mirror of
https://github.com/versity/versitygw.git
synced 2026-07-08 09:06:59 +00:00
niksis02
b590ac9eca
Closes #1640 Add a standalone AWS IAM Query API implementation for managing IAM users through standard AWS SDKs and the AWS CLI. Server usage Start the IAM server with internal file-backed storage: mkdir -p /tmp/versitygw-iam ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --dir /tmp/versitygw-iam Start the IAM server with Vault KV v2 storage using AppRole: VGW_IAM_VAULT_ROLE_SECRET=<role-secret> ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --vault-endpoint-url http://127.0.0.1:8200 --vault-auth-method approle --vault-role-id <role-id> --vault-mount-path kv --vault-secret-storage-path iam Vault authentication also supports root tokens, separate authentication and secret-storage namespaces, custom mount paths, server certificate validation, and mutual TLS client certificates. Configure the AWS CLI credentials used by the IAM server: export AWS_ACCESS_KEY_ID=user export AWS_SECRET_ACCESS_KEY=pass export AWS_DEFAULT_REGION=us-east-1 Implemented IAM actions CreateUser creates an IAM user with an AWS-compatible ARN, generated AIDA user ID, creation timestamp, optional path, and tags. It validates usernames, paths, tag limits, reserved tag prefixes, duplicate tag keys, and existing users. aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob --path /engineering/ --tags Key=team,Value=storage GetUser returns a stored user or the root identity when requested without a username through the IAM Query API. aws --endpoint-url http://127.0.0.1:7070 iam get-user --user-name bob ListUsers returns users in deterministic username order and supports path filtering, marker-based pagination, and MaxItems limits. aws --endpoint-url http://127.0.0.1:7070 iam list-users aws --endpoint-url http://127.0.0.1:7070 iam list-users --path-prefix /engineering/ --max-items 100 UpdateUser updates the username and/or path, recalculates the user ARN, and rejects conflicts with existing users. aws --endpoint-url http://127.0.0.1:7070 iam update-user --user-name bob --new-user-name robert --new-path /platform/ DeleteUser permanently removes an IAM user and returns AWS-compatible errors for missing users. aws --endpoint-url http://127.0.0.1:7070 iam delete-user --user-name robert IAM protocol and authentication - Support the AWS IAM Query protocol version 2010-05-08 over GET and POST form requests. - Return AWS-compatible XML responses, error documents, status codes, request IDs, user metadata, and pagination fields. - Authenticate root credentials with AWS Signature Version 4 for the IAM service in us-east-1. - Support both Authorization-header and query-string SigV4 authentication. - Validate credential scope, signed headers, timestamps, clock skew, content length, signatures, and unsupported signature or session-token modes. - Add IAM-specific validation and error mapping for malformed requests, invalid actions, duplicate entities, missing users, throttling, and internal failures. Storage implementations - Add an internal JSON-backed store using iam.json and iam.json.backup with atomic temporary-file replacement, concurrent access protection, stable ordering, pagination, and persistence across restarts. - Add a Vault KV v2 store with one secret per user, CAS-based duplicate protection, permanent deletion, AppRole reauthentication, namespace support, configurable authentication and KV mounts, root-token authentication, and TLS/mTLS configuration. - Introduce a common Storer interface and require exactly one storage backend to be configured. Server and embedding support - Register the new `versitygw iam` command with environment-variable and CLI configuration for both storage backends. - Add `embedgw.RunIAMAPI` and `IAMConfig` for embedding the IAM service in Go applications. Gateway-level internal packages - Add `internal/iamstore` as a reusable generic file-backed IAM persistence engine and migrate the existing gateway internal IAM service to it. - Add `internal/sigv4auth` for shared SigV4 header and presigned-query parsing, canonical request generation, signature verification, and structured authentication errors. - Refactor the S3 authentication paths to use the shared SigV4 implementation while preserving S3-specific error responses. - Add `internal/httpctx` for shared Fiber context keys and AWS-style request ID handling. - Add `internal/routekit` for shared query, form, and header route matchers. - Add `internal/netutil` for reusable certificate storage, hostname-aware listeners, multi-address serving, TLS listeners, and UNIX socket handling. - Update the custom SigV4 signer to honor an explicitly supplied signed-header list so unrelated headers do not alter IAM signatures. Testing and CI - Add AWS IAM SDK-based integration coverage for all supported user actions, header authentication, query authentication, validation, errors, filtering, and pagination. - Split standalone IAM tests into `versitygw test iam` and retain existing gateway IAM tests under `versitygw test gw-iam`. - Add unit coverage for controllers, authentication, routing, storage, embedding, listeners, request matching, persistence, and signing behavior. - Add `runiamtests.sh` to exercise internal storage over HTTP and HTTPS plus Vault storage through AppRole. - Add a dedicated IAM functional-test workflow with a Vault service and merged runtime coverage reporting. - Include the IAM test runner in shellcheck and add the AWS IAM SDK dependency.
91 lines
4.1 KiB
Modula-2
91 lines
4.1 KiB
Modula-2
module github.com/versity/versitygw
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0
|
|
github.com/DataDog/datadog-go/v5 v5.9.0
|
|
github.com/aws/aws-sdk-go-v2 v1.42.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.26
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.25
|
|
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.2.12
|
|
github.com/aws/aws-sdk-go-v2/service/iam v1.54.5
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.104.1
|
|
github.com/aws/smithy-go v1.27.3
|
|
github.com/cespare/xxhash/v2 v2.3.0
|
|
github.com/davecgh/go-spew v1.1.1
|
|
github.com/go-ldap/ldap/v3 v3.4.13
|
|
github.com/gofiber/fiber/v3 v3.3.0
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/hashicorp/vault-client-go v0.4.3
|
|
github.com/minio/crc64nvme v1.1.1
|
|
github.com/nats-io/nats.go v1.52.0
|
|
github.com/oklog/ulid/v2 v2.1.1
|
|
github.com/pkg/xattr v0.4.12
|
|
github.com/rabbitmq/amqp091-go v1.12.0
|
|
github.com/segmentio/kafka-go v0.4.51
|
|
github.com/smira/go-statsd v1.3.4
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/urfave/cli/v2 v2.27.7
|
|
github.com/valyala/fasthttp v1.72.0
|
|
github.com/versity/scoutfs-go v0.0.0-20260414000839-70f8b6bdfa96
|
|
github.com/zeebo/xxh3 v1.1.0
|
|
golang.org/x/sync v0.21.0
|
|
golang.org/x/sys v0.46.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
|
|
github.com/Azure/go-ntlmssp v0.1.1 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/andybalholm/brotli v1.2.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.22 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.2.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.31.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.7 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.43.4 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
|
|
github.com/gofiber/schema v1.8.0 // indirect
|
|
github.com/gofiber/utils/v2 v2.1.1 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/nats-io/nkeys v0.4.16 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.27 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
|
|
golang.org/x/crypto v0.53.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/text v0.38.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
)
|