mirror of
https://github.com/storytold/irsa-manager.git
synced 2026-10-09 00:09:43 +00:00
fix IdP interface
This commit is contained in:
@@ -1,5 +1,7 @@
|
|||||||
package selfhosted
|
package selfhosted
|
||||||
|
|
||||||
|
import "context"
|
||||||
|
|
||||||
type OIDCIdProvider interface {
|
type OIDCIdProvider interface {
|
||||||
Discovery() ([]byte, error)
|
Discovery() ([]byte, error)
|
||||||
JWK() ([]byte, error)
|
JWK() ([]byte, error)
|
||||||
@@ -8,5 +10,5 @@ type OIDCIdProvider interface {
|
|||||||
|
|
||||||
type OIDCIdPCreator interface {
|
type OIDCIdPCreator interface {
|
||||||
CreateStorage() error
|
CreateStorage() error
|
||||||
Upload(o OIDCIdProvider) error
|
Upload(ctx context.Context, o OIDCIdProvider) error
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -7,9 +7,10 @@ import (
|
|||||||
"github.com/kkb0318/irsa-manager/internal/selfhosted"
|
"github.com/kkb0318/irsa-manager/internal/selfhosted"
|
||||||
)
|
)
|
||||||
|
|
||||||
type MyIdProvider struct {
|
type IdProvider struct {
|
||||||
jwk *selfhosted.JWK
|
jwk *selfhosted.JWK
|
||||||
issuerHostPath string
|
issuerHostPath string
|
||||||
|
jwksFileName string
|
||||||
}
|
}
|
||||||
|
|
||||||
type OIDCDiscoveryConfiguration struct {
|
type OIDCDiscoveryConfiguration struct {
|
||||||
@@ -22,24 +23,24 @@ type OIDCDiscoveryConfiguration struct {
|
|||||||
ClaimsSupported []string `json:"claims_supported"`
|
ClaimsSupported []string `json:"claims_supported"`
|
||||||
}
|
}
|
||||||
|
|
||||||
func (p *MyIdProvider) Discovery() ([]byte, error) {
|
func (p *IdProvider) Discovery() ([]byte, error) {
|
||||||
oidcConfig := OIDCDiscoveryConfiguration{
|
oidcConfig := OIDCDiscoveryConfiguration{
|
||||||
Issuer: fmt.Sprintf("https://%s/", p.issuerHostPath),
|
Issuer: fmt.Sprintf("https://%s/", p.issuerHostPath),
|
||||||
JWKSURI: fmt.Sprintf("https://%s/keys.json", p.issuerHostPath),
|
JWKSURI: fmt.Sprintf("https://%s/%s", p.issuerHostPath, p.jwksFileName),
|
||||||
AuthorizationEndpoint: "urn:kubernetes:programmatic_authorization",
|
AuthorizationEndpoint: "urn:kubernetes:programmatic_authorization",
|
||||||
ResponseTypesSupported: []string{"id_token"},
|
ResponseTypesSupported: []string{"id_token"},
|
||||||
SubjectTypesSupported: []string{"public"},
|
SubjectTypesSupported: []string{"public"},
|
||||||
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
IDTokenSigningAlgValuesSupported: []string{"RS256"},
|
||||||
ClaimsSupported: []string{"sub", "iss"},
|
ClaimsSupported: []string{"sub", "iss"},
|
||||||
}
|
}
|
||||||
jsonData, err := json.MarshalIndent(oidcConfig, "", " ")
|
jsonData, err := json.MarshalIndent(oidcConfig, "", " ")
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
return jsonData, nil
|
return jsonData, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (p *MyIdProvider) JWK() ([]byte, error) {
|
func (p *IdProvider) JWK() ([]byte, error) {
|
||||||
jsonData, err := json.MarshalIndent(p.jwk.GetKeys(), "", " ")
|
jsonData, err := json.MarshalIndent(p.jwk.GetKeys(), "", " ")
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
@@ -47,10 +48,10 @@ func (p *MyIdProvider) JWK() ([]byte, error) {
|
|||||||
return jsonData, nil
|
return jsonData, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func (p *MyIdProvider) Endpoint() []byte {
|
func (p *IdProvider) Endpoint() string {
|
||||||
return []byte{}
|
return ""
|
||||||
}
|
}
|
||||||
|
|
||||||
func NewMyIdProvider(jwk *selfhosted.JWK, issuerHostPath string) *MyIdProvider {
|
func NewIdProvider(jwk *selfhosted.JWK, issuerHostPath, jwksFileName string) *IdProvider {
|
||||||
return &MyIdProvider{jwk, issuerHostPath}
|
return &IdProvider{jwk, issuerHostPath, jwksFileName}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -16,17 +16,11 @@ type S3IdPCreator struct {
|
|||||||
|
|
||||||
// NewS3IdPCreator initializes a new instance of S3IdPCreator with the specified AWS region and bucket name.
|
// NewS3IdPCreator initializes a new instance of S3IdPCreator with the specified AWS region and bucket name.
|
||||||
// This function attempts to create an AWS client configured for the specified region.
|
// This function attempts to create an AWS client configured for the specified region.
|
||||||
func NewS3IdPCreator(region, bucketName string) (*S3IdPCreator, error) {
|
func NewS3IdPCreator(awsConfig *client.AwsConfig, bucketName string) (*S3IdPCreator, error) {
|
||||||
ctx := context.Background()
|
|
||||||
awsConfig, err := client.NewAwsClient(ctx, region)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("unable to load SDK config, %w", err)
|
|
||||||
}
|
|
||||||
s3Client := awsConfig.S3Cient(bucketName)
|
s3Client := awsConfig.S3Cient(bucketName)
|
||||||
return &S3IdPCreator{s3Client}, nil
|
return &S3IdPCreator{s3Client}, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
// CreateStorage creates an S3 bucket
|
// CreateStorage creates an S3 bucket
|
||||||
func (s *S3IdPCreator) CreateStorage() error {
|
func (s *S3IdPCreator) CreateStorage() error {
|
||||||
err := s.s3Client.CreateBucket(context.TODO())
|
err := s.s3Client.CreateBucket(context.TODO())
|
||||||
@@ -39,18 +33,26 @@ func (s *S3IdPCreator) CreateStorage() error {
|
|||||||
// Upload uploads the OIDC provider's discovery configuration and JSON Web Key Set (JWKS) to the specified AWS S3 bucket.
|
// Upload uploads the OIDC provider's discovery configuration and JSON Web Key Set (JWKS) to the specified AWS S3 bucket.
|
||||||
// This method is responsible for uploading the necessary OIDC configuration files to S3, making them accessible for OIDC clients.
|
// This method is responsible for uploading the necessary OIDC configuration files to S3, making them accessible for OIDC clients.
|
||||||
func (s *S3IdPCreator) Upload(ctx context.Context, o selfhosted.OIDCIdProvider) error {
|
func (s *S3IdPCreator) Upload(ctx context.Context, o selfhosted.OIDCIdProvider) error {
|
||||||
err := s.s3Client.PutObject(ctx,
|
discovery, err := o.Discovery()
|
||||||
|
if err != nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
err = s.s3Client.PutObject(ctx,
|
||||||
CONFIGURATION_PATH,
|
CONFIGURATION_PATH,
|
||||||
o.Discovery(),
|
discovery,
|
||||||
)
|
)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("unable to upload discovery document, %w", err)
|
return fmt.Errorf("unable to upload discovery document, %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Uplaod JWK
|
// Uplaod JWK
|
||||||
|
jwk, err := o.JWK()
|
||||||
|
if err != nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
err = s.s3Client.PutObject(ctx,
|
err = s.s3Client.PutObject(ctx,
|
||||||
"keys.json",
|
"keys.json",
|
||||||
o.JWK(),
|
jwk,
|
||||||
)
|
)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("unable to upload JWK, %w", err)
|
return fmt.Errorf("unable to upload JWK, %w", err)
|
||||||
|
|||||||
Reference in New Issue
Block a user