mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 01:58:44 +08:00
STeve (Xin) Huang
80a58fc82c
* GitHub proxy part 5: OAuth flow to retrieve GitHub identity * review comments round1 * review comments round 2 and update tsh git list * make -C integrations/operator crd * make -C integrations/terraform docs * fix flaky test
107 lines
3.4 KiB
Go
107 lines
3.4 KiB
Go
/*
|
|
* Teleport
|
|
* Copyright (C) 2024 Gravitational, Inc.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package client
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/gravitational/trace"
|
|
|
|
"github.com/gravitational/teleport/api/types"
|
|
"github.com/gravitational/teleport/lib/client/sso"
|
|
)
|
|
|
|
// ReissueWithGitHubOAuth starts a GitHub OAuth flow for an logged-in user.
|
|
// The flow does not use regular SSO connectors for logins. Instead, a temporary
|
|
// connector will be created from the GitHub integration associated with the Git
|
|
// server of the provided GitHub organization.
|
|
// TODO(greedy52) preserve access request IDs throughout this flow.
|
|
func (tc *TeleportClient) ReissueWithGitHubOAuth(ctx context.Context, githubOrg string) error {
|
|
keyRing, err := tc.localAgent.GetKeyRing(tc.SiteName, WithSSHCerts{})
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
|
|
rdConfig, err := tc.ssoRedirectorConfig(ctx, "" /* display name is optional */)
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
|
|
rd, err := sso.NewRedirector(rdConfig)
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
defer rd.Close()
|
|
|
|
ssoCeremony := sso.NewCLICeremony(rd, tc.loggedInUserGitHubOAuthInitFunc(keyRing, githubOrg))
|
|
resp, err := ssoCeremony.Run(ctx)
|
|
if err != nil {
|
|
return trace.Wrap(err)
|
|
}
|
|
|
|
// Treat it as reissuing an SSH cert.
|
|
keyRing.ClusterName = tc.SiteName
|
|
keyRing.Cert = resp.Cert
|
|
return trace.Wrap(tc.localAgent.AddKeyRing(keyRing))
|
|
}
|
|
|
|
func (tc *TeleportClient) loggedInUserGitHubOAuthInitFunc(keyRing *KeyRing, org string) sso.CeremonyInit {
|
|
return func(ctx context.Context, clientCallbackURL string) (redirectURL string, err error) {
|
|
request, err := tc.makeGitHubAuthRequest(keyRing, clientCallbackURL)
|
|
if err != nil {
|
|
return "", trace.Wrap(err)
|
|
}
|
|
|
|
clusterClient, err := tc.ConnectToCluster(ctx)
|
|
if err != nil {
|
|
return "", trace.Wrap(err)
|
|
}
|
|
defer clusterClient.Close()
|
|
|
|
rootClient, err := clusterClient.ConnectToRootCluster(ctx)
|
|
if err != nil {
|
|
return "", trace.Wrap(err)
|
|
}
|
|
defer rootClient.Close()
|
|
|
|
resp, err := rootClient.GitServerClient().CreateGitHubAuthRequest(ctx, request, org)
|
|
if err != nil {
|
|
return "", trace.Wrap(err)
|
|
}
|
|
return resp.RedirectURL, nil
|
|
}
|
|
}
|
|
|
|
func (tc *TeleportClient) makeGitHubAuthRequest(keyRing *KeyRing, clientCallbackURL string) (*types.GithubAuthRequest, error) {
|
|
tlsPub, err := keyRing.TLSPrivateKey.MarshalTLSPublicKey()
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
|
|
return &types.GithubAuthRequest{
|
|
ClientRedirectURL: clientCallbackURL,
|
|
KubernetesCluster: tc.KubernetesCluster,
|
|
SshPublicKey: keyRing.SSHPrivateKey.MarshalSSHPublicKey(),
|
|
TlsPublicKey: tlsPub,
|
|
SshAttestationStatement: keyRing.SSHPrivateKey.GetAttestationStatement().ToProto(),
|
|
TlsAttestationStatement: keyRing.TLSPrivateKey.GetAttestationStatement().ToProto(),
|
|
Compatibility: tc.CertificateFormat,
|
|
}, nil
|
|
}
|