headscale/oidc.go

664 lines
17 KiB
Go
Raw Normal View History

2021-09-26 04:53:05 -04:00
package headscale
import (
2021-12-22 21:43:53 -05:00
"bytes"
"context"
2021-09-26 04:53:05 -04:00
"crypto/rand"
"encoding/hex"
"errors"
2021-09-26 04:53:05 -04:00
"fmt"
2021-12-22 21:43:53 -05:00
"html/template"
2021-10-18 15:27:52 -04:00
"net/http"
"strings"
"time"
2021-10-18 15:27:52 -04:00
"github.com/coreos/go-oidc/v3/oidc"
2022-06-20 06:31:19 -04:00
"github.com/gorilla/mux"
2021-09-26 04:53:05 -04:00
"github.com/rs/zerolog/log"
"golang.org/x/oauth2"
"tailscale.com/types/key"
2021-09-26 04:53:05 -04:00
)
const (
randomByteSize = 16
2022-08-07 07:57:07 -04:00
errEmptyOIDCCallbackParams = Error("empty OIDC callback params")
errNoOIDCIDToken = Error("could not extract ID Token for OIDC callback")
errOIDCAllowedDomains = Error("authenticated principal does not match any allowed domain")
errOIDCAllowedUsers = Error("authenticated principal does not match any allowed user")
errOIDCInvalidMachineState = Error("requested machine state key expired before authorisation completed")
errOIDCNodeKeyMissing = Error("could not get node key from cache")
)
type IDTokenClaims struct {
2021-09-26 04:53:05 -04:00
Name string `json:"name,omitempty"`
Groups []string `json:"groups,omitempty"`
Email string `json:"email"`
Username string `json:"preferred_username,omitempty"`
}
2021-10-08 05:43:52 -04:00
func (h *Headscale) initOIDC() error {
2021-09-26 04:53:05 -04:00
var err error
// grab oidc config if it hasn't been already
2021-10-08 05:43:52 -04:00
if h.oauth2Config == nil {
2021-10-18 15:27:52 -04:00
h.oidcProvider, err = oidc.NewProvider(context.Background(), h.cfg.OIDC.Issuer)
2021-09-26 04:53:05 -04:00
if err != nil {
log.Error().
Err(err).
Caller().
Msgf("Could not retrieve OIDC Config: %s", err.Error())
2021-11-14 10:46:09 -05:00
2021-10-08 05:43:52 -04:00
return err
2021-09-26 04:53:05 -04:00
}
2021-10-08 05:43:52 -04:00
h.oauth2Config = &oauth2.Config{
2021-10-18 15:27:52 -04:00
ClientID: h.cfg.OIDC.ClientID,
ClientSecret: h.cfg.OIDC.ClientSecret,
2021-10-08 05:43:52 -04:00
Endpoint: h.oidcProvider.Endpoint(),
2021-11-13 03:36:45 -05:00
RedirectURL: fmt.Sprintf(
"%s/oidc/callback",
strings.TrimSuffix(h.cfg.ServerURL, "/"),
),
Scopes: h.cfg.OIDC.Scope,
}
2021-10-08 05:43:52 -04:00
}
return nil
}
// RegisterOIDC redirects to the OIDC provider for authentication
2022-08-11 06:15:16 -04:00
// Puts NodeKey in cache so the callback can retrieve it using the oidc state param
// Listens in /oidc/register/:nKey.
2022-06-20 06:31:19 -04:00
func (h *Headscale) RegisterOIDC(
2022-06-26 05:55:37 -04:00
writer http.ResponseWriter,
req *http.Request,
2022-06-20 06:31:19 -04:00
) {
2022-06-26 05:55:37 -04:00
vars := mux.Vars(req)
nodeKeyStr, ok := vars["nkey"]
if !ok || nodeKeyStr == "" {
2022-06-20 06:31:19 -04:00
log.Error().
Caller().
Msg("Missing node key in URL")
http.Error(writer, "Missing node key in URL", http.StatusBadRequest)
2021-11-14 10:46:09 -05:00
2021-10-08 05:43:52 -04:00
return
2021-09-26 04:53:05 -04:00
}
log.Trace().
Caller().
Str("node_key", nodeKeyStr).
Msg("Received oidc register call")
randomBlob := make([]byte, randomByteSize)
2021-11-15 11:15:50 -05:00
if _, err := rand.Read(randomBlob); err != nil {
log.Error().
Caller().
Msg("could not read 16 bytes from rand")
2022-06-26 05:55:37 -04:00
http.Error(writer, "Internal server error", http.StatusInternalServerError)
2021-11-14 10:46:09 -05:00
return
}
2021-11-15 11:15:50 -05:00
stateStr := hex.EncodeToString(randomBlob)[:32]
2021-09-26 04:53:05 -04:00
// place the node key into the state cache, so it can be retrieved later
h.registrationCache.Set(stateStr, nodeKeyStr, registerCacheExpiration)
2021-09-26 04:53:05 -04:00
// Add any extra parameter provided in the configuration to the Authorize Endpoint request
extras := make([]oauth2.AuthCodeOption, 0, len(h.cfg.OIDC.ExtraParams))
for k, v := range h.cfg.OIDC.ExtraParams {
extras = append(extras, oauth2.SetAuthURLParam(k, v))
}
authURL := h.oauth2Config.AuthCodeURL(stateStr, extras...)
log.Debug().Msgf("Redirecting to %s for authentication", authURL)
2021-09-26 04:53:05 -04:00
2022-06-26 05:55:37 -04:00
http.Redirect(writer, req, authURL, http.StatusFound)
2021-09-26 04:53:05 -04:00
}
2021-12-22 21:43:53 -05:00
type oidcCallbackTemplateConfig struct {
User string
Verb string
}
var oidcCallbackTemplate = template.Must(
template.New("oidccallback").Parse(`<html>
<body>
<h1>headscale</h1>
<p>
{{.Verb}} as {{.User}}, you can now close this window.
</p>
</body>
</html>`),
)
2021-09-26 04:53:05 -04:00
// OIDCCallback handles the callback from the OIDC endpoint
2022-08-11 06:15:16 -04:00
// Retrieves the nkey from the state cache and adds the machine to the users email namespace
// TODO: A confirmation page for new machines should be added to avoid phishing vulnerabilities
// TODO: Add groups information from OIDC tokens into machine HostInfo
2021-11-13 03:39:04 -05:00
// Listens in /oidc/callback.
2022-06-17 11:42:17 -04:00
func (h *Headscale) OIDCCallback(
2022-06-26 06:01:04 -04:00
writer http.ResponseWriter,
req *http.Request,
2022-06-17 11:42:17 -04:00
) {
2022-08-07 07:57:07 -04:00
code, state, err := validateOIDCCallbackParams(writer, req)
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
2022-09-04 09:02:18 -04:00
rawIDToken, err := h.getIDTokenForOIDCCallback(req.Context(), writer, code, state)
2022-08-07 07:57:07 -04:00
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
2022-09-04 09:02:18 -04:00
idToken, err := h.verifyIDTokenForOIDCCallback(req.Context(), writer, rawIDToken)
2022-08-07 07:57:07 -04:00
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
// TODO: we can use userinfo at some point to grab additional information about the user (groups membership, etc)
// userInfo, err := oidcProvider.UserInfo(context.Background(), oauth2.StaticTokenSource(oauth2Token))
// if err != nil {
// c.String(http.StatusBadRequest, fmt.Sprintf("Failed to retrieve userinfo"))
// return
// }
2022-08-07 07:57:07 -04:00
claims, err := extractIDTokenClaims(writer, idToken)
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
2022-08-07 07:57:07 -04:00
if err := validateOIDCAllowedDomains(writer, h.cfg.OIDC.AllowedDomains, claims); err != nil {
2022-07-11 17:25:13 -04:00
return
}
2022-08-07 07:57:07 -04:00
if err := validateOIDCAllowedUsers(writer, h.cfg.OIDC.AllowedUsers, claims); err != nil {
2022-07-11 17:25:13 -04:00
return
}
nodeKey, machineExists, err := h.validateMachineForOIDCCallback(writer, state, claims)
2022-08-07 07:57:07 -04:00
if err != nil || machineExists {
2022-07-11 17:25:13 -04:00
return
}
2022-08-07 07:57:07 -04:00
namespaceName, err := getNamespaceName(writer, claims, h.cfg.OIDC.StripEmaildomain)
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
// register the machine if it's new
log.Debug().Msg("Registering new machine after successful callback")
2022-08-07 07:57:07 -04:00
namespace, err := h.findOrCreateNewNamespaceForOIDCCallback(writer, namespaceName)
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
if err := h.registerMachineForOIDCCallback(writer, namespace, nodeKey); err != nil {
2022-07-11 17:25:13 -04:00
return
}
2022-08-07 07:57:07 -04:00
content, err := renderOIDCCallbackTemplate(writer, claims)
if err != nil {
2022-07-11 17:25:13 -04:00
return
}
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
writer.WriteHeader(http.StatusOK)
if _, err := writer.Write(content.Bytes()); err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
}
func validateOIDCCallbackParams(
writer http.ResponseWriter,
req *http.Request,
2022-08-07 07:57:07 -04:00
) (string, string, error) {
2022-06-26 06:01:04 -04:00
code := req.URL.Query().Get("code")
state := req.URL.Query().Get("state")
2021-09-26 04:53:05 -04:00
if code == "" || state == "" {
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("Wrong params"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return "", "", errEmptyOIDCCallbackParams
2021-09-26 04:53:05 -04:00
}
2022-08-07 07:57:07 -04:00
return code, state, nil
2022-07-11 17:25:13 -04:00
}
func (h *Headscale) getIDTokenForOIDCCallback(
2022-09-04 09:02:18 -04:00
ctx context.Context,
2022-07-11 17:25:13 -04:00
writer http.ResponseWriter,
code, state string,
2022-08-07 07:57:07 -04:00
) (string, error) {
2022-09-04 09:02:18 -04:00
oauth2Token, err := h.oauth2Config.Exchange(ctx, code)
2021-09-26 04:53:05 -04:00
if err != nil {
2022-03-18 04:40:12 -04:00
log.Error().
Err(err).
Caller().
Msg("Could not exchange code for token")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("Could not exchange code for token"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return "", err
2021-09-26 04:53:05 -04:00
}
log.Trace().
Caller().
Str("code", code).
Str("state", state).
Msg("Got oidc callback")
2021-10-10 05:22:42 -04:00
rawIDToken, rawIDTokenOK := oauth2Token.Extra("id_token").(string)
if !rawIDTokenOK {
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("Could not extract ID Token"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return "", errNoOIDCIDToken
}
2022-08-07 07:57:07 -04:00
return rawIDToken, nil
2022-07-11 17:25:13 -04:00
}
2021-09-26 04:53:05 -04:00
2022-07-11 17:25:13 -04:00
func (h *Headscale) verifyIDTokenForOIDCCallback(
2022-09-04 09:02:18 -04:00
ctx context.Context,
2022-07-11 17:25:13 -04:00
writer http.ResponseWriter,
rawIDToken string,
2022-08-07 07:57:07 -04:00
) (*oidc.IDToken, error) {
2022-07-11 17:25:13 -04:00
verifier := h.oidcProvider.Verifier(&oidc.Config{ClientID: h.cfg.OIDC.ClientID})
2022-09-04 09:02:18 -04:00
idToken, err := verifier.Verify(ctx, rawIDToken)
2021-09-26 04:53:05 -04:00
if err != nil {
log.Error().
Err(err).
Caller().
Msg("failed to verify id token")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("Failed to verify id token"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return nil, err
}
2022-08-07 07:57:07 -04:00
return idToken, nil
2022-07-11 17:25:13 -04:00
}
2022-07-11 17:25:13 -04:00
func extractIDTokenClaims(
writer http.ResponseWriter,
idToken *oidc.IDToken,
2022-08-07 07:57:07 -04:00
) (*IDTokenClaims, error) {
var claims IDTokenClaims
2022-08-17 11:03:10 -04:00
if err := idToken.Claims(&claims); err != nil {
log.Error().
Err(err).
Caller().
Msg("Failed to decode id token claims")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("Failed to decode id token claims"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return nil, err
2021-09-26 04:53:05 -04:00
}
2022-08-07 07:57:07 -04:00
return &claims, nil
2022-07-11 17:25:13 -04:00
}
// validateOIDCAllowedDomains checks that if AllowedDomains is provided,
// that the authenticated principal ends with @<alloweddomain>.
func validateOIDCAllowedDomains(
writer http.ResponseWriter,
allowedDomains []string,
claims *IDTokenClaims,
2022-08-07 07:57:07 -04:00
) error {
2022-07-11 17:25:13 -04:00
if len(allowedDomains) > 0 {
if at := strings.LastIndex(claims.Email, "@"); at < 0 ||
2022-07-11 17:25:13 -04:00
!IsStringInSlice(allowedDomains, claims.Email[at+1:]) {
log.Error().Msg("authenticated principal does not match any allowed domain")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("unauthorized principal (domain mismatch)"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return errOIDCAllowedDomains
}
}
2022-08-07 07:57:07 -04:00
return nil
2022-07-11 17:25:13 -04:00
}
// validateOIDCAllowedUsers checks that if AllowedUsers is provided,
// that the authenticated principal is part of that list.
func validateOIDCAllowedUsers(
writer http.ResponseWriter,
allowedUsers []string,
claims *IDTokenClaims,
2022-08-07 07:57:07 -04:00
) error {
2022-07-11 17:25:13 -04:00
if len(allowedUsers) > 0 &&
!IsStringInSlice(allowedUsers, claims.Email) {
log.Error().Msg("authenticated principal does not match any allowed user")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("unauthorized principal (user mismatch)"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return errOIDCAllowedUsers
}
2022-08-07 07:57:07 -04:00
return nil
2022-07-11 17:25:13 -04:00
}
// validateMachine retrieves machine information if it exist
// The error is not important, because if it does not
// exist, then this is a new machine and we will move
// on to registration.
func (h *Headscale) validateMachineForOIDCCallback(
writer http.ResponseWriter,
state string,
claims *IDTokenClaims,
) (*key.NodePublic, bool, error) {
2021-10-18 15:27:52 -04:00
// retrieve machinekey from state cache
machineKeyIf, machineKeyFound := h.registrationCache.Get(state)
if !machineKeyFound {
2021-11-13 03:36:45 -05:00
log.Error().
Msg("requested machine state key expired before authorisation completed")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("state has expired"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
2022-08-07 07:57:07 -04:00
return nil, false, errOIDCInvalidMachineState
2021-09-26 04:53:05 -04:00
}
var nodeKey key.NodePublic
nodeKeyFromCache, nodeKeyOK := machineKeyIf.(string)
err := nodeKey.UnmarshalText(
[]byte(NodePublicKeyEnsurePrefix(nodeKeyFromCache)),
)
if err != nil {
log.Error().
Msg("could not parse node public key")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("could not parse public key"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return nil, false, err
}
2021-09-26 04:53:05 -04:00
if !nodeKeyOK {
log.Error().Msg("could not get node key from cache")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
_, err := writer.Write([]byte("could not get node key from cache"))
2022-06-26 06:21:35 -04:00
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2021-11-14 10:46:09 -05:00
return nil, false, errOIDCNodeKeyMissing
2021-09-26 04:53:05 -04:00
}
2022-02-28 18:00:41 -05:00
// retrieve machine information if it exist
2022-03-02 02:29:40 -05:00
// The error is not important, because if it does not
// exist, then this is a new machine and we will move
// on to registration.
machine, _ := h.GetMachineByNodeKey(nodeKey)
2021-09-26 04:53:05 -04:00
if machine != nil {
log.Trace().
Caller().
2022-04-24 15:55:54 -04:00
Str("machine", machine.Hostname).
Msg("machine already registered, reauthenticating")
2022-06-26 06:30:52 -04:00
err := h.RefreshMachine(machine, time.Time{})
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to refresh machine")
2022-08-04 04:47:00 -04:00
http.Error(
writer,
"Failed to refresh machine",
http.StatusInternalServerError,
)
2022-06-26 06:30:52 -04:00
2022-08-07 07:57:07 -04:00
return nil, true, err
2022-06-26 06:30:52 -04:00
}
2021-12-22 21:43:53 -05:00
var content bytes.Buffer
if err := oidcCallbackTemplate.Execute(&content, oidcCallbackTemplateConfig{
User: claims.Email,
Verb: "Reauthenticated",
}); err != nil {
log.Error().
Str("func", "OIDCCallback").
Str("type", "reauthenticate").
Err(err).
Msg("Could not render OIDC callback template")
2022-06-17 11:42:17 -04:00
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("Could not render OIDC callback template"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-06-17 11:42:17 -04:00
2022-08-07 07:57:07 -04:00
return nil, true, err
2021-12-22 21:43:53 -05:00
}
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
writer.WriteHeader(http.StatusOK)
2022-06-26 06:30:52 -04:00
_, err = writer.Write(content.Bytes())
2022-06-26 06:21:35 -04:00
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return nil, true, nil
}
return &nodeKey, false, nil
2022-07-11 17:25:13 -04:00
}
func getNamespaceName(
writer http.ResponseWriter,
claims *IDTokenClaims,
stripEmaildomain bool,
2022-08-07 07:57:07 -04:00
) (string, error) {
namespaceName, err := NormalizeToFQDNRules(
2022-02-23 08:22:21 -05:00
claims.Email,
2022-07-11 17:25:13 -04:00
stripEmaildomain,
2022-02-23 08:22:21 -05:00
)
2022-02-22 06:46:45 -05:00
if err != nil {
log.Error().Err(err).Caller().Msgf("couldn't normalize email")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("couldn't normalize email"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-02-22 15:05:39 -05:00
2022-08-07 07:57:07 -04:00
return "", err
2022-02-22 06:46:45 -05:00
}
2022-08-07 07:57:07 -04:00
return namespaceName, nil
2022-07-11 17:25:13 -04:00
}
2021-09-26 04:53:05 -04:00
2022-07-11 17:25:13 -04:00
func (h *Headscale) findOrCreateNewNamespaceForOIDCCallback(
writer http.ResponseWriter,
namespaceName string,
2022-08-07 07:57:07 -04:00
) (*Namespace, error) {
namespace, err := h.GetNamespace(namespaceName)
2022-07-29 11:35:21 -04:00
if errors.Is(err, ErrNamespaceNotFound) {
namespace, err = h.CreateNamespace(namespaceName)
2021-09-26 04:53:05 -04:00
2022-02-22 06:46:45 -05:00
if err != nil {
2021-12-22 21:43:53 -05:00
log.Error().
Err(err).
Caller().
Msgf("could not create new namespace '%s'", namespaceName)
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("could not create namespace"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2021-12-22 21:43:53 -05:00
2022-08-07 07:57:07 -04:00
return nil, err
2022-02-22 06:46:45 -05:00
}
} else if err != nil {
log.Error().
Caller().
Err(err).
Str("namespace", namespaceName).
Msg("could not find or create namespace")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("could not find or create namespace"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return nil, err
}
2022-08-07 07:57:07 -04:00
return namespace, nil
2022-07-11 17:25:13 -04:00
}
2022-07-11 17:25:13 -04:00
func (h *Headscale) registerMachineForOIDCCallback(
writer http.ResponseWriter,
namespace *Namespace,
nodeKey *key.NodePublic,
2022-08-07 07:57:07 -04:00
) error {
nodeKeyStr := NodePublicKeyStripPrefix(*nodeKey)
2022-07-11 17:25:13 -04:00
if _, err := h.RegisterMachineFromAuthCallback(
nodeKeyStr,
namespace.Name,
RegisterMethodOIDC,
2022-07-11 17:25:13 -04:00
); err != nil {
log.Error().
Caller().
Err(err).
Msg("could not register machine")
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("could not register machine"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-08-07 07:57:07 -04:00
return err
2021-10-18 15:27:52 -04:00
}
2022-08-07 07:57:07 -04:00
return nil
2022-07-11 17:25:13 -04:00
}
func renderOIDCCallbackTemplate(
writer http.ResponseWriter,
claims *IDTokenClaims,
2022-08-07 07:57:07 -04:00
) (*bytes.Buffer, error) {
2022-02-22 06:46:45 -05:00
var content bytes.Buffer
if err := oidcCallbackTemplate.Execute(&content, oidcCallbackTemplateConfig{
User: claims.Email,
Verb: "Authenticated",
}); err != nil {
log.Error().
Str("func", "OIDCCallback").
Str("type", "authenticate").
Err(err).
Msg("Could not render OIDC callback template")
2022-06-17 11:42:17 -04:00
2022-06-26 06:01:04 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
2022-08-07 07:57:07 -04:00
_, werr := writer.Write([]byte("Could not render OIDC callback template"))
if werr != nil {
2022-06-26 06:21:35 -04:00
log.Error().
Caller().
2022-08-07 07:57:07 -04:00
Err(werr).
2022-06-26 06:21:35 -04:00
Msg("Failed to write response")
}
2022-06-17 11:42:17 -04:00
2022-08-07 07:57:07 -04:00
return nil, err
2021-10-18 15:27:52 -04:00
}
2022-08-07 07:57:07 -04:00
return &content, nil
2021-09-26 04:53:05 -04:00
}