From 099aad84751c63b1ab1305b41a1a2873a3e8ebd6 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Wed, 4 Jan 2023 10:28:02 +0400 Subject: [PATCH] add apple bad key test, fix key location Previously, default location was outside of container mount. --- backend/app/cmd/server.go | 5 ++++- backend/app/cmd/server_test.go | 14 ++++++++++++++ backend/app/cmd/testdata/apple-bad.p8 | 16 ++++++++++++++++ .../docs/configuration/authorization/index.md | 4 ++-- site/src/docs/configuration/parameters/index.md | 2 +- 5 files changed, 37 insertions(+), 4 deletions(-) create mode 100644 backend/app/cmd/testdata/apple-bad.p8 diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go index 0cc964c2..38c91f7e 100644 --- a/backend/app/cmd/server.go +++ b/backend/app/cmd/server.go @@ -139,7 +139,7 @@ type AppleGroup struct { CID string `long:"cid" env:"CID" description:"Apple client ID"` TID string `long:"tid" env:"TID" description:"Apple service ID"` KID string `long:"kid" env:"KID" description:"Private key ID"` - PrivateKeyFilePath string `long:"private-key-filepath" env:"PRIVATE_KEY_FILEPATH" description:"Private key file location" default:"/var/apple.p8"` + PrivateKeyFilePath string `long:"private-key-filepath" env:"PRIVATE_KEY_FILEPATH" description:"Private key file location" default:"/srv/var/apple.p8"` } // AuthGroup defines options group for auth params @@ -524,6 +524,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) { err = s.addAuthProviders(authenticator) if err != nil { _ = dataService.Close() + _ = authRefreshCache.Close() return nil, fmt.Errorf("failed to make authenticator: %w", err) } @@ -563,6 +564,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) { sslConfig, err := s.makeSSLConfig() if err != nil { _ = dataService.Close() + _ = authRefreshCache.Close() return nil, fmt.Errorf("failed to make config of ssl server params: %w", err) } @@ -603,6 +605,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) { da, errDevAuth := authenticator.DevAuth() if errDevAuth != nil { _ = dataService.Close() + _ = authRefreshCache.Close() return nil, fmt.Errorf("can't make dev oauth2 server: %w", errDevAuth) } devAuth = da diff --git a/backend/app/cmd/server_test.go b/backend/app/cmd/server_test.go index 0010672a..f8009ec0 100644 --- a/backend/app/cmd/server_test.go +++ b/backend/app/cmd/server_test.go @@ -351,6 +351,7 @@ func TestServerApp_Failed(t *testing.T) { assert.EqualError(t, err, "invalid remark42 url demo.remark42.com") t.Log(err) + // wrong store type opts = ServerCommand{} opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"}) @@ -374,6 +375,19 @@ func TestServerApp_Failed(t *testing.T) { "problem subscribing to channel remark42-cache on address wrong_address: "+ "dial tcp: address wrong_address: missing port in address") t.Log(err) + + // wrong apple private key type + opts = ServerCommand{} + opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"}) + p = flags.NewParser(&opts, flags.Default) + _, err = p.ParseArgs([]string{"--auth.apple.cid=123", "--auth.apple.tid=123", + "--auth.apple.kid=123", "--auth.apple.private-key-filepath=testdata/apple-bad.p8"}) + assert.NoError(t, err) + _, err = opts.newServerApp(context.Background()) + assert.EqualError(t, err, + "failed to make authenticator: an AppleProvider creating failed: "+ + "provided private key is not ECDSA") + t.Log(err) } func TestServerApp_Shutdown(t *testing.T) { diff --git a/backend/app/cmd/testdata/apple-bad.p8 b/backend/app/cmd/testdata/apple-bad.p8 new file mode 100644 index 00000000..7ba67dbb --- /dev/null +++ b/backend/app/cmd/testdata/apple-bad.p8 @@ -0,0 +1,16 @@ +-----BEGIN PRIVATE KEY----- +MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKNwapOQ6rQJHetP +HRlJBIh1OsOsUBiXb3rXXE3xpWAxAha0MH+UPRblOko+5T2JqIb+xKf9Vi3oTM3t +KvffaOPtzKXZauscjq6NGzA3LgeiMy6q19pvkUUOlGYK6+Xfl+B7Xw6+hBMkQuGE +nUS8nkpR5mK4ne7djIyfHFfMu4ptAgMBAAECgYA+s0PPtMq1osG9oi4xoxeAGikf +JB3eMUptP+2DYW7mRibc+ueYKhB9lhcUoKhlQUhL8bUUFVZYakP8xD21thmQqnC4 +f63asad0ycteJMLb3r+z26LHuCyOdPg1pyLk3oQ32lVQHBCYathRMcVznxOG16VK +I8BFfstJTaJu0lK/wQJBANYFGusBiZsJQ3utrQMVPpKmloO2++4q1v6ZR4puDQHx +TjLjAIgrkYfwTJBLBRZxec0E7TmuVQ9uJ+wMu/+7zaUCQQDDf2xMnQqYknJoKGq+ +oAnyC66UqWC5xAnQS32mlnJ632JXA0pf9pb1SXAYExB1p9Dfqd3VAwQDwBsDDgP6 +HD8pAkEA0lscNQZC2TaGtKZk2hXkdcH1SKru/g3vWTkRHxfCAznJUaza1fx0wzdG +GcES1Bdez0tbW4llI5By/skZc2eE3QJAFl6fOskBbGHde3Oce0F+wdZ6XIJhEgCP +iukIcKZoZQzoiMJUoVRrA5gqnmaYDI5uRRl/y57zt6YksR3KcLUIuQJAd242M/WF +6YAZat3q/wEeETeQq1wrooew+8lHl05/Nt0cCpV48RGEhJ83pzBm3mnwHf8lTBJH +x6XroMXsmbnsEw== +-----END PRIVATE KEY----- diff --git a/site/src/docs/configuration/authorization/index.md b/site/src/docs/configuration/authorization/index.md index dab52a0a..32bc1a55 100644 --- a/site/src/docs/configuration/authorization/index.md +++ b/site/src/docs/configuration/authorization/index.md @@ -13,7 +13,7 @@ Authentication handled by external providers. You should set up OAuth2 for at le 1. Enable the "Sign in with Apple" capability for your App ID in [the Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list) section. 1. Create [Service ID](https://developer.apple.com/account/resources/identifiers/list/serviceId) and bind with App ID from the previous step. Apple will display the description field value to end-users on sign-in. You'll need that service **Identifier as a ClientID** later on. 1. Configure "Sign in with Apple" for created Service ID. Add domain where you will use that auth on to "Domains and subdomains" and its main page URL (like `https://example.com/` to "Return URLs". -1. Register a [New Key](https://developer.apple.com/account/resources/authkeys/list) (**private key**) for the "Sign in with Apple" feature and download it, you'll need to put it to `/var/apple.p8` path inside container. Also write down the private **Key ID**. +1. Register a [New Key](https://developer.apple.com/account/resources/authkeys/list) (**private key**) for the "Sign in with Apple" feature and download it, you'll need to put it to `/srv/var/apple.p8` path inside container. Also write down the private **Key ID**. 1. Add your Remark42 domain name and sender email in the Certificates, Identifiers & Profiles >> [More](https://developer.apple.com/account/resources/services/configure) section as a new Email Source. After completing the previous steps, you can proceed with configuring the Apple auth provider. You'll need to set the following environment variables: @@ -21,7 +21,7 @@ After completing the previous steps, you can proceed with configuring the Apple - `AUTH_APPLE_CID` (**required**) - Client ID - `AUTH_APPLE_TID` (**required**) - Team ID - `AUTH_APPLE_KID` (**required**) - Private Key ID -- `AUTH_APPLE_PRIVATE_KEY_FILEPATH` (default `/var/apple.p8`) - Private key file location +- `AUTH_APPLE_PRIVATE_KEY_FILEPATH` (default `/srv/var/apple.p8`) - Private key file location ### Facebook diff --git a/site/src/docs/configuration/parameters/index.md b/site/src/docs/configuration/parameters/index.md index eb2da723..b23556ca 100644 --- a/site/src/docs/configuration/parameters/index.md +++ b/site/src/docs/configuration/parameters/index.md @@ -83,7 +83,7 @@ services: | auth.apple.cid | AUTH_APPLE_CID | | Apple client ID | | auth.apple.tid | AUTH_APPLE_TID | | Apple service ID | | auth.apple.kid | AUTH_APPLE_KID | | Private key ID | -| auth.apple.private-key-filepath | AUTH_APPLE_PRIVATE_KEY_FILEPATH | `/var/apple.p8` | Private key file location | +| auth.apple.private-key-filepath | AUTH_APPLE_PRIVATE_KEY_FILEPATH | `/srv/var/apple.p8` | Private key file location | | auth.google.cid | AUTH_GOOGLE_CID | | Google OAuth client ID | | auth.google.csec | AUTH_GOOGLE_CSEC | | Google OAuth client secret | | auth.facebook.cid | AUTH_FACEBOOK_CID | | Facebook OAuth client ID |