Skip to content

Commit 9eeeef8

Browse files
andrewheberleandrewheberle
committed
Initial version
0 parents  commit 9eeeef8

File tree

10 files changed

+1113
-0
lines changed

10 files changed

+1113
-0
lines changed

‎.dockerignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
*.exe
2+
Dockerfile
3+
*.crt
4+
*.key

‎.github/dependabot.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "gomod"
9+
directory: "/"
10+
schedule:
11+
interval: "weekly"
12+
- package-ecosystem: "docker"
13+
directory: "/"
14+
schedule:
15+
interval: "weekly"

‎.github/workflows/docker-image.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Docker Image CI
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
9+
jobs:
10+
11+
build:
12+
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- uses: actions/checkout@v3
17+
- name: Build the Docker image
18+
run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)

‎.github/workflows/docker-publish.yml

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Docker
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
schedule:
10+
- cron: '27 23 * * *'
11+
push:
12+
branches: [ "main" ]
13+
# Publish semver tags as releases.
14+
tags: [ 'v*.*.*' ]
15+
pull_request:
16+
branches: [ "main" ]
17+
18+
env:
19+
# Use docker.io for Docker Hub if empty
20+
REGISTRY: ghcr.io
21+
# github.repository as <account>/<repo>
22+
IMAGE_NAME: ${{ github.repository }}
23+
24+
25+
jobs:
26+
build:
27+
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
packages: write
32+
# This is used to complete the identity challenge
33+
# with sigstore/fulcio when running outside of PRs.
34+
id-token: write
35+
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v3
39+
40+
# Install the cosign tool except on PR
41+
# https://github.com/sigstore/cosign-installer
42+
- name: Install cosign
43+
if: github.event_name != 'pull_request'
44+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
45+
with:
46+
cosign-release: 'v2.1.1'
47+
48+
# Set up BuildKit Docker container builder to be able to build
49+
# multi-platform images and export cache
50+
# https://github.com/docker/setup-buildx-action
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
53+
54+
# Login against a Docker registry except on PR
55+
# https://github.com/docker/#-action
56+
- name: Log into registry ${{ env.REGISTRY }}
57+
if: github.event_name != 'pull_request'
58+
uses: docker/#-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
59+
with:
60+
registry: ${{ env.REGISTRY }}
61+
username: ${{ github.actor }}
62+
password: ${{ secrets.GITHUB_TOKEN }}
63+
64+
# Extract metadata (tags, labels) for Docker
65+
# https://github.com/docker/metadata-action
66+
- name: Extract Docker metadata
67+
id: meta
68+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
69+
with:
70+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
71+
72+
# Build and push Docker image with Buildx (don't push on PR)
73+
# https://github.com/docker/build-push-action
74+
- name: Build and push Docker image
75+
id: build-and-push
76+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
77+
with:
78+
context: .
79+
push: ${{ github.event_name != 'pull_request' }}
80+
tags: ${{ steps.meta.outputs.tags }}
81+
labels: ${{ steps.meta.outputs.labels }}
82+
cache-from: type=gha
83+
cache-to: type=gha,mode=max
84+
85+
# Sign the resulting Docker image digest except on PRs.
86+
# This will only write to the public Rekor transparency log when the Docker
87+
# repository is public to avoid leaking data. If you would like to publish
88+
# transparency data even for private images, pass --force to cosign below.
89+
# https://github.com/sigstore/cosign
90+
- name: Sign the published Docker image
91+
if: ${{ github.event_name != 'pull_request' }}
92+
env:
93+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
94+
TAGS: ${{ steps.meta.outputs.tags }}
95+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
96+
# This step uses the identity token to provision an ephemeral certificate
97+
# against the sigstore community Fulcio instance.
98+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*.exe
2+
*.crt
3+
*.key

‎Dockerfile

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM golang:1.21@sha256:9baee0edab4139ae9b108fffabb8e2e98a67f0b259fd25283c2a084bd74fea0d AS builder
2+
3+
COPY . /build
4+
5+
RUN cd /build && \
6+
go build ./cmd/http-auth-server
7+
8+
FROM gcr.io/distroless/base-debian12:nonroot@sha256:5a779e9c2635dbea68ae7988f398f95686ccde186cd2abf51207e41ed2ec51f4
9+
10+
COPY --from=builder /build/http-auth-server /app/http-auth-server
11+
12+
ENV AUTH_LISTEN=":9091"
13+
14+
ENTRYPOINT [ "/app/http-auth-server" ]

‎cmd/http-auth-server/main.go

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
package main
2+
3+
import (
4+
"log/slog"
5+
"net/http"
6+
"net/url"
7+
"os"
8+
"time"
9+
10+
"github.com/andrewheberle/go-http-auth-server/pkg/sp"
11+
"github.com/spf13/pflag"
12+
"github.com/spf13/viper"
13+
)
14+
15+
func main() {
16+
// command line flags
17+
pflag.String("cert", "", "HTTPS Certificate")
18+
pflag.String("key", "", "HTTPS Key")
19+
pflag.String("listen", "127.0.0.1:9091", "Listen address")
20+
pflag.String("sp-cert", "", "Service Provider Certificate")
21+
pflag.String("sp-key", "", "Service Provider Key")
22+
pflag.String("sp-url", "http://localhost:9091", "Service Provider URL")
23+
pflag.StringToString("sp-claim-mapping", map[string]string{"urn:oasis:names:tc:SAML:attribute:subject-id": "remote-user", "mail": "remote-email", "displayName": "remote-name", "role": "remote-groups"}, "Mapping of claims to headers")
24+
pflag.String("metadata", "", "IdP Metadata URL")
25+
pflag.Bool("debug", false, "Enable debug logging")
26+
pflag.Parse()
27+
28+
// bind to viper
29+
viper.BindPFlags(pflag.CommandLine)
30+
31+
// load from environment
32+
viper.SetEnvPrefix("auth")
33+
viper.AutomaticEnv()
34+
35+
// logging setup
36+
var logLevel = new(slog.LevelVar)
37+
logHandler := slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: logLevel})
38+
slog.SetDefault(slog.New(logHandler))
39+
if viper.GetBool("debug") {
40+
logLevel.Set(slog.LevelDebug)
41+
}
42+
43+
// validate service provider root url
44+
root, err := url.Parse(viper.GetString("sp-url"))
45+
if err != nil {
46+
slog.Error("problem with SP URL", err)
47+
os.Exit(1)
48+
}
49+
50+
// validate metadata url
51+
metadata, err := url.Parse(viper.GetString("metadata"))
52+
if err != nil {
53+
slog.Error("problem with IdP metadata URL", err)
54+
os.Exit(1)
55+
}
56+
57+
// set up auth provider
58+
provider, err := sp.NewServiceProvider(viper.GetString("sp-cert"), viper.GetString("sp-key"), metadata, root, viper.GetStringMapString("sp-claim-mapping"))
59+
if err != nil {
60+
slog.Error("problem setting up SP", err)
61+
os.Exit(1)
62+
}
63+
64+
// set up auth endpoints
65+
http.HandleFunc("/api/verify", provider.ForwardAuthHandler)
66+
http.HandleFunc("/api/authz/forward-auth", provider.ForwardAuthHandler)
67+
68+
// set up saml endpoints
69+
http.HandleFunc(provider.AcsURL().Path, provider.ACSHandler)
70+
http.HandleFunc(provider.MetadataURL().Path, provider.MetadataHandler)
71+
http.HandleFunc(provider.LogoutUrl().Path, provider.LogoutHandler)
72+
73+
// login endpoint
74+
http.Handle("/#", provider.RequireAccount(http.HandlerFunc((func(w http.ResponseWriter, r *http.Request) {
75+
w.Write([]byte("Logged In."))
76+
}))))
77+
78+
// dummy endpoint
79+
80+
srv := &http.Server{
81+
Addr: viper.GetString("listen"),
82+
ReadTimeout: time.Second * 3,
83+
WriteTimeout: time.Second * 3,
84+
}
85+
86+
slog.Info("starting service",
87+
"listen", srv.Addr,
88+
"idp-metadata-url", metadata.String(),
89+
"sp-acs-url", provider.AcsURL().String(),
90+
"sp-metdata-url", provider.MetadataURL().String(),
91+
"sp-logout-url", provider.LogoutUrl().String(),
92+
)
93+
94+
if err := srv.ListenAndServe(); err != nil {
95+
slog.Error("problem with SP URL", err)
96+
os.Exit(1)
97+
}
98+
}

‎go.mod

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
module github.com/andrewheberle/go-http-auth-server
2+
3+
go 1.21.4
4+
5+
require (
6+
github.com/crewjam/saml v0.4.14
7+
github.com/spf13/pflag v1.0.5
8+
github.com/spf13/viper v1.17.0
9+
)
10+
11+
require (
12+
github.com/beevik/etree v1.1.0 // indirect
13+
github.com/crewjam/httperr v0.2.0 // indirect
14+
github.com/fsnotify/fsnotify v1.6.0 // indirect
15+
github.com/golang-jwt/jwt/v4 v4.4.3 // indirect
16+
github.com/hashicorp/hcl v1.0.0 // indirect
17+
github.com/jonboulle/clockwork v0.2.2 // indirect
18+
github.com/magiconair/properties v1.8.7 // indirect
19+
github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
20+
github.com/mitchellh/mapstructure v1.5.0 // indirect
21+
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
22+
github.com/pkg/errors v0.9.1 // indirect
23+
github.com/russellhaering/goxmldsig v1.3.0 // indirect
24+
github.com/sagikazarmark/locafero v0.3.0 // indirect
25+
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
26+
github.com/sourcegraph/conc v0.3.0 // indirect
27+
github.com/spf13/afero v1.10.0 // indirect
28+
github.com/spf13/cast v1.5.1 // indirect
29+
github.com/subosito/gotenv v1.6.0 // indirect
30+
go.uber.org/atomic v1.9.0 // indirect
31+
go.uber.org/multierr v1.9.0 // indirect
32+
golang.org/x/crypto v0.14.0 // indirect
33+
golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
34+
golang.org/x/sys v0.13.0 // indirect
35+
golang.org/x/text v0.13.0 // indirect
36+
gopkg.in/ini.v1 v1.67.0 // indirect
37+
gopkg.in/yaml.v3 v3.0.1 // indirect
38+
)

0 commit comments

Comments
 (0)