martino/uopi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added ldap and pam authentication

Browse Source
This commit is contained in:
Martino Ferrari
2026-06-23 17:59:40 +02:00
parent ac24011487
commit 11120bedca
36 changed files with 1935 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/server.go
+105 -10
View File
@@ -4,10 +4,12 @@ import (
"context"
"io/fs"
"log/slog"
"net"
"net/http"
"strings"
"time"
"github.com/jcmturner/gokrb5/v8/keytab"
"github.com/uopi/uopi/internal/access"
"github.com/uopi/uopi/internal/api"
"github.com/uopi/uopi/internal/audit"
@@ -23,18 +25,35 @@ import (
const apiPrefix = "/api/v1"
type Server struct {
httpServer *http.Server
log *slog.Logger
httpServer *http.Server
tlsCert string
tlsKey string
tlsRedirect string // plain-HTTP addr that 301-redirects to HTTPS; empty = off
log *slog.Logger
}
// New creates the HTTP server, registers all routes, and returns a ready-to-start Server.
// synth may be nil if the synthetic data source is not enabled.
func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Synthetic, store *storage.Store, cfgStore *confmgr.Store, policy *access.Policy, acl *panelacl.Store, ctrlLogic *controllogic.Store, ctrlEngine *controllogic.Engine, dialogs *DialogHub, debug *DebugHub, rec audit.Recorder, channelFinderURL, archiverURL, trustedUserHeader string, log *slog.Logger) *Server {
//
// basicAuthFn, when non-nil, enables built-in HTTP Basic authentication validated
// by that function (typically PAM): REST requests are challenged (401 Basic) and
// WebSocket upgrades validate proactively-resent credentials best-effort. It is
// mutually exclusive with Kerberos (krbKeytab). When tlsCert and tlsKey are both
// set the server serves HTTPS via ListenAndServeTLS.
func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Synthetic, store *storage.Store, cfgStore *confmgr.Store, policy *access.Policy, acl *panelacl.Store, ctrlLogic *controllogic.Store, ctrlEngine *controllogic.Engine, dialogs *DialogHub, debug *DebugHub, rec audit.Recorder, channelFinderURL, archiverURL, trustedUserHeader string, krbKeytab *keytab.Keytab, krbSPN string, basicAuthFn func(user, pass string) error, basicAuthRealm, tlsCert, tlsKey, tlsRedirect string, uiDefaultZoom float64, log *slog.Logger) *Server {
if rec == nil {
rec = audit.Nop()
}
mux := http.NewServeMux()
// When built-in authentication (Kerberos or Basic) is enabled but no external
// proxy header is configured, use an internal header to carry the validated
// username downstream.
userHeader := trustedUserHeader
if (krbKeytab != nil || basicAuthFn != nil) && userHeader == "" {
userHeader = internalUserHeader
}
// Health check
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
@@ -42,7 +61,7 @@ func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Syntheti
})
// WebSocket endpoint
mux.Handle("/ws", &wsHandler{broker: brk, log: log, userHeader: trustedUserHeader, policy: policy, audit: rec, dialogs: dialogs, debug: debug})
var wsHandlerH http.Handler = &wsHandler{broker: brk, log: log, userHeader: userHeader, policy: policy, audit: rec, dialogs: dialogs, debug: debug}
// Prometheus-format metrics
mux.HandleFunc("/metrics", metrics.Handler(brk.ActiveSubscriptions))
@@ -50,11 +69,37 @@ func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Syntheti
// REST API — registered on a dedicated mux so it can be wrapped with the
// access-control middleware (identity resolution + global level enforcement).
apiMux := http.NewServeMux()
api.New(brk, synth, store, cfgStore, policy, acl, ctrlLogic, ctrlEngine, rec, channelFinderURL, archiverURL, log).Register(apiMux, apiPrefix)
mux.Handle(apiPrefix+"/", accessMiddleware(policy, trustedUserHeader, apiMux))
api.New(brk, synth, store, cfgStore, policy, acl, ctrlLogic, ctrlEngine, rec, channelFinderURL, archiverURL, uiDefaultZoom, log).Register(apiMux, apiPrefix)
var apiHandler http.Handler = accessMiddleware(policy, userHeader, apiMux)
// Native SPNEGO/Kerberos authentication (optional). REST/page requests are
// challenged (401 Negotiate); WebSocket upgrades validate proactively-sent
// credentials best-effort. Both stash the validated username in userHeader.
var frontendHandler http.Handler = http.FileServerFS(webFS)
if krbKeytab != nil {
apiHandler = kerberosAuth(krbKeytab, krbSPN, userHeader, true, log, apiHandler)
wsHandlerH = kerberosAuth(krbKeytab, krbSPN, userHeader, false, log, wsHandlerH)
} else if basicAuthFn != nil {
// Built-in HTTP Basic authentication (validated by basicAuthFn, e.g. PAM).
// A shared positive-result cache spares a validation round-trip on every
// browser request. REST is challenged; WebSocket upgrades are best-effort.
cache := newCredCache(5 * time.Minute)
apiHandler = basicAuth(basicAuthFn, userHeader, basicAuthRealm, true, cache, log, apiHandler)
wsHandlerH = basicAuth(basicAuthFn, userHeader, basicAuthRealm, false, cache, log, wsHandlerH)
// Challenge the top-level page load too. Browsers only show the native
// Basic login dialog in response to a 401 on a navigation, not on the
// SPA's background fetch('/api/v1/me'); without this the user is never
// prompted and silently resolves to default_user. Once credentials are
// entered the browser caches them for the origin and resends them on
// every asset, API call and the WebSocket upgrade.
frontendHandler = basicAuth(basicAuthFn, userHeader, basicAuthRealm, true, cache, log, frontendHandler)
}
mux.Handle("/ws", wsHandlerH)
mux.Handle(apiPrefix+"/", apiHandler)
// Embedded frontend — must be last (catch-all)
mux.Handle("/", http.FileServerFS(webFS))
mux.Handle("/", frontendHandler)
return &Server{
httpServer: &http.Server{
@@ -64,7 +109,10 @@ func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Syntheti
WriteTimeout: 30 * time.Second,
IdleTimeout: 120 * time.Second,
},
log: log,
tlsCert: tlsCert,
tlsKey: tlsKey,
tlsRedirect: tlsRedirect,
log: log,
}
}
@@ -108,15 +156,40 @@ func accessMiddleware(policy *access.Policy, userHeader string, next http.Handle
// Start listens and serves until ctx is cancelled.
func (s *Server) Start(ctx context.Context) error {
s.log.Info("listening", "addr", s.httpServer.Addr)
tls := s.tlsCert != "" && s.tlsKey != ""
s.log.Info("listening", "addr", s.httpServer.Addr, "tls", tls)
errCh := make(chan error, 1)
go func() {
if err := s.httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
var err error
if tls {
err = s.httpServer.ListenAndServeTLS(s.tlsCert, s.tlsKey)
} else {
err = s.httpServer.ListenAndServe()
}
if err != nil && err != http.ErrServerClosed {
errCh <- err
}
}()
// Optional plain-HTTP redirector: upgrade http:// visitors to the HTTPS
// service instead of letting them hit the TLS port with a cleartext request.
var redirectSrv *http.Server
if tls && s.tlsRedirect != "" {
redirectSrv = &http.Server{
Addr: s.tlsRedirect,
Handler: httpsRedirectHandler(s.httpServer.Addr),
ReadTimeout: 10 * time.Second,
WriteTimeout: 10 * time.Second,
}
s.log.Info("http→https redirect listening", "addr", s.tlsRedirect)
go func() {
if err := redirectSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
errCh <- err
}
}()
}
select {
case err := <-errCh:
return err
@@ -124,6 +197,28 @@ func (s *Server) Start(ctx context.Context) error {
shutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
s.log.Info("shutting down")
if redirectSrv != nil {
_ = redirectSrv.Shutdown(shutCtx)
}
return s.httpServer.Shutdown(shutCtx)
}
}
// httpsRedirectHandler 301-redirects any plain-HTTP request to the HTTPS service.
// It preserves the requested hostname and path, swapping in the TLS listener's
// port (omitted when 443).
func httpsRedirectHandler(tlsAddr string) http.Handler {
_, tlsPort, _ := net.SplitHostPort(tlsAddr)
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
host := r.Host
if h, _, err := net.SplitHostPort(host); err == nil {
host = h
}
target := "https://" + host
if tlsPort != "" && tlsPort != "443" {
target += ":" + tlsPort
}
target += r.URL.RequestURI()
http.Redirect(w, r, target, http.StatusMovedPermanently)
})
}