2017-01-27 00:08:52 +00:00
|
|
|
package okta
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
|
2017-08-31 02:37:21 +00:00
|
|
|
"github.com/chrismalek/oktasdk-go/okta"
|
2017-01-27 00:08:52 +00:00
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
"github.com/hashicorp/vault/logical/framework"
|
|
|
|
)
|
|
|
|
|
|
|
|
func Factory(conf *logical.BackendConfig) (logical.Backend, error) {
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 17:28:40 +00:00
|
|
|
b := Backend()
|
|
|
|
if err := b.Setup(conf); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return b, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func Backend() *backend {
|
|
|
|
var b backend
|
|
|
|
b.Backend = &framework.Backend{
|
|
|
|
Help: backendHelp,
|
|
|
|
|
|
|
|
PathsSpecial: &logical.Paths{
|
|
|
|
Unauthenticated: []string{
|
|
|
|
"login/*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
|
|
|
|
Paths: append([]*framework.Path{
|
|
|
|
pathConfig(&b),
|
|
|
|
pathUsers(&b),
|
|
|
|
pathGroups(&b),
|
|
|
|
pathUsersList(&b),
|
|
|
|
pathGroupsList(&b),
|
|
|
|
pathLogin(&b),
|
|
|
|
}),
|
|
|
|
|
2017-07-28 18:04:46 +00:00
|
|
|
AuthRenew: b.pathLoginRenew,
|
|
|
|
BackendType: logical.TypeCredential,
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &b
|
|
|
|
}
|
|
|
|
|
|
|
|
type backend struct {
|
|
|
|
*framework.Backend
|
|
|
|
}
|
|
|
|
|
2017-11-02 20:05:48 +00:00
|
|
|
func (b *backend) Login(req *logical.Request, username string, password string) ([]string, *logical.Response, []string, error) {
|
2017-01-27 00:08:52 +00:00
|
|
|
cfg, err := b.Config(req.Storage)
|
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, nil, nil, err
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
if cfg == nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse("Okta backend not configured"), nil, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
client := cfg.OktaClient()
|
2017-08-31 02:37:21 +00:00
|
|
|
|
|
|
|
type embeddedResult struct {
|
|
|
|
User okta.User `json:"user"`
|
|
|
|
}
|
|
|
|
|
|
|
|
type authResult struct {
|
|
|
|
Embedded embeddedResult `json:"_embedded"`
|
|
|
|
}
|
|
|
|
|
|
|
|
authReq, err := client.NewRequest("POST", "authn", map[string]interface{}{
|
|
|
|
"username": username,
|
|
|
|
"password": password,
|
|
|
|
})
|
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, nil, nil, err
|
2017-08-31 02:37:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
var result authResult
|
|
|
|
rsp, err := client.Do(authReq, &result)
|
2017-01-27 00:08:52 +00:00
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse(fmt.Sprintf("Okta auth failed: %v", err)), nil, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
2017-08-31 02:37:21 +00:00
|
|
|
if rsp == nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse("okta auth backend unexpected failure"), nil, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
oktaResponse := &logical.Response{
|
|
|
|
Data: map[string]interface{}{},
|
|
|
|
}
|
|
|
|
|
|
|
|
var allGroups []string
|
2017-09-15 04:27:45 +00:00
|
|
|
// Only query the Okta API for group membership if we have a token
|
|
|
|
if cfg.Token != "" {
|
|
|
|
oktaGroups, err := b.getOktaGroups(client, &result.Embedded.User)
|
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse(fmt.Sprintf("okta failure retrieving groups: %v", err)), nil, nil
|
2017-09-15 04:27:45 +00:00
|
|
|
}
|
|
|
|
if len(oktaGroups) == 0 {
|
|
|
|
errString := fmt.Sprintf(
|
|
|
|
"no Okta groups found; only policies from locally-defined groups available")
|
|
|
|
oktaResponse.AddWarning(errString)
|
|
|
|
}
|
|
|
|
allGroups = append(allGroups, oktaGroups...)
|
|
|
|
}
|
|
|
|
|
2017-01-27 00:08:52 +00:00
|
|
|
// Import the custom added groups from okta backend
|
|
|
|
user, err := b.User(req.Storage, username)
|
2017-08-25 18:48:37 +00:00
|
|
|
if err != nil {
|
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("auth/okta: error looking up user", "error", err)
|
|
|
|
}
|
|
|
|
}
|
2017-01-27 00:08:52 +00:00
|
|
|
if err == nil && user != nil && user.Groups != nil {
|
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("auth/okta: adding local groups", "num_local_groups", len(user.Groups), "local_groups", user.Groups)
|
|
|
|
}
|
|
|
|
allGroups = append(allGroups, user.Groups...)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Retrieve policies
|
|
|
|
var policies []string
|
|
|
|
for _, groupName := range allGroups {
|
2017-08-25 18:48:37 +00:00
|
|
|
entry, _, err := b.Group(req.Storage, groupName)
|
|
|
|
if err != nil {
|
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("auth/okta: error looking up group policies", "error", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if err == nil && entry != nil && entry.Policies != nil {
|
|
|
|
policies = append(policies, entry.Policies...)
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Merge local Policies into Okta Policies
|
2017-02-14 21:28:16 +00:00
|
|
|
if user != nil && user.Policies != nil {
|
|
|
|
policies = append(policies, user.Policies...)
|
|
|
|
}
|
2017-01-27 00:08:52 +00:00
|
|
|
|
|
|
|
if len(policies) == 0 {
|
|
|
|
errStr := "user is not a member of any authorized policy"
|
2017-06-05 14:52:43 +00:00
|
|
|
if len(oktaResponse.Warnings) > 0 {
|
|
|
|
errStr = fmt.Sprintf("%s; additionally, %s", errStr, oktaResponse.Warnings[0])
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
oktaResponse.Data["error"] = errStr
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, oktaResponse, nil, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
2017-11-02 20:05:48 +00:00
|
|
|
return policies, oktaResponse, allGroups, nil
|
2017-01-27 00:08:52 +00:00
|
|
|
}
|
|
|
|
|
2017-09-15 04:27:45 +00:00
|
|
|
func (b *backend) getOktaGroups(client *okta.Client, user *okta.User) ([]string, error) {
|
|
|
|
rsp, err := client.Users.PopulateGroups(user)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if rsp == nil {
|
|
|
|
return nil, fmt.Errorf("okta auth backend unexpected failure")
|
|
|
|
}
|
|
|
|
oktaGroups := make([]string, 0, len(user.Groups))
|
|
|
|
for _, group := range user.Groups {
|
|
|
|
oktaGroups = append(oktaGroups, group.Profile.Name)
|
|
|
|
}
|
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("auth/okta: Groups fetched from Okta", "num_groups", len(oktaGroups), "groups", oktaGroups)
|
|
|
|
}
|
|
|
|
return oktaGroups, nil
|
|
|
|
}
|
|
|
|
|
2017-01-27 00:08:52 +00:00
|
|
|
const backendHelp = `
|
|
|
|
The Okta credential provider allows authentication querying,
|
|
|
|
checking username and password, and associating policies. If an api token is configure
|
|
|
|
groups are pulled down from Okta.
|
|
|
|
|
|
|
|
Configuration of the connection is done through the "config" and "policies"
|
|
|
|
endpoints by a user with root access. Authentication is then done
|
|
|
|
by suppying the two fields for "login".
|
|
|
|
`
|