traefik/middlewares/auth/authenticator.go

145 lines
4.2 KiB
Go
Raw Normal View History

package auth
import (
"fmt"
"io/ioutil"
"net/http"
2018-01-24 17:18:03 +00:00
"net/url"
"strings"
2017-08-25 16:22:03 +00:00
goauth "github.com/abbot/go-http-auth"
"github.com/containous/traefik/log"
2018-01-10 16:48:04 +00:00
"github.com/containous/traefik/middlewares/tracing"
"github.com/containous/traefik/types"
"github.com/urfave/negroni"
)
// Authenticator is a middleware that provides HTTP basic and digest authentication
type Authenticator struct {
handler negroni.Handler
users map[string]string
}
2018-01-10 16:48:04 +00:00
type tracingAuthenticator struct {
name string
handler negroni.Handler
clientSpanKind bool
}
2017-10-02 08:32:02 +00:00
// NewAuthenticator builds a new Authenticator given a config
2018-01-10 16:48:04 +00:00
func NewAuthenticator(authConfig *types.Auth, tracingMiddleware *tracing.Tracing) (*Authenticator, error) {
if authConfig == nil {
2018-01-10 16:48:04 +00:00
return nil, fmt.Errorf("error creating Authenticator: auth is nil")
}
2018-06-11 09:36:03 +00:00
var err error
2018-06-11 09:36:03 +00:00
authenticator := &Authenticator{}
tracingAuth := tracingAuthenticator{}
if authConfig.Basic != nil {
authenticator.users, err = parserBasicUsers(authConfig.Basic)
if err != nil {
return nil, err
}
2018-06-11 09:36:03 +00:00
2017-08-25 16:22:03 +00:00
basicAuth := goauth.NewBasicAuthenticator("traefik", authenticator.secretBasic)
2018-06-11 09:36:03 +00:00
tracingAuth.handler = createAuthBasicHandler(basicAuth, authConfig)
tracingAuth.name = "Auth Basic"
tracingAuth.clientSpanKind = false
} else if authConfig.Digest != nil {
authenticator.users, err = parserDigestUsers(authConfig.Digest)
if err != nil {
return nil, err
}
2018-06-11 09:36:03 +00:00
2017-08-25 16:22:03 +00:00
digestAuth := goauth.NewDigestAuthenticator("traefik", authenticator.secretDigest)
2018-06-11 09:36:03 +00:00
tracingAuth.handler = createAuthDigestHandler(digestAuth, authConfig)
tracingAuth.name = "Auth Digest"
tracingAuth.clientSpanKind = false
2017-08-25 16:22:03 +00:00
} else if authConfig.Forward != nil {
2018-06-11 09:36:03 +00:00
tracingAuth.handler = createAuthForwardHandler(authConfig)
tracingAuth.name = "Auth Forward"
tracingAuth.clientSpanKind = true
2018-01-10 16:48:04 +00:00
}
2018-06-11 09:36:03 +00:00
2018-01-10 16:48:04 +00:00
if tracingMiddleware != nil {
2018-06-11 09:36:03 +00:00
authenticator.handler = tracingMiddleware.NewNegroniHandlerWrapper(tracingAuth.name, tracingAuth.handler, tracingAuth.clientSpanKind)
2018-01-10 16:48:04 +00:00
} else {
2018-06-11 09:36:03 +00:00
authenticator.handler = tracingAuth.handler
}
2018-06-11 09:36:03 +00:00
return authenticator, nil
}
2018-01-10 16:48:04 +00:00
func createAuthForwardHandler(authConfig *types.Auth) negroni.HandlerFunc {
return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
Forward(authConfig.Forward, w, r, next)
})
}
func createAuthDigestHandler(digestAuth *goauth.DigestAuth, authConfig *types.Auth) negroni.HandlerFunc {
return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
if username, _ := digestAuth.CheckAuth(r); username == "" {
log.Debugf("Digest auth failed")
digestAuth.RequireAuth(w, r)
} else {
log.Debugf("Digest auth succeeded")
2018-01-24 17:18:03 +00:00
r.URL.User = url.User(username)
2018-01-10 16:48:04 +00:00
if authConfig.HeaderField != "" {
r.Header[authConfig.HeaderField] = []string{username}
}
next.ServeHTTP(w, r)
}
})
}
func createAuthBasicHandler(basicAuth *goauth.BasicAuth, authConfig *types.Auth) negroni.HandlerFunc {
return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
if username := basicAuth.CheckAuth(r); username == "" {
log.Debugf("Basic auth failed")
basicAuth.RequireAuth(w, r)
} else {
2018-01-24 17:18:03 +00:00
log.Debugf("Basic auth succeeded")
r.URL.User = url.User(username)
2018-01-10 16:48:04 +00:00
if authConfig.HeaderField != "" {
r.Header[authConfig.HeaderField] = []string{username}
}
next.ServeHTTP(w, r)
}
})
}
func getLinesFromFile(filename string) ([]string, error) {
dat, err := ioutil.ReadFile(filename)
if err != nil {
return nil, err
}
// Trim lines and filter out blanks
rawLines := strings.Split(string(dat), "\n")
var filteredLines []string
for _, rawLine := range rawLines {
line := strings.TrimSpace(rawLine)
if line != "" {
filteredLines = append(filteredLines, line)
}
}
return filteredLines, nil
}
func (a *Authenticator) secretBasic(user, realm string) string {
if secret, ok := a.users[user]; ok {
return secret
}
log.Debugf("User not found: %s", user)
return ""
}
func (a *Authenticator) secretDigest(user, realm string) string {
if secret, ok := a.users[user+":"+realm]; ok {
return secret
}
log.Debugf("User not found: %s:%s", user, realm)
return ""
}
func (a *Authenticator) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
a.handler.ServeHTTP(rw, r, next)
}