Skip to content

Commit b2fe105

Browse files
MarcialRosalesMarcialRosales
committed
Support opaque token either via header or cookie
1 parent aa50567 commit b2fe105

File tree

2 files changed

+50
-49
lines changed

2 files changed

+50
-49
lines changed

‎deps/rabbitmq_management/src/rabbit_mgmt_oauth_bootstrap.erl‎

Lines changed: 46 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -20,52 +20,37 @@ init(Req0, State) ->
2020
bootstrap_oauth(Req0, State) ->
2121
AuthSettings = rabbit_mgmt_wm_auth:authSettings(),
2222
Dependencies = oauth_dependencies(),
23-
{Req1, SetTokenAuth} = set_token_auth(AuthSettings, Req0),
24-
JSContent = import_dependencies(Dependencies) ++
25-
set_oauth_settings(AuthSettings) ++
26-
SetTokenAuth ++
27-
export_dependencies(Dependencies),
28-
29-
{ok, cowboy_req:reply(200, #{<<"content-type">> => <<"text/javascript; charset=utf-8">>},
30-
JSContent, Req1), State}.
23+
case set_token_auth(AuthSettings, Req0) of
24+
{error, Reason} ->
25+
rabbit_mgmt_util:not_authorised(Reason, ReqData, Context);
26+
{Req1, SetTokenAuth} ->
27+
JSContent = import_dependencies(Dependencies) ++
28+
set_oauth_settings(AuthSettings) ++
29+
SetTokenAuth ++
30+
export_dependencies(Dependencies),
31+
32+
{ok, cowboy_req:reply(200, #{<<"content-type">> => <<"text/javascript; charset=utf-8">>},
33+
JSContent, Req1), State}
34+
end.
3135

3236
set_oauth_settings(AuthSettings) ->
3337
JsonAuthSettings = rabbit_json:encode(rabbit_mgmt_format:format_nulls(AuthSettings)),
3438
["set_oauth_settings(", JsonAuthSettings, ");"].
3539

3640
set_token_auth(AuthSettings, Req0) ->
37-
case proplists:get_value(oauth_enabled, AuthSettings, false) of
41+
TokenOrError = case proplists:get_value(oauth_enabled, AuthSettings, false) of
3842
true ->
3943
case cowboy_req:parse_header(<<"authorization">>, Req0) of
4044
{bearer, Token} ->
41-
?LOG_DEBUG("set_token_auth bearer token ~p", [Token]),
42-
43-
case oauth2_client:is_jwt_token(Token) of
44-
true ->
45-
{
46-
Req0,
47-
["set_token_auth('", Token, "');"]
48-
};
49-
false ->
50-
case oauth2_client:introspect_token(Token) of
51-
{ok, Tk1} ->
52-
?LOG_DEBUG("Successfully introspected token : ~p", [Tk1]),
53-
{
54-
Req0,
55-
["set_token_auth('", Tk1, "');"]
56-
};
57-
{error, Err1} ->
58-
?LOG_ERROR("Failed to introspected token due to ~p", [Err1]),
59-
{
60-
Req0,
61-
[]
62-
}
63-
end
64-
end;
45+
?LOG_DEBUG("set_token_auth bearer token ~p", [Token]),
46+
{
47+
Req0,
48+
Token
49+
};
6550
_ ->
6651
Cookies = cowboy_req:parse_cookies(Req0),
6752
case lists:keyfind(?OAUTH2_ACCESS_TOKEN_COOKIE_NAME, 1, Cookies) of
68-
{_, Token} ->
53+
{_, Token} ->
6954
?LOG_DEBUG("set_token_auth cookie token ~p", [Token]),
7055
{
7156
cowboy_req:set_resp_cookie(
@@ -75,7 +60,7 @@ set_token_auth(AuthSettings, Req0) ->
7560
path => ?OAUTH2_ACCESS_TOKEN_COOKIE_PATH,
7661
same_site => strict
7762
}),
78-
["set_token_auth('", Token, "');"]
63+
Token
7964
};
8065
false -> {
8166
Req0,
@@ -87,22 +72,38 @@ set_token_auth(AuthSettings, Req0) ->
8772
Req0,
8873
[]
8974
}
75+
end,
76+
case TokenOrError of
77+
{error, _} = Error -> Error;
78+
{Req, Token} ->
79+
case oauth2_client:is_jwt_token(Token) of
80+
true ->
81+
{
82+
Req0,
83+
["set_token_auth('", Token, "');"]
84+
};
85+
false ->
86+
case map_opaque_to_jwt_token(Token) of
87+
{ok, Tk1} ->
88+
?LOG_DEBUG("Successfully introspected token : ~p", [Tk1]),
89+
{
90+
Req0,
91+
["set_token_auth('", Tk1, "');"]
92+
};
93+
{error, _} = Err1 ->
94+
Err1
95+
end
96+
end
9097
end.
9198

99+
92100
map_opaque_to_jwt_token(OpaqueToken) ->
93101
case oauth2_client:introspect_token(Token) of
94-
{error, introspected_token_not_valid} ->
95-
?LOG_ERROR("Failed to introspect token due to ~p", [introspected_token_not_valid]),
96-
rabbit_mgmt_util:not_authorised("Introspected token is not active", ReqData, Context);
97-
{error, Reason} ->
98-
?LOG_ERROR("Failed to introspect token due to ~p", [Reason]),
99-
rabbit_mgmt_util:not_authorised(Reason, ReqData, Context);
102+
{error, introspected_token_not_valid} = Error -> Error;
100103
{ok, JwtPayload} ->
101104
case oauth2_client:sign_token(JwtPayload) of
102-
{ok, JWT} ->
103-
rabbit_mgmt_util:reply([{token, JWT}], ReqData, Context);
104-
{error, Reason} ->
105-
rabbit_mgmt_util:not_authorised(Reason, ReqData, Context)
105+
{ok, JWT} -> {ok, JWT};
106+
{error, Reason} -> Error
106107
end
107108
end.
108109

‎deps/rabbitmq_management/test/rabbit_mgmt_wm_auth_SUITE.erl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ groups() ->
5555
%introspect_opaque_token_returns_active_jwt_token,
5656
%introspect_opaque_token_returns_inactive_jwt_token,
5757
%introspect_opaque_token_returns_401_from_auth_server,
58-
idp_introspect_opaque_token
58+
oauth_bootstrap
5959
]}
6060
]},
6161
{verify_multi_resource_and_provider, [], [
@@ -699,7 +699,7 @@ end_per_group(_, Config) ->
699699
init_per_testcase(Testcase, Config) when Testcase =:= introspect_opaque_token_returns_active_jwt_token orelse
700700
Testcase =:= introspect_opaque_token_returns_inactive_jwt_token orelse
701701
Testcase =:= introspect_opaque_token_returns_401_from_auth_server orelse
702-
Testcase =:= idp_introspect_opaque_token ->
702+
Testcase =:= oauth_bootstrap ->
703703

704704
ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, set_env,
705705
[rabbitmq_auth_backend_oauth2, introspection_endpoint,
@@ -735,7 +735,7 @@ init_per_testcase(Testcase, Config) ->
735735
end_per_testcase(Testcase, Config) when Testcase =:= introspect_opaque_token_returns_active_jwt_token orelse
736736
Testcase =:= introspect_opaque_token_returns_inactive_jwt_token orelse
737737
Testcase =:= introspect_opaque_token_returns_401_from_auth_server orelse
738-
Testcase =:= idp_introspect_opaque_token ->
738+
Testcase =:= oauth_bootstrap ->
739739
ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, unset_env,
740740
[rabbitmq_auth_backend_oauth2, introspection_endpoint]),
741741
ok = rabbit_ct_broker_helpers:rpc(Config, 0, application, unset_env,
@@ -995,7 +995,7 @@ introspect_opaque_token_returns_401_from_auth_server(Config) ->
995995
{ok, {{_HTTP, 401, _}, _Headers, _ResBody}} = req(Config, 0, post, "/auth/introspect", [
996996
{"authorization", "bearer 401"}], []).
997997

998-
idp_introspect_opaque_token(Config) ->
998+
oauth_bootstrap(Config) ->
999999
URI = rabbit_mgmt_test_util:uri_base_from(Config, 0, "") ++ "js/oidc-oauth/bootstrap.js",
10001000
Result = httpc:request(get, {URI, [{"Authorization", "bearer active"}]}, [], []),
10011001
ct:log("response idp: ~p ~p", [URI, Result]).

0 commit comments

Comments
 (0)