mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-24 16:17:11 +08:00
Forrest Marshall
05f3eeaf00
* Support resource-based bootstrapping for backend. Outside of static configuration, most of the persistent state of an auth server exists as a collection of resources, stored in its backend. The resource API also forms the basis of Teleport's more advanced dynamic configuration options. This commit extends the usefulness of the resource API by adding the ability to bootstrap backend state with a set of previously exported resources. This allows the resource API to serve as a rudimentary backup/migration tool. Notes: This features is a work in progress, and very easy to misuse; while it will prevent you from overwriting the state of an existing auth server, it won't stop you from bootstrapping into a wildly misconfigured state. In general, resource-based bootstrapping is not a complete solution for backup or migration. * update e-ref
130 lines
3.2 KiB
Go
130 lines
3.2 KiB
Go
/*
|
|
Copyright 2017 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
authority "github.com/gravitational/teleport/lib/auth/testauthority"
|
|
"github.com/gravitational/teleport/lib/backend"
|
|
"github.com/gravitational/teleport/lib/backend/lite"
|
|
"github.com/gravitational/teleport/lib/services"
|
|
"github.com/gravitational/teleport/lib/utils"
|
|
|
|
"github.com/jonboulle/clockwork"
|
|
"gopkg.in/check.v1"
|
|
)
|
|
|
|
type GithubSuite struct {
|
|
a *AuthServer
|
|
b backend.Backend
|
|
c clockwork.FakeClock
|
|
}
|
|
|
|
var _ = fmt.Printf
|
|
var _ = check.Suite(&GithubSuite{})
|
|
|
|
func (s *GithubSuite) SetUpSuite(c *check.C) {
|
|
var err error
|
|
|
|
utils.InitLoggerForTests()
|
|
|
|
s.c = clockwork.NewFakeClockAt(time.Now())
|
|
|
|
s.b, err = lite.NewWithConfig(context.Background(), lite.Config{
|
|
Path: c.MkDir(),
|
|
PollStreamPeriod: 200 * time.Millisecond,
|
|
Clock: s.c,
|
|
})
|
|
c.Assert(err, check.IsNil)
|
|
|
|
clusterName, err := services.NewClusterName(services.ClusterNameSpecV2{
|
|
ClusterName: "me.localhost",
|
|
})
|
|
c.Assert(err, check.IsNil)
|
|
|
|
authConfig := &InitConfig{
|
|
ClusterName: clusterName,
|
|
Backend: s.b,
|
|
Authority: authority.New(),
|
|
SkipPeriodicOperations: true,
|
|
}
|
|
s.a, err = NewAuthServer(authConfig)
|
|
c.Assert(err, check.IsNil)
|
|
}
|
|
|
|
func (s *GithubSuite) TestPopulateClaims(c *check.C) {
|
|
claims, err := populateGithubClaims(&testGithubAPIClient{})
|
|
c.Assert(err, check.IsNil)
|
|
c.Assert(claims, check.DeepEquals, &services.GithubClaims{
|
|
Username: "octocat",
|
|
OrganizationToTeams: map[string][]string{
|
|
"org1": []string{"team1", "team2"},
|
|
"org2": []string{"team1"},
|
|
},
|
|
})
|
|
}
|
|
|
|
func (s *GithubSuite) TestCreateGithubUser(c *check.C) {
|
|
// Create GitHub user with 1 minute expiry.
|
|
_, err := s.a.createGithubUser(&createUserParams{
|
|
connectorName: "github",
|
|
username: "foo",
|
|
logins: []string{"foo"},
|
|
roles: []string{"admin"},
|
|
sessionTTL: 1 * time.Minute,
|
|
})
|
|
c.Assert(err, check.IsNil)
|
|
|
|
// Within that 1 minute period the user should still exist.
|
|
_, err = s.a.GetUser("foo", false)
|
|
c.Assert(err, check.IsNil)
|
|
|
|
// Advance time 2 minutes, the user should be gone.
|
|
s.c.Advance(2 * time.Minute)
|
|
_, err = s.a.GetUser("foo", false)
|
|
c.Assert(err, check.NotNil)
|
|
}
|
|
|
|
type testGithubAPIClient struct{}
|
|
|
|
func (c *testGithubAPIClient) getUser() (*userResponse, error) {
|
|
return &userResponse{Login: "octocat"}, nil
|
|
}
|
|
|
|
func (c *testGithubAPIClient) getTeams() ([]teamResponse, error) {
|
|
return []teamResponse{
|
|
{
|
|
Name: "team1",
|
|
Slug: "team1",
|
|
Org: orgResponse{Login: "org1"},
|
|
},
|
|
{
|
|
Name: "team2",
|
|
Slug: "team2",
|
|
Org: orgResponse{Login: "org1"},
|
|
},
|
|
{
|
|
Name: "team1",
|
|
Slug: "team1",
|
|
Org: orgResponse{Login: "org2"},
|
|
},
|
|
}, nil
|
|
}
|