mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
110 lines
3.1 KiB
Go
110 lines
3.1 KiB
Go
// Package auth contains exported proxy auth values.
|
|
// These are used to ensure coherent usage across management and proxy implementations.
|
|
package auth
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/tls"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
type Method string
|
|
|
|
const (
|
|
MethodPassword Method = "password"
|
|
MethodPIN Method = "pin"
|
|
MethodOIDC Method = "oidc"
|
|
MethodHeader Method = "header"
|
|
)
|
|
|
|
func (m Method) String() string {
|
|
return string(m)
|
|
}
|
|
|
|
const (
|
|
SessionCookieName = "nb_session"
|
|
DefaultSessionExpiry = 24 * time.Hour
|
|
SessionJWTIssuer = "netbird-management"
|
|
)
|
|
|
|
const ClientIPMetadataKey = "nb-client-ip"
|
|
|
|
// ResolveProto determines the protocol scheme based on the forwarded proto
|
|
// configuration. When set to "http" or "https" the value is used directly.
|
|
// Otherwise TLS state is used: if conn is non-nil "https" is returned, else "http".
|
|
func ResolveProto(forwardedProto string, conn *tls.ConnectionState) string {
|
|
switch forwardedProto {
|
|
case "http", "https":
|
|
return forwardedProto
|
|
default:
|
|
if conn != nil {
|
|
return "https"
|
|
}
|
|
return "http"
|
|
}
|
|
}
|
|
|
|
// ValidateSessionJWT validates a session JWT and returns the user ID, the
|
|
// user's email (when carried), the authentication method, any embedded
|
|
// group memberships, and the parallel group display names. email,
|
|
// groups, and groupNames may be empty for tokens minted before those
|
|
// claims were introduced. groupNames pairs positionally with groups.
|
|
func ValidateSessionJWT(tokenString, domain string, publicKey ed25519.PublicKey) (userID, email, method string, groups, groupNames []string, err error) {
|
|
if publicKey == nil {
|
|
return "", "", "", nil, nil, fmt.Errorf("no public key configured for domain")
|
|
}
|
|
|
|
token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
|
|
if _, ok := t.Method.(*jwt.SigningMethodEd25519); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
|
|
}
|
|
return publicKey, nil
|
|
}, jwt.WithAudience(domain), jwt.WithIssuer(SessionJWTIssuer))
|
|
if err != nil {
|
|
return "", "", "", nil, nil, fmt.Errorf("parse token: %w", err)
|
|
}
|
|
|
|
claims, ok := token.Claims.(jwt.MapClaims)
|
|
if !ok || !token.Valid {
|
|
return "", "", "", nil, nil, fmt.Errorf("invalid token claims")
|
|
}
|
|
|
|
sub, _ := claims.GetSubject()
|
|
if sub == "" {
|
|
return "", "", "", nil, nil, fmt.Errorf("missing subject claim")
|
|
}
|
|
|
|
methodClaim, _ := claims["method"].(string)
|
|
emailClaim, _ := claims["email"].(string)
|
|
groups = extractGroupsClaim(claims["groups"])
|
|
groupNames = extractGroupsClaim(claims["group_names"])
|
|
|
|
return sub, emailClaim, methodClaim, groups, groupNames, nil
|
|
}
|
|
|
|
// extractGroupsClaim decodes the "groups" claim into a string slice. The JWT
|
|
// library decodes JSON arrays as []interface{}, so we coerce element-wise
|
|
// and skip non-string entries silently.
|
|
func extractGroupsClaim(claim interface{}) []string {
|
|
raw, ok := claim.([]interface{})
|
|
if !ok {
|
|
return nil
|
|
}
|
|
if len(raw) == 0 {
|
|
return nil
|
|
}
|
|
groups := make([]string, 0, len(raw))
|
|
for _, v := range raw {
|
|
if s, ok := v.(string); ok && s != "" {
|
|
groups = append(groups, s)
|
|
}
|
|
}
|
|
if len(groups) == 0 {
|
|
return nil
|
|
}
|
|
return groups
|
|
}
|