mirror of
https://github.com/yunionio/cloudpods.git
synced 2026-09-24 16:03:43 +08:00
1049 lines
30 KiB
Go
1049 lines
30 KiB
Go
// Copyright 2019 Yunion
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package handler
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"yunion.io/x/jsonutils"
|
|
"yunion.io/x/log"
|
|
"yunion.io/x/pkg/errors"
|
|
|
|
"yunion.io/x/onecloud/pkg/apigateway/clientman"
|
|
"yunion.io/x/onecloud/pkg/apigateway/constants"
|
|
"yunion.io/x/onecloud/pkg/apigateway/options"
|
|
policytool "yunion.io/x/onecloud/pkg/apigateway/policy"
|
|
"yunion.io/x/onecloud/pkg/appctx"
|
|
"yunion.io/x/onecloud/pkg/appsrv"
|
|
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
|
|
"yunion.io/x/onecloud/pkg/httperrors"
|
|
"yunion.io/x/onecloud/pkg/mcclient"
|
|
"yunion.io/x/onecloud/pkg/mcclient/auth"
|
|
"yunion.io/x/onecloud/pkg/mcclient/modulebase"
|
|
"yunion.io/x/onecloud/pkg/mcclient/modules"
|
|
"yunion.io/x/onecloud/pkg/util/httputils"
|
|
"yunion.io/x/onecloud/pkg/util/netutils2"
|
|
"yunion.io/x/onecloud/pkg/util/rbacutils"
|
|
)
|
|
|
|
func AppContextToken(ctx context.Context) mcclient.TokenCredential {
|
|
val := ctx.Value(appctx.AppContextKey(constants.AUTH_TOKEN))
|
|
if val == nil {
|
|
return nil
|
|
}
|
|
return val.(mcclient.TokenCredential)
|
|
}
|
|
|
|
type AuthHandlers struct {
|
|
*SHandlers
|
|
preLoginHook PreLoginFunc
|
|
}
|
|
|
|
func NewAuthHandlers(prefix string, preLoginHook PreLoginFunc) *AuthHandlers {
|
|
return &AuthHandlers{
|
|
SHandlers: NewHandlers(prefix),
|
|
preLoginHook: preLoginHook,
|
|
}
|
|
}
|
|
|
|
func (h *AuthHandlers) AddMethods() {
|
|
// no middleware handler
|
|
h.AddByMethod(GET, nil,
|
|
NewHP(h.getRegions, "regions"),
|
|
NewHP(h.listTotpRecoveryQuestions, "recovery"),
|
|
)
|
|
h.AddByMethod(POST, nil,
|
|
NewHP(h.resetTotpSecrets, "credential"),
|
|
NewHP(h.validatePasscode, "passcode"),
|
|
NewHP(h.resetTotpRecoveryQuestions, "recovery"),
|
|
NewHP(h.postLoginHandler, "login"),
|
|
NewHP(h.postLogoutHandler, "logout"),
|
|
)
|
|
|
|
// auth middleware handler
|
|
h.AddByMethod(GET, FetchAuthToken,
|
|
NewHP(h.getUser, "user"),
|
|
NewHP(h.getPermissionDetails, "permissions"),
|
|
NewHP(h.getAdminResources, "admin_resources"),
|
|
NewHP(h.getResources, "scoped_resources"),
|
|
)
|
|
h.AddByMethod(POST, FetchAuthToken,
|
|
NewHP(h.resetUserPassword, "password"),
|
|
NewHP(h.getPermissionDetails, "permissions"),
|
|
NewHP(h.doCreatePolicies, "policies"),
|
|
)
|
|
h.AddByMethod(PATCH, FetchAuthToken,
|
|
NewHP(h.doPatchPolicy, "policies", "<policy_id>"),
|
|
)
|
|
h.AddByMethod(DELETE, FetchAuthToken,
|
|
NewHP(h.doDeletePolicies, "policies"),
|
|
)
|
|
}
|
|
|
|
func (h *AuthHandlers) Bind(app *appsrv.Application) {
|
|
h.AddMethods()
|
|
h.SHandlers.Bind(app)
|
|
}
|
|
|
|
func (h *AuthHandlers) GetRegionsResponse(ctx context.Context, w http.ResponseWriter, req *http.Request) (*jsonutils.JSONDict, error) {
|
|
adminToken := auth.AdminCredential()
|
|
if adminToken == nil {
|
|
return nil, errors.Error("failed to get admin credential")
|
|
}
|
|
regions := adminToken.GetRegions()
|
|
if len(regions) == 0 {
|
|
return nil, errors.Error("region is empty")
|
|
}
|
|
regionsJson := jsonutils.NewStringArray(regions)
|
|
s := auth.GetAdminSession(ctx, regions[0], "")
|
|
filters := jsonutils.NewDict()
|
|
filters.Add(jsonutils.NewInt(1000), "limit")
|
|
result, e := modules.Domains.List(s, filters)
|
|
if e != nil {
|
|
return nil, errors.Wrap(e, "list domain")
|
|
}
|
|
domains := jsonutils.NewArray()
|
|
for _, d := range result.Data {
|
|
dn, e := d.Get("name")
|
|
if e == nil {
|
|
if status, err := d.Bool("enabled"); err == nil && status {
|
|
domains.Add(dn)
|
|
}
|
|
}
|
|
}
|
|
resp := jsonutils.NewDict()
|
|
resp.Add(domains, "domains")
|
|
resp.Add(regionsJson, "regions")
|
|
|
|
filters = jsonutils.NewDict()
|
|
filters.Add(jsonutils.NewStringArray([]string{"cas"}), "driver")
|
|
filters.Add(jsonutils.JSONTrue, "enabled")
|
|
filters.Add(jsonutils.NewInt(1000), "limit")
|
|
idps, err := modules.IdentityProviders.List(s, filters)
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "list idp")
|
|
}
|
|
retIdps := make([]jsonutils.JSONObject, 0)
|
|
for i := range idps.Data {
|
|
retIdp := jsonutils.NewDict()
|
|
id, _ := idps.Data[i].GetString("id")
|
|
name, _ := idps.Data[i].GetString("name")
|
|
driver, _ := idps.Data[i].GetString("driver")
|
|
retIdp.Add(jsonutils.NewString(id), "id")
|
|
retIdp.Add(jsonutils.NewString(name), "name")
|
|
retIdp.Add(jsonutils.NewString(driver), "driver")
|
|
conf, err := modules.IdentityProviders.GetSpecific(s, id, "config", nil)
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "idp get config spec")
|
|
}
|
|
retIdp.Update(conf)
|
|
retIdps = append(retIdps, retIdp)
|
|
}
|
|
|
|
resp.Add(jsonutils.NewArray(retIdps...), "idps")
|
|
|
|
return resp, nil
|
|
}
|
|
|
|
func (h *AuthHandlers) getRegions(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
resp, err := h.GetRegionsResponse(ctx, w, req)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
appsrv.SendJSON(w, resp)
|
|
}
|
|
|
|
func (h *AuthHandlers) getUser(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
data, err := getUserInfo(ctx, s, t, req)
|
|
if err != nil {
|
|
httperrors.NotFoundError(w, err.Error())
|
|
return
|
|
}
|
|
body := jsonutils.NewDict()
|
|
body.Add(data, "data")
|
|
|
|
appsrv.SendJSON(w, body)
|
|
}
|
|
|
|
func (h *AuthHandlers) resetTotpSecrets(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
ResetTotpSecrets(ctx, w, req)
|
|
}
|
|
|
|
func (h *AuthHandlers) validatePasscode(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
ValidatePasscodeHandler(ctx, w, req)
|
|
}
|
|
|
|
func (h *AuthHandlers) resetTotpRecoveryQuestions(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
ResetTotpRecoveryQuestions(ctx, w, req)
|
|
}
|
|
|
|
func (h *AuthHandlers) listTotpRecoveryQuestions(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
ListTotpRecoveryQuestions(ctx, w, req)
|
|
}
|
|
|
|
// 返回 token及totp验证状态
|
|
func doTenantLogin(ctx context.Context, w http.ResponseWriter, req *http.Request, body jsonutils.JSONObject) (mcclient.TokenCredential, bool) {
|
|
otpVerified := false
|
|
tenantId, e := body.GetString("tenantId")
|
|
if e != nil {
|
|
httperrors.InvalidInputError(w, "not found tenantId in body")
|
|
return nil, otpVerified
|
|
}
|
|
authTokenStr := getAuthToken(req)
|
|
if len(authTokenStr) == 0 {
|
|
httperrors.InvalidCredentialError(w, "not found auth token")
|
|
return nil, otpVerified
|
|
}
|
|
token := clientman.TokenMan.Get(authTokenStr)
|
|
if token == nil || !token.IsValid() {
|
|
httperrors.InvalidCredentialError(w, "auth token %q is invalid", authTokenStr)
|
|
return nil, otpVerified
|
|
}
|
|
|
|
if isUserEnableTotp(ctx, req, token) {
|
|
totp := clientman.TokenMan.GetTotp(authTokenStr)
|
|
if !totp.IsVerified() {
|
|
httperrors.UnauthorizedError(w, "invalid totp token %q", authTokenStr)
|
|
return nil, otpVerified
|
|
} else {
|
|
otpVerified = true
|
|
}
|
|
}
|
|
|
|
token, e = auth.Client().SetProject(tenantId, "", "", token)
|
|
if e != nil {
|
|
httperrors.InvalidCredentialError(w, "failed to change project")
|
|
return nil, otpVerified
|
|
}
|
|
return token, otpVerified
|
|
}
|
|
|
|
func isUserEnableTotp(ctx context.Context, req *http.Request, token mcclient.TokenCredential) bool {
|
|
if !options.Options.EnableTotp {
|
|
return false
|
|
}
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
usr, err := modules.UsersV3.Get(s, token.GetUserId(), nil)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return jsonutils.QueryBoolean(usr, "enable_mfa", true)
|
|
}
|
|
|
|
func (h *AuthHandlers) doCredentialLogin(ctx context.Context, req *http.Request, body jsonutils.JSONObject) (mcclient.TokenCredential, error) {
|
|
var token mcclient.TokenCredential
|
|
var err error
|
|
var tenant string
|
|
cliIp := netutils2.GetHttpRequestIp(req)
|
|
if body.Contains("username") {
|
|
uname, _ := body.GetString("username")
|
|
|
|
if h.preLoginHook != nil {
|
|
if err = h.preLoginHook(ctx, req, uname, body); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
var passwd string
|
|
passwd, err = body.GetString("password")
|
|
if err != nil {
|
|
return nil, httperrors.NewInputParameterError("get password in body")
|
|
}
|
|
if len(uname) == 0 || len(passwd) == 0 {
|
|
return nil, httperrors.NewInputParameterError("username or password is empty")
|
|
}
|
|
|
|
tenant, uname = parseLoginUser(uname)
|
|
// var token mcclient.TokenCredential
|
|
domain, _ := body.GetString("domain")
|
|
token, err = auth.Client().AuthenticateWeb(uname, passwd, domain, "", "", cliIp)
|
|
} else if body.Contains("cas_ticket") {
|
|
ticket, _ := body.GetString("cas_ticket")
|
|
if len(ticket) == 0 {
|
|
return nil, httperrors.NewInputParameterError("cas_ticket is empty")
|
|
}
|
|
token, err = auth.Client().AuthenticateCAS(ticket, "", "", "", cliIp)
|
|
} else {
|
|
return nil, httperrors.NewInputParameterError("missing credential")
|
|
}
|
|
if err != nil {
|
|
switch httperr := err.(type) {
|
|
case *httputils.JSONClientError:
|
|
if httperr.Code == 409 {
|
|
return nil, err
|
|
}
|
|
}
|
|
return nil, httperrors.NewInvalidCredentialError("username/password incorrect")
|
|
}
|
|
uname := token.GetUserName()
|
|
if len(tenant) > 0 {
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
jsonProj, e := modules.Projects.GetById(s, tenant, nil)
|
|
if e != nil {
|
|
log.Errorf("fail to find preset project %s, reset to empty", tenant)
|
|
tenant = ""
|
|
} else {
|
|
projId, _ := jsonProj.GetString("id")
|
|
// projName, _ := jsonProj.GetString("name")
|
|
ntoken, e := auth.Client().SetProject(projId, "", "", token)
|
|
if e != nil {
|
|
log.Errorf("fail to change to preset project %s(%s), reset to empty", tenant, e)
|
|
tenant = ""
|
|
} else {
|
|
token = ntoken
|
|
}
|
|
}
|
|
}
|
|
if len(tenant) == 0 {
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
projects, e := modules.UsersV3.GetProjects(s, token.GetUserId())
|
|
if e == nil && len(projects.Data) > 0 {
|
|
projectJson := projects.Data[0]
|
|
for _, pJson := range projects.Data {
|
|
pname, _ := pJson.GetString("name")
|
|
if pname == uname {
|
|
projectJson = pJson
|
|
break
|
|
}
|
|
}
|
|
pid, e := projectJson.GetString("id")
|
|
if e == nil {
|
|
ntoken, e := auth.Client().SetProject(pid, "", "", token)
|
|
if e == nil {
|
|
token = ntoken
|
|
} else {
|
|
log.Errorf("fail to change to default project %s(%s), reset to empty", pid, e)
|
|
}
|
|
}
|
|
} else {
|
|
log.Errorf("GetProjects for login user error %s project count %d", e, len(projects.Data))
|
|
}
|
|
}
|
|
return token, nil
|
|
}
|
|
|
|
func parseLoginUser(uname string) (string, string) {
|
|
slashpos := strings.IndexByte(uname, '/')
|
|
tenant := ""
|
|
if slashpos > 0 {
|
|
tenant = uname[0:slashpos]
|
|
uname = uname[slashpos+1:]
|
|
}
|
|
|
|
return tenant, uname
|
|
}
|
|
|
|
func isUserAllowWebconsole(ctx context.Context, w http.ResponseWriter, req *http.Request, token mcclient.TokenCredential) bool {
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
usr, err := modules.UsersV3.Get(s, token.GetUserId(), nil)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return false
|
|
}
|
|
if !jsonutils.QueryBoolean(usr, "allow_web_console", true) {
|
|
httperrors.ForbiddenError(w, "forbidden user %q login from web", usr.String())
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func saveCookie(w http.ResponseWriter, name, val string, expire time.Time, base64 bool) {
|
|
diff := time.Until(expire)
|
|
maxAge := int(diff.Seconds())
|
|
// log.Println("Set cookie", name, expire, maxAge, val)
|
|
var valenc string
|
|
if base64 {
|
|
valenc = Base64UrlEncode([]byte(val))
|
|
} else {
|
|
valenc = val
|
|
}
|
|
// log.Printf("Set coookie: %s - %s\n", val, valenc)
|
|
cookie := &http.Cookie{Name: name, Value: valenc, Path: "/", Expires: expire, MaxAge: maxAge, HttpOnly: false}
|
|
http.SetCookie(w, cookie)
|
|
}
|
|
|
|
func getCookie(r *http.Request, name string) string {
|
|
cookie, err := r.Cookie(name)
|
|
if err != nil {
|
|
log.Errorf("Cookie not found %q", name)
|
|
return ""
|
|
// } else if cookie.Expires.Before(time.Now()) {
|
|
// fmt.Println("Cookie expired ", cookie.Expires, time.Now())
|
|
// return ""
|
|
} else {
|
|
val, err := Base64UrlDecode(cookie.Value)
|
|
if err != nil {
|
|
log.Errorf("Cookie %q fail to decode: %v", name, err)
|
|
return ""
|
|
}
|
|
return string(val)
|
|
}
|
|
}
|
|
|
|
func clearCookie(w http.ResponseWriter, name string) {
|
|
cookie := &http.Cookie{Name: name, Expires: time.Now(), Path: "/", MaxAge: -1, HttpOnly: false}
|
|
http.SetCookie(w, cookie)
|
|
}
|
|
|
|
type PreLoginFunc func(ctx context.Context, req *http.Request, uname string, body jsonutils.JSONObject) error
|
|
|
|
func (h *AuthHandlers) postLoginHandler(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
body, e := appsrv.FetchJSON(req)
|
|
if e != nil {
|
|
httperrors.InvalidInputError(w, "fetch json for request: %v", e)
|
|
return
|
|
}
|
|
var token mcclient.TokenCredential
|
|
otpVerified := false
|
|
if body.Contains("tenantId") { // switch project
|
|
token, otpVerified = doTenantLogin(ctx, w, req, body)
|
|
} else if body.Contains("username") || body.Contains("cas_ticket") {
|
|
// user/password authenticate
|
|
// cas authentication
|
|
token, e = h.doCredentialLogin(ctx, req, body)
|
|
if e != nil {
|
|
httperrors.GeneralServerError(w, e)
|
|
return
|
|
}
|
|
} else {
|
|
httperrors.InvalidInputError(w, "no login credential")
|
|
return
|
|
}
|
|
if token == nil {
|
|
return
|
|
}
|
|
|
|
if !isUserAllowWebconsole(ctx, w, req, token) {
|
|
return
|
|
}
|
|
|
|
//if len(token.GetProjectId()) == 0 {
|
|
// no vaid project, return 403
|
|
// httperrors.NoProjectError(w, "no valid project")
|
|
// return
|
|
//}
|
|
|
|
tid := clientman.TokenMan.Save(token)
|
|
|
|
// 切换项目时，如果之前totp已经验证通过，自动放行
|
|
if otpVerified {
|
|
totp := clientman.TokenMan.GetTotp(tid)
|
|
totp.MarkVerified()
|
|
clientman.TokenMan.SaveTotp(tid)
|
|
}
|
|
// log.Debugf("auth %s token %s", tid, token)
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
authCookie, err := getUserAuthCookie(ctx, s, token, tid, req)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
saveCookie(w, constants.YUNION_AUTH_COOKIE, authCookie, token.GetExpires(), true)
|
|
|
|
if len(token.GetProjectId()) > 0 {
|
|
if body.Contains("isadmin") {
|
|
adminVal := "false"
|
|
if policy.PolicyManager.IsScopeCapable(token, rbacutils.ScopeSystem) {
|
|
adminVal, _ = body.GetString("isadmin")
|
|
}
|
|
saveCookie(w, "isadmin", adminVal, token.GetExpires(), false)
|
|
}
|
|
if body.Contains("scope") {
|
|
scopeStr, _ := body.GetString("scope")
|
|
if !policy.PolicyManager.IsScopeCapable(token, rbacutils.TRbacScope(scopeStr)) {
|
|
scopeStr = string(rbacutils.ScopeProject)
|
|
}
|
|
saveCookie(w, "scope", scopeStr, token.GetExpires(), false)
|
|
}
|
|
if body.Contains("domain") {
|
|
domainStr, _ := body.GetString("domain")
|
|
saveCookie(w, "domain", domainStr, token.GetExpires(), false)
|
|
}
|
|
saveCookie(w, "tenant", token.GetProjectId(), token.GetExpires(), false)
|
|
}
|
|
|
|
setAuthHeader(w, tid)
|
|
|
|
// 开启Totp的状态下，如果用户未设置
|
|
qrcode := ""
|
|
if isUserEnableTotp(ctx, req, token) {
|
|
qrcode, err = initializeUserTotpCred(s, token)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
}
|
|
|
|
appsrv.Send(w, qrcode)
|
|
}
|
|
|
|
func (h *AuthHandlers) postLogoutHandler(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
tid := getAuthToken(req)
|
|
if len(tid) > 0 {
|
|
clientman.TokenMan.Remove(tid)
|
|
}
|
|
clearCookie(w, constants.YUNION_AUTH_COOKIE)
|
|
appsrv.Send(w, "")
|
|
}
|
|
|
|
func FetchRegion(req *http.Request) string {
|
|
r, e := req.Cookie("region")
|
|
if e == nil && len(r.Value) > 0 {
|
|
return r.Value
|
|
}
|
|
if len(options.Options.DefaultRegion) > 0 {
|
|
return options.Options.DefaultRegion
|
|
}
|
|
adminToken := auth.AdminCredential()
|
|
if adminToken == nil {
|
|
log.Errorf("FetchRegion: nil adminTken")
|
|
return ""
|
|
}
|
|
regions := adminToken.GetRegions()
|
|
if len(regions) == 0 {
|
|
log.Errorf("FetchRegion: empty region list")
|
|
return ""
|
|
}
|
|
for _, r := range regions {
|
|
if len(r) > 0 {
|
|
return r
|
|
}
|
|
}
|
|
log.Errorf("FetchRegion: no valid region")
|
|
return ""
|
|
}
|
|
|
|
func fetchDomain(req *http.Request) string {
|
|
r, e := req.Cookie("domain")
|
|
if e != nil {
|
|
return ""
|
|
}
|
|
return r.Value
|
|
}
|
|
|
|
type role struct {
|
|
id string
|
|
name string
|
|
}
|
|
|
|
type projectRoles struct {
|
|
id string
|
|
name string
|
|
domain string
|
|
domainId string
|
|
roles []role
|
|
}
|
|
|
|
func newProjectRoles(projectId, projectName, roleId, roleName string, domainId, domainName string) *projectRoles {
|
|
return &projectRoles{
|
|
id: projectId,
|
|
name: projectName,
|
|
domainId: domainId,
|
|
domain: domainName,
|
|
roles: []role{{id: roleId, name: roleName}},
|
|
}
|
|
}
|
|
|
|
func (this *projectRoles) add(roleId, roleName string) {
|
|
this.roles = append(this.roles, role{id: roleId, name: roleName})
|
|
}
|
|
|
|
func (this *projectRoles) getToken(scope rbacutils.TRbacScope, user, userId, domain, domainId string, ip string) mcclient.TokenCredential {
|
|
return &mcclient.SSimpleToken{
|
|
Domain: domain,
|
|
DomainId: domainId,
|
|
User: user,
|
|
UserId: userId,
|
|
Project: this.name,
|
|
ProjectId: this.id,
|
|
ProjectDomain: this.domain,
|
|
ProjectDomainId: this.domainId,
|
|
Roles: strings.Join(this.getRoles(), ","),
|
|
Context: mcclient.SAuthContext{
|
|
Ip: ip,
|
|
},
|
|
}
|
|
// return policy.PolicyManager.IsScopeCapable(&t, scope)
|
|
}
|
|
|
|
func (this *projectRoles) getRoles() []string {
|
|
roles := make([]string, 0)
|
|
for _, r := range this.roles {
|
|
roles = append(roles, r.name)
|
|
}
|
|
return roles
|
|
}
|
|
|
|
func (this *projectRoles) json(user, userId, domain, domainId string, ip string) jsonutils.JSONObject {
|
|
obj := jsonutils.NewDict()
|
|
obj.Add(jsonutils.NewString(this.id), "id")
|
|
obj.Add(jsonutils.NewString(this.name), "name")
|
|
obj.Add(jsonutils.NewString(this.domain), "domain")
|
|
obj.Add(jsonutils.NewString(this.domainId), "domain_id")
|
|
roles := jsonutils.NewArray()
|
|
for _, r := range this.roles {
|
|
role := jsonutils.NewDict()
|
|
role.Add(jsonutils.NewString(r.id), "id")
|
|
role.Add(jsonutils.NewString(r.name), "name")
|
|
roles.Add(role)
|
|
}
|
|
obj.Add(roles, "roles")
|
|
for _, scope := range []rbacutils.TRbacScope{
|
|
rbacutils.ScopeSystem,
|
|
rbacutils.ScopeDomain,
|
|
rbacutils.ScopeProject,
|
|
} {
|
|
token := this.getToken(scope, user, userId, domain, domainId, ip)
|
|
matches := policy.PolicyManager.MatchedPolicies(scope, token)
|
|
obj.Add(jsonutils.NewStringArray(matches), fmt.Sprintf("%s_policies", scope))
|
|
if len(matches) > 0 {
|
|
obj.Add(jsonutils.JSONTrue, fmt.Sprintf("%s_capable", scope))
|
|
} else {
|
|
obj.Add(jsonutils.JSONFalse, fmt.Sprintf("%s_capable", scope))
|
|
}
|
|
// backward compatible
|
|
if scope == rbacutils.ScopeSystem {
|
|
if len(matches) > 0 {
|
|
obj.Add(jsonutils.JSONTrue, "admin_capable")
|
|
} else {
|
|
obj.Add(jsonutils.JSONFalse, "admin_capable")
|
|
}
|
|
}
|
|
}
|
|
return obj
|
|
}
|
|
|
|
func getUserAuthCookie(ctx context.Context, s *mcclient.ClientSession, token mcclient.TokenCredential, sid string, req *http.Request) (string, error) {
|
|
// info, err := getUserInfo(s, token, req)
|
|
// if err != nil {
|
|
// return "", err
|
|
// }
|
|
info := jsonutils.NewDict()
|
|
info.Add(jsonutils.NewTimeString(token.GetExpires()), "exp")
|
|
info.Add(jsonutils.NewString(sid), "session")
|
|
info.Add(jsonutils.NewBool(isUserEnableTotp(ctx, req, token)), "totp_on") // 用户totp 开启状态。 True（已开启）|False(未开启)
|
|
info.Add(jsonutils.NewBool(options.Options.EnableTotp), "system_totp_on") // 全局totp 开启状态。 True（已开启）|False(未开启)
|
|
return info.String(), nil
|
|
}
|
|
|
|
func getLBAgentInfo(s *mcclient.ClientSession, token mcclient.TokenCredential) (*jsonutils.JSONDict, error) {
|
|
|
|
lbagents, err := modules.LoadbalancerAgents.List(s, nil)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "user %s get lbagent", token.GetUserName())
|
|
}
|
|
|
|
item := jsonutils.NewDict()
|
|
item.Add(jsonutils.NewString(""), "name")
|
|
item.Add(jsonutils.NewString("lbagent"), "type")
|
|
item.Add(jsonutils.JSONTrue, "as_menu")
|
|
if len(lbagents.Data) > 0 {
|
|
item.Add(jsonutils.JSONTrue, "status")
|
|
} else {
|
|
item.Add(jsonutils.JSONFalse, "status")
|
|
}
|
|
return item, nil
|
|
}
|
|
|
|
func getUserInfo(ctx context.Context, s *mcclient.ClientSession, token mcclient.TokenCredential, req *http.Request) (*jsonutils.JSONDict, error) {
|
|
usr, err := modules.UsersV3.Get(s, token.GetUserId(), nil)
|
|
if err != nil {
|
|
log.Errorf("modules.UsersV3.Get fail %s", err)
|
|
return nil, fmt.Errorf("not found user %s", token.GetUserId())
|
|
}
|
|
data := jsonutils.NewDict()
|
|
for _, k := range []string{
|
|
"displayname", "email", "id", "name",
|
|
"enabled", "mobile", "allow_web_console",
|
|
"created_at", "enable_mfa", "is_system_account",
|
|
"last_active_at", "last_login_ip",
|
|
"last_login_source", "idp_driver",
|
|
"password_expires_at", "failed_auth_count", "failed_auth_at",
|
|
} {
|
|
v, e := usr.Get(k)
|
|
if e == nil {
|
|
data.Add(v, k)
|
|
}
|
|
}
|
|
data.Add(jsonutils.NewString(token.GetDomainId()), "domain", "id")
|
|
data.Add(jsonutils.NewString(token.GetDomainName()), "domain", "name")
|
|
data.Add(jsonutils.NewStringArray(auth.AdminCredential().GetRegions()), "regions")
|
|
data.Add(jsonutils.NewStringArray(token.GetRoles()), "roles")
|
|
data.Add(jsonutils.NewString(token.GetProjectName()), "projectName")
|
|
data.Add(jsonutils.NewString(token.GetProjectId()), "projectId")
|
|
data.Add(jsonutils.NewString(token.GetProjectDomain()), "projectDomain")
|
|
data.Add(jsonutils.NewString(token.GetProjectDomainId()), "projectDomainId")
|
|
|
|
query := jsonutils.NewDict()
|
|
query.Add(jsonutils.JSONNull, "effective")
|
|
query.Add(jsonutils.JSONNull, "include_names")
|
|
query.Add(jsonutils.JSONNull, "include_system")
|
|
query.Add(jsonutils.NewInt(0), "limit")
|
|
query.Add(jsonutils.NewString(token.GetUserId()), "user", "id")
|
|
roleAssigns, err := modules.RoleAssignments.List(s, query)
|
|
if err != nil {
|
|
return nil, errors.Wrapf(err, "get RoleAssignments list")
|
|
}
|
|
projects := make(map[string]*projectRoles)
|
|
for _, roleAssign := range roleAssigns.Data {
|
|
roleId, _ := roleAssign.GetString("role", "id")
|
|
roleName, _ := roleAssign.GetString("role", "name")
|
|
projectId, _ := roleAssign.GetString("scope", "project", "id")
|
|
projectName, _ := roleAssign.GetString("scope", "project", "name")
|
|
domainId, _ := roleAssign.GetString("scope", "project", "domain", "id")
|
|
domain, _ := roleAssign.GetString("scope", "project", "domain", "name")
|
|
_, ok := projects[projectId]
|
|
if ok {
|
|
projects[projectId].add(roleId, roleName)
|
|
} else {
|
|
projects[projectId] = newProjectRoles(projectId, projectName, roleId, roleName, domainId, domain)
|
|
}
|
|
}
|
|
projJson := jsonutils.NewArray()
|
|
for _, proj := range projects {
|
|
projJson.Add(proj.json(
|
|
token.GetUserName(),
|
|
token.GetUserId(),
|
|
token.GetDomainName(),
|
|
token.GetDomainId(),
|
|
token.GetLoginIp(),
|
|
))
|
|
}
|
|
data.Add(projJson, "projects")
|
|
|
|
for _, scope := range []rbacutils.TRbacScope{
|
|
rbacutils.ScopeSystem,
|
|
rbacutils.ScopeDomain,
|
|
rbacutils.ScopeProject,
|
|
} {
|
|
p := policy.PolicyManager.MatchedPolicies(scope, token)
|
|
data.Add(jsonutils.NewStringArray(p), fmt.Sprintf("%s_policies", scope))
|
|
if scope == rbacutils.ScopeSystem {
|
|
data.Add(jsonutils.NewStringArray(p), "admin_policies")
|
|
} else if scope == rbacutils.ScopeProject {
|
|
data.Add(jsonutils.NewStringArray(p), "policies")
|
|
}
|
|
}
|
|
allPolicies := policy.PolicyManager.AllPolicies()
|
|
data.Add(jsonutils.Marshal(allPolicies), "all_policies")
|
|
|
|
services := jsonutils.NewArray()
|
|
menus := jsonutils.NewArray()
|
|
k8s := jsonutils.NewArray()
|
|
|
|
adminToken := auth.AdminCredential()
|
|
curReg := FetchRegion(req)
|
|
allsrv := adminToken.GetInternalServices(curReg)
|
|
alleps := auth.Client().GetServiceCatalog().GetServicesByInterface(curReg, "console")
|
|
|
|
if allsrv != nil && len(allsrv) > 0 {
|
|
for _, srv := range allsrv {
|
|
item := jsonutils.NewDict()
|
|
item.Add(jsonutils.NewString(""), "name")
|
|
item.Add(jsonutils.NewString(srv), "type")
|
|
item.Add(jsonutils.JSONTrue, "status")
|
|
if srv == "notify" {
|
|
item.Add(jsonutils.JSONFalse, "as_menu")
|
|
} else {
|
|
item.Add(jsonutils.JSONTrue, "as_menu")
|
|
}
|
|
services.Add(item)
|
|
}
|
|
} else {
|
|
log.Errorf("fail to find services????: %#v %s", adminToken, curReg)
|
|
}
|
|
|
|
lb, err := getLBAgentInfo(s, adminToken)
|
|
if err != nil {
|
|
log.Errorf("getLBAgentInfo fail %s", err)
|
|
} else {
|
|
services.Add(lb)
|
|
}
|
|
|
|
if alleps != nil {
|
|
for _, ep := range alleps {
|
|
item := jsonutils.NewDict()
|
|
item.Add(jsonutils.NewString(ep.Url), "url")
|
|
item.Add(jsonutils.NewString(ep.Name), "name")
|
|
menus.Add(item)
|
|
}
|
|
}
|
|
|
|
s2 := auth.GetSession(ctx, token, FetchRegion(req), "v2")
|
|
cap, err := modules.Capabilities.List(s2, nil)
|
|
if err != nil {
|
|
log.Errorf("modules.Capabilities.List fail %s", err)
|
|
} else {
|
|
hypervisors, _ := cap.Data[0].Get("hypervisors")
|
|
data.Add(hypervisors, "hypervisors")
|
|
}
|
|
|
|
data.Add(menus, "menus")
|
|
data.Add(k8s, "k8sdashboard")
|
|
data.Add(services, "services")
|
|
|
|
if options.Options.NonDefaultDomainProjects {
|
|
data.Add(jsonutils.JSONTrue, "non_default_domain_projects")
|
|
} else {
|
|
data.Add(jsonutils.JSONFalse, "non_default_domain_projects")
|
|
}
|
|
|
|
return data, nil
|
|
}
|
|
|
|
func getUserHandler(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
data, err := getUserInfo(ctx, s, t, req)
|
|
if err != nil {
|
|
httperrors.NotFoundError(w, err.Error())
|
|
return
|
|
}
|
|
body := jsonutils.NewDict()
|
|
body.Add(data, "data")
|
|
|
|
appsrv.SendJSON(w, body)
|
|
}
|
|
|
|
func (h *AuthHandlers) getPermissionDetails(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
|
|
_, query, body := appsrv.FetchEnv(ctx, w, req)
|
|
if body == nil {
|
|
httperrors.InvalidInputError(w, "body is empty")
|
|
return
|
|
}
|
|
var name string
|
|
if query != nil {
|
|
name, _ = query.GetString("policy")
|
|
}
|
|
result, err := policy.PolicyManager.ExplainRpc(t, body, name)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
|
|
appsrv.SendJSON(w, result)
|
|
}
|
|
|
|
func (h *AuthHandlers) getAdminResources(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
res := policy.GetSystemResources()
|
|
appsrv.SendJSON(w, jsonutils.Marshal(res))
|
|
}
|
|
|
|
func (h *AuthHandlers) getResources(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
res := policy.GetResources()
|
|
appsrv.SendJSON(w, jsonutils.Marshal(res))
|
|
}
|
|
|
|
func (h *AuthHandlers) doCreatePolicies(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
// if !utils.IsInStringArray("admin", t.GetRoles()) || t.GetProjectName() != "system" {
|
|
// httperrors.ForbiddenError(w, "not allow to create policy")
|
|
// return
|
|
// }
|
|
_, _, body := appsrv.FetchEnv(ctx, w, req)
|
|
if body == nil {
|
|
httperrors.InvalidInputError(w, "body is empty")
|
|
return
|
|
}
|
|
s := auth.GetSession(ctx, t, FetchRegion(req), "")
|
|
result, err := policytool.PolicyCreate(s, body)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
appsrv.SendJSON(w, result)
|
|
}
|
|
|
|
func (h *AuthHandlers) doPatchPolicy(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
// if !utils.IsInStringArray("admin", t.GetRoles()) || t.GetProjectName() != "system" {
|
|
// httperrors.ForbiddenError(w, "not allow to create policy")
|
|
// return
|
|
// }
|
|
params, _, body := appsrv.FetchEnv(ctx, w, req)
|
|
if body == nil {
|
|
httperrors.InvalidInputError(w, "request body is empty")
|
|
return
|
|
}
|
|
s := auth.GetSession(ctx, t, FetchRegion(req), "")
|
|
result, err := policytool.PolicyPatch(s, params["<policy_id>"], body)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
appsrv.SendJSON(w, result)
|
|
}
|
|
|
|
func (h *AuthHandlers) doDeletePolicies(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
t := AppContextToken(ctx)
|
|
// if !utils.IsInStringArray("admin", t.GetRoles()) || t.GetProjectName() != "system" {
|
|
// httperrors.ForbiddenError(w, "not allow to create policy")
|
|
// return
|
|
// }
|
|
_, query, _ := appsrv.FetchEnv(ctx, w, req)
|
|
s := auth.GetSession(ctx, t, FetchRegion(req), "")
|
|
|
|
idlist, e := query.GetArray("id")
|
|
if e != nil || len(idlist) == 0 {
|
|
httperrors.InvalidInputError(w, "missing id")
|
|
return
|
|
}
|
|
idStrList := jsonutils.JSONArray2StringArray(idlist)
|
|
ret := make([]modulebase.SubmitResult, len(idStrList))
|
|
for i := range idStrList {
|
|
err := policytool.PolicyDelete(s, idStrList[i])
|
|
if err != nil {
|
|
ret[i] = modulebase.SubmitResult{
|
|
Status: 400,
|
|
Id: idStrList[i],
|
|
Data: jsonutils.NewString(err.Error()),
|
|
}
|
|
} else {
|
|
ret[i] = modulebase.SubmitResult{
|
|
Status: 200,
|
|
Id: idStrList[i],
|
|
Data: jsonutils.NewDict(),
|
|
}
|
|
}
|
|
}
|
|
w.WriteHeader(207)
|
|
appsrv.SendJSON(w, modulebase.SubmitResults2JSON(ret))
|
|
}
|
|
|
|
/*
|
|
重置密码
|
|
1.验证新密码正确
|
|
2.验证原密码正确，且idp_driver为空
|
|
3.如果已开启MFA，验证 随机密码正确
|
|
4.重置密码，清除认证token
|
|
*/
|
|
func (h *AuthHandlers) resetUserPassword(ctx context.Context, w http.ResponseWriter, req *http.Request) {
|
|
ctx, err := SetAuthToken(ctx, w, req)
|
|
if err != nil {
|
|
httperrors.InvalidCredentialError(w, "set auth token %v", err)
|
|
return
|
|
}
|
|
|
|
t := AppContextToken(ctx)
|
|
s := auth.GetAdminSession(ctx, FetchRegion(req), "")
|
|
_, _, body := appsrv.FetchEnv(ctx, w, req)
|
|
if body == nil {
|
|
httperrors.InvalidInputError(w, "body is empty")
|
|
return
|
|
}
|
|
|
|
uid := t.GetUserId()
|
|
if len(uid) == 0 {
|
|
httperrors.ConflictError(w, "uid is empty")
|
|
return
|
|
}
|
|
|
|
user, err := modules.UsersV3.Get(s, uid, nil)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
|
|
oldPwd, _ := body.GetString("password_old")
|
|
newPwd, _ := body.GetString("password_new")
|
|
confirmPwd, _ := body.GetString("password_confirm")
|
|
passcode, _ := body.GetString("passcode")
|
|
|
|
// 1.验证新密码正确
|
|
if len(newPwd) < 6 {
|
|
httperrors.InputParameterError(w, "new password must have at least 6 characters")
|
|
return
|
|
}
|
|
|
|
if newPwd != confirmPwd {
|
|
httperrors.InputParameterError(w, "new password mismatch")
|
|
return
|
|
}
|
|
|
|
// 2.验证原密码正确，且idp_driver为空
|
|
if isLdapUser(user) {
|
|
httperrors.ForbiddenError(w, "not support reset ldap user password")
|
|
return
|
|
}
|
|
|
|
cliIp := netutils2.GetHttpRequestIp(req)
|
|
_, err = auth.Client().AuthenticateWeb(t.GetUserName(), oldPwd, t.GetDomainName(), "", "", cliIp)
|
|
if err != nil {
|
|
switch httperr := err.(type) {
|
|
case *httputils.JSONClientError:
|
|
if httperr.Code == 409 {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
}
|
|
}
|
|
httperrors.InputParameterError(w, "密码错误")
|
|
return
|
|
}
|
|
|
|
// 3.如果已开启MFA，验证 随机密码正确
|
|
tid := getAuthToken(req)
|
|
if isMfaEnabled(user) {
|
|
totp := clientman.TokenMan.GetTotp(tid)
|
|
err = totp.VerifyTotpPasscode(s, uid, passcode)
|
|
if err != nil {
|
|
httperrors.InputParameterError(w, "invalid passcode")
|
|
return
|
|
}
|
|
}
|
|
|
|
// 4.重置密码，清除认证token
|
|
params := jsonutils.NewDict()
|
|
params.Set("password", jsonutils.NewString(newPwd))
|
|
ret, err := modules.UsersV3.Patch(s, uid, params)
|
|
if err != nil {
|
|
httperrors.GeneralServerError(w, err)
|
|
return
|
|
} else {
|
|
clientman.TokenMan.Remove(tid)
|
|
}
|
|
|
|
appsrv.SendJSON(w, ret)
|
|
}
|
|
|
|
func isLdapUser(user jsonutils.JSONObject) bool {
|
|
if driver, _ := user.GetString("idp_driver"); driver == "ldap" {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// refer: isUserEnableTotp
|
|
func isMfaEnabled(user jsonutils.JSONObject) bool {
|
|
if !options.Options.EnableTotp {
|
|
return false
|
|
}
|
|
|
|
if ok, _ := user.Bool("enable_mfa"); ok {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|