mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
3c157713b3
Currently Docker authorization framework does not use any user information, which already available in the Docker context for TLS connection. The purpose of this CR is to complete the existing authz work by adding the basic client certificate details (SUBJECT_NAME) and authentication method (TLS) to the authz request. We think this should be the default behavior when no extended authorization module is specified (currently WIP under #20883). Signed-off-by: Liron Levin <liron@twistlock.com>
50 lines
1.6 KiB
Go
50 lines
1.6 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/Sirupsen/logrus"
|
|
"github.com/docker/docker/api/server/httputils"
|
|
"github.com/docker/docker/pkg/authorization"
|
|
"golang.org/x/net/context"
|
|
)
|
|
|
|
// NewAuthorizationMiddleware creates a new Authorization middleware.
|
|
func NewAuthorizationMiddleware(plugins []authorization.Plugin) Middleware {
|
|
return func(handler httputils.APIFunc) httputils.APIFunc {
|
|
return func(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {
|
|
|
|
user := ""
|
|
userAuthNMethod := ""
|
|
|
|
// Default authorization using existing TLS connection credentials
|
|
// FIXME: Non trivial authorization mechanisms (such as advanced certificate validations, kerberos support
|
|
// and ldap) will be extracted using AuthN feature, which is tracked under:
|
|
// https://github.com/docker/docker/pull/20883
|
|
if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
|
|
user = r.TLS.PeerCertificates[0].Subject.CommonName
|
|
userAuthNMethod = "TLS"
|
|
}
|
|
|
|
authCtx := authorization.NewCtx(plugins, user, userAuthNMethod, r.Method, r.RequestURI)
|
|
|
|
if err := authCtx.AuthZRequest(w, r); err != nil {
|
|
logrus.Errorf("AuthZRequest for %s %s returned error: %s", r.Method, r.RequestURI, err)
|
|
return err
|
|
}
|
|
|
|
rw := authorization.NewResponseModifier(w)
|
|
|
|
if err := handler(ctx, rw, r, vars); err != nil {
|
|
logrus.Errorf("Handler for %s %s returned error: %s", r.Method, r.RequestURI, err)
|
|
return err
|
|
}
|
|
|
|
if err := authCtx.AuthZResponse(rw, r); err != nil {
|
|
logrus.Errorf("AuthZResponse for %s %s returned error: %s", r.Method, r.RequestURI, err)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
}
|