Skip to content

Commit b1e274c

Browse files
nishant-dnishant-d
authored
FEAT: call dex directly instead of proxying argocd (#922)
* local import working * authenticator debug * local tested * local tested * docker version upgrade * argo dependency import * removed filter * login proxy correction * user filter redirect * commited dev ssl setting * redirect url rewerite * password login tested * removed http only cookie * admin login password verified * local dev conf * removed serve tls * admin login acd deligate * path prefix url compatible * callback endpoint change * auth redirect reverted * refactor compiling * commited wiregen * auth related wiring extracted in seperate class * authenticator upgrade * middleware correcton * authenticator upgrade
1 parent 5920bde commit b1e274c

File tree

892 files changed

+98477
-43112
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

892 files changed

+98477
-43112
lines changed

‎App.go‎

Lines changed: 42 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,10 @@ package main
1919

2020
import (
2121
"context"
22+
"crypto/tls"
2223
"fmt"
23-
"github.com/argoproj/argo-cd/util/session"
2424
"github.com/casbin/casbin"
25+
authMiddleware "github.com/devtron-labs/authenticator/middleware"
2526
"github.com/devtron-labs/devtron/api/router"
2627
"github.com/devtron-labs/devtron/api/sse"
2728
"github.com/devtron-labs/devtron/client/argocdServer"
@@ -38,30 +39,42 @@ import (
3839
)
3940

4041
type App struct {
41-
MuxRouter *router.MuxRouter
42-
Logger *zap.SugaredLogger
43-
SSE *sse.SSE
44-
Enforcer *casbin.Enforcer
45-
sessionManager *session.SessionManager
46-
server *http.Server
47-
db *pg.DB
48-
pubsubClient *pubsub.PubSubClient
42+
MuxRouter *router.MuxRouter
43+
Logger *zap.SugaredLogger
44+
SSE *sse.SSE
45+
Enforcer *casbin.Enforcer
46+
server *http.Server
47+
db *pg.DB
48+
pubsubClient *pubsub.PubSubClient
49+
// used for local dev only
50+
serveTls bool
51+
sessionManager2 *authMiddleware.SessionManager
4952
}
5053

5154
func NewApp(router *router.MuxRouter,
5255
Logger *zap.SugaredLogger,
5356
sse *sse.SSE,
54-
manager *session.SessionManager,
5557
versionService argocdServer.VersionService,
5658
enforcer *casbin.Enforcer,
5759
db *pg.DB,
58-
pubsubClient *pubsub.PubSubClient) *App {
60+
pubsubClient *pubsub.PubSubClient,
61+
sessionManager2 *authMiddleware.SessionManager,
62+
) *App {
5963
//check argo connection
6064
err := versionService.CheckVersion()
6165
if err != nil {
6266
log.Panic(err)
6367
}
64-
app := &App{MuxRouter: router, Logger: Logger, SSE: sse, Enforcer: enforcer, sessionManager: manager, db: db, pubsubClient: pubsubClient}
68+
app := &App{
69+
MuxRouter: router,
70+
Logger: Logger,
71+
SSE: sse,
72+
Enforcer: enforcer,
73+
db: db,
74+
pubsubClient: pubsubClient,
75+
serveTls: false,
76+
sessionManager2: sessionManager2,
77+
}
6578
return app
6679
}
6780

@@ -83,11 +96,25 @@ func (app *App) Start() {
8396
app.MuxRouter.Init()
8497
//authEnforcer := casbin2.Create()
8598

86-
server := &http.Server{Addr: fmt.Sprintf(":%d", port), Handler: user.Authorizer(app.Enforcer, app.sessionManager)(app.MuxRouter.Router)}
87-
99+
server := &http.Server{Addr: fmt.Sprintf(":%d", port), Handler: authMiddleware.Authorizer(app.sessionManager2, user.WhitelistChecker)(app.MuxRouter.Router)}
88100
app.MuxRouter.Router.Use(middleware.PrometheusMiddleware)
89101
app.server = server
90-
err := server.ListenAndServe()
102+
var err error
103+
if app.serveTls {
104+
cert, err := tls.LoadX509KeyPair(
105+
"localhost.crt",
106+
"localhost.key",
107+
)
108+
if err != nil {
109+
log.Fatal(err)
110+
}
111+
server.TLSConfig = &tls.Config{
112+
Certificates: []tls.Certificate{cert},
113+
}
114+
err = server.ListenAndServeTLS("", "")
115+
} else {
116+
err = server.ListenAndServe()
117+
}
91118
//err := http.ListenAndServe(fmt.Sprintf(":%d", port), auth.Authorizer(app.Enforcer, app.sessionManager)(app.MuxRouter.Router))
92119
if err != nil {
93120
app.Logger.Errorw("error in startup", "err", err)

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.15.10-alpine3.13 AS build-env
1+
FROM golang:1.16.10-alpine3.13 AS build-env
22

33
RUN echo $GOPATH
44

@@ -9,7 +9,7 @@ WORKDIR /go/src/github.com/devtron-labs/devtron
99
ADD . /go/src/github.com/devtron-labs/devtron/
1010
RUN GOOS=linux make
1111

12-
FROM alpine:3.13
12+
FROM alpine:3.15.0
1313
RUN apk add --no-cache ca-certificates
1414
RUN apk update
1515
RUN apk add git

‎Wire.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ func InitializeApp() (*App, error) {
672672
wire.Bind(new(restHandler.BulkUpdateRestHandler), new(*restHandler.BulkUpdateRestHandlerImpl)),
673673

674674
router.NewCoreAppRouterImpl,
675-
wire.Bind(new(router.CoreAppRouter),new(*router.CoreAppRouterImpl)),
675+
wire.Bind(new(router.CoreAppRouter), new(*router.CoreAppRouterImpl)),
676676
restHandler.NewCoreAppRestHandlerImpl,
677677
wire.Bind(new(restHandler.CoreAppRestHandler), new(*restHandler.CoreAppRestHandlerImpl)),
678678

@@ -708,6 +708,8 @@ func InitializeApp() (*App, error) {
708708
pipelineConfig.NewAppLabelRepositoryImpl,
709709
wire.Bind(new(pipelineConfig.AppLabelRepository), new(*pipelineConfig.AppLabelRepositoryImpl)),
710710
util2.NewGoJsonSchemaCustomFormatChecker,
711+
712+
AuthWireSet,
711713
)
712714
return &App{}, nil
713715
}

‎api/restHandler/UserAuthHandler.go‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ package restHandler
2020
import (
2121
"encoding/json"
2222
"fmt"
23+
"github.com/devtron-labs/authenticator/middleware"
2324
"github.com/devtron-labs/devtron/api/restHandler/common"
2425
"net/http"
2526
"strings"
@@ -53,15 +54,31 @@ type UserAuthHandlerImpl struct {
5354
natsClient *pubsub.PubSubClient
5455
userService user.UserService
5556
ssoLoginService sso.SSOLoginService
57+
loginService *middleware.LoginService
5658
}
5759

5860
const POLICY_UPDATE_TOPIC = "Policy.Update"
5961

60-
func NewUserAuthHandlerImpl(userAuthService user.UserAuthService, validator *validator.Validate,
61-
logger *zap.SugaredLogger, enforcer rbac.Enforcer, natsClient *pubsub.PubSubClient, userService user.UserService,
62-
ssoLoginService sso.SSOLoginService) *UserAuthHandlerImpl {
63-
userAuthHandler := &UserAuthHandlerImpl{userAuthService: userAuthService, validator: validator, logger: logger,
64-
enforcer: enforcer, natsClient: natsClient, userService: userService, ssoLoginService: ssoLoginService}
62+
func NewUserAuthHandlerImpl(
63+
userAuthService user.UserAuthService,
64+
validator *validator.Validate,
65+
logger *zap.SugaredLogger,
66+
enforcer rbac.Enforcer,
67+
natsClient *pubsub.PubSubClient,
68+
userService user.UserService,
69+
ssoLoginService sso.SSOLoginService,
70+
loginService *middleware.LoginService,
71+
) *UserAuthHandlerImpl {
72+
userAuthHandler := &UserAuthHandlerImpl{
73+
userAuthService: userAuthService,
74+
validator: validator,
75+
logger: logger,
76+
enforcer: enforcer,
77+
natsClient: natsClient,
78+
userService: userService,
79+
ssoLoginService: ssoLoginService,
80+
loginService: loginService,
81+
}
6582

6683
err := userAuthHandler.Subscribe()
6784
if err != nil {
@@ -86,7 +103,7 @@ func (handler UserAuthHandlerImpl) LoginHandler(w http.ResponseWriter, r *http.R
86103
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
87104
return
88105
}
89-
106+
//token, err := handler.loginService.CreateLoginSession(up.Username, up.Password)
90107
token, err := handler.userAuthService.HandleLogin(up.Username, up.Password)
91108
if err != nil {
92109
common.WriteJsonResp(w, fmt.Errorf("invalid username or password"), nil, http.StatusForbidden)

‎api/router/UserAuthRouter.go‎

Lines changed: 24 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,16 @@
1818
package router
1919

2020
import (
21-
"fmt"
2221
"github.com/argoproj/argo-cd/util/settings"
22+
"github.com/devtron-labs/authenticator/client"
23+
"github.com/devtron-labs/authenticator/oidc"
2324
"github.com/devtron-labs/devtron/api/restHandler"
2425
"github.com/devtron-labs/devtron/client/argocdServer"
25-
"github.com/devtron-labs/devtron/pkg/dex"
2626
"github.com/devtron-labs/devtron/pkg/user"
2727
"github.com/gorilla/mux"
2828
"go.uber.org/zap"
29-
"net"
3029
"net/http"
31-
"time"
30+
"strings"
3231
)
3332

3433
type UserAuthRouter interface {
@@ -40,46 +39,34 @@ type UserAuthRouterImpl struct {
4039
userAuthHandler restHandler.UserAuthHandler
4140
cdProxy func(writer http.ResponseWriter, request *http.Request)
4241
dexProxy func(writer http.ResponseWriter, request *http.Request)
42+
clientApp *oidc.ClientApp
4343
}
4444

45-
func NewUserAuthRouterImpl(logger *zap.SugaredLogger, userAuthHandler restHandler.UserAuthHandler, cdCfg *argocdServer.Config, dexCfg *dex.Config, settings *settings.ArgoCDSettings, userService user.UserService) *UserAuthRouterImpl {
45+
func NewUserAuthRouterImpl(logger *zap.SugaredLogger, userAuthHandler restHandler.UserAuthHandler, settings *settings.ArgoCDSettings, userService user.UserService, dexConfig *client.DexConfig) (*UserAuthRouterImpl, error) {
4646
tlsConfig := settings.TLSConfig()
4747
if tlsConfig != nil {
4848
tlsConfig.InsecureSkipVerify = true
4949
}
50-
client := &http.Client{
51-
Transport: &http.Transport{
52-
TLSClientConfig: tlsConfig,
53-
Proxy: http.ProxyFromEnvironment,
54-
Dial: (&net.Dialer{
55-
Timeout: 30 * time.Second,
56-
KeepAlive: 30 * time.Second,
57-
}).Dial,
58-
TLSHandshakeTimeout: 10 * time.Second,
59-
ExpectContinueTimeout: 1 * time.Second,
60-
},
61-
}
62-
dexClient := &http.Client{
63-
Transport: &http.Transport{
64-
TLSClientConfig: tlsConfig,
65-
Proxy: http.ProxyFromEnvironment,
66-
Dial: (&net.Dialer{
67-
Timeout: 30 * time.Second,
68-
KeepAlive: 30 * time.Second,
69-
}).Dial,
70-
TLSHandshakeTimeout: 10 * time.Second,
71-
ExpectContinueTimeout: 1 * time.Second,
72-
},
73-
}
74-
dexProxy := argocdServer.NewDexHTTPReverseProxy(fmt.Sprintf("%s:%s", dexCfg.Host, dexCfg.Port), dexClient.Transport)
75-
cdProxy := argocdServer.NewCDHTTPReverseProxy(fmt.Sprintf("https://%s:%s", cdCfg.Host, cdCfg.Port), client.Transport, userService.GetUserByToken)
7650
router := &UserAuthRouterImpl{
7751
userAuthHandler: userAuthHandler,
78-
cdProxy: cdProxy,
79-
dexProxy: dexProxy,
8052
logger: logger,
8153
}
82-
return router
54+
logger.Infow("auth starting with dex conf", "conf", dexConfig)
55+
oidcClient, dexProxy, err := client.GetOidcClient(dexConfig, userService.UserExists, router.RedirectUrlSanitiser)
56+
if err != nil {
57+
return nil, err
58+
}
59+
router.dexProxy = dexProxy
60+
router.clientApp = oidcClient
61+
return router, nil
62+
}
63+
64+
// RedirectUrlSanitiser replaces initial "/orchestrator" from url
65+
func (router UserAuthRouterImpl) RedirectUrlSanitiser(redirectUrl string) string {
66+
if strings.Contains(redirectUrl, argocdServer.Dashboard) {
67+
redirectUrl = strings.ReplaceAll(redirectUrl, argocdServer.Orchestrator, "")
68+
}
69+
return redirectUrl
8370
}
8471

8572
func (router UserAuthRouterImpl) initUserAuthRouter(userAuthRouter *mux.Router) {
@@ -89,10 +76,9 @@ func (router UserAuthRouterImpl) initUserAuthRouter(userAuthRouter *mux.Router)
8976
}).Methods("GET")
9077

9178
userAuthRouter.PathPrefix("/api/dex").HandlerFunc(router.dexProxy)
92-
userAuthRouter.Path("/login").HandlerFunc(router.cdProxy)
93-
userAuthRouter.Path("/auth/login").HandlerFunc(router.cdProxy)
94-
userAuthRouter.PathPrefix("/auth/callback").HandlerFunc(router.cdProxy)
95-
79+
userAuthRouter.Path("/login").HandlerFunc(router.clientApp.HandleLogin)
80+
userAuthRouter.Path("/auth/login").HandlerFunc(router.clientApp.HandleLogin)
81+
userAuthRouter.Path("/auth/callback").HandlerFunc(router.clientApp.HandleCallback)
9682
userAuthRouter.Path("/api/v1/session").HandlerFunc(router.userAuthHandler.LoginHandler)
9783
userAuthRouter.Path("/refresh").HandlerFunc(router.userAuthHandler.RefreshTokenHandler)
9884
// Policies mapping in orchestrator

‎authWire.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package main
2+
3+
import (
4+
"github.com/devtron-labs/authenticator/client"
5+
"github.com/devtron-labs/authenticator/middleware"
6+
"github.com/google/wire"
7+
)
8+
9+
// AuthWireSet: set of components used to initialise authentication with dex
10+
var AuthWireSet = wire.NewSet(
11+
wire.Value(client.LocalDevMode(false)),
12+
client.NewK8sClient,
13+
client.BuildDexConfig,
14+
client.GetSettings,
15+
middleware.NewSessionManager,
16+
middleware.NewUserLogin,
17+
)

‎go.mod‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ require (
88
github.com/Azure/go-autorest/autorest/adal v0.9.13
99
github.com/Masterminds/semver v1.5.0 // indirect
1010
github.com/Pallinder/go-randomdata v1.2.0
11-
github.com/ThreeDotsLabs/watermill v1.0.2 // indirect
1211
github.com/argoproj/argo v2.4.1+incompatible
1312
github.com/argoproj/argo-cd v1.2.3
1413
github.com/argoproj/pkg v0.0.0-20190830164810-036726ef3c78 // indirect
@@ -17,9 +16,10 @@ require (
1716
github.com/casbin/casbin v1.9.1
1817
github.com/casbin/xorm-adapter v1.0.1-0.20190716004226-a317737a1007
1918
github.com/colinmarc/hdfs v1.1.4-0.20180805212432-9746310a4d31 // indirect
20-
github.com/coreos/go-oidc v2.1.0+incompatible
19+
github.com/coreos/go-oidc v2.2.1+incompatible
2120
github.com/cyphar/filepath-securejoin v0.2.2 // indirect
2221
github.com/davecgh/go-spew v1.1.1
22+
github.com/devtron-labs/authenticator v0.4.18
2323
github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c // indirect
2424
github.com/elazarl/goproxy v0.0.0-20210110162100-a92cc753f88e // indirect
2525
github.com/emicklei/go-restful v2.11.0+incompatible // indirect
@@ -36,16 +36,15 @@ require (
3636
github.com/gobuffalo/envy v1.7.1 // indirect
3737
github.com/gobuffalo/packr v1.30.1 // indirect
3838
github.com/gobwas/glob v0.2.3 // indirect
39-
github.com/gogo/protobuf v1.3.1
40-
github.com/golang-jwt/jwt/v4 v4.0.0
39+
github.com/gogo/protobuf v1.3.2
40+
github.com/golang-jwt/jwt/v4 v4.1.0
4141
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
42-
github.com/golang/protobuf v1.3.2
43-
github.com/google/go-cmp v0.3.0
42+
github.com/golang/protobuf v1.4.2
43+
github.com/google/go-cmp v0.5.1
4444
github.com/google/go-github v17.0.0+incompatible
45-
github.com/google/uuid v1.1.5 // indirect
4645
github.com/google/wire v0.3.0
4746
github.com/googleapis/gnostic v0.3.1 // indirect
48-
github.com/gorilla/mux v1.7.3
47+
github.com/gorilla/mux v1.8.0
4948
github.com/gorilla/schema v1.1.0
5049
github.com/gorilla/sessions v1.2.0
5150
github.com/gorilla/websocket v1.4.1 // indirect
@@ -56,7 +55,6 @@ require (
5655
github.com/hashicorp/go-uuid v1.0.1 // indirect
5756
github.com/hashicorp/golang-lru v0.5.3 // indirect
5857
github.com/igm/sockjs-go v3.0.0+incompatible // indirect
59-
github.com/imdario/mergo v0.3.8 // indirect
6058
github.com/jcmturner/gofork v1.0.0 // indirect
6159
github.com/jinzhu/inflection v1.0.0 // indirect
6260
github.com/json-iterator/go v1.1.8 // indirect
@@ -75,9 +73,7 @@ require (
7573
github.com/patrickmn/go-cache v2.1.0+incompatible
7674
github.com/pkg/errors v0.9.1
7775
github.com/posthog/posthog-go v0.0.0-20210610161230-cd4408afb35a
78-
github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
7976
github.com/prometheus/client_golang v1.1.0
80-
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4 // indirect
8177
github.com/prometheus/common v0.7.0 // indirect
8278
github.com/prometheus/procfs v0.0.5 // indirect
8379
github.com/robfig/cron/v3 v3.0.1
@@ -93,26 +89,21 @@ require (
9389
github.com/xeipuuv/gojsonschema v1.2.0
9490
go.uber.org/multierr v1.2.0 // indirect
9591
go.uber.org/zap v1.10.0
96-
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
97-
golang.org/x/time v0.0.0-20190921001708-c4c64cad1fd0 // indirect
98-
google.golang.org/appengine v1.6.5
99-
google.golang.org/genproto v0.0.0-20191009194640-548a555dbc03 // indirect
100-
google.golang.org/grpc v1.24.0
92+
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
93+
google.golang.org/grpc v1.31.0
10194
gopkg.in/go-playground/assert.v1 v1.2.1 // indirect
10295
gopkg.in/go-playground/validator.v9 v9.30.0
10396
gopkg.in/igm/sockjs-go.v3 v3.0.0
104-
gopkg.in/inf.v0 v0.9.1 // indirect
10597
gopkg.in/jcmturner/goidentity.v2 v2.0.0 // indirect
106-
gopkg.in/square/go-jose.v2 v2.3.1 // indirect
10798
gopkg.in/src-d/go-git.v4 v4.13.1
10899
gopkg.in/yaml.v2 v2.4.0
109100
k8s.io/api v0.0.0-20191004102349-159aefb8556b
110101
k8s.io/apimachinery v0.0.0-20190816221834-a9f1d8a9c101
111102
k8s.io/client-go v11.0.1-0.20190820062731-7e43eff7c80a+incompatible
112103
k8s.io/helm v2.12.3+incompatible
113-
k8s.io/klog v1.0.0 // indirect
114104
k8s.io/kube-openapi v0.0.0-20190918143330-0270cf2f1c1d // indirect
115-
k8s.io/utils v0.0.0-20191010214722-8d271d903fe4 // indirect
116105
mellium.im/sasl v0.2.1 // indirect
117106
xorm.io/core v0.7.2 // indirect
118107
)
108+
109+
replace github.com/devtron-labs/authenticator => github.com/nishant-d/authenticator v0.4.18

0 commit comments

Comments
 (0)