Skip to content

Commit d6bf8fe

Browse files
MarcialRosalesMarcialRosales
committed
Successful login management ui with opaque token converted to JWT
1 parent 40d2202 commit d6bf8fe

File tree

12 files changed

+81
-25
lines changed

12 files changed

+81
-25
lines changed

‎deps/oauth2_client/src/oauth2_client.erl‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -427,29 +427,29 @@ unlock(LockId) ->
427427
get_opaque_token_signing_key() ->
428428
case get_env(opaque_token_signing_key) of
429429
undefined -> {error, missing_opaque_token_signing_key};
430-
Map ->
431-
parse_signing_key_configuration(Map)
430+
List ->
431+
parse_signing_key_configuration(List)
432432
end.
433433

434434
-spec get_opaque_token_signing_key(string()|binary()) -> {ok, signing_key()} | {error, any()}.
435435
get_opaque_token_signing_key(KeyId) ->
436-
Map = get_env(opaque_token_signing_key),
437-
case maps:get(id, Map, undefined) of
436+
List = get_env(opaque_token_signing_key),
437+
case proplists:get_value(id, List, undefined) of
438438
undefined -> {error, missing_opaque_token_signing_key};
439-
KeyId -> parse_signing_key_configuration(Map);
439+
KeyId -> parse_signing_key_configuration(List);
440440
_ -> {error, missing_opaque_token_signing_key}
441441
end.
442442

443-
parse_signing_key_configuration(Map) ->
444-
SK0 = case maps:get(id, Map, undefined) of
443+
parse_signing_key_configuration(List) ->
444+
SK0 = case proplists:get_value(id, List, undefined) of
445445
undefined -> {error, missing_signing_key_id};
446446
Id -> #signing_key{id = Id}
447447
end,
448-
case {SK0, maps:get(type, Map, hs256)} of
448+
case {SK0, proplists:get_value(type, List, hs256)} of
449449
{{error, _} = Error, _} ->
450450
Error;
451451
{_, hs256} ->
452-
Sk1 = case maps:get(key, Map, undefined) of
452+
Sk1 = case proplists:get_value(key, List, undefined) of
453453
undefined -> {error, missing_symmetrical_key_value};
454454
SymKey -> SK0#signing_key{
455455
type = hs256,
@@ -468,11 +468,11 @@ parse_signing_key_configuration(Map) ->
468468
_ -> Sk1
469469
end;
470470
{_, rs256} ->
471-
Sk2 = case maps:get(key_pem_file, Map, undefined) of
471+
Sk2 = case proplists:get_value(key_pem_file, List, undefined) of
472472
undefined ->
473473
{error, missing_key_pem_file};
474474
PrivateKey ->
475-
case maps:get(cert_pem_file, Map, undefined) of
475+
case proplists:get_value(cert_pem_file, List, undefined) of
476476
undefined ->
477477
{error, missing_cert_pem_file};
478478
PublicKey ->

‎deps/oauth2_client/test/unit_SUITE.erl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ access_token_response_without_expiration_time(_) ->
306306

307307
can_sign_token(_Config) ->
308308
application:set_env(rabbitmq_auth_backend_oauth2, opaque_token_signing_key,
309-
#{ id => <<"key-id">>, type => hs256, key => <<"some-key">>}),
309+
[{ id, <<"key-id">>, type, hs256, key, <<"some-key">>}]),
310310

311311
{ok, Value } = oauth2_client:sign_token(#{"scopes" => "a b"}),
312312
ct:log("JWT : ~p", [Value]),

‎deps/rabbitmq_auth_backend_oauth2/priv/schema/rabbitmq_auth_backend_oauth2.schema‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@
169169

170170
{mapping, "auth_oauth2.opaque_token_signing_key.type",
171171
"rabbitmq_auth_backend_oauth2.key_config.opaque_token_signing_key.type",
172-
[{datatype, {enum, [HS256, RS256]}}]}.
172+
[{datatype, {enum, [hs256, rs256]}}]}.
173173

174174
{mapping, "auth_oauth2.opaque_token_signing_key.key",
175175
"rabbitmq_auth_backend_oauth2.key_config.opaque_token_signing_key.key",
@@ -183,7 +183,11 @@
183183
"rabbitmq_auth_backend_oauth2.key_config.opaque_token_signing_key.cert_pem_file",
184184
[{datatype, file}, {validators, ["file_accessible"]}]}.
185185

186-
186+
{translation,
187+
"rabbitmq_auth_backend_oauth2.opaque_token_signing_key",
188+
fun(Conf) ->
189+
rabbit_oauth2_schema:translate_opaque_token_signing_key(Conf)
190+
end}.
187191

188192
%% ID of the default signing key
189193
%%

‎deps/rabbitmq_auth_backend_oauth2/src/rabbit_oauth2_provider.erl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,12 +147,12 @@ get_signing_keys(OauthProviderId) ->
147147

148148
get_signing_key(KeyId) ->
149149
case maps:get(KeyId, get_signing_keys(root), undefined) of
150-
undefined -> oauth2_client:get_opaque_signing_key(KeyId);
150+
undefined -> oauth2_client:get_opaque_token_signing_key(KeyId);
151151
V -> V
152152
end.
153153
get_signing_key(KeyId, OAuthProviderId) ->
154154
case maps:get(KeyId, get_signing_keys(OAuthProviderId), undefined) of
155-
undefined -> oauth2_client:get_opaque_signing_key(KeyId);
155+
undefined -> oauth2_client:get_opaque_token_signing_key(KeyId);
156156
V -> V
157157
end.
158158

‎deps/rabbitmq_auth_backend_oauth2/src/rabbit_oauth2_schema.erl‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
-define(RESOURCE_SERVERS, "resource_servers").
1313
-define(OAUTH_PROVIDERS, "oauth_providers").
1414
-define(SIGNING_KEYS, "signing_keys").
15+
-define(OPAQUE_TOKEN_SIGNING_KEY, "opaque_token_signing_key").
16+
1517
-define(AUTH_OAUTH2_SCOPE_ALIASES, ?AUTH_OAUTH2 ++ "." ++ ?SCOPE_ALIASES).
1618
-define(AUTH_OAUTH2_RESOURCE_SERVERS, ?AUTH_OAUTH2 ++ "." ++ ?RESOURCE_SERVERS).
1719
-define(AUTH_OAUTH2_OAUTH_PROVIDERS, ?AUTH_OAUTH2 ++ "." ++ ?OAUTH_PROVIDERS).
@@ -25,7 +27,8 @@
2527
translate_resource_servers/1,
2628
translate_signing_keys/1,
2729
translate_endpoint_params/2,
28-
translate_scope_aliases/1
30+
translate_scope_aliases/1,
31+
translate_opaque_token_signing_key/1
2932
]).
3033

3134
resource_servers_key_synonym(Key) -> maps:get(Key, ?RESOURCE_SERVERS_SYNONYMS, Key).
@@ -193,6 +196,13 @@ translate_endpoint_params(Variable, Conf) ->
193196
[{list_to_binary(Param), list_to_binary(V)} || {["auth_oauth2", _, Param], V}
194197
<- Params0].
195198

199+
-spec translate_opaque_token_signing_key([{list(), binary()}]) ->
200+
[{binary(), binary()}].
201+
translate_opaque_token_signing_key(Conf) ->
202+
Params0 = cuttlefish_variable:filter_by_prefix("auth_oauth2.opaque_token_signing_key",
203+
Conf),
204+
extract_opaque_token_signing_key_properties(Params0).
205+
196206
validator_file_exists(Attr, Filename) ->
197207
case file:read_file(Filename) of
198208
{ok, _} ->
@@ -246,6 +256,22 @@ extract_oauth_providers_properties(Settings) ->
246256
} || {[?AUTH_OAUTH2, ?OAUTH_PROVIDERS, Name, Key], V} <- Settings ],
247257
maps:groups_from_list(KeyFun, ValueFun, OAuthProviders).
248258

259+
extract_opaque_token_signing_key_properties(Settings) ->
260+
MapValueFun = fun(K, V) ->
261+
case {K, V} of
262+
{"type", A} when is_atom(A) -> A;
263+
{"type", _} -> list_to_atom(V);
264+
{"id", L} when is_list(L) -> list_to_binary(L);
265+
{"id", B} when is_binary(B) -> B;
266+
{"key", L} when is_list(L) -> list_to_binary(L);
267+
{"key", B} when is_binary(B) -> B
268+
end end,
269+
270+
Translation = [{
271+
list_to_atom(Key),
272+
MapValueFun(Key, V)
273+
} || {[?AUTH_OAUTH2, ?OPAQUE_TOKEN_SIGNING_KEY, Key], V} <- Settings ],
274+
Translation.
249275

250276
extract_resource_server_properties(Settings) ->
251277
KeyFun = fun extract_key_as_binary/1,
@@ -255,6 +281,7 @@ extract_resource_server_properties(Settings) ->
255281
|| {[?AUTH_OAUTH2, ?RESOURCE_SERVERS, Name, Key], V} <- Settings ],
256282
maps:groups_from_list(KeyFun, ValueFun, ResourceServers).
257283

284+
258285
mapOauthProviderProperty({Key, Value}) ->
259286
{Key, case Key of
260287
issuer -> validator_https_uri(Key, Value);

‎deps/rabbitmq_auth_backend_oauth2/src/uaa_jwt.erl‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,10 @@ get_jwk(KeyId, InternalOAuthProvider, AllowUpdateJwks) ->
146146
pem_file -> uaa_jwt_jwk:from_pem_file(Value);
147147
map -> uaa_jwt_jwk:make_jwk(Value);
148148
_ -> {error, unknown_signing_key_type}
149-
end
149+
end;
150+
SK ->
151+
rabbit_log:debug("Opaque token Signing key ~p found", [KeyId]),
152+
{ok, SK#signing_key.key}
150153
end.
151154

152155
verify_signing_key(Type, Value) ->

‎deps/rabbitmq_auth_backend_oauth2/test/rabbit_oauth2_schema_SUITE.erl‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ all() ->
4141
test_without_oauth_providers_with_endpoint_params,
4242
test_scope_aliases_configured_as_list_of_properties,
4343
test_scope_aliases_configured_as_map,
44-
test_scope_aliases_configured_as_list_of_missing_properties
44+
test_scope_aliases_configured_as_list_of_missing_properties,
45+
test_opaque_token_signing_key
4546
].
4647

4748

@@ -326,6 +327,21 @@ test_scope_aliases_configured_as_map(_) ->
326327
<<"developer">> := [<<"rabbitmq.tag:management">>, <<"rabbitmq.read:*/*">>]
327328
} = rabbit_oauth2_schema:translate_scope_aliases(CuttlefishConf).
328329

330+
test_opaque_token_signing_key(_) ->
331+
CuttlefishConf = [
332+
{["auth_oauth2","opaque_token_signing_key","id"],
333+
"key-id"},
334+
{["auth_oauth2","opaque_token_signing_key","type"],
335+
"hs256"},
336+
{["auth_oauth2","opaque_token_signing_key","key"],
337+
"signing-key"}
338+
],
339+
[
340+
{id, <<"key-id">>},
341+
{type, hs256},
342+
{key, <<"signing-key">>}
343+
] = rabbit_oauth2_schema:translate_opaque_token_signing_key(CuttlefishConf).
344+
329345

330346
cert_filename(Conf) ->
331347
string:concat(?config(data_dir, Conf), "certs/cert.pem").

‎deps/rabbitmq_management/priv/www/js/main.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1389,7 +1389,8 @@ function sync_req(type, params0, path_template, options) {
13891389
var req = xmlHttpRequest();
13901390
req.open(type, 'api' + path, false);
13911391
req.setRequestHeader('content-type', 'application/json');
1392-
req.setRequestHeader('authorization', authorization_header());
1392+
let authorization = authorization_header()
1393+
req.setRequestHeader('authorization', authorization);
13931394

13941395
if (options != undefined || options != null) {
13951396
if (options.headers != undefined || options.headers != null) {

‎deps/rabbitmq_management/priv/www/js/oidc-oauth/helper.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -298,9 +298,9 @@ export function oauth_completeLogin() {
298298
});
299299
}
300300
function introspect_token() {
301-
let json = sync_post({}, '/auth/introspect')
302-
console.log("token : " + JSON.stringify(json))
303-
return JSON.parse(json.responseText)
301+
let jwt = JSON.parse(sync_post({}, '/auth/introspect').responseText)
302+
console.log("jwt token : " + jwt)
303+
return jwt.token
304304
}
305305

306306
function is_jwt_token(token) {

‎deps/rabbitmq_management/src/rabbit_mgmt_wm_oauth_introspect.erl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ do_it(ReqData, Context) ->
5151
{ok, JwtPayload} ->
5252
case oauth2_client:sign_token(JwtPayload) of
5353
{ok, JWT} ->
54-
rabbit_mgmt_util:reply(JWT, ReqData, Context);
54+
rabbit_mgmt_util:reply([{token, JWT}], ReqData, Context);
5555
{error, Reason} ->
5656
rabbit_mgmt_util:not_authorised(Reason, ReqData, Context)
5757
end

0 commit comments

Comments
 (0)