From 41a3359085b012197b0d2681354c629f42e72957 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Sat, 3 Dec 2022 13:32:14 +0100 Subject: [PATCH] add the ability to set the JWS aud per site_id Without this option, the aud is ignored. It works only with RPC admin storage. The shared key returned for all requests with the default shared admin storage, so enabling that option does not affect it. --- backend/_example/memory_store/accessor/admin.go | 3 ++- backend/app/cmd/server.go | 9 ++++++++- backend/app/cmd/server_test.go | 3 ++- site/src/docs/configuration/parameters/index.md | 1 + 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/backend/_example/memory_store/accessor/admin.go b/backend/_example/memory_store/accessor/admin.go index d0cbf866..3bc74005 100644 --- a/backend/_example/memory_store/accessor/admin.go +++ b/backend/_example/memory_store/accessor/admin.go @@ -35,7 +35,8 @@ func NewMemAdminStore(key string) *MemAdmin { return &MemAdmin{data: map[string]AdminRec{}, key: key} } -// Key executes find by siteID and returns substructure with secret key +// Key supposed to execute find by siteID and returns substructure with secret key, +// but in this case the shared secret is used for all sites func (m *MemAdmin) Key(_ string) (key string, err error) { return m.key, nil } diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go index 38c91f7e..c8781f53 100644 --- a/backend/app/cmd/server.go +++ b/backend/app/cmd/server.go @@ -206,7 +206,7 @@ type AdminGroup struct { Admins []string `long:"id" env:"ID" description:"admin(s) ids" env-delim:","` Email []string `long:"email" env:"EMAIL" description:"admin emails" env-delim:","` } `group:"shared" namespace:"shared" env-namespace:"SHARED"` - RPC RPCGroup `group:"rpc" namespace:"rpc" env-namespace:"RPC"` + RPC AdminRPCGroup `group:"rpc" namespace:"rpc" env-namespace:"RPC"` } // TelegramGroup defines token for Telegram used in notify and auth modules @@ -274,6 +274,12 @@ type RPCGroup struct { AuthPassword string `long:"auth_passwd" env:"AUTH_PASSWD" description:"basic auth user password"` } +// AdminRPCGroup defines options for remote admin store +type AdminRPCGroup struct { + RPCGroup + SecretPerSite bool `long:"secret_per_site" env:"SECRET_PER_SITE" description:"enable JWT secret retrieval per aud, which is site_id in this case"` +} + // LoadingCache defines interface for caching type LoadingCache interface { Get(key cache.Key, fn func() ([]byte, error)) (data []byte, err error) // load from cache if found or put to cache and return @@ -1184,6 +1190,7 @@ func (s *ServerCommand) getAuthenticator(ds *service.DataStore, avas avatar.Stor Logger: log.Default(), RefreshCache: authRefreshCache, UseGravatar: true, + AudSecrets: s.Admin.RPC.SecretPerSite, }) } diff --git a/backend/app/cmd/server_test.go b/backend/app/cmd/server_test.go index f8009ec0..76c4e635 100644 --- a/backend/app/cmd/server_test.go +++ b/backend/app/cmd/server_test.go @@ -290,7 +290,8 @@ func TestServerApp_WithRemote(t *testing.T) { port := chooseRandomUnusedPort() _, err := p.ParseArgs([]string{"--admin-passwd=password", "--cache.type=none", "--store.type=rpc", "--store.rpc.api=http://127.0.0.1", - "--port=" + strconv.Itoa(port), "--admin.type=rpc", "--admin.rpc.api=http://127.0.0.1", "--avatar.fs.path=/tmp"}) + "--port=" + strconv.Itoa(port), "--avatar.fs.path=/tmp", + "--admin.type=rpc", "--admin.rpc.secret_per_site", "--admin.rpc.api=http://127.0.0.1"}) require.NoError(t, err) opts.Auth.Github.CSEC, opts.Auth.Github.CID = "csec", "cid" opts.BackupLocation, opts.Image.FS.Path = "/tmp", "/tmp" diff --git a/site/src/docs/configuration/parameters/index.md b/site/src/docs/configuration/parameters/index.md index b23556ca..b3577c12 100644 --- a/site/src/docs/configuration/parameters/index.md +++ b/site/src/docs/configuration/parameters/index.md @@ -50,6 +50,7 @@ services: | admin.rpc.timeout | ADMIN_RPC_TIMEOUT | | http timeout (default: 5s) | | admin.rpc.auth_user | ADMIN_RPC_AUTH_USER | | basic auth user name | | admin.rpc.auth_passwd | ADMIN_RPC_AUTH_PASSWD | | basic auth user password | +| admin.rpc.secret_per_site | ADMIN_RPC_SECRET_PER_SITE | | enable JWT secret retrieval per aud, which is site_id in this case | | admin.shared.id | ADMIN_SHARED_ID | | admin IDs (list of user IDs), _multi_ | | admin.shared.email | ADMIN_SHARED_EMAIL | `admin@${REMARK_URL}` | admin emails, _multi_ | | backup | BACKUP_PATH | `./var/backup` | backups location |