MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2024-12-24 06:05:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix crash when config is not properly initialized (#12714)

Browse Source 
fixes #12709
This commit is contained in:
Harshavardhana 2021-07-14 18:27:25 -07:00 committed by GitHub
parent 92ffe5e5ef
commit 10fc30a989
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 41 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/config-current.go
View File

@ -723,8 +723,8 @@ func loadConfig(objAPI ObjectLayer) error {
func getOpenIDValidators(cfg openid.Config) *openid.Validators {
validators := openid.NewValidators()
if cfg.JWKS.URL != nil {
validators.Add(openid.NewJWT(cfg))
if cfg.Enabled {
validators.Add(&cfg)
}
return validators

56
internal/config/identity/openid/jwt.go
View File

@ -41,7 +41,10 @@ import (
// Config - OpenID Config
// RSA authentication target arguments
type Config struct {
JWKS struct {
*sync.RWMutex
Enabled bool `json:"enabled"`
JWKS struct {
URL *xnet.URL `json:"url"`
} `json:"jwks"`
URL *xnet.URL `json:"url,omitempty"`
@ -51,15 +54,15 @@ type Config struct {
DiscoveryDoc DiscoveryDoc
ClientID string
ClientSecret string
provider provider.Provider
publicKeys map[string]crypto.PublicKey
transport *http.Transport
closeRespFn func(io.ReadCloser)
mutex *sync.Mutex
provider provider.Provider
publicKeys map[string]crypto.PublicKey
transport *http.Transport
closeRespFn func(io.ReadCloser)
}
// LookupUser lookup userid for the provider
func (r *Config) LookupUser(userid string) (provider.User, error) {
func (r Config) LookupUser(userid string) (provider.User, error) {
if r.provider != nil {
user, err := r.provider.LookupUser(userid)
if err != nil && err != provider.ErrAccessTokenExpired {
@ -85,7 +88,7 @@ const (
// InitializeProvider initializes if any additional vendor specific
// information was provided, initialization will return an error
// initial login fails.
func (r *Config) InitializeProvider(kvs config.KVS) error {
func (r Config) InitializeProvider(kvs config.KVS) error {
vendor := env.Get(EnvIdentityOpenIDVendor, kvs.Get(Vendor))
if vendor == "" {
return nil
@ -101,17 +104,12 @@ func (r *Config) InitializeProvider(kvs config.KVS) error {
}
// ProviderEnabled returns true if any vendor specific provider is enabled.
func (r *Config) ProviderEnabled() bool {
r.mutex.Lock()
defer r.mutex.Unlock()
return r.provider != nil
func (r Config) ProviderEnabled() bool {
return r.Enabled && r.provider != nil
}
// InitializeKeycloakProvider - initializes keycloak provider
func (r *Config) InitializeKeycloakProvider(adminURL, realm string) error {
r.mutex.Lock()
defer r.mutex.Unlock()
var err error
r.provider, err = provider.KeyCloak(
provider.WithAdminURL(adminURL),
@ -124,8 +122,8 @@ func (r *Config) InitializeKeycloakProvider(adminURL, realm string) error {
// PopulatePublicKey - populates a new publickey from the JWKS URL.
func (r *Config) PopulatePublicKey() error {
r.mutex.Lock()
defer r.mutex.Unlock()
r.Lock()
defer r.Unlock()
if r.JWKS.URL == nil || r.JWKS.URL.String() == "" {
return nil
@ -181,11 +179,6 @@ func (r *Config) UnmarshalJSON(data []byte) error {
return nil
}
// JWT - rs client grants provider details.
type JWT struct {
Config
}
// GetDefaultExpiration - returns the expiration seconds expected.
func GetDefaultExpiration(dsecs string) (time.Duration, error) {
defaultExpiryDuration := time.Duration(60) * time.Minute // Defaults to 1hr.
@ -241,7 +234,7 @@ func updateClaimsExpiry(dsecs string, claims map[string]interface{}) error {
}
// Validate - validates the access token.
func (p *JWT) Validate(token, dsecs string) (map[string]interface{}, error) {
func (r *Config) Validate(token, dsecs string) (map[string]interface{}, error) {
jp := new(jwtgo.Parser)
jp.ValidMethods = []string{
"RS256", "RS384", "RS512", "ES256", "ES384", "ES512",
@ -253,7 +246,9 @@ func (p *JWT) Validate(token, dsecs string) (map[string]interface{}, error) {
if !ok {
return nil, fmt.Errorf("Invalid kid value %v", jwtToken.Header["kid"])
}
return p.publicKeys[kid], nil
r.RLock()
defer r.RUnlock()
return r.publicKeys[kid], nil
}
var claims jwtgo.MapClaims
@ -261,7 +256,7 @@ func (p *JWT) Validate(token, dsecs string) (map[string]interface{}, error) {
if err != nil {
// Re-populate the public key in-case the JWKS
// pubkeys are refreshed
if err = p.PopulatePublicKey(); err != nil {
if err = r.PopulatePublicKey(); err != nil {
return nil, err
}
jwtToken, err = jwtgo.ParseWithClaims(token, &claims, keyFuncCallback)
@ -282,7 +277,7 @@ func (p *JWT) Validate(token, dsecs string) (map[string]interface{}, error) {
}
// ID returns the provider name and authentication type.
func (p *JWT) ID() ID {
func (Config) ID() ID {
return "jwt"
}
@ -415,6 +410,7 @@ func LookupConfig(kvs config.KVS, transport *http.Transport, closeRespFn func(io
}
c = Config{
RWMutex: &sync.RWMutex{},
ClaimName: env.Get(EnvIdentityOpenIDClaimName, kvs.Get(ClaimName)),
ClaimPrefix: env.Get(EnvIdentityOpenIDClaimPrefix, kvs.Get(ClaimPrefix)),
RedirectURI: env.Get(EnvIdentityOpenIDRedirectURI, kvs.Get(RedirectURI)),
@ -423,7 +419,6 @@ func LookupConfig(kvs config.KVS, transport *http.Transport, closeRespFn func(io
ClientSecret: env.Get(EnvIdentityOpenIDClientSecret, kvs.Get(ClientSecret)),
transport: transport,
closeRespFn: closeRespFn,
mutex: &sync.Mutex{}, // allocate for copying
}
configURL := env.Get(EnvIdentityOpenIDURL, kvs.Get(ConfigURL))
@ -477,10 +472,7 @@ func LookupConfig(kvs config.KVS, transport *http.Transport, closeRespFn func(io
return c, err
}
c.Enabled = true
return c, nil
}
// NewJWT - initialize new jwt authenticator.
func NewJWT(c Config) *JWT {
return &JWT{c}
}

26
internal/config/identity/openid/jwt_test.go
View File

@ -90,16 +90,17 @@ func TestJWTAzureFail(t *testing.T) {
t.Fatal(err)
}
cfg := Config{}
cfg.mutex = &sync.Mutex{}
cfg := Config{
RWMutex: &sync.RWMutex{},
Enabled: true,
}
cfg.JWKS.URL = u1
cfg.publicKeys = keys
jwt := NewJWT(cfg)
if jwt.ID() != "jwt" {
t.Fatalf("Uexpected id %s for the validator", jwt.ID())
if cfg.ID() != "jwt" {
t.Fatalf("Unexpected id %s for the validator", cfg.ID())
}
if _, err := jwt.Validate(jwtToken, ""); err == nil {
if _, err := cfg.Validate(jwtToken, ""); err == nil {
// Azure should fail due to non OIDC compliant JWT
// generated by Azure AD
t.Fatal(err)
@ -138,13 +139,14 @@ func TestJWT(t *testing.T) {
t.Fatal(err)
}
cfg := Config{}
cfg.mutex = &sync.Mutex{}
cfg := Config{
RWMutex: &sync.RWMutex{},
Enabled: true,
}
cfg.JWKS.URL = u1
cfg.publicKeys = keys
jwt := NewJWT(cfg)
if jwt.ID() != "jwt" {
t.Fatalf("Uexpected id %s for the validator", jwt.ID())
if cfg.ID() != "jwt" {
t.Fatalf("Unexpected id %s for the validator", cfg.ID())
}
u, err := url.Parse("http://localhost:8443/?Token=invalid")
@ -152,7 +154,7 @@ func TestJWT(t *testing.T) {
t.Fatal(err)
}
if _, err := jwt.Validate(u.Query().Get("Token"), ""); err == nil {
if _, err := cfg.Validate(u.Query().Get("Token"), ""); err == nil {
t.Fatal(err)
}
}

2
internal/config/identity/openid/validators_test.go
View File

@ -95,7 +95,7 @@ func TestValidators(t *testing.T) {
cfg := Config{}
cfg.JWKS.URL = u
if err = vrs.Add(NewJWT(cfg)); err != nil {
if err = vrs.Add(&cfg); err != nil {
t.Fatal(err)
}