minor deployment fixes (3df76330) · Commits · MEC - Multi-access Edge Computing / ETSI MEC Sandbox

charts/meep-auth-svc/values.yaml

+7 −0

Original line number	Diff line number	Diff line
		@@ -61,8 +61,15 @@ ingress:
		- name: ''
		paths:
		- /auth
		# Deprecated endpoint support
		- /platform-ctrl/v1/authorize
		- /platform-ctrl/v1/login
		- /platform-ctrl/v1/logout
		- /platform-ctrl/v1/watchdog
		annotations:
		kubernetes.io/ingress.class: nginx
		nginx.ingress.kubernetes.io/configuration-snippet: \|
		rewrite ^/platform-ctrl(/\|$)(.*)$ /auth/$2 break;
		labels: {}
		tls:

config/permissions.yaml

+3 −3

Original line number	Diff line number	Diff line
		@@ -62,7 +62,7 @@ fileservers:
		# Grafana (3rd Party)
		#------------------------------
		- name: 'grafana'
		path: '/grafana/'
		path: '/grafana'
		mode: 'verify'
		roles:
		admin: 'allow'
		@@ -206,7 +206,7 @@ services:
		# Location Service (Sbox)
		#------------------------------
		- name: 'meep-loc-serv'
		path: '/location/v1'
		path: '/location/v2'
		sbox: true
		default:
		mode: 'allow'
		@@ -484,7 +484,7 @@ services:
		mode: 'verify'
		roles:
		admin: 'allow'
		user: 'block'
		user: 'allow'
		- name: 'CreateReplayFile'
		path: '/replay/{name}'
		method: 'POST'

go-apps/meep-auth-svc/server/auth-svc.go

+12 −20

Original line number	Diff line number	Diff line
		@@ -88,13 +88,13 @@ type Service struct {
		Name string `yaml:"name"`
		Path string `yaml:"path"`
		Sbox bool `yaml:"sbox"`
		Default *Permission `yaml:"default"`
		Endpoints []*Endpoint `yaml:"endpoints"`
		Default Permission `yaml:"default"`
		Endpoints []Endpoint `yaml:"endpoints"`
		}
		type PermissionsConfig struct {
		Default *Permission `yaml:"default"`
		Fileservers []*Fileserver `yaml:"fileservers"`
		Services []*Service `yaml:"services"`
		Default Permission `yaml:"default"`
		Fileservers []Fileserver `yaml:"fileservers"`
		Services []Service `yaml:"services"`
		}

		// Auth Service types
		@@ -300,7 +300,7 @@ func cachePermissions() {
		authSvc.cache.Default = &Permission{Mode: sm.ModeAllow}
		return
		}
		// log.Info(fmt.Sprintf("%+v\n", config))
		fmt.Printf("%+v\n", config)

		// Parse & cache permissions from config file
		// IMPORTANT NOTE: Order is important to prevent prefix matches from running first
		@@ -310,7 +310,7 @@ func cachePermissions() {
		}

		func cacheDefaultPermission(cfg *PermissionsConfig) {
		authSvc.cache.Default = cfg.Default
		authSvc.cache.Default = &cfg.Default
		if authSvc.cache.Default == nil {
		log.Warn("Failed to retrieve default permission")
		log.Warn("Granting full API access for all roles by default")
		@@ -354,13 +354,12 @@ func cacheServicePermissions(cfg *PermissionsConfig) {
		}
		routes = append(routes, route)
		}
		// fmt.Printf("%+v\n", svcMap)

		// Default service permissions
		// IMPORTANT NOTE: This prefix route must be added after the service endpoint routes
		var permission *Permission
		if svc.Default.Mode != "" {
		permission := new(Permission)
		permission = new(Permission)
		permission.Roles = make(map[string]string)
		permission.Mode = svc.Default.Mode
		for role, access := range svc.Default.Roles {
		@@ -540,8 +539,7 @@ func asAuthenticate(w http.ResponseWriter, r *http.Request) {
		if authSvc.router.Match(r, &match) {
		routeName := match.Route.GetName()
		sboxName = match.Vars["sbox"]

		log.Error("routeName: ", routeName, " sboxName: ", sboxName)
		log.Debug("routeName: ", routeName, " sboxName: ", sboxName)

		// Check service-specific routes
		if svcName != "" {
		@@ -606,12 +604,6 @@ func asAuthenticate(w http.ResponseWriter, r *http.Request) {
		// Allow request
		w.Header().Set("Content-Type", "application/json; charset=UTF-8")
		w.WriteHeader(http.StatusOK)

		// Invoke handler
		// handler.ServeHTTP(w, r)
		// handler(w, r)

		// authSvc.router.ServeHTTP(w, r)
		}

		func asAuthorize(w http.ResponseWriter, r *http.Request) {

go-packages/meep-sessions/session-mgr.go

+0 −60

Original line number	Diff line number	Diff line
		@@ -18,12 +18,9 @@ package sessions

		import (
		"errors"
		"net/http"
		"strings"
		"time"

		log "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-logger"
		"github.com/gorilla/mux"
		)

		type SessionTimeoutHandler func(*Session)
		@@ -78,63 +75,6 @@ func (sm SessionMgr) GetPermissionStore() PermissionStore {
		return sm.ps
		}

		// Authorizer - Authorization handler for API access
		func (sm *SessionMgr) Authorizer(inner http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

		// Get route access permissions
		permission, err := sm.ps.Get(sm.service, strings.ToLower(mux.CurrentRoute(r).GetName()))
		if err != nil \|\| permission == nil {
		permission, err = sm.ps.GetDefaultPermission()
		if err != nil \|\| permission == nil {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}
		}

		// Handle according to permission mode
		switch permission.Mode {
		case ModeBlock:
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		case ModeAllow:
		inner.ServeHTTP(w, r)
		return
		case ModeVerify:
		// Retrieve user session, if any
		session, err := sm.ss.Get(r)
		if err != nil \|\| session == nil {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}

		// Verify role permissions
		role := session.Role
		if role == "" {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}
		access := permission.RolePermissions[role]
		if access != AccessGranted {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}

		// For non-admin users, verify session sandbox matches service sandbox, if any
		if session.Role != RoleAdmin && sm.sboxName != "" && sm.sboxName != session.Sandbox {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}

		inner.ServeHTTP(w, r)
		return
		default:
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
		}
		})
		}

		// StartSessionWatchdog - Start Session Watchdog
		func (sm *SessionMgr) StartSessionWatchdog(handler SessionTimeoutHandler) error {
		// Validate input

js-packages/meep-auth-svc-client/package-lock.json

0 → 100644

+594 −0

File added.

Preview size limit exceeded, changes collapsed.