Skip to content

Commit d2d08e8

Browse files
brett19brett19
committed
ING-1369: Implemented no-auth mode to enable user-level setups.
1 parent 7302a26 commit d2d08e8

5 files changed

Lines changed: 105 additions & 57 deletions

File tree

‎cmd/gateway/main.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ func init() {
7979
configFlags.String("cb-user", "Administrator", "the couchbase server username")
8080
configFlags.String("cb-pass", "password", "the couchbase server password")
8181
configFlags.Bool("cb-host-is-local", false, "specifies if the cb-host node is running locally")
82+
configFlags.Bool("single-user-auth", false, "enables single-user authenticating to GRPC and Data API")
8283
configFlags.String("bind-address", "0.0.0.0", "the local address to bind to")
8384
configFlags.Int("data-port", 18098, "the data port")
8485
configFlags.Int("dapi-port", -1, "the data api port")
@@ -252,6 +253,7 @@ type config struct {
252253
cbUser string
253254
cbPass string
254255
cbHostIsLocal bool
256+
singleUserAuth bool
255257
bindAddress string
256258
dataPort int
257259
webPort int
@@ -293,6 +295,7 @@ func readConfig(logger *zap.Logger) *config {
293295
cbUser: viper.GetString("cb-user"),
294296
cbPass: viper.GetString("cb-pass"),
295297
cbHostIsLocal: viper.GetBool("cb-host-is-local"),
298+
singleUserAuth: viper.GetBool("single-user-auth"),
296299
bindAddress: viper.GetString("bind-address"),
297300
dataPort: viper.GetInt("data-port"),
298301
webPort: viper.GetInt("web-port"),
@@ -333,6 +336,7 @@ func readConfig(logger *zap.Logger) *config {
333336
zap.String("cbUser", config.cbUser),
334337
// zap.String("cbPass", config.cbPass),
335338
zap.Bool("cbHostIsLocal", config.cbHostIsLocal),
339+
zap.Bool("singleUserAuth", config.singleUserAuth),
336340
zap.String("bindAddress", config.bindAddress),
337341
zap.Int("dataPort", config.dataPort),
338342
zap.Int("webPort", config.webPort),
@@ -609,6 +613,7 @@ func startGateway() {
609613
Username: config.cbUser,
610614
Password: config.cbPass,
611615
BoostrapNodeIsLocal: config.cbHostIsLocal,
616+
SingleUserAuth: config.singleUserAuth,
612617
Daemon: daemon,
613618
Debug: config.debug,
614619
ProxyServices: strings.Split(config.dapiProxyServices, ","),
@@ -649,8 +654,9 @@ func startGateway() {
649654

650655
if newConfig.cbHost != config.cbHost ||
651656
newConfig.cbUser != config.cbUser ||
652-
newConfig.cbPass != config.cbPass {
653-
logger.Warn("config changes for cbHost, cbUser, or cbPass require a restart")
657+
newConfig.cbPass != config.cbPass ||
658+
newConfig.singleUserAuth != config.singleUserAuth {
659+
logger.Warn("config changes for cbHost, cbUser, cbPass or singleUserAuth require a restart")
654660
}
655661

656662
if newConfig.bindAddress != config.bindAddress ||

‎gateway/auth/singleuserauthenticator.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package auth
2+
3+
import (
4+
"context"
5+
"crypto/tls"
6+
"errors"
7+
)
8+
9+
// We intentionally use an error for this case so that we only permit non-obo requests
10+
// to be produced if the caller is explicitly checking for this condition.
11+
var ErrSingleUserAuthValid = errors.New("single user authentication successful")
12+
13+
type SingleUserAuthenticator struct {
14+
Username string
15+
Password string
16+
}
17+
18+
func (a *SingleUserAuthenticator) ValidateUserForObo(ctx context.Context, user, pass string) (string, string, error) {
19+
if user == a.Username && pass == a.Password {
20+
return "", "", ErrSingleUserAuthValid
21+
}
22+
23+
return "", "", ErrInvalidCredentials
24+
}
25+
26+
func (a *SingleUserAuthenticator) ValidateConnStateForObo(ctx context.Context, connState *tls.ConnectionState) (string, string, error) {
27+
return "", "", ErrInvalidCertificate
28+
}

‎gateway/dapiimpl/server_v1/authhandler.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,10 @@ func (a AuthHandler) MaybeGetOboUserFromContext(ctx context.Context, authHdr *st
9696

9797
oboUser, oboDomain, err := a.Authenticator.ValidateUserForObo(ctx, username, password)
9898
if err != nil {
99+
if errors.Is(err, auth.ErrSingleUserAuthValid) {
100+
return "", "", nil
101+
}
102+
99103
if errors.Is(err, auth.ErrInvalidCredentials) {
100104
return "", "", a.ErrorHandler.NewInvalidCredentialsStatus()
101105
}
@@ -113,10 +117,6 @@ func (a AuthHandler) GetOboUserFromRequest(ctx context.Context, authHdr *string)
113117
return "", "", st
114118
}
115119

116-
if user == "" {
117-
return "", "", a.ErrorHandler.NewNoAuthStatus()
118-
}
119-
120120
return user, domain, nil
121121
}
122122

‎gateway/dataimpl/server_v1/authhandler.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ func (a AuthHandler) MaybeGetOboUserFromContext(ctx context.Context) (string, st
9999

100100
oboUser, oboDomain, err := a.Authenticator.ValidateUserForObo(ctx, username, password)
101101
if err != nil {
102+
if errors.Is(err, auth.ErrSingleUserAuthValid) {
103+
return "", "", nil
104+
}
105+
102106
if errors.Is(err, auth.ErrInvalidCredentials) {
103107
return "", "", a.ErrorHandler.NewInvalidCredentialsStatus()
104108
}
@@ -116,10 +120,6 @@ func (a AuthHandler) GetOboUserFromContext(ctx context.Context) (string, string,
116120
return "", "", st
117121
}
118122

119-
if user == "" {
120-
return "", "", a.ErrorHandler.NewNoAuthStatus()
121-
}
122-
123123
return user, domain, nil
124124
}
125125

‎gateway/gateway.go‎

Lines changed: 61 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ type Config struct {
5858
BoostrapNodeIsLocal bool
5959
Username string
6060
Password string
61+
SingleUserAuth bool
6162

6263
BindAddress string
6364
BindDataPort int
@@ -273,20 +274,31 @@ func (g *Gateway) Run(ctx context.Context) error {
273274
}
274275

275276
// initialize cb-auth
276-
authenticator, err := auth.NewCbAuthAuthenticator(ctx, auth.NewCbAuthAuthenticatorOptions{
277-
NodeId: nodeID,
278-
Addresses: []string{authHostPort},
279-
Username: config.Username,
280-
Password: config.Password,
281-
ClusterUUID: clusterUUID,
282-
Logger: config.Logger.Named("cbauth"),
283-
})
284-
if err != nil {
285-
config.Logger.Error("failed to initialize cbauth connection",
286-
zap.Error(err),
287-
zap.String("hostPort", authHostPort),
288-
zap.String("user", config.Username))
289-
return err
277+
var cbAuthAuthenticator *auth.CbAuthAuthenticator
278+
var authenticator auth.Authenticator
279+
if !config.SingleUserAuth {
280+
cbAuthAuthenticator, err = auth.NewCbAuthAuthenticator(ctx, auth.NewCbAuthAuthenticatorOptions{
281+
NodeId: nodeID,
282+
Addresses: []string{authHostPort},
283+
Username: config.Username,
284+
Password: config.Password,
285+
ClusterUUID: clusterUUID,
286+
Logger: config.Logger.Named("cbauth"),
287+
})
288+
if err != nil {
289+
config.Logger.Error("failed to initialize cbauth connection",
290+
zap.Error(err),
291+
zap.String("hostPort", authHostPort),
292+
zap.String("user", config.Username))
293+
return err
294+
}
295+
296+
authenticator = cbAuthAuthenticator
297+
} else {
298+
authenticator = &auth.SingleUserAuthenticator{
299+
Username: config.Username,
300+
Password: config.Password,
301+
}
290302
}
291303

292304
// try to establish a client connection to the cluster
@@ -319,45 +331,47 @@ func (g *Gateway) Run(ctx context.Context) error {
319331
proxyServices = append(proxyServices, proxy.ServiceType(serviceName))
320332
}
321333

322-
go func() {
323-
watchCh := agentMgr.WatchConfig(context.Background())
324-
runLoop:
325-
for {
326-
select {
327-
case <-g.shutdownSig:
328-
break runLoop
329-
case cfg := <-watchCh:
330-
if cfg == nil {
331-
continue
332-
}
334+
if cbAuthAuthenticator != nil {
335+
go func() {
336+
watchCh := agentMgr.WatchConfig(context.Background())
337+
runLoop:
338+
for {
339+
select {
340+
case <-g.shutdownSig:
341+
break runLoop
342+
case cfg := <-watchCh:
343+
if cfg == nil {
344+
continue
345+
}
333346

334-
mgmtEndpointsList := make([]string, 0, len(cfg.Nodes))
335-
for _, node := range cfg.Nodes {
336-
if node.Addresses.NonSSLPorts.Mgmt > 0 {
337-
mgmtEndpointsList = append(mgmtEndpointsList,
338-
fmt.Sprintf("%s:%d", node.Addresses.Hostname, node.Addresses.NonSSLPorts.Mgmt))
347+
mgmtEndpointsList := make([]string, 0, len(cfg.Nodes))
348+
for _, node := range cfg.Nodes {
349+
if node.Addresses.NonSSLPorts.Mgmt > 0 {
350+
mgmtEndpointsList = append(mgmtEndpointsList,
351+
fmt.Sprintf("%s:%d", node.Addresses.Hostname, node.Addresses.NonSSLPorts.Mgmt))
352+
}
339353
}
340-
}
341354

342-
err := authenticator.Reconfigure(auth.CbAuthAuthenticatorReconfigureOptions{
343-
Addresses: mgmtEndpointsList,
344-
Username: config.Username,
345-
Password: config.Password,
346-
ClusterUUID: clusterUUID,
347-
})
348-
if err != nil {
349-
config.Logger.Warn("failed to reconfigure cbauth",
350-
zap.Error(err))
355+
err := cbAuthAuthenticator.Reconfigure(auth.CbAuthAuthenticatorReconfigureOptions{
356+
Addresses: mgmtEndpointsList,
357+
Username: config.Username,
358+
Password: config.Password,
359+
ClusterUUID: clusterUUID,
360+
})
361+
if err != nil {
362+
config.Logger.Warn("failed to reconfigure cbauth",
363+
zap.Error(err))
364+
}
351365
}
352366
}
353-
}
354367

355-
err := authenticator.Close()
356-
if err != nil {
357-
config.Logger.Warn("failed to shutdown cbauth",
358-
zap.Error(err))
359-
}
360-
}()
368+
err := cbAuthAuthenticator.Close()
369+
if err != nil {
370+
config.Logger.Warn("failed to shutdown cbauth",
371+
zap.Error(err))
372+
}
373+
}()
374+
}
361375

362376
startInstance := func(ctx context.Context, instanceIdx int) error {
363377
rateLimiter := ratelimiting.NewGlobalRateLimiter(uint64(config.RateLimit), time.Second)

0 commit comments

Comments
 (0)