Documentation
¶
Overview ¶
Package cbauthimpl contains internal implementation details of cbauth. It's APIs are subject to change without notice.
Index ¶
- Constants
- Variables
- func GetClientCertAuthType(s *Svc) (tls.ClientAuthType, error)
- func GetClusterUuid(s *Svc) (string, error)
- func GetCreds(s *Svc, host string, port int) (memcachedUser, user, pwd string, err error)
- func GetNodeUuid(s *Svc) (string, error)
- func GetUserBuckets(s *Svc, user, domain, extras string) ([]string, error)
- func GetUserUuid(s *Svc, user, domain string) (string, error)
- func ImportEncryptionKeys(s *Svc, dekPaths []string, dataType KeyDataType, timeout int) error
- func IsAuthTokenPresent(Hdr httpreq.HttpHeader) bool
- func IsJwtPresent(Hdr httpreq.HttpHeader) bool
- func KeysDropComplete(s *Svc, dataType KeyDataType, dropErr error) error
- func RegisterConfigRefreshCallback(s *Svc, cb ConfigRefreshCallback) error
- func RegisterEncryptionKeysCallbacks(s *Svc, refreshKeysCallback RefreshKeysCallback, ...) error
- func RegisterTLSRefreshCallback(s *Svc, callback TLSRefreshCallback) error
- func ResetSvc(s *Svc, staleErr error)
- func SetExpectedClusterUuid(s *Svc, clusterUUID string) error
- func SetTransport(s *Svc, rt http.RoundTripper)
- type AWSPayload
- type Author
- type AzureADPayload
- type AzureManagedPayload
- type AzureSASPayload
- type AzureSharedPayload
- type Cache
- type CacheConfig
- type CacheExt
- type CacheParams
- type CacheStats
- type CachesStats
- type ClusterEncryptionConfig
- type ConfigRefreshCallback
- type CouchbasePayload
- type Credential
- type CredentialGuardrails
- type CredentialMeta
- type CredentialType
- type CredsImpl
- func MaybeGetCredsFromCert(s *Svc, tlsState *tls.ConnectionState) (*CredsImpl, error)
- func VerifyOnBehalf(s *Svc, creds *CredsImpl, onBehalfUser, onBehalfDomain string, ...) (*CredsImpl, error)
- func VerifyOnServer(s *Svc, reqHeaders httpreq.HttpHeader) (*CredsImpl, error)
- func VerifyPassword(s *Svc, user, password string) (*CredsImpl, error)
- func (c *CredsImpl) Domain() string
- func (c *CredsImpl) Expiry() int64
- func (c *CredsImpl) Extras() string
- func (c *CredsImpl) GetBuckets() ([]string, error)
- func (c *CredsImpl) GetCredential(id string) (*Credential, error)
- func (c *CredsImpl) IsAllowed(permission string) (bool, error)
- func (c *CredsImpl) IsAllowedInternal(permission string) (bool, error)
- func (c *CredsImpl) Name() string
- func (c *CredsImpl) User() (name, domain string)
- type DropKeysCallback
- type DropKeysData
- type EaRKey
- type EncrKeysInfo
- type GCPPayload
- type GetInUseKeysCallback
- type GuardrailStatus
- type HTTPPayload
- type KeyDataType
- type KeysCache
- type Node
- type RefreshKeysCallback
- type ReqCache
- type ReqParams
- type Svc
- func (s *Svc) DropKeys(c *DropKeysData, outparam *Void) error
- func (s *Svc) GetInUseKeys(c *KeyDataType, outparam *[]string) error
- func (s *Svc) GetStats(Void, outparam *CachesStats) error
- func (s *Svc) Heartbeat(Void, outparam *Void) error
- func (s *Svc) SetConnectInfo(hostport, user, password string, heartbeatInterval, heartbeatWait int)
- func (s *Svc) SynchronizeKeyFiles(c *KeyDataType, outparam *Void) error
- func (s *Svc) UpdateDB(c *Cache, outparam *bool) error
- func (s *Svc) UpdateDBExt(c *CacheExt, outparam *bool) error
- func (s *Svc) UpdateKeysDB(c *KeysCache, outparam *Void) error
- type SynchronizeKeyFilesCallback
- type TLSConfig
- type TLSRefreshCallback
- type URLWhitelist
- type Void
- Bugs
Constants ¶
const ( CFG_CHANGE_CERTS_TLSCONFIG uint64 = 1 << iota CFG_CHANGE_CLUSTER_ENCRYPTION CFG_CHANGE_CLIENT_CERTS_TLSCONFIG CFG_CHANGE_GUARDRAIL_STATUSES )
Variables ¶
var ErrCallbackAlreadyRegistered = errors.New("Callback is already registered")
ErrCallbackAlreadyRegistered is used to signal that callback is already registered
var ErrCredentialNotFound = errors.New("credential not found")
ErrCredentialNotFound is returned by GetCredential when the requested credential id does not exist (ns_server returned HTTP 404).
var ErrCredentialsExpired = errors.New("Credentials have expired")
ErrCredentialsExpired is returned when credentials have expired
var ErrInsufficientPermissions = errors.New("insufficient permissions")
ErrInsufficientPermissions is returned when the user lacks RBAC permission to perform the requested operation (e.g., consume permission for credentials).
var ErrKeysNotAvailable = errors.New("Keys are not available yet")
ErrKeysNotAvailable is returned if ns_server hasn't provided the encryption keys yet
var ErrNoAuth = errors.New("Authentication failure")
ErrNoAuth is an error that is returned when the user credentials are not recognized
var ErrNoUuid = errors.New("No UUID for user")
ErrNoUuid is an error that is returned when the uuid for user is empty
var ErrSchemaVersionUnsupported = errors.New("unsupported credential schema version")
ErrSchemaVersionUnsupported is returned when a credential uses a schema version that this version of cbauth does not support.
var ErrServiceGuardrailBlocked = errors.New("service not allowed by guardrail")
ErrServiceGuardrailBlocked is returned when the calling service is not listed in the credential's allowedServices guardrail.
var ErrStoredCredentialExpired = errors.New("stored credential has expired")
ErrStoredCredentialExpired is returned when a stored credential's TTL (expiresAt) has passed.
var ErrUserNotFound = errors.New("Username not found")
ErrUserNotFound is used to signal when username can't be extracted from client certificate.
Functions ¶
func GetClientCertAuthType ¶
func GetClientCertAuthType(s *Svc) (tls.ClientAuthType, error)
GetClientCertAuthType returns TLS cert type
func GetClusterUuid ¶ added in v0.1.11
GetClusterUuid returns UUID of the cluster cbauth is currently connecting to
func GetCreds ¶
GetCreds returns service password for given host and port together with memcached admin name and http special user. Or "", "", "", nil if host/port represents unknown service.
func GetNodeUuid ¶ added in v0.1.11
GetNodeUuid returns UUID of the node cbauth is currently connecting to
func GetUserBuckets ¶ added in v0.1.2
func ImportEncryptionKeys ¶ added in v0.1.19
func ImportEncryptionKeys(s *Svc, dekPaths []string, dataType KeyDataType, timeout int) error
func IsAuthTokenPresent ¶
func IsAuthTokenPresent(Hdr httpreq.HttpHeader) bool
IsAuthTokenPresent returns true iff ns_server's ui token header ("ns-server-ui") is set to "yes". UI is using that header to indicate that request is using so called token auth.
func IsJwtPresent ¶ added in v0.1.14
func IsJwtPresent(Hdr httpreq.HttpHeader) bool
func KeysDropComplete ¶ added in v0.1.16
func KeysDropComplete(s *Svc, dataType KeyDataType, dropErr error) error
func RegisterConfigRefreshCallback ¶
func RegisterConfigRefreshCallback(s *Svc, cb ConfigRefreshCallback) error
RegisterConfigRefreshCallback registers callback for refreshing SSL certs or TLS config.
func RegisterEncryptionKeysCallbacks ¶ added in v0.1.16
func RegisterEncryptionKeysCallbacks(s *Svc, refreshKeysCallback RefreshKeysCallback, getInUseKeysCallback GetInUseKeysCallback, dropKeysCallback DropKeysCallback, synchronizeKeyFilesCallback SynchronizeKeyFilesCallback) error
func RegisterTLSRefreshCallback ¶
func RegisterTLSRefreshCallback(s *Svc, callback TLSRefreshCallback) error
RegisterTLSRefreshCallback registers callback for refreshing TLS config
func SetExpectedClusterUuid ¶ added in v0.1.11
SetExpectedClusterUuid sets the expected UUID of the cluster we are connecting to
func SetTransport ¶
func SetTransport(s *Svc, rt http.RoundTripper)
SetTransport allows to change RoundTripper for Svc
Types ¶
type AWSPayload ¶ added in v0.1.19
type AWSPayload struct {
AccessKeyID string `json:"accessKeyId"`
SecretAccessKey string `json:"secretAccessKey"`
Region string `json:"region"`
Endpoint string `json:"endpoint,omitempty"`
SessionToken string `json:"sessionToken,omitempty"`
}
AWSPayload holds AWS S3 / S3-compatible credential fields.
type AzureADPayload ¶ added in v0.1.19
type AzureADPayload struct {
ClientID string `json:"clientId"`
TenantID string `json:"tenantId"`
Endpoint string `json:"endpoint,omitempty"`
ClientSecret string `json:"clientSecret,omitempty"`
Certificate string `json:"certificate,omitempty"`
CertPassword string `json:"certPassword,omitempty"`
}
AzureADPayload holds Azure Active Directory credential fields. Exactly one of ClientSecret or Certificate is populated.
type AzureManagedPayload ¶ added in v0.1.19
type AzureManagedPayload struct {
ManagedIdentityID string `json:"managedIdentityId,omitempty"`
Endpoint string `json:"endpoint,omitempty"`
}
AzureManagedPayload holds Azure Managed Identity credential fields.
type AzureSASPayload ¶ added in v0.1.19
type AzureSASPayload struct {
AccountName string `json:"accountName"`
Endpoint string `json:"endpoint,omitempty"`
}
AzureSASPayload holds Azure Shared Access Signature credential fields.
type AzureSharedPayload ¶ added in v0.1.19
type AzureSharedPayload struct {
}
AzureSharedPayload holds Azure Shared Key credential fields.
type Cache ¶
type Cache struct {
Nodes []Node
AuthCheckURL string `json:"authCheckUrl"`
PermissionCheckURL string `json:"permissionCheckUrl"`
UuidCheckURL string
UserBucketsURL string
KeysDropCompleteURL string `json:"keysDropCompleteURL"`
ImportEncryptionKeysURL string `json:"importEncryptionKeysURL"`
GetCredentialBaseURL string `json:"getCredentialBaseURL"`
SpecialUser string `json:"specialUser"`
SpecialPasswords []string `json:"specialPasswords"`
PermissionsVersion string
UserVersion string
AuthVersion string
CertVersion int
ClientCertVersion int
ExtractUserFromCertURL string `json:"extractUserFromCertURL"`
ClientCertAuthState string `json:"clientCertAuthState"`
ClientCertAuthVersion string `json:"clientCertAuthVersion"`
ClusterEncryptionConfig ClusterEncryptionConfig `json:"clusterEncryptionConfig"`
TLSConfig tlsConfigImport `json:"tlsConfig"`
CacheConfig CacheConfig `json:"cacheConfig"`
GuardrailStatuses []GuardrailStatus `json:"guardrailStatuses"`
}
Cache is a structure into which the revrpc json is unmarshalled
type CacheConfig ¶ added in v0.1.11
type CacheExt ¶ added in v0.1.11
type CacheExt struct {
AuthCheckEndpoint string
AuthVersion string
PermissionCheckEndpoint string
PermissionsVersion string
ExtractUserFromCertEndpoint string
ClientCertAuthVersion string
ClientCertAuthState string
NodeUUID string
ClusterUUID string
}
Cache is a structure into which the revrpc json is unmarshalled if used from external service
type CacheParams ¶ added in v0.1.8
type CacheParams struct {
// contains filtered or unexported fields
}
type CacheStats ¶ added in v0.1.11
type CachesStats ¶ added in v0.1.11
type CachesStats struct {
CacheStats []CacheStats `json:"cacheStats"`
}
type ClusterEncryptionConfig ¶
ClusterEncryptionConfig contains info about whether to use SSL ports for communication channels and whether to disable non-SSL ports.
func GetClusterEncryptionConfig ¶
func GetClusterEncryptionConfig(s *Svc) (ClusterEncryptionConfig, error)
GetClusterEncryptionConfig returns if cross node communication needs to be encrypted and if non-SSL ports need to be disabled.
type ConfigRefreshCallback ¶
ConfigRefreshCallback type describes the callback called when any of the following are updated: 1. SSL certificates 2. TLS configuration 3. Cluster encryption configuration
The clients are notified of the configuration changes by OR'ing the appropriate flags defined above and passing them as an argument to the callback function.
type CouchbasePayload ¶ added in v0.1.19
type CouchbasePayload struct {
EncryptionType string `json:"encryptionType"` // "none", "half", "full"
Username string `json:"username,omitempty"`
Password string `json:"password,omitempty"`
Certificate string `json:"certificate,omitempty"`
PrivateKey string `json:"privateKey,omitempty"`
Passphrase string `json:"passphrase,omitempty"`
RootCertificate string `json:"rootCertificate,omitempty"`
}
CouchbasePayload holds Couchbase remote-cluster credential fields.
type Credential ¶ added in v0.1.19
type Credential struct {
ID string `json:"id"`
Type CredentialType `json:"type"`
SchemaVersion int `json:"schemaVersion"`
Meta CredentialMeta `json:"meta"`
AWS *AWSPayload `json:"aws,omitempty"`
AzureAD *AzureADPayload `json:"azureAd,omitempty"`
AzureSAS *AzureSASPayload `json:"azureSas,omitempty"`
AzureManaged *AzureManagedPayload `json:"azureManaged,omitempty"`
GCP *GCPPayload `json:"gcp,omitempty"`
HTTP *HTTPPayload `json:"http,omitempty"`
Couchbase *CouchbasePayload `json:"couchbase,omitempty"`
}
Credential is the full, decrypted credential returned by GetCredential. Exactly one of the type-specific payload fields will be non-nil, corresponding to the Type.
func GetCredential ¶ added in v0.1.19
func GetCredential(s *Svc, id, user, domain, extras string) (*Credential, error)
GetCredential retrieves the decrypted, ready-to-use credential with the given id from ns_server via the /_cbauth/getCredential/<id> endpoint. The user/domain/extras identify the end-user on whose behalf the credential is being consumed; ns_server checks the consume RBAC permission against this identity (the same on-behalf-of pattern used by checkPermission, getUserBuckets, etc.). The returned Credential contains plaintext sensitive values; callers are responsible for wiping sensitive material after use.
type CredentialGuardrails ¶ added in v0.1.19
type CredentialGuardrails struct {
AllowedServices []string `json:"allowedServices,omitempty"`
URLWhitelist *URLWhitelist `json:"urlWhitelist,omitempty"`
AllowedResources []string `json:"allowedResources,omitempty"`
AllowedOperations []string `json:"allowedOperations,omitempty"`
}
CredentialGuardrails contains optional usage restrictions that services must enforce at runtime. ns_server enforces only AllowedServices; all other guardrails are the service's responsibility.
type CredentialMeta ¶ added in v0.1.19
type CredentialMeta struct {
Description string `json:"description,omitempty"`
Guardrails CredentialGuardrails `json:"guardrails,omitempty"`
CreatedAt int64 `json:"createdAt"`
CreatedBy Author `json:"createdBy"`
UpdatedAt int64 `json:"updatedAt,omitempty"`
UpdatedBy *Author `json:"updatedBy,omitempty"`
ExpiresAt int64 `json:"expiresAt,omitempty"`
PayloadVersion string `json:"payloadVersion,omitempty"`
}
CredentialMeta holds the metadata returned for a credential. All timestamp fields are milliseconds since the Unix epoch.
type CredentialType ¶ added in v0.1.19
type CredentialType string
CredentialType represents the type of a stored credential.
const ( CredentialTypeAWS CredentialType = "aws" CredentialTypeAzureAD CredentialType = "azureAd" CredentialTypeAzureSAS CredentialType = "azureSas" CredentialTypeAzureManaged CredentialType = "azureManaged" CredentialTypeGCP CredentialType = "gcp" CredentialTypeHTTP CredentialType = "http" CredentialTypeCouchbase CredentialType = "couchbase" )
type CredsImpl ¶
type CredsImpl struct {
// contains filtered or unexported fields
}
CredsImpl implements cbauth.Creds interface.
func MaybeGetCredsFromCert ¶
func MaybeGetCredsFromCert(s *Svc, tlsState *tls.ConnectionState) (*CredsImpl, error)
MaybeGetCredsFromCert extracts user's credentials from certificate Those returned credentials could be used for calling IsAllowed function
func VerifyOnBehalf ¶
func VerifyOnBehalf(s *Svc, creds *CredsImpl, onBehalfUser, onBehalfDomain string, onBehalfExtras string) (*CredsImpl, error)
VerifyOnBehalf authenticates http request with on behalf header
func VerifyOnServer ¶
func VerifyOnServer(s *Svc, reqHeaders httpreq.HttpHeader) (*CredsImpl, error)
VerifyOnServer authenticates http request by calling POST /_cbauth REST endpoint
func VerifyPassword ¶
VerifyPassword verifies given user/password creds against cbauth password database. Returns nil, nil if given creds are not recognised at all.
func (*CredsImpl) Expiry ¶ added in v0.1.14
Expiry returns the expiry time in Unix timestamp format, or 0 if no expiry
func (*CredsImpl) Extras ¶ added in v0.1.14
Extras returns the raw extras string (additional authentication context)
func (*CredsImpl) GetBuckets ¶ added in v0.1.13
func (*CredsImpl) GetCredential ¶ added in v0.1.19
func (c *CredsImpl) GetCredential(id string) (*Credential, error)
GetCredential retrieves the decrypted credential on behalf of the authenticated user represented by these Creds. The RBAC consume permission check on ns_server is performed against this user's identity.
func (*CredsImpl) IsAllowed ¶
IsAllowed method returns true if the permission is granted for these credentials
func (*CredsImpl) IsAllowedInternal ¶ added in v0.1.13
IsAllowedInternal method returns true if the permission is granted for these credentials
type DropKeysCallback ¶ added in v0.1.16
type DropKeysCallback func(KeyDataType, []string)
type DropKeysData ¶ added in v0.1.16
type DropKeysData struct {
DataType KeyDataType `json:"dataType"`
Keys []string `json:"keys"`
}
type EncrKeysInfo ¶ added in v0.1.16
type EncrKeysInfo struct {
ActiveKeyId string
Keys []EaRKey
Path string // Where encrypted keys are stored
}
func GetEncryptionKeys ¶ added in v0.1.16
func GetEncryptionKeys(s *Svc, t KeyDataType) (*EncrKeysInfo, error)
func GetEncryptionKeysBlocking ¶ added in v0.1.16
func GetEncryptionKeysBlocking(ctx context.Context, s *Svc, t KeyDataType) (*EncrKeysInfo, error)
GetEncryptionKeysBlocking blocks until UpdateKeysDB is called and the specific keys are available, or the context is cancelled/times out.
type GCPPayload ¶ added in v0.1.19
type GCPPayload struct {
// Service-account mode fields
JSONCredentials string `json:"jsonCredentials,omitempty"`
// HMAC mode fields
AccessKeyID string `json:"accessKeyId,omitempty"`
SecretAccessKey string `json:"secretAccessKey,omitempty"`
// Shared fields
Region string `json:"region,omitempty"`
Endpoint string `json:"endpoint,omitempty"`
}
GCPPayload holds GCP credential fields for the consolidated "gcp" type. Exactly one authentication mode is populated per credential:
- Service-account mode: JSONCredentials is set (and optionally Region / Endpoint).
- HMAC mode: AccessKeyID + SecretAccessKey are set (and optionally Region / Endpoint).
type GetInUseKeysCallback ¶ added in v0.1.16
type GetInUseKeysCallback func(KeyDataType) ([]string, error)
type GuardrailStatus ¶ added in v0.1.12
GuardrailStatus contains the current status for a resource that we want a service to be aware of. Severity may be one of the following, in ascending order of severity: - "serious" - "critical" - "maximum" (equivalently known as "Critical Enforcement")
func GetGuardrailStatuses ¶ added in v0.1.12
func GetGuardrailStatuses(s *Svc) ([]GuardrailStatus, error)
GetGuardrailStatuses returns guardrail statuses.
type HTTPPayload ¶ added in v0.1.19
type HTTPPayload struct {
AuthScheme string `json:"authScheme"` // "basic", "bearer", "mtls"
Username string `json:"username,omitempty"`
Password string `json:"password,omitempty"`
HeaderName string `json:"headerName,omitempty"`
Token string `json:"token,omitempty"`
Certificate string `json:"certificate,omitempty"`
PrivateKey string `json:"privateKey,omitempty"`
Passphrase string `json:"passphrase,omitempty"`
RootCertificate string `json:"rootCertificate,omitempty"`
SkipVerify bool `json:"skipVerify,omitempty"`
}
HTTPPayload holds generic HTTP credential fields.
type KeyDataType ¶ added in v0.1.16
type KeysCache ¶ added in v0.1.16
type KeysCache struct {
DataType KeyDataType `json:"dataType"`
ActiveKeyId string `json:"active"`
Keys []EaRKey `json:"keys"`
Path string `json:"path"`
}
type Node ¶
Node struct is used as part of Cache messages to describe creds and ports of some cluster node.
type RefreshKeysCallback ¶ added in v0.1.16
type RefreshKeysCallback func(KeyDataType) error
type ReqParams ¶ added in v0.1.8
type ReqParams struct {
// contains filtered or unexported fields
}
type Svc ¶
type Svc struct {
// contains filtered or unexported fields
}
Svc is a struct that holds state of cbauth service.
func NewSVC ¶
NewSVC constructs Svc instance. Period is initial period of time where attempts to access stale DB won't cause DBStaleError responses, but service will instead wait for UpdateDB call.
func NewSVCForTest ¶
func NewSVCForTest(period time.Duration, staleErr error, waitfn func(time.Duration, chan struct{}, func())) *Svc
NewSVCForTest constructs Svc instance.
func (*Svc) DropKeys ¶ added in v0.1.16
func (s *Svc) DropKeys(c *DropKeysData, outparam *Void) error
func (*Svc) GetInUseKeys ¶ added in v0.1.16
func (s *Svc) GetInUseKeys(c *KeyDataType, outparam *[]string) error
func (*Svc) GetStats ¶ added in v0.1.11
func (s *Svc) GetStats(Void, outparam *CachesStats) error
func (*Svc) SetConnectInfo ¶ added in v0.1.11
func (*Svc) SynchronizeKeyFiles ¶ added in v0.1.16
func (s *Svc) SynchronizeKeyFiles(c *KeyDataType, outparam *Void) error
func (*Svc) UpdateDBExt ¶ added in v0.1.11
UpdateDBExt is a revrpc method that is used by ns_server update external cbauth state.
type SynchronizeKeyFilesCallback ¶ added in v0.1.16
type SynchronizeKeyFilesCallback func(KeyDataType) error
type TLSConfig ¶
type TLSConfig struct {
MinVersion uint16
CipherSuites []uint16
CipherSuiteNames []string
CipherSuiteOpenSSLNames []string
PreferServerCipherSuites bool
ClientAuthType tls.ClientAuthType
ShouldClientsUseClientCert bool
PrivateKeyPassphrase []byte
ClientPrivateKeyPassphrase []byte
// contains filtered or unexported fields
}
TLSConfig contains tls settings to be used by cbauth clients When something in tls config changes user is notified via TLSRefreshCallback
func GetTLSConfig ¶
GetTLSConfig returns current tls config that contains cipher suites, min TLS version, etc.
type TLSRefreshCallback ¶
type TLSRefreshCallback func() error
TLSRefreshCallback type describes callback for reinitializing TLSConfig when ssl certificate or client cert auth setting changes.
type URLWhitelist ¶ added in v0.1.19
type URLWhitelist struct {
AllAccess bool `json:"allAccess,omitempty"`
AllowedURLs []string `json:"allowedUrls,omitempty"`
DisallowedURLs []string `json:"disallowedUrls,omitempty"`
}
URLWhitelist contains URL-level access restrictions inside a credential's guardrails. Services must enforce these at runtime; ns_server does not.
Notes ¶
Bugs ¶
consider some kind of CAS later