github.com/greenpau/go-authcrunch@v1.0.50/pkg/authn/idp_apikey_auth.go (about)

     1  // Copyright 2022 Paul Greenberg greenpau@outlook.com
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package authn
    16  
    17  import (
    18  	"context"
    19  	"github.com/greenpau/go-authcrunch/pkg/authn/enums/operator"
    20  	"github.com/greenpau/go-authcrunch/pkg/authproxy"
    21  	"github.com/greenpau/go-authcrunch/pkg/errors"
    22  	"github.com/greenpau/go-authcrunch/pkg/requests"
    23  	"github.com/greenpau/go-authcrunch/pkg/user"
    24  	"go.uber.org/zap"
    25  	"time"
    26  )
    27  
    28  // APIKeyAuth performs API key authentication.
    29  func (p *Portal) APIKeyAuth(r *authproxy.Request) error {
    30  	if r.Realm == "" {
    31  		r.Realm = "local"
    32  	}
    33  
    34  	rr := requests.NewRequest()
    35  	rr.Logger = p.logger
    36  	rr.Response.Authenticated = false
    37  	rr.Key.Payload = r.Secret
    38  	rr.Upstream.Realm = r.Realm
    39  
    40  	backend := p.getIdentityStoreByRealm(r.Realm)
    41  	if backend == nil {
    42  		p.logger.Warn(
    43  			"realm backend not found",
    44  			zap.String("source_address", r.Address),
    45  			zap.String("custom_auth", "apikey"),
    46  			zap.String("realm", r.Realm),
    47  		)
    48  		return errors.ErrAPIKeyAuthFailed
    49  	}
    50  
    51  	if err := backend.Request(operator.LookupAPIKey, rr); err != nil {
    52  		p.logger.Warn(
    53  			"api key lookup failed",
    54  			zap.String("source_address", r.Address),
    55  			zap.String("custom_auth", "apikey"),
    56  			zap.String("realm", r.Realm),
    57  			zap.Error(err),
    58  		)
    59  		return errors.ErrAPIKeyAuthFailed
    60  	}
    61  
    62  	if err := backend.Request(operator.IdentifyUser, rr); err != nil {
    63  		p.logger.Warn(
    64  			"user lookup following api key lookup failed",
    65  			zap.String("source_address", r.Address),
    66  			zap.String("custom_auth", "apikey"),
    67  			zap.String("realm", r.Realm),
    68  			zap.Error(err),
    69  		)
    70  		return errors.ErrAPIKeyAuthFailed
    71  	}
    72  
    73  	m := make(map[string]interface{})
    74  	m["sub"] = rr.User.Username
    75  	m["email"] = rr.User.Email
    76  	if rr.User.FullName != "" {
    77  		m["name"] = rr.User.FullName
    78  	}
    79  	if len(rr.User.Roles) > 0 {
    80  		m["roles"] = rr.User.Roles
    81  	}
    82  
    83  	// m["jti"] = rr.Upstream.SessionID
    84  	m["exp"] = time.Now().Add(time.Duration(p.keystore.GetTokenLifetime(nil, nil)) * time.Second).UTC().Unix()
    85  	m["iat"] = time.Now().UTC().Unix()
    86  	m["nbf"] = time.Now().Add(time.Duration(60) * time.Second * -1).UTC().Unix()
    87  	if _, exists := m["origin"]; !exists {
    88  		m["origin"] = r.Realm
    89  	}
    90  	m["iss"] = "authp"
    91  	m["addr"] = r.Address
    92  
    93  	// Perform user claim transformation if necessary.
    94  	if err := p.transformUser(context.Background(), rr, m); err != nil {
    95  		return err
    96  	}
    97  
    98  	// Inject portal specific roles
    99  	injectPortalRoles(m)
   100  
   101  	// Create a new user and sign the token.
   102  	usr, err := user.NewUser(m)
   103  	if err != nil {
   104  		p.logger.Warn(
   105  			"user build following user lookup failed",
   106  			zap.String("source_address", r.Address),
   107  			zap.String("custom_auth", "apikey"),
   108  			zap.String("realm", r.Realm),
   109  			zap.Error(err),
   110  		)
   111  		return errors.ErrAPIKeyAuthFailed
   112  	}
   113  	if err := p.keystore.SignToken(nil, nil, usr); err != nil {
   114  		p.logger.Warn(
   115  			"user token signing failed",
   116  			zap.String("source_address", r.Address),
   117  			zap.String("custom_auth", "apikey"),
   118  			zap.String("realm", r.Realm),
   119  			zap.Error(err),
   120  		)
   121  		return errors.ErrAPIKeyAuthFailed
   122  	}
   123  
   124  	r.Response.Payload = usr.Token
   125  	r.Response.Name = usr.TokenName
   126  	return nil
   127  }