OpenShift Cluster Console 登录源码解析

// LoginFunc redirects to the OIDC provider for user login.
func (a *Authenticator) LoginFunc(w http.ResponseWriter, r *http.Request) {
    var randData [4]byte
    if _, err := io.ReadFull(rand.Reader, randData[:]); err != nil {
        panic(err)
    }
    state := hex.EncodeToString(randData[:])

    cookie := http.Cookie{
        Name:     stateCookieName,
        Value:    state,
        HttpOnly: true,
        Secure:   a.secureCookies,
    }
    http.SetCookie(w, &cookie)
    http.Redirect(w, r, a.getOAuth2Config().AuthCodeURL(state), http.StatusSeeOther)
}

// vendor/golang.org/x/oauth2/oauth2.go
// Opts may include AccessTypeOnline or AccessTypeOffline, as well
// as ApprovalForce.
// It can also be used to pass the PKCE challenge.
// See https://www.oauth.com/oauth2-servers/pkce/ for more info.
func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string {
    var buf bytes.Buffer
    buf.WriteString(c.Endpoint.AuthURL)
    v := url.Values{
        "response_type": {"code"},
        "client_id":     {c.ClientID},
    }
    if c.RedirectURL != "" {
        v.Set("redirect_uri", c.RedirectURL)
    }
    if len(c.Scopes) > 0 {
        v.Set("scope", strings.Join(c.Scopes, " "))
    }
    if state != "" {
        // TODO(light): Docs say never to omit state; don't allow empty.
        v.Set("state", state)
    }
    for _, opt := range opts {
        opt.setValue(v)
    }
    if strings.Contains(c.Endpoint.AuthURL, "?") {
        buf.WriteByte('&')
    } else {
        buf.WriteByte('?')
    }
    buf.WriteString(v.Encode())
    return buf.String()
}

// CallbackFunc handles OAuth2 callbacks and code/token exchange.
// Requests with unexpected params are redirected to the root route.
func (a *Authenticator) CallbackFunc(fn func(loginInfo LoginJSON, successURL string, w http.ResponseWriter)) func(w http.ResponseWriter, r *http.Request) {
    return func(w http.ResponseWriter, r *http.Request) {
        q := r.URL.Query()
        qErr := q.Get("error")
        code := q.Get("code")
        urlState := q.Get("state")

        cookieState, err := r.Cookie(stateCookieName)
        if err != nil {
            log.Errorf("failed to parse state cookie: %v", err)
            a.redirectAuthError(w, errorMissingState, err)
            return
        }

        // Lack of both `error` and `code` indicates some other redirect with no params.
        if qErr == "" && code == "" {
            http.Redirect(w, r, a.errorURL, http.StatusSeeOther)
            return
        }

        if code == "" {
            log.Infof("missing auth code in query param")
            a.redirectAuthError(w, errorMissingCode, nil)
            return
        }

        if urlState != cookieState.Value {
            log.Errorf("State in url does not match State cookie")
            a.redirectAuthError(w, errorInvalidState, nil)
            return
        }
        ctx := oidc.ClientContext(context.TODO(), a.clientFunc())
        oauthConfig, lm := a.authFunc() // 需要查看 Authenticator 的定义
        token, err := oauthConfig.Exchange(ctx, code)
        if err != nil {
            log.Infof("unable to verify auth code with issuer: %v", err)
            a.redirectAuthError(w, errorInvalidCode, err)
            return
        }

        ls, err := lm.login(w, token)
        if err != nil {
            log.Errorf("error constructing login state: %v", err)
            a.redirectAuthError(w, errorInternal, nil)
            return
        }

        log.Infof("oauth success, redirecting to: %q", a.successURL)
        fn(ls.toLoginJSON(), a.successURL, w)
    }
}

// pkg/auth/auth.go
type Authenticator struct {
    authFunc func() (*oauth2.Config, loginMethod)

    clientFunc func() *http.Client

    // userFunc returns the User associated with the cookie from a request.
    // This is not part of loginMethod to avoid creating an unnecessary
    // HTTP client for every call.
    userFunc func(*http.Request) (*User, error)

    errorURL      string
    successURL    string
    cookiePath    string
    refererURL    *url.URL
    secureCookies bool
}

// pkg/auth/auth.go
func NewAuthenticator(ctx context.Context, c *Config) (*Authenticator, error) {
    // ...
    a.authFunc = func() (*oauth2.Config, loginMethod) {
        // rebuild non-pointer struct each time to prevent any mutation
        baseOAuth2Config := oauth2.Config{
            ClientID:     c.ClientID,
            ClientSecret: c.ClientSecret,
            RedirectURL:  c.RedirectURL,
            Scopes:       c.Scope,
            Endpoint:     fallbackEndpoint,
        }

        currentEndpoint, currentLoginMethod, errAuthSource := authSourceFunc()
        if errAuthSource != nil {
            log.Errorf("failed to get latest auth source data: %v", errAuthSource)
            return &baseOAuth2Config, fallbackLoginMethod
        }

        baseOAuth2Config.Endpoint = currentEndpoint
        return &baseOAuth2Config, currentLoginMethod
    }
}

// pkg/auth/auth.go
case AuthSourceOpenShift:
    a.userFunc = getOpenShiftUser
    authSourceFunc = func() (oauth2.Endpoint, loginMethod, error) {
        // Use the k8s CA for OAuth metadata discovery.
        // Don't include system roots when talking to the API server.
        k8sClient, errK8Client := newHTTPClient(c.K8sCA, false)
        if errK8Client != nil {
            return oauth2.Endpoint{}, nil, errK8Client
        }

        return newOpenShiftAuth(ctx, &openShiftConfig{
            k8sClient:     k8sClient,
            oauthClient:   a.clientFunc(),
            issuerURL:     c.IssuerURL,
            cookiePath:    c.CookiePath,
            secureCookies: c.SecureCookies,
        })
    }

// pkg/auth/auth_openshift.go
func newOpenShiftAuth(ctx context.Context, c *openShiftConfig) (oauth2.Endpoint, *openShiftAuth, error) {
    // Use metadata discovery to determine the OAuth2 token and authorization URL.
    // https://docs.openshift.com/container-platform/3.9/architecture/additional_concepts/authentication.html#oauth-server-metadata
    wellKnownURL := strings.TrimSuffix(c.issuerURL, "/") + "/.well-known/oauth-authorization-server"

    req, err := http.NewRequest(http.MethodGet, wellKnownURL, nil)
    if err != nil {
        return oauth2.Endpoint{}, nil, err
    }

    resp, err := c.k8sClient.Do(req.WithContext(ctx))
    if err != nil {
        return oauth2.Endpoint{}, nil, err
    }
    defer resp.Body.Close()

    if resp.StatusCode/100 != 2 {
        return oauth2.Endpoint{}, nil, fmt.Errorf("discovery through endpoint %s failed: %s",
            wellKnownURL, resp.Status)
    }

    var metadata struct {
        Issuer string `json:"issuer"`
        Auth   string `json:"authorization_endpoint"`
        Token  string `json:"token_endpoint"`
    }

    if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
        return oauth2.Endpoint{}, nil, fmt.Errorf("discovery through endpoint %s failed to decode body: %v",
            wellKnownURL, err)
    }

    if err := validateAbsURL(metadata.Issuer); err != nil {
        return oauth2.Endpoint{}, nil, err
    }

    if err := validateAbsURL(metadata.Auth); err != nil {
        return oauth2.Endpoint{}, nil, err
    }

    if err := validateAbsURL(metadata.Token); err != nil {
        return oauth2.Endpoint{}, nil, err
    }

    // Make sure we can talk to the issuer endpoint.
    req, err = http.NewRequest(http.MethodHead, metadata.Issuer, nil)
    if err != nil {
        return oauth2.Endpoint{}, nil, err
    }

    resp, err = c.oauthClient.Do(req.WithContext(ctx))
    if err != nil {
        return oauth2.Endpoint{}, nil, fmt.Errorf("request to OAuth issuer endpoint %s failed: %v",
            metadata.Token, err)
    }
    defer resp.Body.Close()

    // Special page on the integrated OAuth server for requesting a token.
    // TODO: We will need to implement this directly console to support external OAuth servers.
    requestTokenURL := proxy.SingleJoiningSlash(metadata.Token, "/request")
    kubeAdminLogoutURL := proxy.SingleJoiningSlash(metadata.Issuer, "/logout")
    return oauth2.Endpoint{
            AuthURL:  metadata.Auth,
            TokenURL: metadata.Token,
        }, &openShiftAuth{
            c.cookiePath,
            c.secureCookies,
            SpecialAuthURLs{
                requestTokenURL,
                kubeAdminLogoutURL,
            },
        }, nil
}

// pkg/auth/auth.go
token, err := oauthConfig.Exchange(ctx, code)
if err != nil {
    log.Infof("unable to verify auth code with issuer: %v", err)
    a.redirectAuthError(w, errorInvalidCode, err)
    return
}

ls, err := lm.login(w, token)
if err != nil {
    log.Errorf("error constructing login state: %v", err)
    a.redirectAuthError(w, errorInternal, nil)
    return
}

// pkg/auth/auth_openshift.go
func (o *openShiftAuth) login(w http.ResponseWriter, token *oauth2.Token) (*loginState, error) {
    if token.AccessToken == "" {
        return nil, fmt.Errorf("token response did not contain an access token %#v", token)
    }
    ls := &loginState{
        // Not clear if there's another way to fill in information like the user's name.
        rawToken: token.AccessToken,
    }

    expiresIn := (time.Hour * 24).Seconds()
    if !token.Expiry.IsZero() {
        expiresIn = token.Expiry.Sub(time.Now()).Seconds()
    }

    // NOTE: In Tectonic, we previously had issues with tokens being bigger than
    // cookies can handle. Since OpenShift doesn't store groups in the token, the
    // token can't grow arbitrarily big, so we assume it will always fit in a cookie
    // value.
    //
    // NOTE: in the future we'll have to avoid the use of cookies. This should likely switch to frontend
    // only logic using the OAuth2 implicit flow.
    // https://tools.ietf.org/html/rfc6749#section-4.2
    cookie := http.Cookie{
        Name:     openshiftSessionCookieName,
        Value:    ls.rawToken,
        MaxAge:   int(expiresIn),
        HttpOnly: true,
        Path:     o.cookiePath,
        Secure:   o.secureCookies,
    }

    http.SetCookie(w, &cookie)
    return ls, nil
}