security

package
v1.1.1-0...-66c8b0b Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 10, 2024 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	RoleUserManager       = "userManager"
	RoleCollectionManager = "collectionManager"
	RoleBackupDownloader  = "backupDownloader"
	RoleBackupUploader    = "backupUploader"

	// RoleUploadsAnytime allows uploading versions regardless of Backup Windows
	RoleUploadsAnytime = "uploadsAnytime"
	RoleSysAdmin       = "systemAdmin"
)
View Source 
const (
	ActionDownload      = "file.download"
	ActionUpload        = "file.upload"
	ActionUploadAnytime = "file.upload-anytime"
	ActionViewProfile   = "profile.view"
)
View Source 
const (
	IdentityKeyClaimIndex = "login"
	AccessKeyClaimIndex   = "accessKeyName"
	ScopeClaimIndex       = "operationsScope"
)
View Source 
const KindGrantedAccess = "grantedaccesses"

Variables

View Source 
var AllActions = []string{
	ActionDownload, ActionUpload, ActionUploadAnytime, ActionViewProfile,
}

Functions

func CanThoseRolesPerformAction 

func CanThoseRolesPerformAction(roles []string, action string) bool

CanThoseRolesPerformAction checks if any listed role is allowing to perform action

func CompareFastCryptoHash 

func CompareFastCryptoHash(plain string, hash string) bool

func ComparePassword 

func ComparePassword(password string, hash string) (bool, error)

ComparePassword is used to compare a user-inputted password to a hash to see if the password matches or not.

func CreateHashFromPassword 

func CreateHashFromPassword(password string) (string, error)

CreateHashFromPassword is used to generate a new password hash for storing and comparing at a later date.

func DecideCanDo 

func DecideCanDo(dr *DecisionRequest) bool

DecideCanDo is taking a decision if specific Action can be made on by Actor on a Subject

Logic:

  1. Subject defines who can access it and how

  2. There are SYSTEM-WIDE roles defined on the user that allows globally do everything

  3. User can generate a LIMITED SCOPE JWT token with /auth/login endpoint. This kind of token can define that in context of given Subject the roles should be limited to specific ones Important! Those roles cannot be higher than defined on the Subject or on the Actor in its profile

Cases: 

Has limited token: User generates JWT with "backupDownloader" role in context of "iwa-ait" collection.
                   So even if that User is a "collectionManager" for this collection, with that specific JWT token
                   its possible to only download backups.

func ExtractLoginFromJWT 

func ExtractLoginFromJWT(jwt string) (string, string)

ExtractLoginFromJWT returns username of a user that owns this token

func FillPasswordFromKindSecret 

func FillPasswordFromKindSecret(r config.ConfigurationProvider, ref *PasswordFromSecretRef, setterCallback func(secret string)) error

FillPasswordFromKindSecret is able to fill up object from a data retrieved from `kind: Secret` in Kubernetes

func GetRolesActions 

func GetRolesActions() map[string][]string

func GetRolesInheritance 

func GetRolesInheritance() map[string][]string

func HashJWT 

func HashJWT(jwt string) string

func HashSha256 

func HashSha256(input string) string

func InitializeModel 

func InitializeModel(db *gorm.DB) error

Types

type AccessControlList 

type AccessControlList []AccessControlObject

func (AccessControlList) IsPermitted 

func (acl AccessControlList) IsPermitted(name string, objType string, action string) bool

IsPermitted checks if given user is granted a role in this list

type AccessControlObject 

type AccessControlObject struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Roles Roles  `json:"roles"`
}

type Actor 

type Actor interface {
	IsInAccessKeyContext() bool
	GetAccessKeyRolesInContextOf(Subject) Roles
	GetRoles() Roles
	GetEmail() string
	GetName() string
	GetTypeName() string
	GetSessionLimitedOperationsScope() *SessionLimitedOperationsScope
}

type Argon2Config 

type Argon2Config struct {
	// contains filtered or unexported fields
}

func CreateDefaultPasswordConfig 

func CreateDefaultPasswordConfig() *Argon2Config

type DecisionRequest 

type DecisionRequest struct {
	Actor   Actor
	Subject Subject
	Action  string
}

type GrantedAccess 

type GrantedAccess struct {
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt gorm.DeletedAt `gorm:"index"`

	ID            string    `json:"id"            structs:"id" sql:"type:string;primary_key;default:uuid_generate_v4()"`
	ExpiresAt     time.Time `json:"expiresAt"     structs:"expiresAt"`
	Deactivated   bool      `json:"deactivated"   structs:"deactivated"`
	Description   string    `json:"description"   structs:"description"`
	RequesterIP   string    `json:"requesterIP"   structs:"requesterIP"`
	User          string    `json:"user"          structs:"user"`
	AccessKeyName string    `json:"accessKeyName" structs:"accessKeyName"`
}

GrantedAccess stores information about generated JWT tokens (successful logins to the system)

func NewGrantedAccess 

func NewGrantedAccess(jwt string, expiresAt time.Time, deactivated bool, description string, requesterIP string, username string, accessKeyName string) GrantedAccess

func (GrantedAccess) IsNotExpired 

func (ga GrantedAccess) IsNotExpired() bool

func (GrantedAccess) IsValid 

func (ga GrantedAccess) IsValid() bool

type GrantedAccessRepository 

type GrantedAccessRepository struct {
	// contains filtered or unexported fields
}

type PasswordFromSecretRef 

type PasswordFromSecretRef struct {
	Name  string `json:"name"`
	Entry string `json:"entry"`
}

PasswordFromSecretRef references passwords stored in ConfigMaps 

Name is the ConfigMap name
Entry is the key name in .data

type Roles 

type Roles []string

func (Roles) HasRole 

func (p Roles) HasRole(name string) bool

func (Roles) IsEmpty 

func (p Roles) IsEmpty() bool

type ScopedElement 

type ScopedElement struct {
	Type  string   `form:"type" json:"type" binding:"required"`
	Name  string   `form:"name" json:"name" binding:"required"`
	Roles []string `form:"roles" json:"roles" binding:"required"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func NewService 

func NewService(db *gorm.DB) Service

func (Service) GetAllGrantedAccessesForUserByUsername 

func (s Service) GetAllGrantedAccessesForUserByUsername(name string) []GrantedAccess

func (Service) GetGrantedAccessInformation 

func (s Service) GetGrantedAccessInformation(jwt string) (GrantedAccess, error)

func (Service) GetGrantedAccessInformationBySessionId 

func (s Service) GetGrantedAccessInformationBySessionId(sessionId string) (GrantedAccess, error)

func (Service) IsTokenStillValid 

func (s Service) IsTokenStillValid(jwt string) bool

func (Service) RevokeSessionByJWT 

func (s Service) RevokeSessionByJWT(jwt string) error

func (Service) RevokeSessionBySessionId 

func (s Service) RevokeSessionBySessionId(sessionId string) error

func (Service) StoreJWTAsGrantedAccess 

func (s Service) StoreJWTAsGrantedAccess(token string, expire time.Time, ip string, description string, username string, accessKeyName string) string

type SessionLimitedOperationsScope 

type SessionLimitedOperationsScope struct {
	Elements []ScopedElement `form:"elements" json:"elements"`
}

SessionLimitedOperationsScope allows to define additional limitations on the user's JWT token, so even if user has higher permissions we can limit those permissions per JWT token

func ExtractScopeFromString 

func ExtractScopeFromString(asJson string) (*SessionLimitedOperationsScope, error)

func ExtractSessionLimitedOperationsScopeFromJWT 

func ExtractSessionLimitedOperationsScopeFromJWT(jwt string) (*SessionLimitedOperationsScope, error)

type Subject 

type Subject interface {
	GetId() string
	GetTypeName() string
	GetAccessControlList() *AccessControlList
}

type UserIdentity 

type UserIdentity struct {
	Username      string
	AccessKeyName string
}

func NewUserIdentityFromString 

func NewUserIdentityFromString(login string) UserIdentity

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.