X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/654560f15c684635f2331363f04ad4cb3e9663d6..11f4d90ff07de3557a86d78cb8623ad059633d04:/lib/controller/federation.go diff --git a/lib/controller/federation.go b/lib/controller/federation.go index ed2eb31c78..e7d6e29b88 100644 --- a/lib/controller/federation.go +++ b/lib/controller/federation.go @@ -17,8 +17,9 @@ import ( "regexp" "strings" - "git.curoverse.com/arvados.git/sdk/go/arvados" - "git.curoverse.com/arvados.git/sdk/go/auth" + "git.arvados.org/arvados.git/sdk/go/arvados" + "git.arvados.org/arvados.git/sdk/go/auth" + "git.arvados.org/arvados.git/sdk/go/ctxlog" "github.com/jmcvetta/randutil" ) @@ -93,20 +94,12 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler { wfHandler := &genericFederatedRequestHandler{next, h, wfRe, nil} containersHandler := &genericFederatedRequestHandler{next, h, containersRe, nil} - containerRequestsHandler := &genericFederatedRequestHandler{next, h, containerRequestsRe, - []federatedRequestDelegate{remoteContainerRequestCreate}} - collectionsRequestsHandler := &genericFederatedRequestHandler{next, h, collectionsRe, - []federatedRequestDelegate{fetchRemoteCollectionByUUID, fetchRemoteCollectionByPDH}} linksRequestsHandler := &genericFederatedRequestHandler{next, h, linksRe, nil} mux.Handle("/arvados/v1/workflows", wfHandler) mux.Handle("/arvados/v1/workflows/", wfHandler) mux.Handle("/arvados/v1/containers", containersHandler) mux.Handle("/arvados/v1/containers/", containersHandler) - mux.Handle("/arvados/v1/container_requests", containerRequestsHandler) - mux.Handle("/arvados/v1/container_requests/", containerRequestsHandler) - mux.Handle("/arvados/v1/collections", collectionsRequestsHandler) - mux.Handle("/arvados/v1/collections/", collectionsRequestsHandler) mux.Handle("/arvados/v1/links", linksRequestsHandler) mux.Handle("/arvados/v1/links/", linksRequestsHandler) mux.Handle("/", next) @@ -128,8 +121,6 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler { mux.ServeHTTP(w, req) }) - - return mux } type CurrentUser struct { @@ -141,11 +132,20 @@ type CurrentUser struct { // checks it again api_client_authorizations table in the database, // and fills in the token scope and user UUID. Does not handle remote // tokens unless they are already in the database and not expired. -func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, error) { +// +// Return values are: +// +// nil, false, non-nil -- if there was an internal error +// +// nil, false, nil -- if the token is invalid +// +// non-nil, true, nil -- if the token is valid +func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, bool, error) { user := CurrentUser{Authorization: arvados.APIClientAuthorization{APIToken: token}} - db, err := h.db(req) + db, err := h.db(req.Context()) if err != nil { - return nil, err + ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): database error", token) + return nil, false, err } var uuid string @@ -156,22 +156,30 @@ func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUse } user.Authorization.APIToken = token var scopes string - err = db.QueryRowContext(req.Context(), `SELECT api_client_authorizations.uuid, api_client_authorizations.scopes, users.uuid FROM api_client_authorizations JOIN users on api_client_authorizations.user_id=users.id WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp) LIMIT 1`, token).Scan(&user.Authorization.UUID, &scopes, &user.UUID) - if err != nil { - return nil, err + err = db.QueryRowContext(req.Context(), `SELECT api_client_authorizations.uuid, api_client_authorizations.scopes, users.uuid FROM api_client_authorizations JOIN users on api_client_authorizations.user_id=users.id WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp AT TIME ZONE 'UTC') LIMIT 1`, token).Scan(&user.Authorization.UUID, &scopes, &user.UUID) + if err == sql.ErrNoRows { + ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): not found in database", token) + return nil, false, nil + } else if err != nil { + ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): database error", token) + return nil, false, err } if uuid != "" && user.Authorization.UUID != uuid { - return nil, fmt.Errorf("UUID embedded in v2 token did not match record") + // secret part matches, but UUID doesn't -- somewhat surprising + ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): secret part found, but with different UUID: %s", token, user.Authorization.UUID) + return nil, false, nil } err = json.Unmarshal([]byte(scopes), &user.Authorization.Scopes) if err != nil { - return nil, err + ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): error parsing scopes from db", token) + return nil, false, err } - return &user, nil + ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): ok", token) + return &user, true, nil } func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []string) (*arvados.APIClientAuthorization, error) { - db, err := h.db(req) + db, err := h.db(req.Context()) if err != nil { return nil, err } @@ -196,9 +204,9 @@ func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []st (uuid, api_token, expires_at, scopes, user_id, api_client_id, created_at, updated_at) -VALUES ($1, $2, CURRENT_TIMESTAMP + INTERVAL '2 weeks', $3, +VALUES ($1, $2, CURRENT_TIMESTAMP AT TIME ZONE 'UTC' + INTERVAL '2 weeks', $3, (SELECT id FROM users WHERE users.uuid=$4 LIMIT 1), -0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`, +0, CURRENT_TIMESTAMP AT TIME ZONE 'UTC', CURRENT_TIMESTAMP AT TIME ZONE 'UTC')`, uuid, token, string(scopesjson), userUUID) if err != nil { @@ -206,10 +214,9 @@ VALUES ($1, $2, CURRENT_TIMESTAMP + INTERVAL '2 weeks', $3, } return &arvados.APIClientAuthorization{ - UUID: uuid, - APIToken: token, - ExpiresAt: "", - Scopes: scopes}, nil + UUID: uuid, + APIToken: token, + Scopes: scopes}, nil } // Extract the auth token supplied in req, and replace it with a @@ -245,18 +252,21 @@ func (h *Handler) saltAuthToken(req *http.Request, remote string) (updatedReq *h return updatedReq, nil } + ctxlog.FromContext(req.Context()).Debugf("saltAuthToken: cluster %s token %s remote %s", h.Cluster.ClusterID, creds.Tokens[0], remote) token, err := auth.SaltToken(creds.Tokens[0], remote) - if err == auth.ErrObsoleteToken { - // If the token exists in our own database, salt it - // for the remote. Otherwise, assume it was issued by - // the remote, and pass it through unmodified. - currentUser, err := h.validateAPItoken(req, creds.Tokens[0]) - if err == sql.ErrNoRows { - // Not ours; pass through unmodified. - token = creds.Tokens[0] - } else if err != nil { + if err == auth.ErrObsoleteToken || err == auth.ErrTokenFormat { + // If the token exists in our own database for our own + // user, salt it for the remote. Otherwise, assume it + // was issued by the remote, and pass it through + // unmodified. + currentUser, ok, err := h.validateAPItoken(req, creds.Tokens[0]) + if err != nil { return nil, err + } else if !ok || strings.HasPrefix(currentUser.UUID, remote) { + // Unknown, or cached + belongs to remote; + // pass through unmodified. + token = creds.Tokens[0] } else { // Found; make V2 version and salt it. token, err = auth.SaltToken(currentUser.Authorization.TokenV2(), remote)