MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-20 02:27:50 -04:00
Code Issues Packages Projects Releases Wiki Activity

support additional claim info in Auditing STS calls (#15381)

Browse Source 
Bonus: Adds a missing AuditLog from AssumeRoleWithCertificate API

Fixes #9529
This commit is contained in:
Harshavardhana 2022-07-22 11:12:03 -07:00 committed by GitHub
parent ff5a5c1ee0
commit b0d70a0e5e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 63 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
cmd/sts-handlers.go
View File

@ -183,6 +183,9 @@ func parseForm(r *http.Request) error {
func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) { func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRole") ctx := newContext(r, w, "AssumeRole")
claims := make(map[string]interface{})
defer logger.AuditLog(ctx, w, r, claims)
// Check auth here (otherwise r.Form will have unexpected values from // Check auth here (otherwise r.Form will have unexpected values from
// the call to `parseForm` below), but return failure only after we are // the call to `parseForm` below), but return failure only after we are
// able to validate that it is a valid STS request, so that we are able // able to validate that it is a valid STS request, so that we are able
@ -208,7 +211,6 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
} }
ctx = newContext(r, w, action) ctx = newContext(r, w, action)
defer logger.AuditLog(ctx, w, r, nil)
// Validate the authentication result here so that failures will be // Validate the authentication result here so that failures will be
// audit-logged. // audit-logged.
@ -246,25 +248,22 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
return return
} }
m := map[string]interface{}{ claims[expClaim] = UTCNow().Add(duration).Unix()
expClaim: UTCNow().Add(duration).Unix(), claims[parentClaim] = user.AccessKey
parentClaim: user.AccessKey,
}
// Validate that user.AccessKey's policies can be retrieved - it may not // Validate that user.AccessKey's policies can be retrieved - it may not
// be in case the user is disabled. // be in case the user is disabled.
_, err = globalIAMSys.PolicyDBGet(user.AccessKey, false) if _, err = globalIAMSys.PolicyDBGet(user.AccessKey, false); err != nil {
if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, err)
return return
} }
if len(sessionPolicyStr) > 0 { if len(sessionPolicyStr) > 0 {
m[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr)) claims[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr))
} }
secret := globalActiveCred.SecretKey secret := globalActiveCred.SecretKey
cred, err := auth.GetNewCredentialsWithMetadata(m, secret) cred, err := auth.GetNewCredentialsWithMetadata(claims, secret)
if err != nil { if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err)
return return
@ -310,6 +309,9 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Request) { func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRoleSSOCommon") ctx := newContext(r, w, "AssumeRoleSSOCommon")
claims := make(map[string]interface{})
defer logger.AuditLog(ctx, w, r, claims)
// Parse the incoming form data. // Parse the incoming form data.
if err := parseForm(r); err != nil { if err := parseForm(r); err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, err)
@ -333,7 +335,6 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
} }
ctx = newContext(r, w, action) ctx = newContext(r, w, action)
defer logger.AuditLog(ctx, w, r, nil)
token := r.Form.Get(stsToken) token := r.Form.Get(stsToken)
if token == "" { if token == "" {
@ -356,8 +357,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
} }
// Validate JWT; check clientID in claims matches the one associated with the roleArn // Validate JWT; check clientID in claims matches the one associated with the roleArn
m, err := globalOpenIDConfig.Validate(roleArn, token, accessToken, r.Form.Get(stsDurationSeconds)) if err := globalOpenIDConfig.Validate(roleArn, token, accessToken, r.Form.Get(stsDurationSeconds), claims); err != nil {
if err != nil {
switch err { switch err {
case openid.ErrTokenExpired: case openid.ErrTokenExpired:
switch action { switch action {
@ -379,13 +379,13 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
if globalIAMSys.HasRolePolicy() { if globalIAMSys.HasRolePolicy() {
// If roleArn is used, we set it as a claim, and use the // If roleArn is used, we set it as a claim, and use the
// associated policy when credentials are used. // associated policy when credentials are used.
m[roleArnClaim] = roleArn.String() claims[roleArnClaim] = roleArn.String()
} else { } else {
// If no role policy is configured, then we use claims from the // If no role policy is configured, then we use claims from the
// JWT. This is a MinIO STS API specific value, this value // JWT. This is a MinIO STS API specific value, this value
// should be set and configured on your identity provider as // should be set and configured on your identity provider as
// part of JWT custom claims. // part of JWT custom claims.
policySet, ok := iampolicy.GetPoliciesFromClaims(m, iamPolicyClaimNameOpenID()) policySet, ok := iampolicy.GetPoliciesFromClaims(claims, iamPolicyClaimNameOpenID())
policies := strings.Join(policySet.ToSlice(), ",") policies := strings.Join(policySet.ToSlice(), ",")
if ok { if ok {
policyName = globalIAMSys.CurrentPolicies(policies) policyName = globalIAMSys.CurrentPolicies(policies)
@ -402,7 +402,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
return return
} }
} }
m[iamPolicyClaimNameOpenID()] = policyName claims[iamPolicyClaimNameOpenID()] = policyName
} }
sessionPolicyStr := r.Form.Get(stsPolicy) sessionPolicyStr := r.Form.Get(stsPolicy)
@ -427,11 +427,11 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
return return
} }
m[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr)) claims[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr))
} }
secret := globalActiveCred.SecretKey secret := globalActiveCred.SecretKey
cred, err := auth.GetNewCredentialsWithMetadata(m, secret) cred, err := auth.GetNewCredentialsWithMetadata(claims, secret)
if err != nil { if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err)
return return
@ -443,7 +443,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
// parentUser as per the requirements for service accounts for OpenID // parentUser as per the requirements for service accounts for OpenID
// based logins. // based logins.
var subFromToken string var subFromToken string
if v, ok := m[subClaim]; ok { if v, ok := claims[subClaim]; ok {
subFromToken, _ = v.(string) subFromToken, _ = v.(string)
} }
@ -454,7 +454,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ
} }
var issFromToken string var issFromToken string
if v, ok := m[issClaim]; ok { if v, ok := claims[issClaim]; ok {
issFromToken, _ = v.(string) issFromToken, _ = v.(string)
} }
@ -540,7 +540,8 @@ func (sts *stsAPIHandlers) AssumeRoleWithClientGrants(w http.ResponseWriter, r *
func (sts *stsAPIHandlers) AssumeRoleWithLDAPIdentity(w http.ResponseWriter, r *http.Request) { func (sts *stsAPIHandlers) AssumeRoleWithLDAPIdentity(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRoleWithLDAPIdentity") ctx := newContext(r, w, "AssumeRoleWithLDAPIdentity")
defer logger.AuditLog(ctx, w, r, nil, stsLDAPPassword) claims := make(map[string]interface{})
defer logger.AuditLog(ctx, w, r, claims, stsLDAPPassword)
// Parse the incoming form data. // Parse the incoming form data.
if err := parseForm(r); err != nil { if err := parseForm(r); err != nil {
@ -615,18 +616,16 @@ func (sts *stsAPIHandlers) AssumeRoleWithLDAPIdentity(w http.ResponseWriter, r *
return return
} }
m := map[string]interface{}{ claims[expClaim] = UTCNow().Add(expiryDur).Unix()
expClaim: UTCNow().Add(expiryDur).Unix(), claims[ldapUser] = ldapUserDN
ldapUser: ldapUserDN, claims[ldapUserN] = ldapUsername
ldapUserN: ldapUsername,
}
if len(sessionPolicyStr) > 0 { if len(sessionPolicyStr) > 0 {
m[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr)) claims[iampolicy.SessionPolicyName] = base64.StdEncoding.EncodeToString([]byte(sessionPolicyStr))
} }
secret := globalActiveCred.SecretKey secret := globalActiveCred.SecretKey
cred, err := auth.GetNewCredentialsWithMetadata(m, secret) cred, err := auth.GetNewCredentialsWithMetadata(claims, secret)
if err != nil { if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err)
return return
@ -682,6 +681,9 @@ func (sts *stsAPIHandlers) AssumeRoleWithLDAPIdentity(w http.ResponseWriter, r *
func (sts *stsAPIHandlers) AssumeRoleWithCertificate(w http.ResponseWriter, r *http.Request) { func (sts *stsAPIHandlers) AssumeRoleWithCertificate(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRoleWithCertificate") ctx := newContext(r, w, "AssumeRoleWithCertificate")
claims := make(map[string]interface{})
defer logger.AuditLog(ctx, w, r, claims)
if !globalSTSTLSConfig.Enabled { if !globalSTSTLSConfig.Enabled {
writeSTSErrorResponse(ctx, w, true, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCertificate' is disabled")) writeSTSErrorResponse(ctx, w, true, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCertificate' is disabled"))
return return
@ -789,13 +791,13 @@ func (sts *stsAPIHandlers) AssumeRoleWithCertificate(w http.ResponseWriter, r *h
// Associate any service accounts to the certificate CN // Associate any service accounts to the certificate CN
parentUser := "tls:" + certificate.Subject.CommonName parentUser := "tls:" + certificate.Subject.CommonName
tmpCredentials, err := auth.GetNewCredentialsWithMetadata(map[string]interface{}{ claims[expClaim] = UTCNow().Add(expiry).Unix()
expClaim: UTCNow().Add(expiry).Unix(), claims[subClaim] = certificate.Subject.CommonName
parentClaim: parentUser, claims[audClaim] = certificate.Subject.Organization
subClaim: certificate.Subject.CommonName, claims[issClaim] = certificate.Issuer.CommonName
audClaim: certificate.Subject.Organization, claims[parentClaim] = parentUser
issClaim: certificate.Issuer.CommonName,
}, globalActiveCred.SecretKey) tmpCredentials, err := auth.GetNewCredentialsWithMetadata(claims, globalActiveCred.SecretKey)
if err != nil { if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err)
return return
@ -838,6 +840,9 @@ func (sts *stsAPIHandlers) AssumeRoleWithCertificate(w http.ResponseWriter, r *h
func (sts *stsAPIHandlers) AssumeRoleWithCustomToken(w http.ResponseWriter, r *http.Request) { func (sts *stsAPIHandlers) AssumeRoleWithCustomToken(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRoleWithCustomToken") ctx := newContext(r, w, "AssumeRoleWithCustomToken")
claims := make(map[string]interface{})
defer logger.AuditLog(ctx, w, r, claims)
if globalAuthNPlugin == nil { if globalAuthNPlugin == nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCustomToken' is disabled")) writeSTSErrorResponse(ctx, w, true, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCustomToken' is disabled"))
return return
@ -849,8 +854,6 @@ func (sts *stsAPIHandlers) AssumeRoleWithCustomToken(w http.ResponseWriter, r *h
return return
} }
defer logger.AuditLog(ctx, w, r, nil)
token := r.Form.Get(stsToken) token := r.Form.Get(stsToken)
if token == "" { if token == "" {
writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, fmt.Errorf("Invalid empty `Token` parameter provided")) writeSTSErrorResponse(ctx, w, true, ErrSTSInvalidParameterValue, fmt.Errorf("Invalid empty `Token` parameter provided"))
@ -904,21 +907,20 @@ func (sts *stsAPIHandlers) AssumeRoleWithCustomToken(w http.ResponseWriter, r *h
parentUser := "custom:" + res.Success.User parentUser := "custom:" + res.Success.User
// metadata map // metadata map
m := map[string]interface{}{ claims[expClaim] = UTCNow().Add(time.Duration(expiry) * time.Second).Unix()
expClaim: UTCNow().Add(time.Duration(expiry) * time.Second).Unix(), claims[subClaim] = parentUser
parentClaim: parentUser, claims[roleArnClaim] = roleArn.String()
subClaim: parentUser, claims[parentClaim] = parentUser
roleArnClaim: roleArn.String(),
}
// Add all other claims from the plugin **without** replacing any // Add all other claims from the plugin **without** replacing any
// existing claims. // existing claims.
for k, v := range res.Success.Claims { for k, v := range res.Success.Claims {
if _, ok := m[k]; !ok { if _, ok := claims[k]; !ok {
m[k] = v claims[k] = v
} }
} }
tmpCredentials, err := auth.GetNewCredentialsWithMetadata(m, globalActiveCred.SecretKey) tmpCredentials, err := auth.GetNewCredentialsWithMetadata(claims, globalActiveCred.SecretKey)
if err != nil { if err != nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err) writeSTSErrorResponse(ctx, w, true, ErrSTSInternalError, err)
return return

23
internal/config/identity/openid/jwt.go
View File

@ -131,7 +131,7 @@ const (
) )
// Validate - validates the id_token. // Validate - validates the id_token.
func (r *Config) Validate(arn arn.ARN, token, accessToken, dsecs string) (map[string]interface{}, error) { func (r *Config) Validate(arn arn.ARN, token, accessToken, dsecs string, claims jwtgo.MapClaims) error {
jp := new(jwtgo.Parser) jp := new(jwtgo.Parser)
jp.ValidMethods = []string{ jp.ValidMethods = []string{
"RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512",
@ -148,33 +148,32 @@ func (r *Config) Validate(arn arn.ARN, token, accessToken, dsecs string) (map[st
pCfg, ok := r.arnProviderCfgsMap[arn] pCfg, ok := r.arnProviderCfgsMap[arn]
if !ok { if !ok {
return nil, fmt.Errorf("Role %s does not exist", arn) return fmt.Errorf("Role %s does not exist", arn)
} }
var claims jwtgo.MapClaims
jwtToken, err := jp.ParseWithClaims(token, &claims, keyFuncCallback) jwtToken, err := jp.ParseWithClaims(token, &claims, keyFuncCallback)
if err != nil { if err != nil {
// Re-populate the public key in-case the JWKS // Re-populate the public key in-case the JWKS
// pubkeys are refreshed // pubkeys are refreshed
if err = r.PopulatePublicKey(arn); err != nil { if err = r.PopulatePublicKey(arn); err != nil {
return nil, err return err
} }
jwtToken, err = jwtgo.ParseWithClaims(token, &claims, keyFuncCallback) jwtToken, err = jwtgo.ParseWithClaims(token, &claims, keyFuncCallback)
if err != nil { if err != nil {
return nil, err return err
} }
} }
if !jwtToken.Valid { if !jwtToken.Valid {
return nil, ErrTokenExpired return ErrTokenExpired
} }
if err = updateClaimsExpiry(dsecs, claims); err != nil { if err = updateClaimsExpiry(dsecs, claims); err != nil {
return nil, err return err
} }
if err = r.updateUserinfoClaims(arn, accessToken, claims); err != nil { if err = r.updateUserinfoClaims(arn, accessToken, claims); err != nil {
return nil, err return err
} }
// Validate that matching clientID appears in the aud or azp claims. // Validate that matching clientID appears in the aud or azp claims.
@ -188,7 +187,7 @@ func (r *Config) Validate(arn arn.ARN, token, accessToken, dsecs string) (map[st
// case sensitive // case sensitive
audValues, ok := iampolicy.GetValuesFromClaims(claims, audClaim) audValues, ok := iampolicy.GetValuesFromClaims(claims, audClaim)
if !ok { if !ok {
return nil, errors.New("STS JWT Token has `aud` claim invalid, `aud` must match configured OpenID Client ID") return errors.New("STS JWT Token has `aud` claim invalid, `aud` must match configured OpenID Client ID")
} }
if !audValues.Contains(pCfg.ClientID) { if !audValues.Contains(pCfg.ClientID) {
// if audience claims is missing, look for "azp" claims. // if audience claims is missing, look for "azp" claims.
@ -202,14 +201,14 @@ func (r *Config) Validate(arn arn.ARN, token, accessToken, dsecs string) (map[st
// string containing a StringOrURI value // string containing a StringOrURI value
azpValues, ok := iampolicy.GetValuesFromClaims(claims, azpClaim) azpValues, ok := iampolicy.GetValuesFromClaims(claims, azpClaim)
if !ok { if !ok {
return nil, errors.New("STS JWT Token has `azp` claim invalid, `azp` must match configured OpenID Client ID") return errors.New("STS JWT Token has `azp` claim invalid, `azp` must match configured OpenID Client ID")
} }
if !azpValues.Contains(pCfg.ClientID) { if !azpValues.Contains(pCfg.ClientID) {
return nil, errors.New("STS JWT Token has `azp` claim invalid, `azp` must match configured OpenID Client ID") return errors.New("STS JWT Token has `azp` claim invalid, `azp` must match configured OpenID Client ID")
} }
} }
return claims, nil return nil
} }
func (r *Config) updateUserinfoClaims(arn arn.ARN, accessToken string, claims map[string]interface{}) error { func (r *Config) updateUserinfoClaims(arn arn.ARN, accessToken string, claims map[string]interface{}) error {

7
internal/config/identity/openid/jwt_test.go
View File

@ -29,6 +29,7 @@ import (
"time" "time"
jwtg "github.com/golang-jwt/jwt/v4" jwtg "github.com/golang-jwt/jwt/v4"
jwtgo "github.com/golang-jwt/jwt/v4"
"github.com/minio/minio/internal/arn" "github.com/minio/minio/internal/arn"
"github.com/minio/minio/internal/config" "github.com/minio/minio/internal/config"
jwtm "github.com/minio/minio/internal/jwt" jwtm "github.com/minio/minio/internal/jwt"
@ -106,7 +107,8 @@ func TestJWTAzureFail(t *testing.T) {
}, },
} }
if _, err := cfg.Validate(DummyRoleARN, jwtToken, "", ""); err == nil { var claims jwtgo.MapClaims
if err = cfg.Validate(DummyRoleARN, jwtToken, "", "", claims); err == nil {
// Azure should fail due to non OIDC compliant JWT // Azure should fail due to non OIDC compliant JWT
// generated by Azure AD // generated by Azure AD
t.Fatal(err) t.Fatal(err)
@ -159,7 +161,8 @@ func TestJWT(t *testing.T) {
t.Fatal(err) t.Fatal(err)
} }
if _, err := cfg.Validate(DummyRoleARN, u.Query().Get("Token"), "", ""); err == nil { var claims jwtgo.MapClaims
if err = cfg.Validate(DummyRoleARN, u.Query().Get("Token"), "", "", claims); err == nil {
t.Fatal(err) t.Fatal(err)
} }
} }