diff --git a/README.md b/README.md index 9dd9970..a5d0f26 100644 --- a/README.md +++ b/README.md @@ -316,9 +316,11 @@ file. | `api.allow_blocklist_write` | bool | `true` | **unused** | | `api.trusted_proxies` | list of CIDR | empty | the only peers whose `X-Forwarded-For` / `X-Real-IP` is believed | | `api.cors_origins` | list | empty | `"*"` is allowed but discouraged; the origin is echoed per request so credentials keep working | -| `api.auth.mode` | `none` \| `apikey` \| `basic` | `apikey` | see [Admin API](#admin-api) | +| `api.auth.mode` | `none` \| `apikey` \| `basic` \| `oidc` | `apikey` | see [Admin API](#admin-api) | | `api.auth.api_keys` | list | empty | full-access keys (`X-API-Key` header, or basic auth with any user) | | `api.auth.read_only_api_keys` | list | empty | GET-only keys; mutations answer 403 | +| `api.auth.oidc_issuer` / `oidc_audience` / `oidc_client_id` | strings | empty | OIDC issuer, accepted access-token audience, and public browser client id; required in `oidc` mode | +| `api.auth.oidc_write_roles` | list | `[admin]` | OIDC roles allowed to make changes; other authenticated users are read-only | | `api.auth.username` / `password` | string | — | for `mode: basic`; the password may be plaintext or a bcrypt hash (it is hashed either way and compared in constant time) | | `api.auth.session_ttl` | duration | `12h` | lifetime of a `POST /api/auth/login` bearer token | | `api.auth.trust_loopback` | bool | `true` | requests from `127.0.0.0/8` and `::1` authenticate as a local principal without a key | @@ -520,6 +522,18 @@ hash in constant time. `basic`: HTTP basic against `auth.username` / mutation are open to anyone who can reach the port; the settings validator emits a warning for exactly this. +`oidc` mode signs the console in through a public PKCE client. Configure +`oidc_issuer` (for go-auth, `https://users.k6n.net`), `oidc_client_id`, and +`oidc_audience` (the resource audience included in the client's access tokens). +Register `https:///auth/oidc/callback` as a redirect URI, and +include the configured audience in the client's `audience` list. The API +validates RS256 signatures and issuer, audience and expiry using OIDC discovery +and JWKS. Users carrying a role listed in `oidc_write_roles` (default `admin`) +can make changes; other valid users have read-only access. Discovery metadata +is fetched lazily on the first bearer-token request. Set `trust_loopback: false` +on networked deployments if local requests should also require an OIDC token; +the loopback bypass is independent of the selected auth mode. + JSON request bodies are capped at 4 MiB and unknown fields are rejected, so a typo is a 400 rather than a silent no-op. A panic in a handler becomes a 500 and is logged. diff --git a/deploy/config.example.yaml b/deploy/config.example.yaml index 4f25bf7..7f65958 100644 --- a/deploy/config.example.yaml +++ b/deploy/config.example.yaml @@ -198,12 +198,18 @@ api: trusted_proxies: [] cors_origins: [] auth: - # none | apikey | basic + # none | apikey | basic | oidc mode: apikey api_keys: ["CHANGE-ME-long-random-string"] read_only_api_keys: [] trust_loopback: true session_ttl: 12h + # For mode: oidc, configure a registered public PKCE client and the API + # audience included in its access tokens. Users need the admin role to write. + oidc_issuer: https://users.k6n.net + oidc_audience: https://fancy-dns.example.net + oidc_client_id: fancy-dns + oidc_write_roles: [admin] rate_limit: per_minute: 600 failures: 10 diff --git a/deploy/k8s/00-config.yaml b/deploy/k8s/00-config.yaml index 4a4a799..fe6de12 100644 --- a/deploy/k8s/00-config.yaml +++ b/deploy/k8s/00-config.yaml @@ -113,8 +113,12 @@ data: # is unset, so a missing secret is a crash loop rather than an # unauthenticated console. auth: - mode: apikey + mode: oidc api_keys: ["${FANCYDNS_API_KEY}"] + oidc_issuer: https://users.k6n.net + oidc_audience: https://dns.k6n.net + oidc_client_id: fancy-dns + oidc_write_roles: [admin] trust_loopback: false metrics: diff --git a/deploy/k8s/08-secret-apikey.yaml b/deploy/k8s/08-secret-apikey.yaml index c8bf4d2..e2a3ff5 100644 --- a/deploy/k8s/08-secret-apikey.yaml +++ b/deploy/k8s/08-secret-apikey.yaml @@ -4,10 +4,9 @@ # kubectl -n dns create secret generic fancy-dns-apikey \ # --from-literal=api-key="$(openssl rand -hex 32)" # -# With auth.mode: apikey and api_keys: ["${FANCYDNS_API_KEY}"] in the config, -# a missing FANCYDNS_API_KEY is a startup error rather than an empty key, so a -# forgotten secret shows up as a CrashLoopBackOff and not as an unauthenticated -# console on the network. +# With api_keys: ["${FANCYDNS_API_KEY}"] in the config, a missing +# FANCYDNS_API_KEY is a startup error rather than an empty key. These keys +# remain available for machine clients when the console uses OIDC. apiVersion: v1 kind: Secret metadata: diff --git a/go.mod b/go.mod index 3fd8663..e2416ea 100644 --- a/go.mod +++ b/go.mod @@ -4,6 +4,7 @@ go 1.27.1 require ( github.com/alicebob/miniredis/v2 v2.39.0 + github.com/coreos/go-oidc/v3 v3.21.0 github.com/miekg/dns v1.1.73 github.com/prometheus/client_golang v1.24.1 github.com/redis/go-redis/v9 v9.22.0 @@ -15,12 +16,14 @@ require ( require ( github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.70.1 // indirect github.com/prometheus/procfs v0.21.1 // indirect github.com/yuin/gopher-lua v1.1.1 // indirect go.uber.org/atomic v1.11.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/protobuf v1.36.11 // indirect diff --git a/go.sum b/go.sum index 7b74679..ee2ab72 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,12 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA= github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM= +github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= @@ -50,6 +54,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= diff --git a/internal/api/api.go b/internal/api/api.go index c14bb80..2c51b44 100644 --- a/internal/api/api.go +++ b/internal/api/api.go @@ -27,7 +27,7 @@ import ( // Principal is the authenticated identity behind a request. type Principal struct { - // Mode is "apikey", "basic" or "anonymous". + // Mode is "apikey", "basic", "oidc" or "anonymous". Mode string // Name is a human label for the key or user. Name string @@ -246,6 +246,7 @@ func (s *Server) routes(cfg *config.Config) *http.ServeMux { }))) } mux.Handle("POST "+base+"auth/login", s.limited(s.handleLogin)) + mux.Handle("GET "+base+"auth/config", s.public(s.handleAuthConfig)) mux.Handle("POST "+base+"auth/logout", s.authed(s.handleLogout, false)) // Everything below requires a principal. @@ -391,6 +392,13 @@ func (s *Server) principal(r *http.Request) (Principal, error) { } switch strings.ToLower(scheme) { case "bearer": + // Local sessions minted by /auth/login are 64-character hex + // strings. OIDC access tokens are compact JWTs (three segments). + // Keep key-based login sessions usable alongside OIDC for scripted + // clients, while sending JWT-shaped credentials to the verifier. + if s.auth.mode == "oidc" && strings.Count(value, ".") == 2 { + return s.auth.oidcPrincipal(value) + } return s.auth.session(value) case "basic": user, pass, ok := r.BasicAuth() diff --git a/internal/api/auth.go b/internal/api/auth.go index d4af2ae..7404580 100644 --- a/internal/api/auth.go +++ b/internal/api/auth.go @@ -1,16 +1,19 @@ package api import ( + "context" "crypto/rand" "crypto/sha256" "crypto/subtle" "encoding/hex" "errors" + "fmt" "net/http" "sync" "time" "git.k8s-git-k6n.net/mats/fancy-dns/internal/config" + "github.com/coreos/go-oidc/v3/oidc" ) // authenticator checks API keys, basic credentials and issued session tokens. @@ -38,18 +41,34 @@ type authenticator struct { // sessionTTL is how long an issued token stays valid. sessionTTL time.Duration // trustLoopback is informational; the caller checks it. - mu sync.RWMutex - sessions map[string]session + mu sync.RWMutex + sessions map[string]session + oidcIssuer string + oidcAudience string + oidcClientID string + oidcWriteRoles map[string]bool + oidcInitMu sync.Mutex + oidcVerifier *oidc.IDTokenVerifier } func newAuthenticator(cfg config.Auth) *authenticator { a := &authenticator{ - mode: cfg.Mode, - readOnly: make(map[string]string, len(cfg.ReadOnlyAPIKeys)), - readWrite: make(map[string]string, len(cfg.APIKeys)), - username: cfg.Username, - sessionTTL: cfg.SessionTTL.D(), - sessions: make(map[string]session), + mode: cfg.Mode, + readOnly: make(map[string]string, len(cfg.ReadOnlyAPIKeys)), + readWrite: make(map[string]string, len(cfg.APIKeys)), + username: cfg.Username, + sessionTTL: cfg.SessionTTL.D(), + sessions: make(map[string]session), + oidcIssuer: cfg.OIDCIssuer, + oidcAudience: cfg.OIDCAudience, + oidcClientID: cfg.OIDCClientID, + oidcWriteRoles: make(map[string]bool), + } + for _, role := range cfg.OIDCWriteRoles { + a.oidcWriteRoles[role] = true + } + if len(a.oidcWriteRoles) == 0 { + a.oidcWriteRoles["admin"] = true } for i, k := range cfg.ReadOnlyAPIKeys { if k == "" { @@ -74,6 +93,68 @@ func newAuthenticator(cfg config.Auth) *authenticator { return a } +// oidcPrincipal verifies an RS256 access token against issuer discovery/JWKS. +// Provider metadata and keys are fetched lazily, then cached by go-oidc. +func (a *authenticator) oidcPrincipal(raw string) (Principal, error) { + if a == nil || a.oidcIssuer == "" || a.oidcAudience == "" { + return Principal{}, errors.New("oidc: not configured") + } + a.oidcInitMu.Lock() + if a.oidcVerifier == nil { + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + provider, err := oidc.NewProvider(ctx, a.oidcIssuer) + cancel() + if err != nil { + a.oidcInitMu.Unlock() + return Principal{}, fmt.Errorf("oidc discovery: %w", err) + } + a.oidcVerifier = provider.Verifier(&oidc.Config{ClientID: a.oidcAudience, SupportedSigningAlgs: []string{"RS256"}}) + } + verifier := a.oidcVerifier + a.oidcInitMu.Unlock() + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + defer cancel() + tok, err := verifier.Verify(ctx, raw) + if err != nil { + return Principal{}, fmt.Errorf("oidc token: %w", err) + } + var claims struct { + Subject string `json:"sub"` + TokenUse string `json:"token_use"` + Name string `json:"name"` + Email string `json:"email"` + Roles []string `json:"roles"` + } + if err := tok.Claims(&claims); err != nil { + return Principal{}, err + } + if claims.Subject == "" || claims.TokenUse != "access" { + return Principal{}, errors.New("oidc: token is not an access token") + } + name := claims.Name + if name == "" { + name = claims.Email + } + if name == "" { + name = claims.Subject + } + readOnly := true + for _, role := range claims.Roles { + if a.oidcWriteRoles[role] { + readOnly = false + break + } + } + return Principal{Mode: "oidc", Name: name, ReadOnly: readOnly}, nil +} + +func (a *authenticator) OIDCConfig() (issuer, clientID string) { + if a == nil || a.mode != "oidc" { + return "", "" + } + return a.oidcIssuer, a.oidcClientID +} + func keyLabel(kind string, i int) string { return kind + "-" + itoa(i+1) } @@ -290,3 +371,8 @@ func (s *Server) handleWhoami(w http.ResponseWriter, r *http.Request) { "base_path": s.base, }) } + +func (s *Server) handleAuthConfig(w http.ResponseWriter, r *http.Request) { + issuer, clientID := s.auth.OIDCConfig() + writeJSON(w, http.StatusOK, map[string]string{"mode": s.AuthMode(), "issuer": issuer, "client_id": clientID}) +} diff --git a/internal/api/auth_test.go b/internal/api/auth_test.go index bcc32d8..90f028d 100644 --- a/internal/api/auth_test.go +++ b/internal/api/auth_test.go @@ -34,6 +34,30 @@ func modeBasic(c *config.Config) { } } +func modeOIDCWithAPIKey(c *config.Config) { + c.API.Auth = config.Auth{ + Mode: "oidc", APIKeys: []string{"machine-key"}, + OIDCIssuer: "https://users.example.test", OIDCAudience: "https://dns.example.test", OIDCClientID: "fancy-dns", + TrustLoopback: false, SessionTTL: config.Duration(time.Hour), + } +} + +func TestOIDCModeKeepsAPIKeyLoginSessionsUsable(t *testing.T) { + h := newHarness(t, modeOIDCWithAPIKey) + res := h.do(http.MethodPost, "/api/auth/login", `{"api_key":"machine-key"}`) + if res.status != http.StatusOK { + t.Fatalf("API key login = %d: %s", res.status, res.body) + } + token, _ := res.json(t)["token"].(string) + if token == "" { + t.Fatal("login returned an empty bearer token") + } + res = h.do(http.MethodGet, "/api/whoami", "", "Authorization: Bearer "+token) + if res.status != http.StatusOK { + t.Fatalf("session bearer in OIDC mode = %d: %s", res.status, res.body) + } +} + // TestAuthModeAPIKey covers every way a request can present a key in apikey // mode, and the invariant that matters: the right key always works and every // other credential never does. diff --git a/internal/api/oidc_test.go b/internal/api/oidc_test.go new file mode 100644 index 0000000..2bc77d5 --- /dev/null +++ b/internal/api/oidc_test.go @@ -0,0 +1,116 @@ +package api + +import ( + "crypto" + "crypto/rand" + "crypto/rsa" + "crypto/sha256" + "encoding/base64" + "encoding/json" + "math/big" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "git.k8s-git-k6n.net/mats/fancy-dns/internal/config" +) + +func TestOIDCAccessTokenVerificationAndRoleGate(t *testing.T) { + key, err := rsa.GenerateKey(rand.Reader, 2048) + if err != nil { + t.Fatal(err) + } + var issuer string + mux := http.NewServeMux() + mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) { + _ = json.NewEncoder(w).Encode(map[string]string{"issuer": issuer, "jwks_uri": issuer + "/keys"}) + }) + mux.HandleFunc("/keys", func(w http.ResponseWriter, r *http.Request) { + e := big.NewInt(int64(key.PublicKey.E)).Bytes() + _ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{map[string]string{ + "kty": "RSA", "use": "sig", "alg": "RS256", "kid": "test-key", + "n": base64.RawURLEncoding.EncodeToString(key.PublicKey.N.Bytes()), + "e": base64.RawURLEncoding.EncodeToString(e), + }}}) + }) + server := httptest.NewServer(mux) + defer server.Close() + issuer = server.URL + a := newAuthenticator(config.Auth{Mode: "oidc", OIDCIssuer: issuer, OIDCAudience: "fancy-dns-api"}) + for _, tc := range []struct { + name string + roles []string + wantReadOnly bool + bad bool + badSignature bool + badIssuer bool + }{ + {name: "admin can write", roles: []string{"admin"}, wantReadOnly: false}, + {name: "ordinary account is read only", roles: []string{"staff"}, wantReadOnly: true}, + {name: "wrong audience refused", roles: []string{"admin"}, bad: true}, + {name: "wrong issuer refused", roles: []string{"admin"}, bad: true, badIssuer: true}, + {name: "expired token refused", roles: []string{"admin"}, bad: true}, + {name: "id token refused", roles: []string{"admin"}, bad: true}, + {name: "bad signature refused", roles: []string{"admin"}, bad: true, badSignature: true}, + } { + t.Run(tc.name, func(t *testing.T) { + aud := "fancy-dns-api" + use := "access" + exp := time.Now().Add(time.Hour).Unix() + if strings.Contains(tc.name, "wrong audience") { + aud = "another-api" + } + if strings.Contains(tc.name, "expired") { + exp = time.Now().Add(-time.Hour).Unix() + } + if strings.Contains(tc.name, "id token") { + use = "id" + } + tokenIssuer := issuer + if tc.badIssuer { + tokenIssuer += "/wrong" + } + token := signedOIDCToken(t, key, map[string]any{"iss": tokenIssuer, "sub": "user-1", "aud": aud, "exp": exp, "iat": time.Now().Unix(), "token_use": use, "name": "Test User", "roles": tc.roles}) + if tc.badSignature { + parts := strings.Split(token, ".") + parts[2] = strings.Repeat("A", len(parts[2])) + token = strings.Join(parts, ".") + } + p, err := a.oidcPrincipal(token) + if tc.bad { + if err == nil { + t.Fatalf("accepted invalid token as %+v", p) + } + return + } + if err != nil { + t.Fatal(err) + } + if p.Mode != "oidc" || p.Name != "Test User" || p.ReadOnly != tc.wantReadOnly { + t.Fatalf("principal = %+v", p) + } + }) + } +} + +func signedOIDCToken(t *testing.T, key *rsa.PrivateKey, claims map[string]any) string { + t.Helper() + enc := base64.RawURLEncoding.EncodeToString + header, err := json.Marshal(map[string]string{"alg": "RS256", "kid": "test-key", "typ": "JWT"}) + if err != nil { + t.Fatal(err) + } + payload, err := json.Marshal(claims) + if err != nil { + t.Fatal(err) + } + message := enc(header) + "." + enc(payload) + digest := sha256.Sum256([]byte(message)) + signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:]) + if err != nil { + t.Fatal(err) + } + return message + "." + enc(signature) +} diff --git a/internal/config/config.go b/internal/config/config.go index 37de19d..5ccb98e 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -15,6 +15,7 @@ import ( "math" "net" "net/netip" + "net/url" "os" "path/filepath" "sort" @@ -477,8 +478,13 @@ type API struct { } type Auth struct { - // Mode is "none", "apikey" or "basic". + // Mode is "none", "apikey", "basic" or "oidc". Mode string `yaml:"mode"` + // OIDC settings validate access tokens issued by an external provider. + OIDCIssuer string `yaml:"oidc_issuer"` + OIDCAudience string `yaml:"oidc_audience"` + OIDCClientID string `yaml:"oidc_client_id"` + OIDCWriteRoles []string `yaml:"oidc_write_roles"` // APIKeys grant full access. APIKeys []string `yaml:"api_keys"` // ReadOnlyAPIKeys may only call GET endpoints. @@ -1152,9 +1158,9 @@ func (c *Config) Validate() error { } } switch c.API.Auth.Mode { - case "none", "apikey", "basic": + case "none", "apikey", "basic", "oidc": default: - add("api.auth.mode must be none, apikey or basic (got %q)", c.API.Auth.Mode) + add("api.auth.mode must be none, apikey, basic or oidc (got %q)", c.API.Auth.Mode) } if c.API.Auth.Mode == "apikey" && len(c.API.Auth.APIKeys) == 0 && !c.API.Auth.TrustLoopback { add("api.auth.mode is apikey but api.auth.api_keys is empty and trust_loopback is false: the API would be unauthenticated") @@ -1162,6 +1168,17 @@ func (c *Config) Validate() error { if c.API.Auth.Mode == "basic" && c.API.Auth.Username == "" { add("api.auth.mode is basic but api.auth.username is empty") } + if c.API.Auth.Mode == "oidc" { + if c.API.Auth.OIDCIssuer == "" || c.API.Auth.OIDCAudience == "" || c.API.Auth.OIDCClientID == "" { + add("api.auth.mode is oidc and requires oidc_issuer, oidc_audience and oidc_client_id") + } + if c.API.Auth.OIDCIssuer != "" { + u, err := url.Parse(c.API.Auth.OIDCIssuer) + if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" { + add("api.auth.oidc_issuer must be an HTTPS issuer URL") + } + } + } if c.API.Auth.SessionTTL <= 0 { add("api.auth.session_ttl must be > 0") } @@ -1290,6 +1307,8 @@ func (c *Config) HasAPIAuth() bool { return len(c.API.Auth.APIKeys) > 0 || len(c.API.Auth.ReadOnlyAPIKeys) > 0 || !c.API.Auth.TrustLoopback case "basic": return true + case "oidc": + return true } return false } diff --git a/internal/web/dist/index.html b/internal/web/dist/index.html index 59a9f5b..f61ba25 100644 --- a/internal/web/dist/index.html +++ b/internal/web/dist/index.html @@ -5,7 +5,7 @@ web - + diff --git a/web/src/App.tsx b/web/src/App.tsx index 17dda61..6c4a9d6 100644 --- a/web/src/App.tsx +++ b/web/src/App.tsx @@ -69,6 +69,7 @@ export default function App() { {/* Bare: no shell, no header, no nav. */} } /> + } /> (path: string, init?: RequestInit): Promise } const token = getToken() - if (token && !headers.has('X-API-Key')) headers.set('X-API-Key', token) + if (token && !headers.has('Authorization')) headers.set('Authorization', `Bearer ${token}`) let res: Response try { @@ -369,7 +369,7 @@ export function streamLogs(handlers: LogStreamHandlers): () => void { if (stopped) return const token = getToken() const headers = new Headers({ Accept: 'text/event-stream' }) - if (token) headers.set('X-API-Key', token) + if (token) headers.set('Authorization', `Bearer ${token}`) try { const res = await fetch(STREAM_PATH, { diff --git a/web/src/pages/Login.tsx b/web/src/pages/Login.tsx index a828a8c..be90f9e 100644 --- a/web/src/pages/Login.tsx +++ b/web/src/pages/Login.tsx @@ -7,13 +7,12 @@ * shown as an error. */ -import { useEffect, useState } from 'react' +import { useEffect, useRef, useState } from 'react' import type { FormEvent } from 'react' import { Globe, KeyRound, LogIn, ShieldCheck, Terminal } from 'lucide-react' import { useSearchParams } from 'react-router-dom' -import { ApiError, login, whoami } from '../lib/api' -import type { Whoami } from '../lib/types' +import { ApiError, login, setToken } from '../lib/api' import { Button, Card, CardBody, Input } from '../components/ui' import { Spinner } from '../components/ui' @@ -22,11 +21,17 @@ function wantsPassword(mode: string): boolean { return mode === 'basic' } +function safeNext(value: string): string { + return value.startsWith('/') && !value.startsWith('//') && !value.includes('\\') ? value : '/' +} + export default function Login() { const [params] = useSearchParams() const next = params.get('next') ?? '/' + const callbackStarted = useRef(false) const [mode, setMode] = useState(null) + const [oidc, setOIDC] = useState<{ issuer: string; client_id: string } | null>(null) const [apiKey, setApiKey] = useState('') const [username, setUsername] = useState('') const [password, setPassword] = useState('') @@ -35,33 +40,118 @@ export default function Login() { useEffect(() => { let live = true - whoami() - .then((who: Whoami) => { - if (live) setMode(who.auth_mode ?? 'apikey') + fetch('/api/auth/config', { headers: { Accept: 'application/json' } }) + .then(async (res) => { + if (!res.ok) throw new Error('could not load authentication settings') + return (await res.json()) as { mode?: string; issuer?: string; client_id?: string } }) - .catch(() => { - // Unauthenticated probes and older daemons both land here: show the - // form rather than an error, the submit will say what is wrong. - if (live) setMode('apikey') + .then((cfg) => { + if (!live) return + setMode(cfg.mode ?? 'apikey') + if (cfg.issuer && cfg.client_id) setOIDC({ issuer: cfg.issuer, client_id: cfg.client_id }) }) + .catch(() => { if (live) setMode('apikey') }) return () => { live = false } }, []) + useEffect(() => { + const providerError = params.get('error') + if (providerError) { + setError(params.get('error_description') ?? `identity provider sign in failed: ${providerError}`) + return + } + const code = params.get('code') + if (!code || !oidc || mode !== 'oidc') return + if (callbackStarted.current) return + callbackStarted.current = true + let pendingLogin: { state: string; verifier: string; next: string } | null + try { + pendingLogin = JSON.parse(sessionStorage.getItem('fancydns.oidc.pending') ?? 'null') + } catch { pendingLogin = null } + if (!pendingLogin?.state || pendingLogin.state !== params.get('state') || !pendingLogin.verifier) { + setError('OIDC login state check failed. Start sign in again.') + return + } + sessionStorage.removeItem('fancydns.oidc.pending') + setPending(true) + void (async () => { + try { + const discoveryRes = await fetch(`${oidc.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`) + if (!discoveryRes.ok) throw new Error('could not discover the identity provider') + const discovery = (await discoveryRes.json()) as { token_endpoint?: string } + if (!discovery.token_endpoint) throw new Error('identity provider has no token endpoint') + const body = new URLSearchParams({ + grant_type: 'authorization_code', + client_id: oidc.client_id, + code, + redirect_uri: `${window.location.origin}/auth/oidc/callback`, + code_verifier: pendingLogin.verifier, + }) + const tokenRes = await fetch(discovery.token_endpoint, { + method: 'POST', + headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, + body, + }) + const tokenBody = (await tokenRes.json()) as { access_token?: string; error_description?: string } + if (!tokenRes.ok || !tokenBody.access_token) throw new Error(tokenBody.error_description ?? 'code exchange failed') + setToken(tokenBody.access_token) + window.location.assign(safeNext(pendingLogin.next)) + } catch (err) { + setError(err instanceof Error ? err.message : 'OIDC sign in failed') + } finally { setPending(false) } + })() + }, [mode, oidc, params]) + + const startOIDC = async (): Promise => { + if (!oidc) return + setPending(true) + setError(null) + try { + const discoveryRes = await fetch(`${oidc.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`) + if (!discoveryRes.ok) throw new Error('could not discover the identity provider') + const discovery = (await discoveryRes.json()) as { authorization_endpoint?: string } + if (!discovery.authorization_endpoint) throw new Error('identity provider has no authorization endpoint') + const random = (bytes: number): string => { + const data = crypto.getRandomValues(new Uint8Array(bytes)) + return btoa(String.fromCharCode(...data)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') + } + const verifier = random(32) + const challenge = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier)) + const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(challenge))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') + const state = random(24) + const redirectURI = `${window.location.origin}/auth/oidc/callback` + sessionStorage.setItem('fancydns.oidc.pending', JSON.stringify({ state, verifier, next })) + const authorize = new URL(discovery.authorization_endpoint) + authorize.search = new URLSearchParams({ + response_type: 'code', client_id: oidc.client_id, redirect_uri: redirectURI, + scope: 'openid profile email', state, code_challenge: codeChallenge, code_challenge_method: 'S256', + }).toString() + window.location.assign(authorize.toString()) + } catch (err) { + setError(err instanceof Error ? err.message : 'could not start OIDC sign in') + setPending(false) + } + } + const onSubmit = async (event: FormEvent): Promise => { event.preventDefault() if (pending) return setError(null) setPending(true) try { + if (mode === 'oidc') { + await startOIDC() + return + } if (wantsPassword(mode ?? 'apikey')) { await login({ username, password }) } else { await login({ api_key: apiKey }) } // A full navigation: the shell reads whoami and the token on boot. - window.location.assign(next.startsWith('/') ? next : '/') + window.location.assign(safeNext(next)) } catch (err) { setError( err instanceof ApiError @@ -94,12 +184,12 @@ export default function Login() { ? 'Checking the authentication mode…' : passwordMode ? 'This node uses username and password.' - : 'This node uses an API key.' + : mode === 'oidc' ? 'Sign in with your identity provider.' : 'This node uses an API key.' } >
void onSubmit(event)}> - {passwordMode ? ( + {mode === 'oidc' ? null : passwordMode ? ( <> - {pending ? 'Signing in…' : 'Sign in'} + {pending ? 'Signing in…' : mode === 'oidc' ? 'Continue with OIDC' : 'Sign in'}