Use proxy for all operations

MarcialRosales · MarcialRosales · commit c3beea4b1056 · 2024-12-15T13:25:45.000+01:00
get_token
get_openid_configuration
Download jwks
diff --git a/deps/oauth2_client/src/oauth2_client.erl b/deps/oauth2_client/src/oauth2_client.erl
@@ -13,6 +13,10 @@
         merge_openid_configuration/2,
         merge_oauth_provider/2,
         extract_ssl_options_as_list/1,
+        get_httpc_option_proxy_auth_if_any/1,
+        get_httpc_option_proxy_if_any/1,
+        get_httpc_option_ssl_options_if_any/1,
+        get_httpc_option_timeout_of_default/1,
         format_ssl_options/1, format_oauth_provider/1, format_oauth_provider_id/1,
         extract_proxy_options_from_url/1
         ]).
@@ -29,11 +33,10 @@ get_access_token(OAuthProvider, Request) ->
     Header = [],
     Type = ?CONTENT_URLENCODED,
     Body = build_access_token_request_body(Request),
-    HTTPOptions = get_ssl_options_if_any(OAuthProvider) ++
-        get_timeout_of_default(Request#access_token_request.timeout) ++ 
-        get_proxy_auth_if_any(OAuthProvider#oauth_provider.proxy_options),
-    Options = get_proxy_if_any(OAuthProvider#oauth_provider.proxy_options),    
-    Response = httpc:request(post, {URL, Header, Type, Body}, HTTPOptions, Options),
+    HTTPOptions = get_httpc_option_ssl_options_if_any(OAuthProvider) ++
+        get_httpc_option_timeout_of_default(Request#access_token_request.timeout),
+    Response = http_post(URL, Header, Type, Body, HTTPOptions, 
+        OAuthProvider#oauth_provider.proxy_options),
     parse_access_token_response(Response).
 
 -spec refresh_access_token(oauth_provider(), refresh_token_request()) ->
@@ -44,13 +47,35 @@ refresh_access_token(OAuthProvider, Request) ->
     Header = [],
     Type = ?CONTENT_URLENCODED,
     Body = build_refresh_token_request_body(Request),
-    HTTPOptions = get_ssl_options_if_any(OAuthProvider) ++
-        get_timeout_of_default(Request#refresh_token_request.timeout) ++ 
-        get_proxy_auth_if_any(OAuthProvider#oauth_provider.proxy_options),
-    Options = get_proxy_if_any(OAuthProvider#oauth_provider.proxy_options),
-    Response = httpc:request(post, {URL, Header, Type, Body}, HTTPOptions, Options),
+    HTTPOptions = get_httpc_option_ssl_options_if_any(OAuthProvider) ++
+        get_httpc_option_timeout_of_default(Request#refresh_token_request.timeout),
+    Response = http_post(URL, Header, Type, Body, HTTPOptions, 
+        OAuthProvider#oauth_provider.proxy_options),
     parse_access_token_response(Response).
 
+http_post(URL, Header, Type, Body, HTTPOptions, ProxyOptions) ->
+    case ProxyOptions of 
+        undefined -> httpc:request(post, {URL, Header, Type, Body}, HTTPOptions, []);
+        _ ->
+            case httpc:set_options(get_httpc_option_proxy_if_any(ProxyOptions)) of
+                ok -> 
+                    httpc:request(post, {URL, Header, Type, Body},
+                        HTTPOptions ++ get_httpc_option_proxy_auth_if_any(ProxyOptions), []);
+                {error, _} = Error -> Error 
+            end
+    end.
+http_get(URL, HTTPOptions, ProxyOptions) ->
+    case ProxyOptions of 
+        undefined -> httpc:request(get, {URL, []}, HTTPOptions, []);
+        _ ->
+            case httpc:set_options(get_httpc_option_proxy_if_any(ProxyOptions)) of 
+                ok -> 
+                    httpc:request(get, {URL, []},
+                        HTTPOptions ++ get_httpc_option_proxy_auth_if_any(ProxyOptions), []);
+                {error, _} = Error -> Error 
+            end
+    end.
+        
 append_paths(Path1, Path2) ->
     erlang:iolist_to_binary([Path1, Path2]).
 
@@ -102,15 +127,9 @@ drop_trailing_path_separator(Path) when is_list(Path) ->
 get_openid_configuration(DiscoverEndpoint, TLSOptions, ProxyOptions) ->    
     rabbit_log:debug("get_openid_configuration from ~p (~p) [~p]", [DiscoverEndpoint,
         format_ssl_options(TLSOptions), format_proxy_options(ProxyOptions)]),
-    Options = get_proxy_if_any(ProxyOptions),
-    case httpc:set_options(Options) of 
-        ok -> 
-            Response = httpc:request(get, {DiscoverEndpoint, []},
-                TLSOptions ++ get_proxy_auth_if_any(ProxyOptions), []),
-            parse_openid_configuration_response(Response);
-        {error, _} = Error -> Error 
-    end.
-
+    Response = http_get(DiscoverEndpoint, TLSOptions, ProxyOptions),
+    parse_openid_configuration_response(Response).
+    
 -spec merge_openid_configuration(openid_configuration(), oauth_provider()) ->
     oauth_provider().
 merge_openid_configuration(OpenId, OAuthProvider0) ->    
@@ -292,7 +311,7 @@ download_oauth_provider(OAuthProvider) ->
         undefined -> {error, {missing_oauth_provider_attributes, [issuer]}};
         URL ->
             rabbit_log:debug("Downloading oauth_provider using ~p ", [URL]),
-            case get_openid_configuration(URL, get_ssl_options_if_any(OAuthProvider),
+            case get_openid_configuration(URL, get_httpc_option_ssl_options_if_any(OAuthProvider),
                     OAuthProvider#oauth_provider.proxy_options) of
                 {ok, OpenIdConfiguration} ->
                     {ok, update_oauth_provider_endpoints_configuration(
@@ -570,31 +589,36 @@ append_extra_parameters(Request, QueryList) ->
         Params -> Params ++ QueryList
     end.
 
-get_ssl_options_if_any(OAuthProvider) ->
+get_httpc_option_ssl_options_if_any(OAuthProvider) ->
     case OAuthProvider#oauth_provider.ssl_options of
         undefined -> [];
         Options ->  [{ssl, Options}]
     end.
 
-get_timeout_of_default(Timeout) ->
+get_httpc_option_timeout_of_default(Timeout) ->
     case Timeout of
         undefined -> [{timeout, ?DEFAULT_HTTP_TIMEOUT}];
         Timeout -> [{timeout, Timeout}]
     end.
 
-get_proxy_if_any(ProxyOptions) ->
+get_httpc_option_proxy_if_any(ProxyOptions) ->
     case ProxyOptions of
         undefined -> 
             []; 
-        Proxy -> 
-            P = {{Proxy#proxy_options.host, Proxy#proxy_options.port},[]},
-            case Proxy#proxy_options.https of 
-                true -> [{https_proxy, P}];
-                false -> [{proxy, P}]
+        Proxy -> case {Proxy#proxy_options.host, Proxy#proxy_options.port} of 
+            {undefined, 0} -> [];
+            {_, 0} -> [];
+            {undefined, _} -> [];
+            {Host, Port} ->
+                P = {{Host, Port},[]},
+                case Proxy#proxy_options.https of 
+                    true -> [{https_proxy, P}];
+                    false -> [{proxy, P}]
+                end
             end
     end.
 
-get_proxy_auth_if_any(ProxyOptions) ->
+get_httpc_option_proxy_auth_if_any(ProxyOptions) ->
     case ProxyOptions of
         undefined -> 
             []; 
@@ -706,7 +730,7 @@ format_proxy_options(undefined) ->
     lists:flatten(io_lib:format("{no proxy}", []));
 
 format_proxy_options(ProxyOptions) ->
-    lists:flatten(io_lib:format("{https: ~p, hostname: ~p, port: ~p, username: ~p, " ++
+    lists:flatten(io_lib:format("{https: ~p, host: ~p, port: ~p, username: ~p, " ++
         "password: ~p }", [
         ProxyOptions#proxy_options.https,
         ProxyOptions#proxy_options.host,
diff --git a/deps/rabbitmq_auth_backend_oauth2/src/uaa_jwks.erl b/deps/rabbitmq_auth_backend_oauth2/src/uaa_jwks.erl
@@ -1,15 +1,43 @@
 -module(uaa_jwks).
 -export([get/2, get/3]).
 
+-import(oauth2_client, [
+    get_httpc_option_ssl_options_if_any/1,
+    get_httpc_option_timeout_of_default/1,
+    get_httpc_option_proxy_auth_if_any/1,
+    get_httpc_option_proxy_if_any/1]).
+
 -spec get(uri_string:uri_string(), list()) -> {ok, term()} | {error, term()}.
 get(JwksUrl, SslOptions) ->
-    Options = [{timeout, 60000}] ++ [{ssl, SslOptions}],
-    httpc:request(get, {JwksUrl, []}, Options, []).
+    http_get(JwksUrl, SslOptions, undefined).
 
--spec get(uri_string:uri_string(), list(), list()) -> {ok, term()} | {error, term()}.
+-spec get(uri_string:uri_string(), list(), oauth2_client:proxy_options() | undefined | 'none') -> 
+        {ok, term()} | {error, term()}.
 get(JwksUrl, SslOptions, undefined) ->
     get(JwksUrl, SslOptions);
-get(JwksUrl, SslOptions, Options) ->
-    HttpOptions = [{timeout, 60000}] ++ [{ssl, SslOptions}],
-    httpc:set_options(Options),
-    httpc:request(get, {JwksUrl, []}, HttpOptions, []).
+get(JwksUrl, SslOptions, ProxyOptions) ->
+    http_get(JwksUrl, SslOptions, ProxyOptions).    
+
+get_ssl_options_if_any(SslOptions) ->
+    case SslOptions of
+        undefined -> [];
+        Options ->  [{ssl, Options}]
+    end.
+
+http_get(URL, SslOptions, ProxyOptions) ->
+    HttpOptions = get_httpc_option_timeout_of_default(60000) 
+                    ++ get_ssl_options_if_any(SslOptions),
+    {HttpProxyOptions, SetOptions} = 
+        case ProxyOptions of 
+            undefined -> {[], ok};
+        _ ->
+            case httpc:set_options(get_httpc_option_proxy_if_any(ProxyOptions)) of 
+                ok -> {get_httpc_option_proxy_auth_if_any(ProxyOptions), ok};
+                {error, _} = Error -> {undefined, Error}
+            end
+    end,
+    case SetOptions of 
+        ok -> httpc:request(get, {URL, []}, HttpOptions ++ HttpProxyOptions, []);
+        {error, _} -> SetOptions
+    end.
+        
diff --git a/deps/rabbitmq_auth_backend_oauth2/src/uaa_jwt.erl b/deps/rabbitmq_auth_backend_oauth2/src/uaa_jwt.erl
@@ -43,10 +43,10 @@ add_signing_key(KeyId, Type, Value) ->
 
 -spec update_jwks_signing_keys(oauth_provider()) -> ok | {error, term()}.
 update_jwks_signing_keys(#oauth_provider{id = Id, jwks_uri = JwksUrl,
-        ssl_options = SslOptions}) ->
+        ssl_options = SslOptions, proxy_options = ProxyOptions}) ->
     rabbit_log:debug("Downloading signing keys from ~tp (TLS options: ~p)",
         [JwksUrl, format_ssl_options(SslOptions)]),
-    case uaa_jwks:get(JwksUrl, SslOptions) of
+    case uaa_jwks:get(JwksUrl, SslOptions, ProxyOptions) of
         {ok, {_, _, JwksBody}} ->
             KeyList = maps:get(<<"keys">>,
                 jose:decode(erlang:iolist_to_binary(JwksBody)), []),
diff --git a/selenium/test/oauth/env.docker.forward-proxy b/selenium/test/oauth/env.docker.forward-proxy
@@ -1,3 +1,3 @@
-export FORWARD_PROXY_URL=forward-proxy:9092
+export FORWARD_PROXY_URL=http://forward-proxy:9092
 export OAUTH_PROVIDER_URL=${KEYCLOAK_URL}
 export OAUTH_PROVIDER_CA_CERT=${KEYCLOAK_CA_CERT}
diff --git a/selenium/test/oauth/env.local.forward-proxy b/selenium/test/oauth/env.local.forward-proxy
@@ -1,3 +1,3 @@
-export FORWARD_PROXY_URL=forward-proxy:9092
+export FORWARD_PROXY_URL=http://forward-proxy:9092
 export OAUTH_PROVIDER_URL=${KEYCLOAK_URL}
 export OAUTH_PROVIDER_CA_CERT=${KEYCLOAK_CA_CERT}
diff --git a/selenium/test/oauth/forward-proxy/httpd.conf b/selenium/test/oauth/forward-proxy/httpd.conf
@@ -146,8 +146,10 @@ LogLevel warn
   LogLevel debug
   ErrorLog /dev/stderr
   CustomLog /dev/stdout combined
+#  SetEnv auth-proxy-chain on
 
   <Proxy "*">
     Allow from all
+    
   </Proxy>
 </VirtualHost>
diff --git a/selenium/test/utils.js b/selenium/test/utils.js
@@ -9,11 +9,11 @@ const UAALoginPage = require('./pageobjects/UAALoginPage')
 const KeycloakLoginPage = require('./pageobjects/KeycloakLoginPage')
 const assert = require('assert')
 
+const runLocal = String(process.env.RUN_LOCAL).toLowerCase() != 'false'
 const uaaUrl = process.env.UAA_URL || 'http://localhost:8080'
 const baseUrl = randomly_pick_baseurl(process.env.RABBITMQ_URL) || 'http://localhost:15672/'
-const proxyUrl = process.env.FORWARD_PROXY_URL
+const proxyUrl = runLocal ? undefined : process.env.FORWARD_PROXY_URL
 const hostname = process.env.RABBITMQ_HOSTNAME || 'localhost'
-const runLocal = String(process.env.RUN_LOCAL).toLowerCase() != 'false'
 const seleniumUrl = process.env.SELENIUM_URL || 'http://selenium:4444'
 const screenshotsDir = process.env.SCREENSHOTS_DIR || '/screens'
 const profiles = process.env.PROFILES || ''
