2019-01-04 22:48:12 +01:00
|
|
|
// +build ignore
|
|
|
|
|
|
|
|
/*
|
2020-07-15 13:55:55 +02:00
|
|
|
* MinIO Cloud Storage, (C) 2019,2020 MinIO, Inc.
|
2019-01-04 22:48:12 +01:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"crypto/rand"
|
|
|
|
"encoding/base64"
|
2019-11-30 06:37:42 +01:00
|
|
|
"encoding/json"
|
2019-01-04 22:48:12 +01:00
|
|
|
"encoding/xml"
|
2019-11-13 11:30:54 +01:00
|
|
|
"errors"
|
2019-01-04 22:48:12 +01:00
|
|
|
"flag"
|
|
|
|
"fmt"
|
|
|
|
"log"
|
|
|
|
"net/http"
|
|
|
|
"net/url"
|
2020-06-24 16:49:09 +02:00
|
|
|
"strings"
|
2019-01-04 22:48:12 +01:00
|
|
|
"time"
|
|
|
|
|
|
|
|
"golang.org/x/oauth2"
|
|
|
|
|
2020-07-14 18:38:05 +02:00
|
|
|
"github.com/minio/minio-go/v7"
|
|
|
|
"github.com/minio/minio-go/v7/pkg/credentials"
|
2019-01-04 22:48:12 +01:00
|
|
|
"github.com/minio/minio/pkg/auth"
|
|
|
|
)
|
|
|
|
|
|
|
|
// AssumedRoleUser - The identifiers for the temporary security credentials that
|
|
|
|
// the operation returns. Please also see https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumedRoleUser
|
|
|
|
type AssumedRoleUser struct {
|
|
|
|
Arn string
|
|
|
|
AssumedRoleID string `xml:"AssumeRoleId"`
|
|
|
|
// contains filtered or unexported fields
|
|
|
|
}
|
|
|
|
|
|
|
|
// AssumeRoleWithWebIdentityResponse contains the result of successful AssumeRoleWithWebIdentity request.
|
|
|
|
type AssumeRoleWithWebIdentityResponse struct {
|
|
|
|
XMLName xml.Name `xml:"https://sts.amazonaws.com/doc/2011-06-15/ AssumeRoleWithWebIdentityResponse" json:"-"`
|
|
|
|
Result WebIdentityResult `xml:"AssumeRoleWithWebIdentityResult"`
|
|
|
|
ResponseMetadata struct {
|
|
|
|
RequestID string `xml:"RequestId,omitempty"`
|
|
|
|
} `xml:"ResponseMetadata,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// WebIdentityResult - Contains the response to a successful AssumeRoleWithWebIdentity
|
2019-04-09 20:39:42 +02:00
|
|
|
// request, including temporary credentials that can be used to make MinIO API requests.
|
2019-01-04 22:48:12 +01:00
|
|
|
type WebIdentityResult struct {
|
|
|
|
AssumedRoleUser AssumedRoleUser `xml:",omitempty"`
|
|
|
|
Audience string `xml:",omitempty"`
|
|
|
|
Credentials auth.Credentials `xml:",omitempty"`
|
|
|
|
PackedPolicySize int `xml:",omitempty"`
|
|
|
|
Provider string `xml:",omitempty"`
|
|
|
|
SubjectFromWebIdentityToken string `xml:",omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// Returns a base64 encoded random 32 byte string.
|
|
|
|
func randomState() string {
|
|
|
|
b := make([]byte, 32)
|
|
|
|
rand.Read(b)
|
|
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
|
|
|
}
|
|
|
|
|
|
|
|
var (
|
2019-11-30 06:37:42 +01:00
|
|
|
stsEndpoint string
|
|
|
|
configEndpoint string
|
|
|
|
clientID string
|
|
|
|
clientSec string
|
2020-06-24 16:49:09 +02:00
|
|
|
clientScopes string
|
2019-11-30 06:37:42 +01:00
|
|
|
port int
|
2019-01-04 22:48:12 +01:00
|
|
|
)
|
|
|
|
|
2019-11-30 06:37:42 +01:00
|
|
|
// DiscoveryDoc - parses the output from openid-configuration
|
2020-07-15 13:55:55 +02:00
|
|
|
// for example http://localhost:8080/auth/realms/minio/.well-known/openid-configuration
|
2019-11-30 06:37:42 +01:00
|
|
|
type DiscoveryDoc struct {
|
|
|
|
Issuer string `json:"issuer,omitempty"`
|
|
|
|
AuthEndpoint string `json:"authorization_endpoint,omitempty"`
|
|
|
|
TokenEndpoint string `json:"token_endpoint,omitempty"`
|
|
|
|
UserInfoEndpoint string `json:"userinfo_endpoint,omitempty"`
|
|
|
|
RevocationEndpoint string `json:"revocation_endpoint,omitempty"`
|
|
|
|
JwksURI string `json:"jwks_uri,omitempty"`
|
|
|
|
ResponseTypesSupported []string `json:"response_types_supported,omitempty"`
|
|
|
|
SubjectTypesSupported []string `json:"subject_types_supported,omitempty"`
|
|
|
|
IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported,omitempty"`
|
|
|
|
ScopesSupported []string `json:"scopes_supported,omitempty"`
|
|
|
|
TokenEndpointAuthMethods []string `json:"token_endpoint_auth_methods_supported,omitempty"`
|
|
|
|
ClaimsSupported []string `json:"claims_supported,omitempty"`
|
|
|
|
CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
func parseDiscoveryDoc(ustr string) (DiscoveryDoc, error) {
|
|
|
|
d := DiscoveryDoc{}
|
|
|
|
req, err := http.NewRequest(http.MethodGet, ustr, nil)
|
|
|
|
if err != nil {
|
|
|
|
return d, err
|
|
|
|
}
|
|
|
|
clnt := http.Client{
|
|
|
|
Transport: http.DefaultTransport,
|
|
|
|
}
|
|
|
|
resp, err := clnt.Do(req)
|
|
|
|
if err != nil {
|
|
|
|
return d, err
|
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
|
|
return d, err
|
|
|
|
}
|
|
|
|
dec := json.NewDecoder(resp.Body)
|
|
|
|
if err = dec.Decode(&d); err != nil {
|
|
|
|
return d, err
|
|
|
|
}
|
|
|
|
return d, nil
|
|
|
|
}
|
|
|
|
|
2019-01-04 22:48:12 +01:00
|
|
|
func init() {
|
|
|
|
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
2019-11-30 06:37:42 +01:00
|
|
|
flag.StringVar(&configEndpoint, "config-ep",
|
2020-07-15 13:55:55 +02:00
|
|
|
"http://localhost:8080/auth/realms/minio/.well-known/openid-configuration",
|
2019-11-30 06:37:42 +01:00
|
|
|
"OpenID discovery document endpoint")
|
2019-01-04 22:48:12 +01:00
|
|
|
flag.StringVar(&clientID, "cid", "", "Client ID")
|
2019-11-30 06:37:42 +01:00
|
|
|
flag.StringVar(&clientSec, "csec", "", "Client Secret")
|
2020-06-24 16:49:09 +02:00
|
|
|
flag.StringVar(&clientScopes, "cscopes", "openid", "Client Scopes")
|
2019-10-23 07:59:13 +02:00
|
|
|
flag.IntVar(&port, "port", 8080, "Port")
|
2019-01-04 22:48:12 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
func main() {
|
|
|
|
flag.Parse()
|
2019-11-30 06:37:42 +01:00
|
|
|
if clientID == "" || clientSec == "" {
|
2019-01-04 22:48:12 +01:00
|
|
|
flag.PrintDefaults()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-11-30 06:37:42 +01:00
|
|
|
ddoc, err := parseDiscoveryDoc(configEndpoint)
|
|
|
|
if err != nil {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Errorf("Failed to parse OIDC discovery document %s", err))
|
2019-11-30 06:37:42 +01:00
|
|
|
fmt.Println(err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-07-15 13:55:55 +02:00
|
|
|
scopes := ddoc.ScopesSupported
|
2020-06-24 16:49:09 +02:00
|
|
|
if clientScopes != "" {
|
2020-07-15 13:55:55 +02:00
|
|
|
scopes = strings.Split(clientScopes, ",")
|
2020-06-24 16:49:09 +02:00
|
|
|
}
|
|
|
|
|
2019-01-04 22:48:12 +01:00
|
|
|
ctx := context.Background()
|
|
|
|
|
|
|
|
config := oauth2.Config{
|
|
|
|
ClientID: clientID,
|
2019-11-30 06:37:42 +01:00
|
|
|
ClientSecret: clientSec,
|
2019-01-04 22:48:12 +01:00
|
|
|
Endpoint: oauth2.Endpoint{
|
2019-11-30 06:37:42 +01:00
|
|
|
AuthURL: ddoc.AuthEndpoint,
|
|
|
|
TokenURL: ddoc.TokenEndpoint,
|
2019-01-04 22:48:12 +01:00
|
|
|
},
|
2019-11-30 06:37:42 +01:00
|
|
|
RedirectURL: fmt.Sprintf("http://localhost:%d/oauth2/callback", port),
|
2020-06-24 16:49:09 +02:00
|
|
|
Scopes: scopes,
|
2019-01-04 22:48:12 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
state := randomState()
|
|
|
|
|
|
|
|
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Printf("%s %s", r.Method, r.RequestURI)
|
|
|
|
if r.RequestURI != "/" {
|
|
|
|
http.NotFound(w, r)
|
|
|
|
return
|
|
|
|
}
|
2019-01-04 22:48:12 +01:00
|
|
|
http.Redirect(w, r, config.AuthCodeURL(state), http.StatusFound)
|
|
|
|
})
|
|
|
|
|
|
|
|
http.HandleFunc("/oauth2/callback", func(w http.ResponseWriter, r *http.Request) {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Printf("%s %s", r.Method, r.RequestURI)
|
2019-01-04 22:48:12 +01:00
|
|
|
if r.URL.Query().Get("state") != state {
|
|
|
|
http.Error(w, "state did not match", http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-11-13 11:30:54 +01:00
|
|
|
getWebTokenExpiry := func() (*credentials.WebIdentityToken, error) {
|
|
|
|
oauth2Token, err := config.Exchange(ctx, r.URL.Query().Get("code"))
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if !oauth2Token.Valid() {
|
|
|
|
return nil, errors.New("invalid token")
|
|
|
|
}
|
|
|
|
|
|
|
|
return &credentials.WebIdentityToken{
|
|
|
|
Token: oauth2Token.Extra("id_token").(string),
|
|
|
|
Expiry: int(oauth2Token.Expiry.Sub(time.Now().UTC()).Seconds()),
|
|
|
|
}, nil
|
|
|
|
}
|
2019-11-30 06:37:42 +01:00
|
|
|
|
2019-11-13 11:30:54 +01:00
|
|
|
sts, err := credentials.NewSTSWebIdentity(stsEndpoint, getWebTokenExpiry)
|
2019-01-04 22:48:12 +01:00
|
|
|
if err != nil {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Errorf("Could not get STS credentials: %s", err))
|
2019-11-13 11:30:54 +01:00
|
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
2019-01-04 22:48:12 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-11-13 11:30:54 +01:00
|
|
|
opts := &minio.Options{
|
|
|
|
Creds: sts,
|
|
|
|
BucketLookup: minio.BucketLookupAuto,
|
|
|
|
}
|
2019-01-04 22:48:12 +01:00
|
|
|
|
2019-11-13 11:30:54 +01:00
|
|
|
u, err := url.Parse(stsEndpoint)
|
|
|
|
if err != nil {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Errorf("Failed to parse STS Endpoint: %s", err))
|
2019-11-13 11:30:54 +01:00
|
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
2019-01-04 22:48:12 +01:00
|
|
|
|
2020-10-24 20:16:59 +02:00
|
|
|
clnt, err := minio.New(u.Host, opts)
|
2019-11-13 11:30:54 +01:00
|
|
|
if err != nil {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Errorf("Error while initializing Minio client, %s", err))
|
2019-11-13 11:30:54 +01:00
|
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
2020-10-24 20:16:59 +02:00
|
|
|
buckets, err := clnt.ListBuckets(r.Context())
|
2019-11-13 11:30:54 +01:00
|
|
|
if err != nil {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Errorf("Error while listing buckets, %s", err))
|
2019-11-13 11:30:54 +01:00
|
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
2020-03-14 06:58:53 +01:00
|
|
|
creds, _ := sts.Get()
|
|
|
|
|
|
|
|
bucketNames := []string{}
|
|
|
|
|
2019-11-13 11:30:54 +01:00
|
|
|
for _, bucket := range buckets {
|
2020-03-14 06:58:53 +01:00
|
|
|
log.Println(fmt.Sprintf("Bucket discovered: %s", bucket.Name))
|
|
|
|
bucketNames = append(bucketNames, bucket.Name)
|
|
|
|
}
|
|
|
|
response := make(map[string]interface{})
|
|
|
|
response["credentials"] = creds
|
|
|
|
response["buckets"] = bucketNames
|
|
|
|
c, err := json.MarshalIndent(response, "", "\t")
|
|
|
|
if err != nil {
|
|
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
|
|
return
|
2019-01-04 22:48:12 +01:00
|
|
|
}
|
2020-03-14 06:58:53 +01:00
|
|
|
w.Write(c)
|
2019-01-04 22:48:12 +01:00
|
|
|
})
|
|
|
|
|
2019-10-23 07:59:13 +02:00
|
|
|
address := fmt.Sprintf("localhost:%v", port)
|
|
|
|
log.Printf("listening on http://%s/", address)
|
|
|
|
log.Fatal(http.ListenAndServe(address, nil))
|
2019-01-04 22:48:12 +01:00
|
|
|
}
|