unistack-org/micro
3
0
Fork 3
Code Issues 14 Pull Requests 2 Actions Packages Projects Releases 242 Wiki Activity

Merge pull request #1635 from micro/auth-fixes

Browse Source 
Auth: Move token generation logic out the client wrappers
This commit is contained in:
ben-toogood 2020-05-14 14:00:55 +01:00 committed by GitHub
commit b4c0224746
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 95 additions and 189 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
auth/jwt/jwt.go
View File

@ -2,6 +2,7 @@ package jwt
import (
"sync"
"time"
"github.com/micro/go-micro/v2/auth"
"github.com/micro/go-micro/v2/auth/token"
@ -176,15 +177,20 @@ func (j *jwt) Token(opts ...auth.TokenOption) (*auth.Token, error) {
return nil, err
}
tok, err := j.jwt.Generate(account, token.WithExpiry(options.Expiry))
access, err := j.jwt.Generate(account, token.WithExpiry(options.Expiry))
if err != nil {
return nil, err
}
refresh, err := j.jwt.Generate(account, token.WithExpiry(options.Expiry+time.Hour))
if err != nil {
return nil, err
}
return &auth.Token{
Created: tok.Created,
Expiry: tok.Expiry,
AccessToken: tok.Token,
RefreshToken: tok.Token,
Created: access.Created,
Expiry: access.Expiry,
AccessToken: access.Token,
RefreshToken: refresh.Token,
}, nil
}

22
auth/service/service.go
View File

@ -23,7 +23,6 @@ type svc struct {
auth pb.AuthService
rule pb.RulesService
jwt token.Provider
addrs []string
rules []*pb.Rule
sync.Mutex
@ -71,7 +70,7 @@ func (s *svc) Generate(id string, opts ...auth.GenerateOption) (*auth.Account, e
Metadata: options.Metadata,
Provider: options.Provider,
Namespace: options.Namespace,
}, client.WithAddress(s.addrs...))
})
if err != nil {
return nil, err
}
@ -90,7 +89,7 @@ func (s *svc) Grant(role string, res *auth.Resource) error {
Name: res.Name,
Endpoint: res.Endpoint,
},
}, client.WithAddress(s.addrs...))
})
return err
}
@ -105,7 +104,7 @@ func (s *svc) Revoke(role string, res *auth.Resource) error {
Name: res.Name,
Endpoint: res.Endpoint,
},
}, client.WithAddress(s.addrs...))
})
return err
}
@ -175,7 +174,7 @@ func (s *svc) Inspect(token string) (*auth.Account, error) {
// the token is not a JWT or we do not have the keys to decode it,
// fall back to the auth service
rsp, err := s.auth.Inspect(context.TODO(), &pb.InspectRequest{Token: token}, client.WithAddress(s.addrs...))
rsp, err := s.auth.Inspect(context.TODO(), &pb.InspectRequest{Token: token})
if err != nil {
return nil, err
}
@ -191,7 +190,7 @@ func (s *svc) Token(opts ...auth.TokenOption) (*auth.Token, error) {
Secret: options.Secret,
RefreshToken: options.RefreshToken,
TokenExpiry: int64(options.Expiry.Seconds()),
}, client.WithAddress(s.addrs...))
})
if err != nil {
return nil, err
}
@ -256,7 +255,7 @@ func (s *svc) listRules(filters ...string) []*pb.Rule {
// loadRules retrieves the rules from the auth service
func (s *svc) loadRules() {
rsp, err := s.rule.List(context.TODO(), &pb.ListRequest{}, client.WithAddress(s.addrs...))
rsp, err := s.rule.List(context.TODO(), &pb.ListRequest{})
s.Lock()
defer s.Unlock()
@ -301,21 +300,14 @@ func serializeAccount(a *pb.Account) *auth.Account {
// NewAuth returns a new instance of the Auth service
func NewAuth(opts ...auth.Option) auth.Auth {
options := auth.NewOptions(opts...)
if options.Client == nil {
options.Client = client.DefaultClient
}
addrs := options.Addrs
// if len(addrs) == 0 {
// addrs = []string{"127.0.0.1:8010"}
// }
service := &svc{
auth: pb.NewAuthService("go.micro.auth", options.Client),
rule: pb.NewRulesService("go.micro.auth", options.Client),
options: options,
addrs: addrs,
}
// load rules periodically from the auth service
@ -323,9 +315,9 @@ func NewAuth(opts ...auth.Option) auth.Auth {
ruleTimer := time.NewTicker(time.Second * 30)
for {
<-ruleTimer.C
time.Sleep(jitter.Do(time.Second * 5))
service.loadRules()
<-ruleTimer.C
}
}()

18
config/cmd/cmd.go
View File

@ -11,6 +11,7 @@ import (
"github.com/micro/go-micro/v2/auth/provider"
"github.com/micro/go-micro/v2/broker"
"github.com/micro/go-micro/v2/client"
"github.com/micro/go-micro/v2/client/grpc"
"github.com/micro/go-micro/v2/client/selector"
"github.com/micro/go-micro/v2/config"
configSrc "github.com/micro/go-micro/v2/config/source"
@ -21,10 +22,12 @@ import (
"github.com/micro/go-micro/v2/debug/trace"
"github.com/micro/go-micro/v2/logger"
"github.com/micro/go-micro/v2/registry"
registrySrv "github.com/micro/go-micro/v2/registry/service"
"github.com/micro/go-micro/v2/runtime"
"github.com/micro/go-micro/v2/server"
"github.com/micro/go-micro/v2/store"
"github.com/micro/go-micro/v2/transport"
"github.com/micro/go-micro/v2/util/wrapper"
// clients
cgrpc "github.com/micro/go-micro/v2/client/grpc"
@ -468,6 +471,10 @@ func (c *cmd) Before(ctx *cli.Context) error {
var serverOpts []server.Option
var clientOpts []client.Option
// setup a client to use when calling the runtime
authFn := func() auth.Auth { return *c.opts.Auth }
microClient := wrapper.AuthClient(authFn, grpc.NewClient())
// Set the store
if name := ctx.String("store"); len(name) > 0 {
s, ok := c.opts.Stores[name]
@ -475,7 +482,7 @@ func (c *cmd) Before(ctx *cli.Context) error {
return fmt.Errorf("Unsupported store: %s", name)
}
*c.opts.Store = s()
*c.opts.Store = s(store.WithClient(microClient))
}
// Set the runtime
@ -485,7 +492,7 @@ func (c *cmd) Before(ctx *cli.Context) error {
return fmt.Errorf("Unsupported runtime: %s", name)
}
*c.opts.Runtime = r()
*c.opts.Runtime = r(runtime.WithClient(microClient))
}
// Set the tracer
@ -504,8 +511,7 @@ func (c *cmd) Before(ctx *cli.Context) error {
if !ok {
return fmt.Errorf("Unsupported auth: %s", name)
}
*c.opts.Auth = a()
*c.opts.Auth = a(auth.WithClient(microClient))
serverOpts = append(serverOpts, server.Auth(*c.opts.Auth))
}
@ -554,7 +560,7 @@ func (c *cmd) Before(ctx *cli.Context) error {
return fmt.Errorf("Registry %s not found", name)
}
*c.opts.Registry = r()
*c.opts.Registry = r(registrySrv.WithClient(microClient))
serverOpts = append(serverOpts, server.Registry(*c.opts.Registry))
clientOpts = append(clientOpts, client.Registry(*c.opts.Registry))
@ -725,7 +731,7 @@ func (c *cmd) Before(ctx *cli.Context) error {
(*c.opts.Auth).Init(authOpts...)
if ctx.String("config") == "service" {
opt := config.WithSource(configSrv.NewSource(configSrc.WithClient(*c.opts.Client)))
opt := config.WithSource(configSrv.NewSource(configSrc.WithClient(microClient)))
if err := (*c.opts.Config).Init(opt); err != nil {
logger.Fatalf("Error configuring config: %v", err)
}

92
service.go
View File

@ -7,6 +7,7 @@ import (
rtime "runtime"
"strings"
"sync"
"time"
"github.com/micro/go-micro/v2/auth"
"github.com/micro/go-micro/v2/client"
@ -42,7 +43,7 @@ func newService(opts ...Option) Service {
// wrap client to inject From-Service header on any calls
options.Client = wrapper.FromService(serviceName, options.Client)
options.Client = wrapper.TraceCall(serviceName, trace.DefaultTracer, options.Client)
options.Client = wrapper.AuthClient(serviceName, options.Server.Options().Id, authFn, options.Client)
options.Client = wrapper.AuthClient(authFn, options.Client)
// wrap the server to provide handler stats
options.Server.Init(
@ -51,12 +52,6 @@ func newService(opts ...Option) Service {
server.WrapHandler(wrapper.AuthHandler(authFn)),
)
// set the client in the service implementations
// options.Auth.Init(auth.WithClient(options.Client))
// options.Registry.Init(registrySrv.WithClient(options.Client))
// options.Runtime.Init(runtime.WithClient(options.Client))
// options.Store.Init(store.WithClient(options.Client))
// set opts
service.opts = options
@ -119,15 +114,6 @@ func (s *service) Init(opts ...Option) {
// Explicitly set the table name to the service name
name := s.opts.Cmd.App().Name
s.opts.Store.Init(store.Table(name))
// Reset the clients for the micro services, this is done
// previously in newService for micro (since init is never called)
// however it needs to be done again here since for normal go-micro
// services the implementation may have changed by CLI flags.
// s.opts.Auth.Init(auth.WithClient(s.Client()))
// s.opts.Registry.Init(registrySrv.WithClient(s.Client()))
// s.opts.Runtime.Init(runtime.WithClient(s.Client()))
// s.opts.Store.Init(store.WithClient(s.Client()))
})
}
@ -240,25 +226,71 @@ func (s *service) Run() error {
}
func (s *service) generateAccount() error {
// generate a new auth account for the service
name := fmt.Sprintf("%v-%v", s.Name(), s.Server().Options().Id)
opts := []auth.GenerateOption{
auth.WithType("service"),
auth.WithRoles("service"),
auth.WithNamespace(s.Options().Auth.Options().Namespace),
// extract the account creds from options, these can be set by flags
accID := s.Options().Auth.Options().ID
accSecret := s.Options().Auth.Options().Secret
// if no credentials were provided, generate an account
if len(accID) == 0 || len(accSecret) == 0 {
name := fmt.Sprintf("%v-%v", s.Name(), s.Server().Options().Id)
opts := []auth.GenerateOption{
auth.WithType("service"),
auth.WithRoles("service"),
auth.WithNamespace(s.Options().Auth.Options().Namespace),
}
acc, err := s.Options().Auth.Generate(name, opts...)
if err != nil {
return err
}
logger.Infof("Auth [%v] Authenticated as %v", s.Options().Auth, name)
accID = acc.ID
accSecret = acc.Secret
}
acc, err := s.Options().Auth.Generate(name, opts...)
// generate the first token
token, err := s.Options().Auth.Token(
auth.WithCredentials(accID, accSecret),
auth.WithExpiry(time.Minute*10),
)
if err != nil {
return err
}
// generate a token
token, err := s.Options().Auth.Token(auth.WithCredentials(acc.ID, acc.Secret))
if err != nil {
return err
}
// set the credentials and token in auth options
s.Options().Auth.Init(
auth.ClientToken(token),
auth.Credentials(accID, accSecret),
)
// periodically check to see if the token needs refreshing
go func() {
timer := time.NewTicker(time.Second * 15)
for {
<-timer.C
// don't refresh the token if it's not close to expiring
tok := s.Options().Auth.Options().Token
if tok.Expiry.Unix() > time.Now().Add(time.Minute).Unix() {
continue
}
// generate the first token
tok, err := s.Options().Auth.Token(
auth.WithCredentials(accID, accSecret),
auth.WithExpiry(time.Minute*10),
)
if err != nil {
logger.Warnf("[Auth] Error refreshing token: %v", err)
continue
}
// set the token
s.Options().Auth.Init(auth.ClientToken(tok))
}
}()
s.Options().Auth.Init(auth.ClientToken(token), auth.Credentials(acc.ID, acc.Secret))
logger.Infof("Auth [%v] Authenticated as %v", s.Options().Auth, name)
return nil
}

90
util/config/config.go
View File

@ -1,90 +0,0 @@
package config
import (
"io/ioutil"
"os"
"os/user"
"path/filepath"
"strings"
conf "github.com/micro/go-micro/v2/config"
"github.com/micro/go-micro/v2/config/source/file"
"github.com/micro/go-micro/v2/util/log"
)
// FileName for global micro config
const FileName = ".micro"
// config is a singleton which is required to ensure
// each function call doesn't load the .micro file
// from disk
var config = newConfig()
// Get a value from the .micro file
func Get(path ...string) (string, error) {
tk := config.Get(path...).String("")
return strings.TrimSpace(tk), nil
}
// Set a value in the .micro file
func Set(value string, path ...string) error {
// get the filepath
fp, err := filePath()
if err != nil {
return err
}
// set the value
config.Set(value, path...)
// write to the file
return ioutil.WriteFile(fp, config.Bytes(), 0644)
}
func filePath() (string, error) {
usr, err := user.Current()
if err != nil {
return "", err
}
return filepath.Join(usr.HomeDir, FileName), nil
}
// newConfig returns a loaded config
func newConfig() conf.Config {
// get the filepath
fp, err := filePath()
if err != nil {
log.Error(err)
return conf.DefaultConfig
}
// write the file if it does not exist
if _, err := os.Stat(fp); os.IsNotExist(err) {
ioutil.WriteFile(fp, []byte{}, 0644)
} else if err != nil {
log.Error(err)
return conf.DefaultConfig
}
// create a new config
c, err := conf.NewConfig(
conf.WithSource(
file.NewSource(
file.WithPath(fp),
),
),
)
if err != nil {
log.Error(err)
return conf.DefaultConfig
}
// load the config
if err := c.Load(); err != nil {
log.Error(err)
return conf.DefaultConfig
}
// return the conf
return c
}

46
util/wrapper/wrapper.go
View File

@ -12,7 +12,6 @@ import (
"github.com/micro/go-micro/v2/errors"
"github.com/micro/go-micro/v2/metadata"
"github.com/micro/go-micro/v2/server"
"github.com/micro/go-micro/v2/util/config"
)
type fromServiceWrapper struct {
@ -133,8 +132,6 @@ func TraceHandler(t trace.Tracer) server.HandlerWrapper {
type authWrapper struct {
client.Client
name string
id string
auth func() auth.Auth
}
@ -159,57 +156,20 @@ func (a *authWrapper) Call(ctx context.Context, req client.Request, rsp interfac
return a.Client.Call(ctx, req, rsp, opts...)
}
// performs the call with the authorization token provided
callWithToken := func(token string) error {
ctx := metadata.Set(ctx, "Authorization", auth.BearerScheme+token)
return a.Client.Call(ctx, req, rsp, opts...)
}
// check to see if we have a valid access token
aaOpts := aa.Options()
if aaOpts.Token != nil && aaOpts.Token.Expiry.Unix() > time.Now().Unix() {
return callWithToken(aaOpts.Token.AccessToken)
}
// check to ensure we're not calling auth, since this will result in
// an endless loop
if req.Service() == "go.micro.auth" {
ctx = metadata.Set(ctx, "Authorization", auth.BearerScheme+aaOpts.Token.AccessToken)
return a.Client.Call(ctx, req, rsp, opts...)
}
// if we have a refresh token we can use this to generate another access token
if aaOpts.Token != nil {
tok, err := aa.Token(auth.WithToken(aaOpts.Token.RefreshToken))
if err != nil {
return err
}
aa.Init(auth.ClientToken(tok))
return callWithToken(tok.AccessToken)
}
// generate a new token if we have credentials
if len(aaOpts.ID) > 0 && len(aaOpts.Secret) > 0 {
tok, err := aa.Token(auth.WithCredentials(aaOpts.ID, aaOpts.Secret))
if err != nil {
return err
}
aa.Init(auth.ClientToken(tok))
return callWithToken(tok.AccessToken)
}
// check to see if a token was provided in config, this is normally used for
// setting the token when calling via the cli
if token, err := config.Get("micro", "auth", "token"); err == nil && len(token) > 0 {
return callWithToken(token)
}
// call without an auth token
return a.Client.Call(ctx, req, rsp, opts...)
}
// AuthClient wraps requests with the auth header
func AuthClient(name string, id string, auth func() auth.Auth, c client.Client) client.Client {
return &authWrapper{c, name, id, auth}
func AuthClient(auth func() auth.Auth, c client.Client) client.Client {
return &authWrapper{c, auth}
}
// AuthHandler wraps a server handler to perform auth