16306: Merge branch 'master'

[arvados.git] / lib / controller / localdb / login_oidc.go

diff --git a/lib/controller/localdb/login_oidc.go b/lib/controller/localdb/login_oidc.go
index b74d22f8ead979e09686856b6b053c7f3c9250f2..a5fe45181b3319c0b07b881f747719762dcabb8a 100644 (file)
--- a/lib/controller/localdb/login_oidc.go
+++ b/lib/controller/localdb/login_oidc.go
@@ -22,7 +22,6 @@ import (
        "time"
 
        "git.arvados.org/arvados.git/lib/controller/api"
-       "git.arvados.org/arvados.git/lib/controller/railsproxy"
        "git.arvados.org/arvados.git/lib/controller/rpc"
        "git.arvados.org/arvados.git/lib/ctrlctx"
        "git.arvados.org/arvados.git/sdk/go/arvados"
@@ -38,15 +37,16 @@ import (
        "google.golang.org/api/people/v1"
 )
 
-const (
+var (
        tokenCacheSize        = 1000
        tokenCacheNegativeTTL = time.Minute * 5
        tokenCacheTTL         = time.Minute * 10
+       tokenCacheRaceWindow  = time.Minute
 )
 
 type oidcLoginController struct {
        Cluster            *arvados.Cluster
-       RailsProxy         *railsProxy
+       Parent             *Conn
        Issuer             string // OIDC issuer URL, e.g., "https://accounts.google.com"
        ClientID           string
        ClientSecret       string
@@ -143,7 +143,7 @@ func (ctrl *oidcLoginController) Login(ctx context.Context, opts arvados.LoginOp
                return loginError(err)
        }
        ctxRoot := auth.NewContext(ctx, &auth.Credentials{Tokens: []string{ctrl.Cluster.SystemRootToken}})
-       return ctrl.RailsProxy.UserSessionCreate(ctxRoot, rpc.UserSessionCreateOptions{
+       return ctrl.Parent.UserSessionCreate(ctxRoot, rpc.UserSessionCreateOptions{
                ReturnTo: state.Remote + "," + state.ReturnTo,
                AuthInfo: *authinfo,
        })
@@ -322,7 +322,7 @@ func OIDCAccessTokenAuthorizer(cluster *arvados.Cluster, getdb func(context.Cont
        // We want ctrl to be nil if the chosen controller is not a
        // *oidcLoginController, so we can ignore the 2nd return value
        // of this type cast.
-       ctrl, _ := chooseLoginController(cluster, railsproxy.NewConn(cluster)).(*oidcLoginController)
+       ctrl, _ := NewConn(cluster).loginController.(*oidcLoginController)
        cache, err := lru.New2Q(tokenCacheSize)
        if err != nil {
                panic(err)
@@ -364,8 +364,9 @@ func (ta *oidcTokenAuthorizer) WrapCalls(origFunc api.RoutableFunc) api.Routable
                        return origFunc(ctx, opts)
                }
                // Check each token in the incoming request. If any
-               // are OAuth2 access tokens, swap them out for Arvados
-               // tokens.
+               // are valid OAuth2 access tokens, insert/update them
+               // in the database so RailsAPI's auth code accepts
+               // them.
                for _, tok := range creds.Tokens {
                        err = ta.registerToken(ctx, tok)
                        if err != nil {
@@ -380,7 +381,7 @@ func (ta *oidcTokenAuthorizer) WrapCalls(origFunc api.RoutableFunc) api.Routable
 // if so, ensures that an api_client_authorizations row exists so that
 // RailsAPI will accept it as an Arvados token.
 func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) error {
-       if strings.HasPrefix(tok, "v2/") {
+       if tok == ta.ctrl.Cluster.SystemRootToken || strings.HasPrefix(tok, "v2/") {
                return nil
        }
        if cached, hit := ta.cache.Get(tok); !hit {
@@ -390,12 +391,11 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
                // cached negative result (value is expiry time)
                if time.Now().Before(exp) {
                        return nil
-               } else {
-                       ta.cache.Remove(tok)
                }
+               ta.cache.Remove(tok)
        } else {
                // cached positive result
-               aca := cached.(*arvados.APIClientAuthorization)
+               aca := cached.(arvados.APIClientAuthorization)
                var expiring bool
                if aca.ExpiresAt != "" {
                        t, err := time.Parse(time.RFC3339Nano, aca.ExpiresAt)
@@ -465,7 +465,7 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
        // Expiry time for our token is one minute longer than our
        // cache TTL, so we don't pass it through to RailsAPI just as
        // it's expiring.
-       exp := time.Now().UTC().Add(tokenCacheTTL + time.Minute)
+       exp := time.Now().UTC().Add(tokenCacheTTL + tokenCacheRaceWindow)
 
        var aca arvados.APIClientAuthorization
        if updating {
@@ -475,7 +475,7 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
                }
                ctxlog.FromContext(ctx).WithField("HMAC", hmac).Debug("(*oidcTokenAuthorizer)registerToken: updated api_client_authorizations row")
        } else {
-               aca, err = createAPIClientAuthorization(ctx, ta.ctrl.RailsProxy, ta.ctrl.Cluster.SystemRootToken, *authinfo)
+               aca, err = ta.ctrl.Parent.CreateAPIClientAuthorization(ctx, ta.ctrl.Cluster.SystemRootToken, *authinfo)
                if err != nil {
                        return err
                }
@@ -490,6 +490,7 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
        if err != nil {
                return err
        }
+       aca.ExpiresAt = exp.Format(time.RFC3339Nano)
        ta.cache.Add(tok, aca)
        return nil
 }