@ -243,7 +243,7 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
if ! s . initialized { if ! s . initialized {
return nil , fmt . Errorf ( "STS service not initialized" ) return nil , fmt . Errorf ( "STS service not initialized" )
} }
if request == nil { if request == nil {
return nil , fmt . Errorf ( "request cannot be nil" ) return nil , fmt . Errorf ( "request cannot be nil" )
} }
@ -300,8 +300,8 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
// 7. Build and return response
// 7. Build and return response
assumedRoleUser := & AssumedRoleUser { assumedRoleUser := & AssumedRoleUser {
AssumedRoleId : request . RoleArn , AssumedRoleId : request . RoleArn ,
Arn : GenerateAssumedRoleArn ( request . RoleArn , request . RoleSessionName ) ,
Subject : externalIdentity . UserID ,
Arn : GenerateAssumedRoleArn ( request . RoleArn , request . RoleSessionName ) ,
Subject : externalIdentity . UserID ,
} }
return & AssumeRoleResponse { return & AssumeRoleResponse {
@ -315,7 +315,7 @@ func (s *STSService) AssumeRoleWithCredentials(ctx context.Context, request *Ass
if ! s . initialized { if ! s . initialized {
return nil , fmt . Errorf ( "STS service not initialized" ) return nil , fmt . Errorf ( "STS service not initialized" )
} }
if request == nil { if request == nil {
return nil , fmt . Errorf ( "request cannot be nil" ) return nil , fmt . Errorf ( "request cannot be nil" )
} }
@ -379,8 +379,8 @@ func (s *STSService) AssumeRoleWithCredentials(ctx context.Context, request *Ass
// 8. Build and return response
// 8. Build and return response
assumedRoleUser := & AssumedRoleUser { assumedRoleUser := & AssumedRoleUser {
AssumedRoleId : request . RoleArn , AssumedRoleId : request . RoleArn ,
Arn : GenerateAssumedRoleArn ( request . RoleArn , request . RoleSessionName ) ,
Subject : externalIdentity . UserID ,
Arn : GenerateAssumedRoleArn ( request . RoleArn , request . RoleSessionName ) ,
Subject : externalIdentity . UserID ,
} }
return & AssumeRoleResponse { return & AssumeRoleResponse {
@ -394,34 +394,34 @@ func (s *STSService) ValidateSessionToken(ctx context.Context, sessionToken stri
if ! s . initialized { if ! s . initialized {
return nil , fmt . Errorf ( "STS service not initialized" ) return nil , fmt . Errorf ( "STS service not initialized" )
} }
if sessionToken == "" { if sessionToken == "" {
return nil , fmt . Errorf ( "session token cannot be empty" ) return nil , fmt . Errorf ( "session token cannot be empty" )
} }
// For now, use the session token as session ID directly
// For now, use the session token as session ID directly
// In a full implementation, this would:
// In a full implementation, this would:
// 1. Parse JWT session token
// 1. Parse JWT session token
// 2. Verify signature and expiration
// 2. Verify signature and expiration
// 3. Extract session ID from claims
// 3. Extract session ID from claims
// Extract session ID (simplified - assuming token contains session ID directly)
// Extract session ID (simplified - assuming token contains session ID directly)
sessionId := s . extractSessionIdFromToken ( sessionToken ) sessionId := s . extractSessionIdFromToken ( sessionToken )
if sessionId == "" { if sessionId == "" {
return nil , fmt . Errorf ( "invalid session token format" ) return nil , fmt . Errorf ( "invalid session token format" )
} }
// Retrieve session from store
// Retrieve session from store
session , err := s . sessionStore . GetSession ( ctx , sessionId ) session , err := s . sessionStore . GetSession ( ctx , sessionId )
if err != nil { if err != nil {
return nil , fmt . Errorf ( "session validation failed: %w" , err ) return nil , fmt . Errorf ( "session validation failed: %w" , err )
} }
// Additional validation can be added here
// Additional validation can be added here
if session . ExpiresAt . Before ( time . Now ( ) ) { if session . ExpiresAt . Before ( time . Now ( ) ) {
return nil , fmt . Errorf ( "session has expired" ) return nil , fmt . Errorf ( "session has expired" )
} }
return session , nil return session , nil
} }
@ -430,23 +430,23 @@ func (s *STSService) RevokeSession(ctx context.Context, sessionToken string) err
if ! s . initialized { if ! s . initialized {
return fmt . Errorf ( "STS service not initialized" ) return fmt . Errorf ( "STS service not initialized" )
} }
if sessionToken == "" { if sessionToken == "" {
return fmt . Errorf ( "session token cannot be empty" ) return fmt . Errorf ( "session token cannot be empty" )
} }
// Extract session ID from token
// Extract session ID from token
sessionId := s . extractSessionIdFromToken ( sessionToken ) sessionId := s . extractSessionIdFromToken ( sessionToken )
if sessionId == "" { if sessionId == "" {
return fmt . Errorf ( "invalid session token format" ) return fmt . Errorf ( "invalid session token format" )
} }
// Remove session from store
// Remove session from store
err := s . sessionStore . RevokeSession ( ctx , sessionId ) err := s . sessionStore . RevokeSession ( ctx , sessionId )
if err != nil { if err != nil {
return fmt . Errorf ( "failed to revoke session: %w" , err ) return fmt . Errorf ( "failed to revoke session: %w" , err )
} }
return nil return nil
} }
@ -457,22 +457,22 @@ func (s *STSService) validateAssumeRoleWithWebIdentityRequest(request *AssumeRol
if request . RoleArn == "" { if request . RoleArn == "" {
return fmt . Errorf ( "RoleArn is required" ) return fmt . Errorf ( "RoleArn is required" )
} }
if request . WebIdentityToken == "" { if request . WebIdentityToken == "" {
return fmt . Errorf ( "WebIdentityToken is required" ) return fmt . Errorf ( "WebIdentityToken is required" )
} }
if request . RoleSessionName == "" { if request . RoleSessionName == "" {
return fmt . Errorf ( "RoleSessionName is required" ) return fmt . Errorf ( "RoleSessionName is required" )
} }
// Validate session duration if provided
// Validate session duration if provided
if request . DurationSeconds != nil { if request . DurationSeconds != nil {
if * request . DurationSeconds < 900 || * request . DurationSeconds > 43200 { // 15min to 12 hours
if * request . DurationSeconds < 900 || * request . DurationSeconds > 43200 { // 15min to 12 hours
return fmt . Errorf ( "DurationSeconds must be between 900 and 43200 seconds" ) return fmt . Errorf ( "DurationSeconds must be between 900 and 43200 seconds" )
} }
} }
return nil return nil
} }
@ -486,7 +486,7 @@ func (s *STSService) validateWebIdentityToken(ctx context.Context, token string)
return identity , provider , nil return identity , provider , nil
} }
} }
return nil , nil , fmt . Errorf ( "web identity token validation failed with all providers" ) return nil , nil , fmt . Errorf ( "web identity token validation failed with all providers" )
} }
@ -497,27 +497,27 @@ func (s *STSService) validateRoleAssumption(roleArn string, identity *providers.
// 1. Role exists
// 1. Role exists
// 2. Role trust policy allows assumption by this identity
// 2. Role trust policy allows assumption by this identity
// 3. Identity has permission to assume the role
// 3. Identity has permission to assume the role
if roleArn == "" { if roleArn == "" {
return fmt . Errorf ( "role ARN cannot be empty" ) return fmt . Errorf ( "role ARN cannot be empty" )
} }
if identity == nil { if identity == nil {
return fmt . Errorf ( "identity cannot be nil" ) return fmt . Errorf ( "identity cannot be nil" )
} }
// Basic role ARN format validation
// Basic role ARN format validation
expectedPrefix := "arn:seaweed:iam::role/" expectedPrefix := "arn:seaweed:iam::role/"
if len ( roleArn ) < len ( expectedPrefix ) || roleArn [ : len ( expectedPrefix ) ] != expectedPrefix { if len ( roleArn ) < len ( expectedPrefix ) || roleArn [ : len ( expectedPrefix ) ] != expectedPrefix {
return fmt . Errorf ( "invalid role ARN format: got %s, expected format: %s*" , roleArn , expectedPrefix ) return fmt . Errorf ( "invalid role ARN format: got %s, expected format: %s*" , roleArn , expectedPrefix )
} }
// For testing, reject non-existent roles
// For testing, reject non-existent roles
roleName := extractRoleNameFromArn ( roleArn ) roleName := extractRoleNameFromArn ( roleArn )
if roleName == "NonExistentRole" { if roleName == "NonExistentRole" {
return fmt . Errorf ( "role does not exist: %s" , roleName ) return fmt . Errorf ( "role does not exist: %s" , roleName )
} }
return nil return nil
} }
@ -526,7 +526,7 @@ func (s *STSService) calculateSessionDuration(durationSeconds *int64) time.Durat
if durationSeconds != nil { if durationSeconds != nil {
return time . Duration ( * durationSeconds ) * time . Second return time . Duration ( * durationSeconds ) * time . Second
} }
// Use default from config
// Use default from config
return s . config . TokenDuration return s . config . TokenDuration
} }
@ -536,7 +536,7 @@ func (s *STSService) extractSessionIdFromToken(sessionToken string) string {
// For simplified implementation, we need to map session tokens to session IDs
// For simplified implementation, we need to map session tokens to session IDs
// The session token is stored as part of the credentials in the session
// The session token is stored as part of the credentials in the session
// So we need to search through sessions to find the matching token
// So we need to search through sessions to find the matching token
// For now, use the session token directly as session ID since we store them together
// For now, use the session token directly as session ID since we store them together
// In a full implementation, this would parse JWT and extract session ID from claims
// In a full implementation, this would parse JWT and extract session ID from claims
if len ( sessionToken ) > 10 && sessionToken [ : 2 ] == "ST" { if len ( sessionToken ) > 10 && sessionToken [ : 2 ] == "ST" {
@ -544,12 +544,12 @@ func (s *STSService) extractSessionIdFromToken(sessionToken string) string {
// This is inefficient but works for testing
// This is inefficient but works for testing
return s . findSessionIdByToken ( sessionToken ) return s . findSessionIdByToken ( sessionToken )
} }
// For test compatibility, also handle direct session IDs
// For test compatibility, also handle direct session IDs
if len ( sessionToken ) == 32 { // Typical session ID length
if len ( sessionToken ) == 32 { // Typical session ID length
return sessionToken return sessionToken
} }
return "" return ""
} }
@ -558,22 +558,22 @@ func (s *STSService) findSessionIdByToken(sessionToken string) string {
// In a real implementation, we'd maintain a reverse index
// In a real implementation, we'd maintain a reverse index
// For testing, we can use the fact that our memory store can be searched
// For testing, we can use the fact that our memory store can be searched
// This is a simplified approach - in production we'd use proper token->session mapping
// This is a simplified approach - in production we'd use proper token->session mapping
memStore , ok := s . sessionStore . ( * MemorySessionStore ) memStore , ok := s . sessionStore . ( * MemorySessionStore )
if ! ok { if ! ok {
return "" return ""
} }
// Search through all sessions to find matching token
// Search through all sessions to find matching token
memStore . mutex . RLock ( ) memStore . mutex . RLock ( )
defer memStore . mutex . RUnlock ( ) defer memStore . mutex . RUnlock ( )
for sessionId , session := range memStore . sessions { for sessionId , session := range memStore . sessions {
if session . Credentials != nil && session . Credentials . SessionToken == sessionToken { if session . Credentials != nil && session . Credentials . SessionToken == sessionToken {
return sessionId return sessionId
} }
} }
return "" return ""
} }
@ -582,29 +582,29 @@ func (s *STSService) validateAssumeRoleWithCredentialsRequest(request *AssumeRol
if request . RoleArn == "" { if request . RoleArn == "" {
return fmt . Errorf ( "RoleArn is required" ) return fmt . Errorf ( "RoleArn is required" )
} }
if request . Username == "" { if request . Username == "" {
return fmt . Errorf ( "Username is required" ) return fmt . Errorf ( "Username is required" )
} }
if request . Password == "" { if request . Password == "" {
return fmt . Errorf ( "Password is required" ) return fmt . Errorf ( "Password is required" )
} }
if request . RoleSessionName == "" { if request . RoleSessionName == "" {
return fmt . Errorf ( "RoleSessionName is required" ) return fmt . Errorf ( "RoleSessionName is required" )
} }
if request . ProviderName == "" { if request . ProviderName == "" {
return fmt . Errorf ( "ProviderName is required" ) return fmt . Errorf ( "ProviderName is required" )
} }
// Validate session duration if provided
// Validate session duration if provided
if request . DurationSeconds != nil { if request . DurationSeconds != nil {
if * request . DurationSeconds < 900 || * request . DurationSeconds > 43200 { // 15min to 12 hours
if * request . DurationSeconds < 900 || * request . DurationSeconds > 43200 { // 15min to 12 hours
return fmt . Errorf ( "DurationSeconds must be between 900 and 43200 seconds" ) return fmt . Errorf ( "DurationSeconds must be between 900 and 43200 seconds" )
} }
} }
return nil return nil
} }
chrislu
2 months ago