27+
func NewSessionOptions() *SessionOptions {
28+
return &SessionOptions{
29+
CookieEncryptionKeyPath: "",
30+
CookieAuthenticationKeyPath: "",
31+
}
32+
}
33+
34+
func (opts *SessionOptions) AddFlags(fs *flag.FlagSet) {
35+
fs.StringVar(&opts.CookieEncryptionKeyPath, "cookie-encryption-key-file", "", "Encryption key used to encrypt cookies. Must be set when --user-auth is 'oidc'.")
36+
fs.StringVar(&opts.CookieAuthenticationKeyPath, "cookie-authentication-key-file", "", "Authentication key used to sign cookies. Must be set when --user-auth is 'oidc'.")
37+
}
38+
39+
func (opts *SessionOptions) ApplyConfig(config *serverconfig.Session) {
40+
serverconfig.SetIfUnset(&opts.CookieEncryptionKeyPath, config.CookieEncryptionKeyFile)
41+
serverconfig.SetIfUnset(&opts.CookieAuthenticationKeyPath, config.CookieAuthenticationKeyFile)
42+
}
43+
44+
func (opts *SessionOptions) Validate(userAuthType string) []error {
45+
var errs []error
46+
47+
switch userAuthType {
48+
case "oidc":
49+
if opts.CookieEncryptionKeyPath == "" || opts.CookieAuthenticationKeyPath == "" {
50+
errs = append(errs, fmt.Errorf("cookie-encryption-key-file and cookie-authentication-key-file must be set when --user-auth is 'oidc'"))
51+
}
52+
default:
53+
if opts.CookieEncryptionKeyPath != "" || opts.CookieAuthenticationKeyPath != "" {
54+
errs = append(errs, fmt.Errorf("cookie-encryption-key-file and cookie-authentication-key-file must not be set when --user-auth is not 'oidc'"))
55+
}
56+
}
57+
58+
return errs
59+
}
60+
61+
func (opts *SessionOptions) Complete(userAuthType string) (*CompletedOptions, error) {
62+
if errs := opts.Validate(userAuthType); len(errs) > 0 {
63+
return nil, utilerrors.NewAggregate(errs)
64+
}
65+
66+
completed := &completedOptions{}
67+
68+
if len(opts.CookieEncryptionKeyPath) > 0 {
69+
encKey, err := os.ReadFile(opts.CookieEncryptionKeyPath)
70+
if err != nil {
71+
return nil, fmt.Errorf("failed to open cookie encryption key file %q: %w", opts.CookieEncryptionKeyPath, err)
72+
}
73+
completed.CookieEncryptionKey = encKey
74+
}
75+
76+
if len(opts.CookieAuthenticationKeyPath) > 0 {
77+
authnKey, err := os.ReadFile(opts.CookieAuthenticationKeyPath)
78+
if err != nil {
79+
return nil, fmt.Errorf("failed to open cookie authentication key file %q: %w", opts.CookieAuthenticationKeyPath, err)
80+
}
81+
completed.CookieAuthenticationKey = authnKey
82+
}
83+
84+
return &CompletedOptions{
85+
completedOptions: completed,
86+
}, nil
87+
}

‎cmd/bridge/main.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"strings"
1515

1616
authopts "github.com/openshift/console/cmd/bridge/config/auth"
17+
"github.com/openshift/console/cmd/bridge/config/session"
1718
"github.com/openshift/console/pkg/auth"
1819
"github.com/openshift/console/pkg/flags"
1920
"github.com/openshift/console/pkg/knative"
@@ -66,6 +67,9 @@ func main() {
6667
authOptions := authopts.NewAuthOptions()
6768
authOptions.AddFlags(fs)
6869

70+
sessionOptions := session.NewSessionOptions()
71+
sessionOptions.AddFlags(fs)
72+
6973
// Define commandline / env / config options
7074
fs.String("config", "", "The YAML config file.")
7175

@@ -149,6 +153,7 @@ func main() {
149153
}
150154

151155
authOptions.ApplyConfig(&cfg.Auth)
156+
sessionOptions.ApplyConfig(&cfg.Session)
152157

153158
baseURL, err := flags.ValidateFlagIsURL("base-address", *fBaseAddress, true)
154159
flags.FatalIfFailed(err)
@@ -275,12 +280,18 @@ func main() {
275280
CopiedCSVsDisabled: *fCopiedCSVsDisabled,
276281
}
277282

278-
completedAuthnOptions, err := authOptions.Complete(*fK8sAuth)
283+
completedAuthnOptions, err := authOptions.Complete()
279284
if err != nil {
280285
klog.Fatalf("failed to complete authentication options: %v", err)
281286
os.Exit(1)
282287
}
283288

289+
completedSessionOptions, err := sessionOptions.Complete(completedAuthnOptions.AuthType)
290+
if err != nil {
291+
klog.Fatalf("failed to complete session options: %v", err)
292+
os.Exit(1)
293+
}
294+
284295
// if !in-cluster (dev) we should not pass these values to the frontend
285296
// is used by catalog-utils.ts
286297
if *fK8sMode == "in-cluster" {
@@ -571,7 +582,7 @@ func main() {
571582
caCertFilePath = k8sInClusterCA
572583
}
573584

574-
if err := completedAuthnOptions.ApplyTo(srv, k8sEndpoint, caCertFilePath); err != nil {
585+
if err := completedAuthnOptions.ApplyTo(srv, k8sEndpoint, caCertFilePath, completedSessionOptions); err != nil {
575586
klog.Fatalf("failed to apply configuration to server: %v", err)
576587
os.Exit(1)
577588
}

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ require (
1111
github.com/devfile/registry-support/index/generator v0.0.0-20231020181239-1168591f0b4e
1212
github.com/devfile/registry-support/registry-library v0.0.0-20231020181239-1168591f0b4e
1313
github.com/golang/mock v1.6.0
14+
github.com/gorilla/sessions v1.2.2
1415
github.com/gorilla/websocket v1.4.2
1516
github.com/graph-gophers/graphql-go v1.5.0
1617
github.com/openshift/api v3.9.0+incompatible
@@ -97,6 +98,7 @@ require (
9798
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
9899
github.com/google/uuid v1.3.1 // indirect
99100
github.com/gorilla/mux v1.8.0 // indirect
101+
github.com/gorilla/securecookie v1.1.2 // indirect
100102
github.com/gosuri/uitable v0.0.4 // indirect
101103
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
102104
github.com/h2non/filetype v1.1.1 // indirect

‎go.sum‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -661,6 +661,10 @@ github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2z
661661
github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
662662
github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
663663
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
664+
github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
665+
github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
666+
github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
667+
github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
664668
github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
665669
github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
666670
github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=

0 commit comments

Comments
 (0)