test (b2a615f5) · Commits · tuxist / proxyplus

src/auth/AuthDBAdapter.cpp

+12 −2

Changes for src/auth/AuthDBAdapter.cpp: 12 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -38,11 +38,13 @@ bool bindServiceConnectionToSession(authdb::client::ClientConnection &con,
		AuthDBAdapter::AuthDBAdapter(std::string authdbUrl,
		std::string serviceClientName,
		std::string serviceClientSecret,
		IPermissionRegistry &registry)
		IPermissionRegistry &registry,
		bool tlsVerify)
		: _url(std::move(authdbUrl))
		, _serviceClientName(std::move(serviceClientName))
		, _serviceClientSecret(std::move(serviceClientSecret))
		, _registry(registry) {}
		, _registry(registry)
		, _tlsVerify(tlsVerify) {}

		AuthResult AuthDBAdapter::authenticatePassword(const std::string &username,
		const SecureString &password,
		@@ -50,6 +52,7 @@ AuthResult AuthDBAdapter::authenticatePassword(const std::string &username,
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		con.setUsername(username);
		con.setUserPassword(password.reveal());
		authdb::client::Client clt(con);
		@@ -99,6 +102,7 @@ AuthResult AuthDBAdapter::authenticateToken(const std::string &token,
		if (!sid.empty()) {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		authdb::client::Client clt(con);
		if (bindServiceConnectionToSession(con, clt, _serviceClientName,
		_serviceClientSecret, token)) {
		@@ -131,6 +135,7 @@ AuthResult AuthDBAdapter::authenticateToken(const std::string &token,
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		con.setClientName(token.substr(0, sep));
		con.setClientSecret(token.substr(sep + 1));
		authdb::client::Client clt(con);
		@@ -153,6 +158,7 @@ std::optional<User> AuthDBAdapter::getUser(const std::string &userId) {
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		authdb::client::Client clt(con);
		if (!bindServiceConnectionToSession(con, clt, _serviceClientName, _serviceClientSecret,
		"")) {
		@@ -184,6 +190,7 @@ std::vector<Role> AuthDBAdapter::getUserRoles(const std::string &sessionId) {
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		authdb::client::Client clt(con);
		if (!bindServiceConnectionToSession(con, clt, _serviceClientName, _serviceClientSecret,
		sessionId)) {
		@@ -223,6 +230,7 @@ bool AuthDBAdapter::hasPermission(const std::string &sessionId,
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		authdb::client::Client clt(con);
		if (!bindServiceConnectionToSession(con, clt, _serviceClientName, _serviceClientSecret,
		sessionId)) {
		@@ -248,6 +256,7 @@ void AuthDBAdapter::revokeSession(const std::string &sessionId) {
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		authdb::client::Client clt(con);
		if (bindServiceConnectionToSession(con, clt, _serviceClientName, _serviceClientSecret,
		sessionId)) {
		@@ -262,6 +271,7 @@ bool AuthDBAdapter::isReachable() {
		try {
		authdb::client::ClientConnection con;
		con.setUrl(_url);
		con.setTlsVerify(_tlsVerify);
		con.setClientName(_serviceClientName);
		con.setClientSecret(_serviceClientSecret);
		authdb::client::Client clt(con);

src/auth/AuthDBAdapter.h

+6 −1

Changes for src/auth/AuthDBAdapter.h: 6 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -21,10 +21,14 @@ public:
		// serviceClientName/serviceClientSecret is ProxyPlus's own authdb Client-Credential
		// (see scripts/authdb-bootstrap.sh) -- it is what lets ProxyPlus look up GPOs/sessions/
		// users on behalf of an already-authenticated caller without re-asking for a password.
		// tlsVerify=false skips hostname/CA-chain verification of authdb's TLS certificate --
		// needed when authdbUrl addresses authdb by bare IP (a cert SAN normally won't cover
		// that IP). Defaults to true, matching netplus::TlsTrustPolicy's secure-by-default.
		AuthDBAdapter(std::string authdbUrl,
		std::string serviceClientName,
		std::string serviceClientSecret,
		IPermissionRegistry &registry);
		IPermissionRegistry &registry,
		bool tlsVerify = true);

		AuthResult authenticatePassword(
		const std::string &username,
		@@ -55,6 +59,7 @@ private:
		std::string _serviceClientName;
		std::string _serviceClientSecret;
		IPermissionRegistry &_registry;
		bool _tlsVerify;
		};

		} // namespace proxyplus::auth

src/config/BootstrapConfig.cpp

+2 −0

Changes for src/config/BootstrapConfig.cpp: 2 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@ const std::set<std::string> &knownLeafPatterns() {
		"/proxyplus/node/mode",
		"/proxyplus/paths/data",
		"/proxyplus/paths/authdb",
		"/proxyplus/paths/authdb_tls_verify",
		"/proxyplus/paths/plugins",
		"/proxyplus/paths/queue",
		"/proxyplus/admin/listen",
		@@ -178,6 +179,7 @@ void BootstrapConfig::loadAndValidate() {

		cfg.dataPath = readValue(conf, "/proxyplus/paths/data", "");
		cfg.authdbPath = readValue(conf, "/proxyplus/paths/authdb", "");
		cfg.authdbTlsVerify = readBool(conf, "/proxyplus/paths/authdb_tls_verify", true);
		cfg.pluginsPath = readValue(conf, "/proxyplus/paths/plugins", "");
		cfg.queuePath = readValue(conf, "/proxyplus/paths/queue", "");

src/config/BootstrapConfig.h

+2 −0

Changes for src/config/BootstrapConfig.h: 2 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -28,6 +28,8 @@ struct AppConfig {

		std::string dataPath;
		std::string authdbPath; // authdb connection URL, see docs/ARCHITECTURE.md
		bool authdbTlsVerify = true; // false for an authdbPath addressed by bare IP, whose cert
		// SAN won't cover that IP (see AuthDBAdapter's tlsVerify)
		std::string pluginsPath;
		std::string queuePath;

src/main.cpp

+2 −1

Changes for src/main.cpp: 2 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -104,7 +104,8 @@ int main(int argc, char **argv) {

		auto [serviceClientName, serviceClientSecret] = readServiceCredential(cfg.dataPath);
		proxyplus::auth::AuthDBAdapter authService(cfg.authdbPath, serviceClientName,
		serviceClientSecret, configStore);
		serviceClientSecret, configStore,
		cfg.authdbTlsVerify);

		proxyplus::plugin::AuthServicePluginFacade authFacade(authService);
		proxyplus::plugin::PluginManager pluginManager(authFacade);