palourde/uchiwa

package authentication

import (
    "encoding/json"
    "net/http"

    jwt "github.com/dgrijalva/jwt-go"
    "github.com/gorilla/context"
    "github.com/sensu/uchiwa/uchiwa/audit"
    "github.com/sensu/uchiwa/uchiwa/helpers"
    "github.com/sensu/uchiwa/uchiwa/logger"
    "github.com/sensu/uchiwa/uchiwa/structs"
)

// New function initalizes and returns a Config struct
func New(auth structs.Auth) Config {
    c := Config{
        Auth: auth,
    }
    return c
}

// publicHandler does not enforce authentication
func publicHandler(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        next.ServeHTTP(w, r)
    })
}

// restrictedHandler enforce authentication by validating the JWT
// or the access token provided in the configuration
func restrictedHandler(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        var token *jwt.Token
        authenticationToken, err := r.Cookie(authenticationCookieName)
        if err == nil {
            // Verify the JWT
            token, err = verifyJWT(authenticationToken.Value)
            if err != nil {
                logger.Debug("No JWT token provided")
            } else {
                xsrfTokenFromClaims, ok := token.Claims["xsrfToken"]
                if !ok {
                    logger.Debug("The XSRF Token is missing from the JWT claims")
                    http.Error(w, "Request unauthorized", http.StatusUnauthorized)
                    return
                }

                xsrfTokenFromHeader := r.Header.Get("X-XSRF-TOKEN")

                if xsrfTokenFromHeader == "" || xsrfTokenFromClaims != xsrfTokenFromHeader {
                    logger.Debug("The XSRF token does not match the XSRF claim")
                    http.Error(w, "Request unauthorized", http.StatusUnauthorized)
                    return
                }
            }
        } else {
            logger.Debugf("No AuthenticationToken cookie found: %s", err.Error())
        }

        // Verify the access token if no JWT was provided
        if err != nil {
            token, err = verifyAccessToken(r)
        }

        // If no JWT or access token found
        if err != nil {
            logger.Debug("No access token provided")
            http.Error(w, "Request unauthorized", http.StatusUnauthorized)
            return
        }

        // Determine the audit level of the request
        var level string
        if r.Method == "GET" || r.Method == "HEAD" {
            level = "verbose"
        } else {
            level = "default"
        }

        // Determine the user of the request
        var username string
        username, ok := token.Claims["username"].(string)
        if !ok {
            username = "Unknown"
        }

        // Add the request to the audit log
        log := structs.AuditLog{
            Action:     r.Method,
            Level:      level,
            RemoteAddr: helpers.GetIP(r),
            URL:        r.URL.String(),
            User:       username,
        }
        audit.Log(log)

        setJWTInContext(r, token)
        next.ServeHTTP(w, r)
        context.Clear(r)
        return
    })
}

// Authenticate calls the proper handler based on whether authentication is enabled or not
func (c *Config) Authenticate(next http.Handler) http.Handler {
    if c.DriverName == "none" {
        return publicHandler(next)
    }
    return restrictedHandler(next)
}

// Login authenticates a user against the authentication driver
func (c *Config) Login() http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if r.Method == "POST" {
            decoder := json.NewDecoder(r.Body)
            var data interface{}
            err := decoder.Decode(&data)
            if err != nil {
                logger.Warningf("Could not decode the body: %s", err)
                http.Error(w, "", http.StatusInternalServerError)
                return
            }

            m, ok := data.(map[string]interface{})
            if !ok {
                logger.Warningf("Could not assert the body: %s", err)
                http.Error(w, "", http.StatusInternalServerError)
                return
            }

            u := m["user"].(string)
            p := m["pass"].(string)
            if u == "" || p == "" {
                logger.Info("Authentication failed: user and password must not be empty")
                http.Error(w, "", http.StatusUnauthorized)
                return
            }

            user, err := c.login(u, p)
            if err != nil {
                logger.Info(err)

                // Add the login failure to the audit log
                log := structs.AuditLog{
                    Action:     "loginfailure",
                    Level:      "default",
                    Output:     err.Error(),
                    RemoteAddr: helpers.GetIP(r),
                    User:       u,
                }
                audit.Log(log)

                http.Error(w, "", http.StatusUnauthorized)
                return
            }

            xsrfToken := helpers.RandomString(32)
            authenticationToken, err := GetToken(user, xsrfToken)
            if err != nil {
                logger.Infof("Authentication failed, could not create the token: %s", err)
                http.Error(w, "", http.StatusUnauthorized)
                return
            }

            // Set the required cookies
            SetCookies(w, r, authenticationToken, xsrfToken)

            // Add the successful login to the audit log
            log := structs.AuditLog{
                Action:     "loginsuccess",
                Level:      "default",
                RemoteAddr: helpers.GetIP(r),
                User:       u,
            }
            audit.Log(log)

            return
        }

        http.Redirect(w, r, "/#/login", http.StatusFound)
        return
    })
}