Jaehoon Kim
3 months ago
45 changed files with 3628 additions and 1132 deletions
-
1.gitignore
-
79README.md
-
16go.mod
-
30go.sum
-
27test/s3/iam/Makefile
-
114test/s3/iam/iam_config.json
-
6test/s3/iam/iam_config.local.json
-
8test/s3/iam/s3_iam_distributed_test.go
-
357test/s3/iam/s3_sts_assume_role_test.go
-
291test/s3/iam/s3_sts_ldap_test.go
-
82test/s3/iam/setup_all_tests.sh
-
2test/s3/iam/setup_keycloak.sh
-
4weed/iam/integration/advanced_policy_test.go
-
6weed/iam/integration/iam_integration_test.go
-
18weed/iam/integration/iam_manager.go
-
43weed/iam/integration/iam_manager_trust.go
-
571weed/iam/ldap/ldap_provider.go
-
24weed/iam/sts/cross_instance_token_test.go
-
24weed/iam/sts/distributed_sts_test.go
-
15weed/iam/sts/provider_factory.go
-
14weed/iam/sts/sts_service.go
-
5weed/pb/master.proto
-
185weed/pb/master_pb/master.pb.go
-
10weed/pb/volume_server.proto
-
1133weed/pb/volume_server_pb/volume_server.pb.go
-
777weed/pb/volume_server_pb/volume_server_grpc.pb.go
-
24weed/remote_storage/gcs/gcs_storage_client.go
-
15weed/s3api/auth_credentials_trust.go
-
12weed/s3api/auth_signature_v4_sts_test.go
-
8weed/s3api/s3_end_to_end_test.go
-
9weed/s3api/s3_iam_middleware.go
-
10weed/s3api/s3_jwt_auth_test.go
-
4weed/s3api/s3_multipart_iam_test.go
-
6weed/s3api/s3_presigned_url_iam_test.go
-
40weed/s3api/s3api_server.go
-
4weed/s3api/s3api_server_routing_test.go
-
429weed/s3api/s3api_sts.go
-
4weed/security/jwt.go
-
143weed/server/filer_jwt_test.go
-
40weed/server/filer_server_handlers.go
-
1weed/server/master_grpc_server.go
-
13weed/server/volume_grpc_client_to_master.go
-
9weed/storage/disk_location.go
-
76weed/storage/store.go
-
71weed/storage/store_state.go
@ -0,0 +1,357 @@ |
|||||
|
package iam |
||||
|
|
||||
|
import ( |
||||
|
"encoding/xml" |
||||
|
"fmt" |
||||
|
"io" |
||||
|
"net/http" |
||||
|
"net/url" |
||||
|
"os" |
||||
|
"strings" |
||||
|
"testing" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/aws/aws-sdk-go/aws/credentials" |
||||
|
v4 "github.com/aws/aws-sdk-go/aws/signer/v4" |
||||
|
"github.com/stretchr/testify/assert" |
||||
|
"github.com/stretchr/testify/require" |
||||
|
) |
||||
|
|
||||
|
// AssumeRoleResponse represents the STS AssumeRole response
|
||||
|
type AssumeRoleTestResponse struct { |
||||
|
XMLName xml.Name `xml:"AssumeRoleResponse"` |
||||
|
Result struct { |
||||
|
Credentials struct { |
||||
|
AccessKeyId string `xml:"AccessKeyId"` |
||||
|
SecretAccessKey string `xml:"SecretAccessKey"` |
||||
|
SessionToken string `xml:"SessionToken"` |
||||
|
Expiration string `xml:"Expiration"` |
||||
|
} `xml:"Credentials"` |
||||
|
AssumedRoleUser struct { |
||||
|
AssumedRoleId string `xml:"AssumedRoleId"` |
||||
|
Arn string `xml:"Arn"` |
||||
|
} `xml:"AssumedRoleUser"` |
||||
|
} `xml:"AssumeRoleResult"` |
||||
|
} |
||||
|
|
||||
|
// TestSTSAssumeRoleValidation tests input validation for AssumeRole endpoint
|
||||
|
func TestSTSAssumeRoleValidation(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Fatal("SeaweedFS STS endpoint is not running at", TestSTSEndpoint, "- please run 'make setup-all-tests' first") |
||||
|
} |
||||
|
|
||||
|
// Check if AssumeRole is implemented by making a test call
|
||||
|
if !isAssumeRoleImplemented(t) { |
||||
|
t.Fatal("AssumeRole action is not implemented in the running server - please rebuild weed binary with new code and restart the server") |
||||
|
} |
||||
|
|
||||
|
t.Run("missing_role_arn", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
// RoleArn is missing
|
||||
|
}, "test-access-key", "test-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail without RoleArn") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Equal(t, "MissingParameter", errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("missing_role_session_name", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
// RoleSessionName is missing
|
||||
|
}, "test-access-key", "test-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail without RoleSessionName") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Equal(t, "MissingParameter", errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("unsupported_action_for_anonymous", func(t *testing.T) { |
||||
|
// AssumeRole requires SigV4 authentication, anonymous requests should fail
|
||||
|
resp, err := callSTSAPI(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
// Should fail because AssumeRole requires AWS SigV4 authentication
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"AssumeRole should require authentication") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for anonymous AssumeRole: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
}) |
||||
|
|
||||
|
t.Run("invalid_duration_too_short", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"DurationSeconds": {"100"}, // Less than 900 seconds minimum
|
||||
|
}, "test-access-key", "test-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with DurationSeconds < 900") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Equal(t, "InvalidParameterValue", errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("invalid_duration_too_long", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"DurationSeconds": {"100000"}, // More than 43200 seconds maximum
|
||||
|
}, "test-access-key", "test-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with DurationSeconds > 43200") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Equal(t, "InvalidParameterValue", errResp.Error.Code) |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// isAssumeRoleImplemented checks if the running server supports AssumeRole
|
||||
|
func isAssumeRoleImplemented(t *testing.T) bool { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test"}, |
||||
|
"RoleSessionName": {"test"}, |
||||
|
}, "test", "test") |
||||
|
if err != nil { |
||||
|
return false |
||||
|
} |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
if err != nil { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
// If we get "NotImplemented", the action isn't supported
|
||||
|
var errResp STSErrorTestResponse |
||||
|
if xml.Unmarshal(body, &errResp) == nil && errResp.Error.Code == "NotImplemented" { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
// If we get InvalidAction, the action isn't routed
|
||||
|
if errResp.Error.Code == "InvalidAction" { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
return true |
||||
|
} |
||||
|
|
||||
|
// TestSTSAssumeRoleWithValidCredentials tests AssumeRole with valid IAM credentials
|
||||
|
// This test requires a configured IAM user in SeaweedFS
|
||||
|
func TestSTSAssumeRoleWithValidCredentials(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Skip("SeaweedFS STS endpoint is not running at", TestSTSEndpoint) |
||||
|
} |
||||
|
|
||||
|
// Use test credentials from environment or fall back to defaults
|
||||
|
accessKey := os.Getenv("STS_TEST_ACCESS_KEY") |
||||
|
if accessKey == "" { |
||||
|
accessKey = "admin" |
||||
|
} |
||||
|
secretKey := os.Getenv("STS_TEST_SECRET_KEY") |
||||
|
if secretKey == "" { |
||||
|
secretKey = "admin" |
||||
|
} |
||||
|
|
||||
|
t.Run("successful_assume_role", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/admin"}, |
||||
|
"RoleSessionName": {"integration-test-session"}, |
||||
|
}, accessKey, secretKey) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response status: %d, body: %s", resp.StatusCode, string(body)) |
||||
|
|
||||
|
// If AssumeRole is not yet implemented, expect an error about unsupported action
|
||||
|
if resp.StatusCode != http.StatusOK { |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
t.Logf("Error response: code=%s, message=%s", errResp.Error.Code, errResp.Error.Message) |
||||
|
|
||||
|
// This test will initially fail until AssumeRole is implemented
|
||||
|
// Once implemented, uncomment the assertions below
|
||||
|
// assert.Fail(t, "AssumeRole not yet implemented")
|
||||
|
} else { |
||||
|
var stsResp AssumeRoleTestResponse |
||||
|
err = xml.Unmarshal(body, &stsResp) |
||||
|
require.NoError(t, err, "Failed to parse response: %s", string(body)) |
||||
|
|
||||
|
creds := stsResp.Result.Credentials |
||||
|
assert.NotEmpty(t, creds.AccessKeyId, "AccessKeyId should not be empty") |
||||
|
assert.NotEmpty(t, creds.SecretAccessKey, "SecretAccessKey should not be empty") |
||||
|
assert.NotEmpty(t, creds.SessionToken, "SessionToken should not be empty") |
||||
|
assert.NotEmpty(t, creds.Expiration, "Expiration should not be empty") |
||||
|
|
||||
|
t.Logf("Successfully obtained temporary credentials: AccessKeyId=%s", creds.AccessKeyId) |
||||
|
} |
||||
|
}) |
||||
|
|
||||
|
t.Run("with_custom_duration", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/admin"}, |
||||
|
"RoleSessionName": {"duration-test-session"}, |
||||
|
"DurationSeconds": {"3600"}, // 1 hour
|
||||
|
}, accessKey, secretKey) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response status: %d, body: %s", resp.StatusCode, string(body)) |
||||
|
|
||||
|
// Verify DurationSeconds is accepted
|
||||
|
if resp.StatusCode != http.StatusOK { |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
// Should not fail due to DurationSeconds parameter
|
||||
|
assert.NotContains(t, errResp.Error.Message, "DurationSeconds", |
||||
|
"DurationSeconds parameter should be accepted") |
||||
|
} |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// TestSTSAssumeRoleWithInvalidCredentials tests AssumeRole rejection with bad credentials
|
||||
|
func TestSTSAssumeRoleWithInvalidCredentials(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Skip("SeaweedFS STS endpoint is not running at", TestSTSEndpoint) |
||||
|
} |
||||
|
|
||||
|
t.Run("invalid_access_key", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/admin"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
}, "invalid-access-key", "some-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
// Should fail with access denied or signature mismatch
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with invalid access key") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for invalid credentials: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
}) |
||||
|
|
||||
|
t.Run("invalid_secret_key", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIWithSigV4(t, url.Values{ |
||||
|
"Action": {"AssumeRole"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/admin"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
}, "admin", "wrong-secret-key") |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
// Should fail with signature mismatch
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with invalid secret key") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for wrong secret: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// callSTSAPIWithSigV4 makes an STS API call with AWS Signature V4 authentication
|
||||
|
func callSTSAPIWithSigV4(t *testing.T, params url.Values, accessKey, secretKey string) (*http.Response, error) { |
||||
|
// Prepare request body
|
||||
|
body := params.Encode() |
||||
|
|
||||
|
// Create request
|
||||
|
req, err := http.NewRequest(http.MethodPost, TestSTSEndpoint+"/", |
||||
|
strings.NewReader(body)) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
|
||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
||||
|
req.Header.Set("Host", req.URL.Host) |
||||
|
|
||||
|
// Sign request with AWS Signature V4 using official SDK
|
||||
|
creds := credentials.NewStaticCredentials(accessKey, secretKey, "") |
||||
|
signer := v4.NewSigner(creds) |
||||
|
|
||||
|
// Read body for signing
|
||||
|
// Note: We need a ReadSeeker for the signer, or we can pass the body string/bytes to ComputeBodyHash if needed,
|
||||
|
// but standard Sign method takes an io.ReadSeeker for the body.
|
||||
|
bodyReader := strings.NewReader(body) |
||||
|
_, err = signer.Sign(req, bodyReader, "sts", "us-east-1", time.Now()) |
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("failed to sign request: %w", err) |
||||
|
} |
||||
|
|
||||
|
client := &http.Client{Timeout: 30 * time.Second} |
||||
|
return client.Do(req) |
||||
|
} |
||||
@ -0,0 +1,291 @@ |
|||||
|
package iam |
||||
|
|
||||
|
import ( |
||||
|
"encoding/xml" |
||||
|
"io" |
||||
|
"net/http" |
||||
|
"net/url" |
||||
|
"os" |
||||
|
"strings" |
||||
|
"testing" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/stretchr/testify/assert" |
||||
|
"github.com/stretchr/testify/require" |
||||
|
) |
||||
|
|
||||
|
// AssumeRoleWithLDAPIdentityResponse represents the STS response for LDAP identity
|
||||
|
type AssumeRoleWithLDAPIdentityTestResponse struct { |
||||
|
XMLName xml.Name `xml:"AssumeRoleWithLDAPIdentityResponse"` |
||||
|
Result struct { |
||||
|
Credentials struct { |
||||
|
AccessKeyId string `xml:"AccessKeyId"` |
||||
|
SecretAccessKey string `xml:"SecretAccessKey"` |
||||
|
SessionToken string `xml:"SessionToken"` |
||||
|
Expiration string `xml:"Expiration"` |
||||
|
} `xml:"Credentials"` |
||||
|
} `xml:"AssumeRoleWithLDAPIdentityResult"` |
||||
|
} |
||||
|
|
||||
|
// TestSTSLDAPValidation tests input validation for AssumeRoleWithLDAPIdentity
|
||||
|
func TestSTSLDAPValidation(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Fatal("SeaweedFS STS endpoint is not running at", TestSTSEndpoint, "- please run 'make setup-all-tests' first") |
||||
|
} |
||||
|
|
||||
|
// Check if AssumeRoleWithLDAPIdentity is implemented
|
||||
|
if !isLDAPIdentityActionImplemented(t) { |
||||
|
t.Fatal("AssumeRoleWithLDAPIdentity action is not implemented in the running server - please rebuild weed binary with new code and restart the server") |
||||
|
} |
||||
|
|
||||
|
t.Run("missing_ldap_username", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"LDAPPassword": {"testpass"}, |
||||
|
// LDAPUsername is missing
|
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail without LDAPUsername") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
// Expect either MissingParameter or InvalidAction (if not implemented)
|
||||
|
assert.Contains(t, []string{"MissingParameter", "InvalidAction"}, errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("missing_ldap_password", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"LDAPUsername": {"testuser"}, |
||||
|
// LDAPPassword is missing
|
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail without LDAPPassword") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Contains(t, []string{"MissingParameter", "InvalidAction"}, errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("missing_role_arn", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"LDAPUsername": {"testuser"}, |
||||
|
"LDAPPassword": {"testpass"}, |
||||
|
// RoleArn is missing
|
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail without RoleArn") |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
var errResp STSErrorTestResponse |
||||
|
err = xml.Unmarshal(body, &errResp) |
||||
|
require.NoError(t, err, "Failed to parse error response: %s", string(body)) |
||||
|
assert.Contains(t, []string{"MissingParameter", "InvalidAction"}, errResp.Error.Code) |
||||
|
}) |
||||
|
|
||||
|
t.Run("invalid_duration_too_short", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test-role"}, |
||||
|
"RoleSessionName": {"test-session"}, |
||||
|
"LDAPUsername": {"testuser"}, |
||||
|
"LDAPPassword": {"testpass"}, |
||||
|
"DurationSeconds": {"100"}, // Less than 900 seconds minimum
|
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
// If the action is implemented, it should reject invalid duration
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for invalid duration: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// TestSTSLDAPWithValidCredentials tests LDAP authentication
|
||||
|
// This test requires an LDAP server to be configured
|
||||
|
func TestSTSLDAPWithValidCredentials(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Skip("SeaweedFS STS endpoint is not running at", TestSTSEndpoint) |
||||
|
} |
||||
|
|
||||
|
// Check if LDAP is configured (skip if not)
|
||||
|
if !isLDAPConfigured() { |
||||
|
t.Skip("LDAP is not configured - skipping LDAP integration tests") |
||||
|
} |
||||
|
|
||||
|
t.Run("successful_ldap_auth", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/ldap-user"}, |
||||
|
"RoleSessionName": {"ldap-test-session"}, |
||||
|
"LDAPUsername": {"testuser"}, |
||||
|
"LDAPPassword": {"testpass"}, |
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response status: %d, body: %s", resp.StatusCode, string(body)) |
||||
|
|
||||
|
if resp.StatusCode == http.StatusOK { |
||||
|
var stsResp AssumeRoleWithLDAPIdentityTestResponse |
||||
|
err = xml.Unmarshal(body, &stsResp) |
||||
|
require.NoError(t, err, "Failed to parse response: %s", string(body)) |
||||
|
|
||||
|
creds := stsResp.Result.Credentials |
||||
|
assert.NotEmpty(t, creds.AccessKeyId, "AccessKeyId should not be empty") |
||||
|
assert.NotEmpty(t, creds.SecretAccessKey, "SecretAccessKey should not be empty") |
||||
|
assert.NotEmpty(t, creds.SessionToken, "SessionToken should not be empty") |
||||
|
assert.NotEmpty(t, creds.Expiration, "Expiration should not be empty") |
||||
|
} |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// TestSTSLDAPWithInvalidCredentials tests LDAP rejection with bad credentials
|
||||
|
func TestSTSLDAPWithInvalidCredentials(t *testing.T) { |
||||
|
if testing.Short() { |
||||
|
t.Skip("Skipping integration test in short mode") |
||||
|
} |
||||
|
|
||||
|
if !isSTSEndpointRunning(t) { |
||||
|
t.Skip("SeaweedFS STS endpoint is not running at", TestSTSEndpoint) |
||||
|
} |
||||
|
|
||||
|
t.Run("invalid_ldap_password", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/ldap-user"}, |
||||
|
"RoleSessionName": {"ldap-test-session"}, |
||||
|
"LDAPUsername": {"testuser"}, |
||||
|
"LDAPPassword": {"wrong-password"}, |
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for invalid LDAP credentials: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
|
||||
|
// Should fail (either AccessDenied or InvalidAction if not implemented)
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with invalid LDAP password") |
||||
|
}) |
||||
|
|
||||
|
t.Run("nonexistent_ldap_user", func(t *testing.T) { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/ldap-user"}, |
||||
|
"RoleSessionName": {"ldap-test-session"}, |
||||
|
"LDAPUsername": {"nonexistent-user-12345"}, |
||||
|
"LDAPPassword": {"somepassword"}, |
||||
|
}) |
||||
|
require.NoError(t, err) |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
require.NoError(t, err) |
||||
|
t.Logf("Response for nonexistent user: status=%d, body=%s", resp.StatusCode, string(body)) |
||||
|
|
||||
|
// Should fail
|
||||
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, |
||||
|
"Should fail with nonexistent LDAP user") |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
// callSTSAPIForLDAP makes an STS API call for LDAP operation
|
||||
|
func callSTSAPIForLDAP(t *testing.T, params url.Values) (*http.Response, error) { |
||||
|
req, err := http.NewRequest(http.MethodPost, TestSTSEndpoint+"/", |
||||
|
strings.NewReader(params.Encode())) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
|
||||
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
||||
|
|
||||
|
client := &http.Client{Timeout: 30 * time.Second} |
||||
|
return client.Do(req) |
||||
|
} |
||||
|
|
||||
|
// isLDAPConfigured checks if LDAP server is configured and available
|
||||
|
func isLDAPConfigured() bool { |
||||
|
// Check environment variable for LDAP URL
|
||||
|
ldapURL := os.Getenv("LDAP_URL") |
||||
|
return ldapURL != "" |
||||
|
} |
||||
|
|
||||
|
// isLDAPIdentityActionImplemented checks if the running server supports AssumeRoleWithLDAPIdentity
|
||||
|
func isLDAPIdentityActionImplemented(t *testing.T) bool { |
||||
|
resp, err := callSTSAPIForLDAP(t, url.Values{ |
||||
|
"Action": {"AssumeRoleWithLDAPIdentity"}, |
||||
|
"Version": {"2011-06-15"}, |
||||
|
"RoleArn": {"arn:aws:iam::role/test"}, |
||||
|
"RoleSessionName": {"test"}, |
||||
|
"LDAPUsername": {"test"}, |
||||
|
"LDAPPassword": {"test"}, |
||||
|
}) |
||||
|
if err != nil { |
||||
|
return false |
||||
|
} |
||||
|
defer resp.Body.Close() |
||||
|
|
||||
|
body, err := io.ReadAll(resp.Body) |
||||
|
if err != nil { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
// If we get "NotImplemented" or empty response, the action isn't supported
|
||||
|
if len(body) == 0 { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
var errResp STSErrorTestResponse |
||||
|
if xml.Unmarshal(body, &errResp) == nil && errResp.Error.Code == "NotImplemented" { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
// If we get InvalidAction, the action isn't routed
|
||||
|
if errResp.Error.Code == "InvalidAction" { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
return true |
||||
|
} |
||||
@ -0,0 +1,43 @@ |
|||||
|
package integration |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"fmt" |
||||
|
|
||||
|
"github.com/seaweedfs/seaweedfs/weed/iam/policy" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/iam/utils" |
||||
|
) |
||||
|
|
||||
|
// ValidateTrustPolicyForPrincipal validates if a principal is allowed to assume a role
|
||||
|
func (m *IAMManager) ValidateTrustPolicyForPrincipal(ctx context.Context, roleArn, principalArn string) error { |
||||
|
if !m.initialized { |
||||
|
return fmt.Errorf("IAM manager not initialized") |
||||
|
} |
||||
|
|
||||
|
// Extract role name from ARN
|
||||
|
roleName := utils.ExtractRoleNameFromArn(roleArn) |
||||
|
|
||||
|
// Get role definition
|
||||
|
roleDef, err := m.roleStore.GetRole(ctx, m.getFilerAddress(), roleName) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("failed to get role %s: %w", roleName, err) |
||||
|
} |
||||
|
|
||||
|
if roleDef.TrustPolicy == nil { |
||||
|
return fmt.Errorf("role has no trust policy") |
||||
|
} |
||||
|
|
||||
|
// Create evaluation context
|
||||
|
evalCtx := &policy.EvaluationContext{ |
||||
|
Principal: principalArn, |
||||
|
Action: "sts:AssumeRole", |
||||
|
Resource: roleArn, |
||||
|
} |
||||
|
|
||||
|
// Evaluate the trust policy
|
||||
|
if !m.evaluateTrustPolicy(roleDef.TrustPolicy, evalCtx) { |
||||
|
return fmt.Errorf("trust policy denies access to principal: %s", principalArn) |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
@ -0,0 +1,571 @@ |
|||||
|
package ldap |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"crypto/tls" |
||||
|
"fmt" |
||||
|
"net" |
||||
|
"strings" |
||||
|
"sync" |
||||
|
"sync/atomic" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/go-ldap/ldap/v3" |
||||
|
"github.com/mitchellh/mapstructure" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/glog" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/iam/providers" |
||||
|
) |
||||
|
|
||||
|
// LDAPConfig holds configuration for LDAP provider
|
||||
|
type LDAPConfig struct { |
||||
|
// Server is the LDAP server URL (ldap:// or ldaps://)
|
||||
|
Server string `json:"server"` |
||||
|
|
||||
|
// BindDN is the DN used to bind for searches (optional for anonymous bind)
|
||||
|
BindDN string `json:"bindDN,omitempty"` |
||||
|
|
||||
|
// BindPassword is the password for the bind DN
|
||||
|
BindPassword string `json:"bindPassword,omitempty"` |
||||
|
|
||||
|
// BaseDN is the base DN for user searches
|
||||
|
BaseDN string `json:"baseDN"` |
||||
|
|
||||
|
// UserFilter is the filter to find users (use %s for username placeholder)
|
||||
|
// Example: "(uid=%s)" or "(cn=%s)" or "(&(objectClass=person)(uid=%s))"
|
||||
|
UserFilter string `json:"userFilter"` |
||||
|
|
||||
|
// GroupFilter is the filter to find user groups (use %s for user DN placeholder)
|
||||
|
// Example: "(member=%s)" or "(memberUid=%s)"
|
||||
|
GroupFilter string `json:"groupFilter,omitempty"` |
||||
|
|
||||
|
// GroupBaseDN is the base DN for group searches (defaults to BaseDN)
|
||||
|
GroupBaseDN string `json:"groupBaseDN,omitempty"` |
||||
|
|
||||
|
// Attributes to retrieve from LDAP
|
||||
|
Attributes LDAPAttributes `json:"attributes,omitempty"` |
||||
|
|
||||
|
// UseTLS enables StartTLS
|
||||
|
UseTLS bool `json:"useTLS,omitempty"` |
||||
|
|
||||
|
// InsecureSkipVerify skips TLS certificate verification
|
||||
|
InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"` |
||||
|
|
||||
|
// ConnectionTimeout is the connection timeout
|
||||
|
ConnectionTimeout time.Duration `json:"connectionTimeout,omitempty"` |
||||
|
|
||||
|
// PoolSize is the number of connections in the pool (default: 10)
|
||||
|
PoolSize int `json:"poolSize,omitempty"` |
||||
|
|
||||
|
// Audience is the expected audience for tokens (optional)
|
||||
|
Audience string `json:"audience,omitempty"` |
||||
|
} |
||||
|
|
||||
|
// LDAPAttributes maps LDAP attribute names
|
||||
|
type LDAPAttributes struct { |
||||
|
Email string `json:"email,omitempty"` // Default: mail
|
||||
|
DisplayName string `json:"displayName,omitempty"` // Default: cn
|
||||
|
Groups string `json:"groups,omitempty"` // Default: memberOf
|
||||
|
UID string `json:"uid,omitempty"` // Default: uid
|
||||
|
} |
||||
|
|
||||
|
// connectionPool manages a pool of LDAP connections for reuse
|
||||
|
type connectionPool struct { |
||||
|
conns chan *ldap.Conn |
||||
|
mu sync.Mutex |
||||
|
size int |
||||
|
closed uint32 // atomic flag: 1 if closed, 0 if open
|
||||
|
} |
||||
|
|
||||
|
// LDAPProvider implements the IdentityProvider interface for LDAP
|
||||
|
type LDAPProvider struct { |
||||
|
name string |
||||
|
config *LDAPConfig |
||||
|
initialized bool |
||||
|
mu sync.RWMutex |
||||
|
pool *connectionPool |
||||
|
} |
||||
|
|
||||
|
// NewLDAPProvider creates a new LDAP provider
|
||||
|
func NewLDAPProvider(name string) *LDAPProvider { |
||||
|
return &LDAPProvider{ |
||||
|
name: name, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Name returns the provider name
|
||||
|
func (p *LDAPProvider) Name() string { |
||||
|
return p.name |
||||
|
} |
||||
|
|
||||
|
// Initialize initializes the provider with configuration
|
||||
|
func (p *LDAPProvider) Initialize(config interface{}) error { |
||||
|
p.mu.Lock() |
||||
|
defer p.mu.Unlock() |
||||
|
|
||||
|
if p.initialized { |
||||
|
return fmt.Errorf("LDAP provider already initialized") |
||||
|
} |
||||
|
|
||||
|
cfg := &LDAPConfig{} |
||||
|
|
||||
|
// Check if input is already the correct struct type
|
||||
|
if c, ok := config.(*LDAPConfig); ok { |
||||
|
cfg = c |
||||
|
} else { |
||||
|
// Parse from map using mapstructure with weak typing and time duration hook
|
||||
|
decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{ |
||||
|
DecodeHook: mapstructure.ComposeDecodeHookFunc( |
||||
|
mapstructure.StringToTimeDurationHookFunc(), |
||||
|
), |
||||
|
Result: cfg, |
||||
|
TagName: "json", |
||||
|
WeaklyTypedInput: true, |
||||
|
}) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("failed to create config decoder: %w", err) |
||||
|
} |
||||
|
|
||||
|
if err := decoder.Decode(config); err != nil { |
||||
|
return fmt.Errorf("failed to decode LDAP configuration: %w", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Validate required fields
|
||||
|
if cfg.Server == "" { |
||||
|
return fmt.Errorf("LDAP server URL is required") |
||||
|
} |
||||
|
if cfg.BaseDN == "" { |
||||
|
return fmt.Errorf("LDAP base DN is required") |
||||
|
} |
||||
|
if cfg.UserFilter == "" { |
||||
|
cfg.UserFilter = "(cn=%s)" // Default filter
|
||||
|
} |
||||
|
|
||||
|
// Warn if BindDN is configured but BindPassword is empty
|
||||
|
if cfg.BindDN != "" && cfg.BindPassword == "" { |
||||
|
glog.Warningf("LDAP provider '%s' configured with BindDN but no BindPassword", p.name) |
||||
|
} |
||||
|
|
||||
|
// Warn if InsecureSkipVerify is enabled
|
||||
|
if cfg.InsecureSkipVerify { |
||||
|
glog.Warningf("LDAP provider '%s' has InsecureSkipVerify enabled. Do not use in production.", p.name) |
||||
|
} |
||||
|
|
||||
|
// Set default attributes
|
||||
|
if cfg.Attributes.Email == "" { |
||||
|
cfg.Attributes.Email = "mail" |
||||
|
} |
||||
|
if cfg.Attributes.DisplayName == "" { |
||||
|
cfg.Attributes.DisplayName = "cn" |
||||
|
} |
||||
|
if cfg.Attributes.Groups == "" { |
||||
|
cfg.Attributes.Groups = "memberOf" |
||||
|
} |
||||
|
if cfg.Attributes.UID == "" { |
||||
|
cfg.Attributes.UID = "uid" |
||||
|
} |
||||
|
if cfg.GroupBaseDN == "" { |
||||
|
cfg.GroupBaseDN = cfg.BaseDN |
||||
|
} |
||||
|
if cfg.ConnectionTimeout == 0 { |
||||
|
cfg.ConnectionTimeout = 10 * time.Second |
||||
|
} |
||||
|
|
||||
|
p.config = cfg |
||||
|
|
||||
|
// Initialize connection pool (default size: 10 connections)
|
||||
|
poolSize := 10 |
||||
|
if cfg.PoolSize > 0 { |
||||
|
poolSize = cfg.PoolSize |
||||
|
} |
||||
|
p.pool = &connectionPool{ |
||||
|
conns: make(chan *ldap.Conn, poolSize), |
||||
|
size: poolSize, |
||||
|
} |
||||
|
|
||||
|
p.initialized = true |
||||
|
|
||||
|
glog.V(1).Infof("LDAP provider '%s' initialized: server=%s, baseDN=%s", |
||||
|
p.name, cfg.Server, cfg.BaseDN) |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// getConnection gets a connection from the pool or creates a new one
|
||||
|
func (p *LDAPProvider) getConnection() (*ldap.Conn, error) { |
||||
|
// Try to get a connection from the pool (non-blocking)
|
||||
|
select { |
||||
|
case conn := <-p.pool.conns: |
||||
|
// Test if connection is still alive
|
||||
|
if conn != nil && conn.IsClosing() { |
||||
|
conn.Close() |
||||
|
// Connection is dead, create a new one
|
||||
|
return p.createConnection() |
||||
|
} |
||||
|
return conn, nil |
||||
|
default: |
||||
|
// Pool is empty, create a new connection
|
||||
|
return p.createConnection() |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// returnConnection returns a connection to the pool
|
||||
|
func (p *LDAPProvider) returnConnection(conn *ldap.Conn) { |
||||
|
if conn == nil || conn.IsClosing() { |
||||
|
if conn != nil { |
||||
|
conn.Close() |
||||
|
} |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// Check if pool is closed before attempting to send
|
||||
|
if atomic.LoadUint32(&p.pool.closed) == 1 { |
||||
|
conn.Close() |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// Try to return to pool (non-blocking)
|
||||
|
select { |
||||
|
case p.pool.conns <- conn: |
||||
|
// Successfully returned to pool
|
||||
|
default: |
||||
|
// Pool is full, close the connection
|
||||
|
conn.Close() |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// createConnection establishes a new connection to the LDAP server
|
||||
|
func (p *LDAPProvider) createConnection() (*ldap.Conn, error) { |
||||
|
var conn *ldap.Conn |
||||
|
var err error |
||||
|
|
||||
|
// Create dialer with timeout
|
||||
|
dialer := &net.Dialer{Timeout: p.config.ConnectionTimeout} |
||||
|
|
||||
|
// Parse server URL
|
||||
|
if strings.HasPrefix(p.config.Server, "ldaps://") { |
||||
|
// LDAPS connection
|
||||
|
tlsConfig := &tls.Config{ |
||||
|
InsecureSkipVerify: p.config.InsecureSkipVerify, |
||||
|
MinVersion: tls.VersionTLS12, |
||||
|
} |
||||
|
conn, err = ldap.DialURL(p.config.Server, ldap.DialWithDialer(dialer), ldap.DialWithTLSConfig(tlsConfig)) |
||||
|
} else { |
||||
|
// LDAP connection
|
||||
|
conn, err = ldap.DialURL(p.config.Server, ldap.DialWithDialer(dialer)) |
||||
|
if err == nil && p.config.UseTLS { |
||||
|
// StartTLS
|
||||
|
tlsConfig := &tls.Config{ |
||||
|
InsecureSkipVerify: p.config.InsecureSkipVerify, |
||||
|
MinVersion: tls.VersionTLS12, |
||||
|
} |
||||
|
if err = conn.StartTLS(tlsConfig); err != nil { |
||||
|
conn.Close() |
||||
|
return nil, fmt.Errorf("failed to start TLS: %w", err) |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("failed to connect to LDAP server: %w", err) |
||||
|
} |
||||
|
|
||||
|
return conn, nil |
||||
|
} |
||||
|
|
||||
|
// Close closes all connections in the pool
|
||||
|
func (p *LDAPProvider) Close() error { |
||||
|
if p.pool == nil { |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Atomically mark pool as closed to prevent new connections being returned
|
||||
|
if !atomic.CompareAndSwapUint32(&p.pool.closed, 0, 1) { |
||||
|
// Already closed
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
p.pool.mu.Lock() |
||||
|
defer p.pool.mu.Unlock() |
||||
|
|
||||
|
// Now safe to close the channel since closed flag prevents new sends
|
||||
|
close(p.pool.conns) |
||||
|
for conn := range p.pool.conns { |
||||
|
if conn != nil { |
||||
|
conn.Close() |
||||
|
} |
||||
|
} |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Authenticate authenticates a user with username:password credentials
|
||||
|
func (p *LDAPProvider) Authenticate(ctx context.Context, credentials string) (*providers.ExternalIdentity, error) { |
||||
|
p.mu.RLock() |
||||
|
if !p.initialized { |
||||
|
p.mu.RUnlock() |
||||
|
return nil, fmt.Errorf("LDAP provider not initialized") |
||||
|
} |
||||
|
config := p.config |
||||
|
p.mu.RUnlock() |
||||
|
|
||||
|
// Parse credentials (username:password format)
|
||||
|
parts := strings.SplitN(credentials, ":", 2) |
||||
|
if len(parts) != 2 { |
||||
|
return nil, fmt.Errorf("invalid credentials format (expected username:password)") |
||||
|
} |
||||
|
username, password := parts[0], parts[1] |
||||
|
|
||||
|
if username == "" || password == "" { |
||||
|
return nil, fmt.Errorf("username and password are required") |
||||
|
} |
||||
|
|
||||
|
// Get connection from pool
|
||||
|
conn, err := p.getConnection() |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
// Note: defer returnConnection moved to after rebinding to service account
|
||||
|
|
||||
|
// First, bind with service account to search for user
|
||||
|
if config.BindDN != "" { |
||||
|
err = conn.Bind(config.BindDN, config.BindPassword) |
||||
|
if err != nil { |
||||
|
glog.V(2).Infof("LDAP service bind failed: %v", err) |
||||
|
conn.Close() // Close on error, don't return to pool
|
||||
|
return nil, fmt.Errorf("LDAP service bind failed: %w", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Search for the user
|
||||
|
userFilter := fmt.Sprintf(config.UserFilter, ldap.EscapeFilter(username)) |
||||
|
searchRequest := ldap.NewSearchRequest( |
||||
|
config.BaseDN, |
||||
|
ldap.ScopeWholeSubtree, |
||||
|
ldap.NeverDerefAliases, |
||||
|
1, // Size limit
|
||||
|
int(config.ConnectionTimeout.Seconds()), |
||||
|
false, |
||||
|
userFilter, |
||||
|
[]string{"dn", config.Attributes.Email, config.Attributes.DisplayName, config.Attributes.UID, config.Attributes.Groups}, |
||||
|
nil, |
||||
|
) |
||||
|
|
||||
|
result, err := conn.Search(searchRequest) |
||||
|
if err != nil { |
||||
|
glog.V(2).Infof("LDAP user search failed: %v", err) |
||||
|
conn.Close() // Close on error
|
||||
|
return nil, fmt.Errorf("LDAP user search failed: %w", err) |
||||
|
} |
||||
|
|
||||
|
if len(result.Entries) == 0 { |
||||
|
conn.Close() // Close on error
|
||||
|
return nil, fmt.Errorf("user not found") |
||||
|
} |
||||
|
if len(result.Entries) > 1 { |
||||
|
conn.Close() // Close on error
|
||||
|
return nil, fmt.Errorf("multiple users found") |
||||
|
} |
||||
|
|
||||
|
userEntry := result.Entries[0] |
||||
|
userDN := userEntry.DN |
||||
|
|
||||
|
// Bind as the user to verify password
|
||||
|
err = conn.Bind(userDN, password) |
||||
|
if err != nil { |
||||
|
glog.V(2).Infof("LDAP user bind failed for %s: %v", username, err) |
||||
|
conn.Close() // Close on error, don't return to pool
|
||||
|
return nil, fmt.Errorf("authentication failed: invalid credentials") |
||||
|
} |
||||
|
|
||||
|
// Rebind to service account before returning connection to pool
|
||||
|
// This prevents pool corruption from authenticated user binds
|
||||
|
if config.BindDN != "" { |
||||
|
if err = conn.Bind(config.BindDN, config.BindPassword); err != nil { |
||||
|
glog.V(2).Infof("LDAP rebind to service account failed: %v", err) |
||||
|
conn.Close() // Close on error, don't return to pool
|
||||
|
return nil, fmt.Errorf("LDAP service account rebind failed after successful user authentication (check bindDN %q and its credentials): %w", config.BindDN, err) |
||||
|
} |
||||
|
} |
||||
|
// Now safe to defer return to pool with clean service account binding
|
||||
|
defer p.returnConnection(conn) |
||||
|
|
||||
|
// Build identity from LDAP attributes
|
||||
|
identity := &providers.ExternalIdentity{ |
||||
|
UserID: username, |
||||
|
Email: userEntry.GetAttributeValue(config.Attributes.Email), |
||||
|
DisplayName: userEntry.GetAttributeValue(config.Attributes.DisplayName), |
||||
|
Groups: userEntry.GetAttributeValues(config.Attributes.Groups), |
||||
|
Provider: p.name, |
||||
|
Attributes: map[string]string{ |
||||
|
"dn": userDN, |
||||
|
"uid": userEntry.GetAttributeValue(config.Attributes.UID), |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
// If no groups from memberOf, try group search
|
||||
|
if len(identity.Groups) == 0 && config.GroupFilter != "" { |
||||
|
groups, err := p.searchUserGroups(conn, userDN, config) |
||||
|
if err != nil { |
||||
|
glog.V(2).Infof("Group search failed for %s: %v", username, err) |
||||
|
} else { |
||||
|
identity.Groups = groups |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
glog.V(2).Infof("LDAP authentication successful for user: %s, groups: %v", username, identity.Groups) |
||||
|
return identity, nil |
||||
|
} |
||||
|
|
||||
|
// searchUserGroups searches for groups the user belongs to
|
||||
|
func (p *LDAPProvider) searchUserGroups(conn *ldap.Conn, userDN string, config *LDAPConfig) ([]string, error) { |
||||
|
groupFilter := fmt.Sprintf(config.GroupFilter, ldap.EscapeFilter(userDN)) |
||||
|
searchRequest := ldap.NewSearchRequest( |
||||
|
config.GroupBaseDN, |
||||
|
ldap.ScopeWholeSubtree, |
||||
|
ldap.NeverDerefAliases, |
||||
|
0, |
||||
|
int(config.ConnectionTimeout.Seconds()), |
||||
|
false, |
||||
|
groupFilter, |
||||
|
[]string{"cn", "dn"}, |
||||
|
nil, |
||||
|
) |
||||
|
|
||||
|
result, err := conn.Search(searchRequest) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
|
||||
|
var groups []string |
||||
|
for _, entry := range result.Entries { |
||||
|
cn := entry.GetAttributeValue("cn") |
||||
|
if cn != "" { |
||||
|
groups = append(groups, cn) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return groups, nil |
||||
|
} |
||||
|
|
||||
|
// GetUserInfo retrieves user information by user ID
|
||||
|
func (p *LDAPProvider) GetUserInfo(ctx context.Context, userID string) (*providers.ExternalIdentity, error) { |
||||
|
p.mu.RLock() |
||||
|
if !p.initialized { |
||||
|
p.mu.RUnlock() |
||||
|
return nil, fmt.Errorf("LDAP provider not initialized") |
||||
|
} |
||||
|
config := p.config |
||||
|
p.mu.RUnlock() |
||||
|
|
||||
|
// Get connection from pool
|
||||
|
conn, err := p.getConnection() |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
// Note: defer returnConnection moved to after bind
|
||||
|
|
||||
|
// Bind with service account
|
||||
|
if config.BindDN != "" { |
||||
|
err = conn.Bind(config.BindDN, config.BindPassword) |
||||
|
if err != nil { |
||||
|
conn.Close() // Close on bind failure
|
||||
|
return nil, fmt.Errorf("LDAP service bind failed: %w", err) |
||||
|
} |
||||
|
} |
||||
|
defer p.returnConnection(conn) |
||||
|
|
||||
|
// Search for the user
|
||||
|
userFilter := fmt.Sprintf(config.UserFilter, ldap.EscapeFilter(userID)) |
||||
|
searchRequest := ldap.NewSearchRequest( |
||||
|
config.BaseDN, |
||||
|
ldap.ScopeWholeSubtree, |
||||
|
ldap.NeverDerefAliases, |
||||
|
1, |
||||
|
int(config.ConnectionTimeout.Seconds()), |
||||
|
false, |
||||
|
userFilter, |
||||
|
[]string{"dn", config.Attributes.Email, config.Attributes.DisplayName, config.Attributes.UID, config.Attributes.Groups}, |
||||
|
nil, |
||||
|
) |
||||
|
|
||||
|
result, err := conn.Search(searchRequest) |
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("LDAP user search failed: %w", err) |
||||
|
} |
||||
|
|
||||
|
if len(result.Entries) == 0 { |
||||
|
return nil, fmt.Errorf("user not found") |
||||
|
} |
||||
|
if len(result.Entries) > 1 { |
||||
|
return nil, fmt.Errorf("multiple users found") |
||||
|
} |
||||
|
|
||||
|
userEntry := result.Entries[0] |
||||
|
identity := &providers.ExternalIdentity{ |
||||
|
UserID: userID, |
||||
|
Email: userEntry.GetAttributeValue(config.Attributes.Email), |
||||
|
DisplayName: userEntry.GetAttributeValue(config.Attributes.DisplayName), |
||||
|
Groups: userEntry.GetAttributeValues(config.Attributes.Groups), |
||||
|
Provider: p.name, |
||||
|
Attributes: map[string]string{ |
||||
|
"dn": userEntry.DN, |
||||
|
"uid": userEntry.GetAttributeValue(config.Attributes.UID), |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
// If no groups from memberOf, try group search
|
||||
|
if len(identity.Groups) == 0 && config.GroupFilter != "" { |
||||
|
groups, err := p.searchUserGroups(conn, userEntry.DN, config) |
||||
|
if err != nil { |
||||
|
glog.V(2).Infof("Group search failed for %s: %v", userID, err) |
||||
|
} else { |
||||
|
identity.Groups = groups |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return identity, nil |
||||
|
} |
||||
|
|
||||
|
// ValidateToken validates credentials (username:password format) and returns claims
|
||||
|
func (p *LDAPProvider) ValidateToken(ctx context.Context, token string) (*providers.TokenClaims, error) { |
||||
|
identity, err := p.Authenticate(ctx, token) |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
|
||||
|
p.mu.RLock() |
||||
|
config := p.config |
||||
|
p.mu.RUnlock() |
||||
|
|
||||
|
// If audience is configured, validate it (consistent with OIDC approach)
|
||||
|
audience := p.name |
||||
|
if config.Audience != "" { |
||||
|
audience = config.Audience |
||||
|
} |
||||
|
|
||||
|
// Populate standard TokenClaims fields for interface compliance
|
||||
|
now := time.Now() |
||||
|
ttl := 1 * time.Hour // Default TTL for LDAP tokens
|
||||
|
|
||||
|
return &providers.TokenClaims{ |
||||
|
Subject: identity.UserID, |
||||
|
Issuer: p.name, |
||||
|
Audience: audience, |
||||
|
IssuedAt: now, |
||||
|
ExpiresAt: now.Add(ttl), |
||||
|
Claims: map[string]interface{}{ |
||||
|
"email": identity.Email, |
||||
|
"name": identity.DisplayName, |
||||
|
"groups": identity.Groups, |
||||
|
"dn": identity.Attributes["dn"], |
||||
|
"provider": p.name, |
||||
|
}, |
||||
|
}, nil |
||||
|
} |
||||
|
|
||||
|
// IsInitialized returns whether the provider is initialized
|
||||
|
func (p *LDAPProvider) IsInitialized() bool { |
||||
|
p.mu.RLock() |
||||
|
defer p.mu.RUnlock() |
||||
|
return p.initialized |
||||
|
} |
||||
1133
weed/pb/volume_server_pb/volume_server.pb.go
File diff suppressed because it is too large
View File
File diff suppressed because it is too large
View File
777
weed/pb/volume_server_pb/volume_server_grpc.pb.go
File diff suppressed because it is too large
View File
File diff suppressed because it is too large
View File
@ -0,0 +1,15 @@ |
|||||
|
package s3api |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"fmt" |
||||
|
) |
||||
|
|
||||
|
// ValidateTrustPolicyForPrincipal validates if a principal is allowed to assume a role
|
||||
|
// Delegates to the IAM integration if available
|
||||
|
func (iam *IdentityAccessManagement) ValidateTrustPolicyForPrincipal(ctx context.Context, roleArn, principalArn string) error { |
||||
|
if iam.iamIntegration != nil { |
||||
|
return iam.iamIntegration.ValidateTrustPolicyForPrincipal(ctx, roleArn, principalArn) |
||||
|
} |
||||
|
return fmt.Errorf("IAM integration not available") |
||||
|
} |
||||
@ -0,0 +1,143 @@ |
|||||
|
package weed_server |
||||
|
|
||||
|
import ( |
||||
|
"net/http/httptest" |
||||
|
"testing" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/golang-jwt/jwt/v5" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/security" |
||||
|
) |
||||
|
|
||||
|
func TestFilerServer_maybeCheckJwtAuthorization_Scoped(t *testing.T) { |
||||
|
signingKey := "secret" |
||||
|
filerGuard := security.NewGuard(nil, signingKey, 0, signingKey, 0) |
||||
|
fs := &FilerServer{ |
||||
|
filerGuard: filerGuard, |
||||
|
} |
||||
|
|
||||
|
// Helper to generate token
|
||||
|
genToken := func(allowedPrefixes []string, allowedMethods []string) string { |
||||
|
claims := security.SeaweedFilerClaims{ |
||||
|
AllowedPrefixes: allowedPrefixes, |
||||
|
AllowedMethods: allowedMethods, |
||||
|
RegisteredClaims: jwt.RegisteredClaims{ |
||||
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)), |
||||
|
}, |
||||
|
} |
||||
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) |
||||
|
str, err := token.SignedString([]byte(signingKey)) |
||||
|
if err != nil { |
||||
|
t.Fatalf("failed to sign token: %v", err) |
||||
|
} |
||||
|
return str |
||||
|
} |
||||
|
|
||||
|
tests := []struct { |
||||
|
name string |
||||
|
token string |
||||
|
method string |
||||
|
path string |
||||
|
isWrite bool |
||||
|
expectAuthorized bool |
||||
|
}{ |
||||
|
{ |
||||
|
name: "no restrictions", |
||||
|
token: genToken(nil, nil), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "allowed prefix match", |
||||
|
token: genToken([]string{"/data"}, nil), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "allowed prefix mismatch", |
||||
|
token: genToken([]string{"/private"}, nil), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: false, |
||||
|
}, |
||||
|
{ |
||||
|
name: "allowed method match", |
||||
|
token: genToken(nil, []string{"GET"}), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "allowed method mismatch", |
||||
|
token: genToken(nil, []string{"POST"}), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: false, |
||||
|
}, |
||||
|
{ |
||||
|
name: "both match", |
||||
|
token: genToken([]string{"/data"}, []string{"GET"}), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "prefix match, method mismatch", |
||||
|
token: genToken([]string{"/data"}, []string{"POST"}), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: false, |
||||
|
}, |
||||
|
{ |
||||
|
name: "multiple prefixes match", |
||||
|
token: genToken([]string{"/other", "/data"}, nil), |
||||
|
method: "GET", |
||||
|
path: "/data/test", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "write operation with method restriction", |
||||
|
token: genToken(nil, []string{"POST", "PUT"}), |
||||
|
method: "POST", |
||||
|
path: "/data/upload", |
||||
|
isWrite: true, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
{ |
||||
|
name: "root path with prefix restriction", |
||||
|
token: genToken([]string{"/data"}, nil), |
||||
|
method: "GET", |
||||
|
path: "/", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: false, |
||||
|
}, |
||||
|
{ |
||||
|
name: "exact prefix match", |
||||
|
token: genToken([]string{"/data"}, nil), |
||||
|
method: "GET", |
||||
|
path: "/data", |
||||
|
isWrite: false, |
||||
|
expectAuthorized: true, |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
for _, tt := range tests { |
||||
|
t.Run(tt.name, func(t *testing.T) { |
||||
|
req := httptest.NewRequest(tt.method, tt.path, nil) |
||||
|
req.Header.Set("Authorization", "Bearer "+tt.token) |
||||
|
if authorized := fs.maybeCheckJwtAuthorization(req, tt.isWrite); authorized != tt.expectAuthorized { |
||||
|
t.Errorf("expected authorized=%v, got %v", tt.expectAuthorized, authorized) |
||||
|
} |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,71 @@ |
|||||
|
package storage |
||||
|
|
||||
|
import ( |
||||
|
"fmt" |
||||
|
"os" |
||||
|
"path/filepath" |
||||
|
|
||||
|
"github.com/seaweedfs/seaweedfs/weed/glog" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/util" |
||||
|
"google.golang.org/protobuf/proto" |
||||
|
) |
||||
|
|
||||
|
const ( |
||||
|
StateFileName = "state.pb" |
||||
|
StateFileMode = 0644 |
||||
|
) |
||||
|
|
||||
|
type State struct { |
||||
|
FilePath string |
||||
|
Pb *volume_server_pb.VolumeServerState |
||||
|
} |
||||
|
|
||||
|
func NewState(dir string) (*State, error) { |
||||
|
state := &State{ |
||||
|
FilePath: filepath.Join(dir, StateFileName), |
||||
|
Pb: nil, |
||||
|
} |
||||
|
|
||||
|
err := state.Load() |
||||
|
return state, err |
||||
|
} |
||||
|
|
||||
|
func (st *State) Load() error { |
||||
|
st.Pb = &volume_server_pb.VolumeServerState{} |
||||
|
|
||||
|
if !util.FileExists(st.FilePath) { |
||||
|
glog.V(1).Infof("No preexisting store state at %s", st.FilePath) |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
binPb, err := os.ReadFile(st.FilePath) |
||||
|
if err != nil { |
||||
|
st.Pb = nil |
||||
|
return fmt.Errorf("failed to read store state from %s : %v", st.FilePath, err) |
||||
|
} |
||||
|
if err := proto.Unmarshal(binPb, st.Pb); err != nil { |
||||
|
st.Pb = nil |
||||
|
return fmt.Errorf("failed to parse store state from %s : %v", st.FilePath, err) |
||||
|
} |
||||
|
|
||||
|
glog.V(1).Infof("Got store state from %s: %v", st.FilePath, st.Pb) |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func (st *State) Save() error { |
||||
|
if st.Pb == nil { |
||||
|
st.Pb = &volume_server_pb.VolumeServerState{} |
||||
|
} |
||||
|
|
||||
|
binPb, err := proto.Marshal(st.Pb) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("failed to serialize store state %v: %s", st.Pb, err) |
||||
|
} |
||||
|
if err := util.WriteFile(st.FilePath, binPb, StateFileMode); err != nil { |
||||
|
return fmt.Errorf("failed to write store state to %s : %v", st.FilePath, err) |
||||
|
} |
||||
|
|
||||
|
glog.V(1).Infof("Saved store state %v to %s", st.Pb, st.FilePath) |
||||
|
return nil |
||||
|
} |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue