cloudfoundry-incubator/stratos

package auth

import (
    "encoding/base64"
    "errors"
    "io/ioutil"
    "time"

    "github.com/cloudfoundry-incubator/stratos/src/jetstream/plugins/kubernetes/config"
    "github.com/cloudfoundry-incubator/stratos/src/jetstream/repository/interfaces"

    "github.com/labstack/echo/v4"
)

const authConnectTypeKubeConfigAz = "kubeconfig-az"

// AzureKubeAuth is Azure Authentication with Certificates
type AzureKubeAuth struct {
    CertKubeAuth
}

// InitAzureKubeAuth creates a AzureKubeAuth
func InitAzureKubeAuth(portalProxy interfaces.PortalProxy) KubeAuthProvider {
    return &AzureKubeAuth{*InitCertKubeAuth(portalProxy)}
}

// GetName returns the provider name
func (c *AzureKubeAuth) GetName() string {
    return authConnectTypeKubeConfigAz
}

func (p *AzureKubeAuth) FetchToken(cnsiRecord interfaces.CNSIRecord, ec echo.Context) (*interfaces.TokenRecord, *interfaces.CNSIRecord, error) {
    req := ec.Request()

    // Need to extract the parameters from the request body
    defer req.Body.Close()
    body, err := ioutil.ReadAll(req.Body)
    if err != nil {
        return nil, nil, err
    }

    kubeConfig, err := config.ParseKubeConfig(body)

    kubeConfigUser, err := kubeConfig.GetUserForCluster(cnsiRecord.APIEndpoint.String())
    if err != nil {
        return nil, nil, errors.New("Unable to find cluster in kubeconfig")
    }

    authConfig, err := p.getAKSAuthConfig(kubeConfigUser)
    if err != nil {
        return nil, nil, errors.New("User doesn't use AKS auth")
    }

    jsonString, err := authConfig.GetJSON()
    if err != nil {
        return nil, nil, err
    }
    // Refresh token isn't required since the AccessToken will never expire
    refreshToken := jsonString

    accessToken := jsonString
    // Indefinite expiry
    expiry := time.Now().Local().Add(time.Hour * time.Duration(100000))

    tokenRecord := p.portalProxy.InitEndpointTokenRecord(expiry.Unix(), accessToken, refreshToken, false)
    tokenRecord.AuthType = authConnectTypeKubeConfigAz

    return &tokenRecord, &cnsiRecord, nil
}

func (p *AzureKubeAuth) getAKSAuthConfig(k *config.KubeConfigUser) (*KubeCertificate, error) {

    if !isAKSAuth(k) {
        return nil, errors.New("User doesn't use AKS")
    }

    cert, err := base64.StdEncoding.DecodeString(k.User.ClientCertificate)
    if err != nil {
        return nil, errors.New("Unable to decode certificate")
    }
    certKey, err := base64.StdEncoding.DecodeString(k.User.ClientKeyData)
    if err != nil {
        return nil, errors.New("Unable to decode certificate key")
    }
    kubeCertAuth := &KubeCertificate{
        Certificate:    string(cert),
        CertificateKey: string(certKey),
        Token:          k.User.Token,
    }
    return kubeCertAuth, nil
}

func isAKSAuth(k *config.KubeConfigUser) bool {
    if k.User.ClientCertificate == "" ||
        k.User.ClientKeyData == "" ||
        k.User.Token == "" {
        return false
    }
    return true
}

func (c *AzureKubeAuth) RegisterJetstreamAuthType(portal interfaces.PortalProxy) {
    // Register auth type with Jetstream
    c.portalProxy.AddAuthProvider(c.GetName(), interfaces.AuthProvider{
        Handler:  c.DoFlowRequest,
        UserInfo: c.GetUserFromToken,
    })
}