mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 05:27:24 +08:00
Noah Stride
0433a9d5cb
* Introduce NodeJoin/BotJoin events with GH support * Remove Node -> Instance for clarity * Add CircleCI join audit attributes * Tidy implementation * More tidying of implementation * Add tests for audit event emission * Appease linter with AmericaniZed spellings * Fix imports * Fix missing errcheck in Join test * Update token safe name to omit entire token for shorter tokens
73 lines
2.2 KiB
Go
73 lines
2.2 KiB
Go
/*
|
|
Copyright 2022 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// CircleCI workload identity
|
|
//
|
|
// Key values:
|
|
// Issuer of tokens: `https://oidc.circleci.com/org/ORGANIZATION_ID`
|
|
// Audience: `ORGANIZATION_ID`
|
|
//
|
|
// `iat` and `exp` will be included and should be respected.
|
|
//
|
|
// Useful references:
|
|
// - https://circleci.com/docs/openid-connect-tokens/
|
|
|
|
package circleci
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/gravitational/trace"
|
|
"github.com/mitchellh/mapstructure"
|
|
)
|
|
|
|
const IssuerURLTemplate = "https://oidc.circleci.com/org/%s"
|
|
|
|
func issuerURL(template, organizationID string) string {
|
|
return fmt.Sprintf(template, organizationID)
|
|
}
|
|
|
|
// IDTokenClaims is the structure of claims contained with a CircleCI issued
|
|
// ID token.
|
|
// See https://circleci.com/docs/openid-connect-tokens/
|
|
type IDTokenClaims struct {
|
|
// Sub identifies who is running the CircleCI job and where.
|
|
// In the format of: `org/ORGANIZATION_ID/project/PROJECT_ID/user/USER_ID`
|
|
Sub string `json:"sub"`
|
|
// ContextIDs is a list of UUIDs for the contexts used in the job.
|
|
ContextIDs []string `json:"oidc.circleci.com/context-ids"`
|
|
// ProjectID is the ID of the project in which the job is running.
|
|
ProjectID string `json:"oidc.circleci.com/project-id"`
|
|
}
|
|
|
|
// JoinAuditAttributes returns a series of attributes that can be inserted into
|
|
// audit events related to a specific join.
|
|
func (c *IDTokenClaims) JoinAuditAttributes() (map[string]interface{}, error) {
|
|
res := map[string]interface{}{}
|
|
d, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
|
|
TagName: "json",
|
|
Result: &res,
|
|
})
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
if err := d.Decode(c); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
return res, nil
|
|
}
|