Skip to content

Commit

Permalink
fix(apikey): show api key configuration in mgmt API (#2138)
Browse files Browse the repository at this point in the history 
Signed-off-by: Andrei Aaron <[email protected]>
  • Loading branch information
@andaaron
andaaron authored Dec 14, 2023
1 parent 18aa975 commit cff7457
Show file tree
Hide file tree
Showing 5 changed files with 111 additions and 4 deletions.
1 change: 1 addition & 0 deletions pkg/extensions/extension_mgmt.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ type Auth struct {
Address string `json:"address,omitempty" mapstructure:"address"`
} `json:"ldap,omitempty" mapstructure:"ldap"`
OpenID *OpenIDConfig `json:"openid,omitempty" mapstructure:"openid"`
APIKey bool `json:"apikey,omitempty" mapstructure:"apikey"`
}

type StrippedConfig struct {
Expand Down
106 changes: 102 additions & 4 deletions pkg/extensions/extensions_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,12 @@ func TestMgmtExtension(t *testing.T) {
username, seedUser := test.GenerateRandomString()
password, seedPass := test.GenerateRandomString()
htpasswdPath := test.MakeHtpasswdFileFromString(test.GetCredString(username, password))

defer func() {
conf.HTTP.Auth.HTPasswd.Path = ""
os.Remove(htpasswdPath)
}()

conf.HTTP.Auth.HTPasswd.Path = htpasswdPath

conf.Extensions = &extconf.ExtensionConfig{}
Expand Down Expand Up @@ -203,6 +209,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.HTPasswd.Path, ShouldEqual, "")
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

// with credentials
resp, err = resty.R().SetBasicAuth(username, password).Get(baseURL + constants.FullMgmt)
Expand All @@ -216,6 +223,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.HTPasswd.Path, ShouldEqual, "")
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

// with wrong credentials
resp, err = resty.R().SetBasicAuth(username, "wrong").Get(baseURL + constants.FullMgmt)
Expand All @@ -224,7 +232,6 @@ func TestMgmtExtension(t *testing.T) {
})

Convey("Verify mgmt auth info route enabled with ldap", t, func() {
defer os.Remove(conf.HTTP.Auth.HTPasswd.Path) // cleanup of a file created in previous Convey
conf.HTTP.Auth.LDAP = (&config.LDAPConfig{
BaseDN: "basedn",
Address: "ldapexample",
Expand Down Expand Up @@ -281,13 +288,84 @@ func TestMgmtExtension(t *testing.T) {
// ldap is always nil, htpasswd should be populated when ldap is used
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with ldap + apikey", t, func() {
conf.HTTP.Auth.LDAP = (&config.LDAPConfig{
BaseDN: "basedn",
Address: "ldapexample",
}).SetBindDN("binddn")
conf.HTTP.Auth.APIKey = true

defer func() {
conf.HTTP.Auth.APIKey = false
}()

conf.Extensions = &extconf.ExtensionConfig{}
conf.Extensions.Search = &extconf.SearchConfig{}
conf.Extensions.Search.Enable = &defaultValue
conf.Extensions.Search.CVE = nil
conf.Extensions.UI = &extconf.UIConfig{}
conf.Extensions.UI.Enable = &defaultValue

conf.Log.Output = logFile.Name()
defer os.Remove(logFile.Name()) // cleanup

ctlr := api.NewController(conf)

subPaths := make(map[string]config.StorageConfig)
subPaths["/a"] = config.StorageConfig{RootDirectory: t.TempDir()}

ctlr.Config.Storage.RootDirectory = t.TempDir()
ctlr.Config.Storage.SubPaths = subPaths

ctlrManager := test.NewControllerManager(ctlr)
ctlrManager.StartAndWait(port)
defer ctlrManager.StopServer()

found, err := test.ReadLogFileAndSearchString(logFile.Name(),
"setting up mgmt routes", mgmtReadyTimeout)
defer func() {
if !found {
data, err := os.ReadFile(logFile.Name())
So(err, ShouldBeNil)
t.Log(string(data))
}
}()
So(found, ShouldBeTrue)
So(err, ShouldBeNil)

found, err = test.ReadLogFileAndSearchString(logFile.Name(),
"finished setting up mgmt routes", mgmtReadyTimeout)
So(found, ShouldBeTrue)
So(err, ShouldBeNil)

// without credentials
resp, err := resty.R().Get(baseURL + constants.FullMgmt)
So(err, ShouldBeNil)
So(resp.StatusCode(), ShouldEqual, http.StatusOK)

mgmtResp := extensions.StrippedConfig{}
err = json.Unmarshal(resp.Body(), &mgmtResp)
So(err, ShouldBeNil)
So(mgmtResp.HTTP.Auth.HTPasswd.Path, ShouldEqual, "")
// ldap is always nil, htpasswd should be populated when ldap is used
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeTrue)
})

Convey("Verify mgmt auth info route enabled with htpasswd + ldap", t, func() {
username, seedUser := test.GenerateRandomString()
password, seedPass := test.GenerateRandomString()
htpasswdPath := test.MakeHtpasswdFileFromString(test.GetCredString(username, password))
defer os.Remove(htpasswdPath)

defer func() {
conf.HTTP.Auth.HTPasswd.Path = ""
os.Remove(htpasswdPath)
}()

conf.HTTP.Auth.HTPasswd.Path = htpasswdPath
conf.HTTP.Auth.LDAP = (&config.LDAPConfig{
BaseDN: "basedn",
Expand Down Expand Up @@ -346,6 +424,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.HTPasswd.Path, ShouldEqual, "")
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

// with credentials
resp, err = resty.R().SetBasicAuth(username, password).Get(baseURL + constants.FullMgmt)
Expand All @@ -359,13 +438,19 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.HTPasswd.Path, ShouldEqual, "")
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with htpasswd + ldap + bearer", t, func() {
username, seedUser := test.GenerateRandomString()
password, seedPass := test.GenerateRandomString()
htpasswdPath := test.MakeHtpasswdFileFromString(test.GetCredString(username, password))
defer os.Remove(htpasswdPath)

defer func() {
conf.HTTP.Auth.HTPasswd.Path = ""
os.Remove(htpasswdPath)
}()

conf.HTTP.Auth.HTPasswd.Path = htpasswdPath
conf.HTTP.Auth.LDAP = (&config.LDAPConfig{
BaseDN: "basedn",
Expand Down Expand Up @@ -427,6 +512,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldNotBeNil)
So(mgmtResp.HTTP.Auth.Bearer.Realm, ShouldEqual, "realm")
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, "service")
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

// with credentials
resp, err = resty.R().SetBasicAuth(username, password).Get(baseURL + constants.FullMgmt)
Expand All @@ -442,6 +528,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldNotBeNil)
So(mgmtResp.HTTP.Auth.Bearer.Realm, ShouldEqual, "realm")
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, "service")
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with ldap + bearer", t, func() {
Expand Down Expand Up @@ -509,6 +596,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldNotBeNil)
So(mgmtResp.HTTP.Auth.Bearer.Realm, ShouldEqual, "realm")
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, "service")
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with bearer", t, func() {
Expand Down Expand Up @@ -567,6 +655,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldNotBeNil)
So(mgmtResp.HTTP.Auth.Bearer.Realm, ShouldEqual, "realm")
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, "service")
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with openID", t, func() {
Expand Down Expand Up @@ -634,13 +723,18 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.OpenID, ShouldNotBeNil)
So(mgmtResp.HTTP.Auth.OpenID.Providers, ShouldNotBeEmpty)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled with empty openID provider list", t, func() {
username, seedUser := test.GenerateRandomString()
password, seedPass := test.GenerateRandomString()
htpasswdPath := test.MakeHtpasswdFileFromString(test.GetCredString(username, password))
defer os.Remove(htpasswdPath)

defer func() {
conf.HTTP.Auth.HTPasswd.Path = ""
os.Remove(htpasswdPath)
}()

conf.HTTP.Auth.HTPasswd.Path = htpasswdPath
conf.HTTP.Auth.LDAP = nil
Expand Down Expand Up @@ -701,6 +795,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.OpenID, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})

Convey("Verify mgmt auth info route enabled without any auth", t, func() {
Expand Down Expand Up @@ -745,6 +840,7 @@ func TestMgmtExtension(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer, ShouldBeNil)
So(mgmtResp.HTTP.Auth.HTPasswd, ShouldBeNil)
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

found, err := test.ReadLogFileAndSearchString(logFile.Name(),
"setting up mgmt routes", mgmtReadyTimeout)
Expand Down Expand Up @@ -898,6 +994,7 @@ func TestMgmtWithBearer(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, conf.HTTP.Auth.Bearer.Service)
So(mgmtResp.HTTP.Auth.HTPasswd, ShouldBeNil)
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)

resp, err = resty.R().SetBasicAuth("", "").Get(baseURL + constants.FullMgmt)
So(err, ShouldBeNil)
Expand All @@ -912,6 +1009,7 @@ func TestMgmtWithBearer(t *testing.T) {
So(mgmtResp.HTTP.Auth.Bearer.Service, ShouldEqual, conf.HTTP.Auth.Bearer.Service)
So(mgmtResp.HTTP.Auth.HTPasswd, ShouldBeNil)
So(mgmtResp.HTTP.Auth.LDAP, ShouldBeNil)
So(mgmtResp.HTTP.Auth.APIKey, ShouldBeFalse)
})
}

Expand Down
3 changes: 3 additions & 0 deletions swagger/docs.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions swagger/swagger.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1299,6 +1299,9 @@
"extensions.Auth": {
"type": "object",
"properties": {
"apikey": {
"type": "boolean"
},
"bearer": {
"$ref": "#/definitions/extensions.BearerConfig"
},
Expand Down
2 changes: 2 additions & 0 deletions swagger/swagger.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,8 @@ definitions:
type: object
extensions.Auth:
properties:
apikey:
type: boolean
bearer:
$ref: '#/definitions/extensions.BearerConfig'
htpasswd:
Expand Down

0 comments on commit cff7457

Please sign in to comment.