2016-12-26 19:21:23 +01:00
|
|
|
/*
|
2019-04-09 20:39:42 +02:00
|
|
|
* MinIO Cloud Storage, (C) 2015, 2016, 2017, 2018 MinIO, Inc.
|
2016-12-26 19:21:23 +01:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
package auth
|
2016-12-26 19:21:23 +01:00
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/rand"
|
2017-08-24 00:59:37 +02:00
|
|
|
"crypto/subtle"
|
2016-12-26 19:21:23 +01:00
|
|
|
"encoding/base64"
|
2019-02-28 02:46:55 +01:00
|
|
|
"encoding/json"
|
|
|
|
"errors"
|
2017-10-31 19:54:32 +01:00
|
|
|
"fmt"
|
2019-11-29 14:27:54 +01:00
|
|
|
"strconv"
|
2018-10-31 23:07:20 +01:00
|
|
|
"strings"
|
2018-10-09 23:00:01 +02:00
|
|
|
"time"
|
|
|
|
|
|
|
|
jwtgo "github.com/dgrijalva/jwt-go"
|
2016-12-26 19:21:23 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2019-04-09 20:39:42 +02:00
|
|
|
// Minimum length for MinIO access key.
|
2018-02-02 04:43:30 +01:00
|
|
|
accessKeyMinLen = 3
|
2017-06-06 00:18:03 +02:00
|
|
|
|
2019-04-09 20:39:42 +02:00
|
|
|
// Maximum length for MinIO access key.
|
2017-08-04 05:03:37 +02:00
|
|
|
// There is no max length enforcement for access keys
|
2017-06-06 00:18:03 +02:00
|
|
|
accessKeyMaxLen = 20
|
|
|
|
|
2019-04-09 20:39:42 +02:00
|
|
|
// Minimum length for MinIO secret key for both server and gateway mode.
|
2017-06-06 00:18:03 +02:00
|
|
|
secretKeyMinLen = 8
|
|
|
|
|
2019-04-09 20:39:42 +02:00
|
|
|
// Maximum secret key length for MinIO, this
|
2017-06-06 00:18:03 +02:00
|
|
|
// is used when autogenerating new credentials.
|
2017-08-04 05:03:37 +02:00
|
|
|
// There is no max length enforcement for secret keys
|
|
|
|
secretKeyMaxLen = 40
|
2017-06-06 00:18:03 +02:00
|
|
|
|
|
|
|
// Alpha numeric table used for generating access keys.
|
|
|
|
alphaNumericTable = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
|
|
|
|
|
|
|
// Total length of the alpha numeric table.
|
|
|
|
alphaNumericTableLen = byte(len(alphaNumericTable))
|
2016-12-26 19:21:23 +01:00
|
|
|
)
|
|
|
|
|
2017-06-06 00:18:03 +02:00
|
|
|
// Common errors generated for access and secret key validation.
|
2017-03-16 08:16:06 +01:00
|
|
|
var (
|
2017-10-31 19:54:32 +01:00
|
|
|
ErrInvalidAccessKeyLength = fmt.Errorf("access key must be minimum %v or more characters long", accessKeyMinLen)
|
|
|
|
ErrInvalidSecretKeyLength = fmt.Errorf("secret key must be minimum %v or more characters long", secretKeyMinLen)
|
2017-03-16 08:16:06 +01:00
|
|
|
)
|
2017-03-16 20:21:58 +01:00
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
// IsAccessKeyValid - validate access key for right length.
|
|
|
|
func IsAccessKeyValid(accessKey string) bool {
|
2017-08-04 05:03:37 +02:00
|
|
|
return len(accessKey) >= accessKeyMinLen
|
2016-12-26 19:21:23 +01:00
|
|
|
}
|
|
|
|
|
2018-11-10 00:48:24 +01:00
|
|
|
// IsSecretKeyValid - validate secret key for right length.
|
|
|
|
func IsSecretKeyValid(secretKey string) bool {
|
2017-08-04 05:03:37 +02:00
|
|
|
return len(secretKey) >= secretKeyMinLen
|
2016-12-26 19:21:23 +01:00
|
|
|
}
|
|
|
|
|
2019-10-23 07:59:13 +02:00
|
|
|
// Default access and secret keys.
|
|
|
|
const (
|
|
|
|
DefaultAccessKey = "minioadmin"
|
|
|
|
DefaultSecretKey = "minioadmin"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Default access credentials
|
|
|
|
var (
|
|
|
|
DefaultCredentials = Credentials{
|
|
|
|
AccessKey: DefaultAccessKey,
|
|
|
|
SecretKey: DefaultSecretKey,
|
|
|
|
}
|
|
|
|
)
|
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
// Credentials holds access and secret keys.
|
|
|
|
type Credentials struct {
|
2018-10-09 23:00:01 +02:00
|
|
|
AccessKey string `xml:"AccessKeyId" json:"accessKey,omitempty"`
|
|
|
|
SecretKey string `xml:"SecretAccessKey" json:"secretKey,omitempty"`
|
|
|
|
Expiration time.Time `xml:"Expiration" json:"expiration,omitempty"`
|
|
|
|
SessionToken string `xml:"SessionToken" json:"sessionToken,omitempty"`
|
|
|
|
Status string `xml:"-" json:"status,omitempty"`
|
2020-03-17 18:36:13 +01:00
|
|
|
ParentUser string `xml:"-" json:"parentUser,omitempty"`
|
2020-05-20 20:33:35 +02:00
|
|
|
Groups []string `xml:"-" json:"groups,omitempty"`
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
|
|
|
|
2019-10-23 07:59:13 +02:00
|
|
|
func (cred Credentials) String() string {
|
|
|
|
var s strings.Builder
|
|
|
|
s.WriteString(cred.AccessKey)
|
|
|
|
s.WriteString(":")
|
|
|
|
s.WriteString(cred.SecretKey)
|
|
|
|
if cred.SessionToken != "" {
|
|
|
|
s.WriteString("\n")
|
|
|
|
s.WriteString(cred.SessionToken)
|
|
|
|
}
|
2020-04-14 20:28:56 +02:00
|
|
|
if !cred.Expiration.IsZero() && !cred.Expiration.Equal(timeSentinel) {
|
2019-10-23 07:59:13 +02:00
|
|
|
s.WriteString("\n")
|
|
|
|
s.WriteString(cred.Expiration.String())
|
|
|
|
}
|
|
|
|
return s.String()
|
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
// IsExpired - returns whether Credential is expired or not.
|
|
|
|
func (cred Credentials) IsExpired() bool {
|
2020-04-14 20:28:56 +02:00
|
|
|
if cred.Expiration.IsZero() || cred.Expiration.Equal(timeSentinel) {
|
2018-10-09 23:00:01 +02:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return cred.Expiration.Before(time.Now().UTC())
|
2017-01-27 01:51:51 +01:00
|
|
|
}
|
|
|
|
|
2019-12-19 23:21:21 +01:00
|
|
|
// IsTemp - returns whether credential is temporary or not.
|
|
|
|
func (cred Credentials) IsTemp() bool {
|
2020-04-28 21:49:56 +02:00
|
|
|
return cred.SessionToken != "" && !cred.Expiration.IsZero() && !cred.Expiration.Equal(timeSentinel)
|
2020-03-17 18:36:13 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsServiceAccount - returns whether credential is a service account or not
|
|
|
|
func (cred Credentials) IsServiceAccount() bool {
|
2020-04-14 20:28:56 +02:00
|
|
|
return cred.ParentUser != "" && (cred.Expiration.IsZero() || cred.Expiration.Equal(timeSentinel))
|
2019-12-19 23:21:21 +01:00
|
|
|
}
|
|
|
|
|
2017-03-16 08:16:06 +01:00
|
|
|
// IsValid - returns whether credential is valid or not.
|
2017-10-31 19:54:32 +01:00
|
|
|
func (cred Credentials) IsValid() bool {
|
2018-10-09 23:00:01 +02:00
|
|
|
// Verify credentials if its enabled or not set.
|
2019-10-23 07:59:13 +02:00
|
|
|
if cred.Status == "off" {
|
|
|
|
return false
|
2018-10-09 23:00:01 +02:00
|
|
|
}
|
2019-10-23 07:59:13 +02:00
|
|
|
return IsAccessKeyValid(cred.AccessKey) && IsSecretKeyValid(cred.SecretKey) && !cred.IsExpired()
|
2017-03-16 00:30:34 +01:00
|
|
|
}
|
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
// Equal - returns whether two credentials are equal or not.
|
|
|
|
func (cred Credentials) Equal(ccred Credentials) bool {
|
2017-03-16 08:16:06 +01:00
|
|
|
if !ccred.IsValid() {
|
|
|
|
return false
|
2017-01-27 01:51:51 +01:00
|
|
|
}
|
2018-10-09 23:00:01 +02:00
|
|
|
return (cred.AccessKey == ccred.AccessKey && subtle.ConstantTimeCompare([]byte(cred.SecretKey), []byte(ccred.SecretKey)) == 1 &&
|
|
|
|
subtle.ConstantTimeCompare([]byte(cred.SessionToken), []byte(ccred.SessionToken)) == 1)
|
2016-12-26 19:21:23 +01:00
|
|
|
}
|
2016-12-27 17:28:10 +01:00
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
var timeSentinel = time.Unix(0, 0).UTC()
|
|
|
|
|
2019-11-29 14:27:54 +01:00
|
|
|
// ErrInvalidDuration invalid token expiry
|
|
|
|
var ErrInvalidDuration = errors.New("invalid token expiry")
|
|
|
|
|
|
|
|
// ExpToInt64 - convert input interface value to int64.
|
|
|
|
func ExpToInt64(expI interface{}) (expAt int64, err error) {
|
2019-02-28 02:46:55 +01:00
|
|
|
switch exp := expI.(type) {
|
2019-11-29 14:27:54 +01:00
|
|
|
case string:
|
|
|
|
expAt, err = strconv.ParseInt(exp, 10, 64)
|
2019-02-28 02:46:55 +01:00
|
|
|
case float64:
|
2019-11-29 14:27:54 +01:00
|
|
|
expAt, err = int64(exp), nil
|
2019-02-28 02:46:55 +01:00
|
|
|
case int64:
|
2019-11-29 14:27:54 +01:00
|
|
|
expAt, err = exp, nil
|
|
|
|
case int:
|
|
|
|
expAt, err = int64(exp), nil
|
|
|
|
case uint64:
|
|
|
|
expAt, err = int64(exp), nil
|
|
|
|
case uint:
|
|
|
|
expAt, err = int64(exp), nil
|
2019-02-28 02:46:55 +01:00
|
|
|
case json.Number:
|
|
|
|
expAt, err = exp.Int64()
|
|
|
|
case time.Duration:
|
2019-11-29 14:27:54 +01:00
|
|
|
expAt, err = time.Now().UTC().Add(exp).Unix(), nil
|
2019-02-28 02:46:55 +01:00
|
|
|
case nil:
|
2019-11-29 14:27:54 +01:00
|
|
|
expAt, err = 0, nil
|
2019-02-28 02:46:55 +01:00
|
|
|
default:
|
2019-11-29 14:27:54 +01:00
|
|
|
expAt, err = 0, ErrInvalidDuration
|
|
|
|
}
|
|
|
|
if expAt < 0 {
|
|
|
|
return 0, ErrInvalidDuration
|
2019-02-28 02:46:55 +01:00
|
|
|
}
|
2019-11-29 14:27:54 +01:00
|
|
|
return expAt, err
|
2019-02-28 02:46:55 +01:00
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
// GetNewCredentialsWithMetadata generates and returns new credential with expiry.
|
|
|
|
func GetNewCredentialsWithMetadata(m map[string]interface{}, tokenSecret string) (cred Credentials, err error) {
|
2018-04-20 02:24:43 +02:00
|
|
|
readBytes := func(size int) (data []byte, err error) {
|
2017-10-31 19:54:32 +01:00
|
|
|
data = make([]byte, size)
|
2018-04-20 02:24:43 +02:00
|
|
|
var n int
|
|
|
|
if n, err = rand.Read(data); err != nil {
|
|
|
|
return nil, err
|
2017-10-31 19:54:32 +01:00
|
|
|
} else if n != size {
|
2018-04-20 02:24:43 +02:00
|
|
|
return nil, fmt.Errorf("Not enough data. Expected to read: %v bytes, got: %v bytes", size, n)
|
2017-10-31 19:54:32 +01:00
|
|
|
}
|
2018-04-20 02:24:43 +02:00
|
|
|
return data, nil
|
2016-12-27 17:28:10 +01:00
|
|
|
}
|
2017-02-07 21:51:43 +01:00
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
// Generate access key.
|
2018-04-20 02:24:43 +02:00
|
|
|
keyBytes, err := readBytes(accessKeyMaxLen)
|
|
|
|
if err != nil {
|
|
|
|
return cred, err
|
|
|
|
}
|
2017-10-31 19:54:32 +01:00
|
|
|
for i := 0; i < accessKeyMaxLen; i++ {
|
2017-03-16 08:16:06 +01:00
|
|
|
keyBytes[i] = alphaNumericTable[keyBytes[i]%alphaNumericTableLen]
|
|
|
|
}
|
2017-10-31 19:54:32 +01:00
|
|
|
cred.AccessKey = string(keyBytes)
|
2017-02-07 21:51:43 +01:00
|
|
|
|
2017-03-16 08:16:06 +01:00
|
|
|
// Generate secret key.
|
2018-04-20 02:24:43 +02:00
|
|
|
keyBytes, err = readBytes(secretKeyMaxLen)
|
|
|
|
if err != nil {
|
|
|
|
return cred, err
|
|
|
|
}
|
2019-11-29 14:27:54 +01:00
|
|
|
cred.SecretKey = strings.Replace(string([]byte(base64.StdEncoding.EncodeToString(keyBytes))[:secretKeyMaxLen]),
|
|
|
|
"/", "+", -1)
|
2019-10-23 07:59:13 +02:00
|
|
|
cred.Status = "on"
|
2018-10-09 23:00:01 +02:00
|
|
|
|
2020-03-17 18:36:13 +01:00
|
|
|
if tokenSecret == "" {
|
|
|
|
cred.Expiration = timeSentinel
|
|
|
|
return cred, nil
|
|
|
|
}
|
|
|
|
|
2019-11-29 14:27:54 +01:00
|
|
|
expiry, err := ExpToInt64(m["exp"])
|
2019-02-28 02:46:55 +01:00
|
|
|
if err != nil {
|
|
|
|
return cred, err
|
|
|
|
}
|
2018-10-09 23:00:01 +02:00
|
|
|
|
|
|
|
m["accessKey"] = cred.AccessKey
|
|
|
|
jwt := jwtgo.NewWithClaims(jwtgo.SigningMethodHS512, jwtgo.MapClaims(m))
|
|
|
|
|
2019-08-09 00:44:57 +02:00
|
|
|
cred.Expiration = time.Unix(expiry, 0).UTC()
|
2018-10-09 23:00:01 +02:00
|
|
|
cred.SessionToken, err = jwt.SignedString([]byte(tokenSecret))
|
|
|
|
if err != nil {
|
|
|
|
return cred, err
|
|
|
|
}
|
2017-02-07 21:51:43 +01:00
|
|
|
|
2018-04-20 02:24:43 +02:00
|
|
|
return cred, nil
|
2017-08-04 05:03:37 +02:00
|
|
|
}
|
|
|
|
|
2018-10-09 23:00:01 +02:00
|
|
|
// GetNewCredentials generates and returns new credential.
|
|
|
|
func GetNewCredentials() (cred Credentials, err error) {
|
|
|
|
return GetNewCredentialsWithMetadata(map[string]interface{}{}, "")
|
|
|
|
}
|
|
|
|
|
2017-10-31 19:54:32 +01:00
|
|
|
// CreateCredentials returns new credential with the given access key and secret key.
|
|
|
|
// Error is returned if given access key or secret key are invalid length.
|
|
|
|
func CreateCredentials(accessKey, secretKey string) (cred Credentials, err error) {
|
|
|
|
if !IsAccessKeyValid(accessKey) {
|
|
|
|
return cred, ErrInvalidAccessKeyLength
|
|
|
|
}
|
2018-11-10 00:48:24 +01:00
|
|
|
if !IsSecretKeyValid(secretKey) {
|
2017-10-31 19:54:32 +01:00
|
|
|
return cred, ErrInvalidSecretKeyLength
|
|
|
|
}
|
|
|
|
cred.AccessKey = accessKey
|
|
|
|
cred.SecretKey = secretKey
|
2018-10-09 23:00:01 +02:00
|
|
|
cred.Expiration = timeSentinel
|
2019-10-23 07:59:13 +02:00
|
|
|
cred.Status = "on"
|
2017-10-31 19:54:32 +01:00
|
|
|
return cred, nil
|
2016-12-27 17:28:10 +01:00
|
|
|
}
|