mirror/opencloud
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-05-06 07:03:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

MachineAuthAPIKey -> SystemUserAPIKey (#3672)

Browse Source 
* split machineauthapikey and systemuserapikey

Signed-off-by: jkoberg <jkoberg@owncloud.com>

* changelog

Signed-off-by: jkoberg <jkoberg@owncloud.com>

* specific errors and some reverts

Signed-off-by: jkoberg <jkoberg@owncloud.com>

* use correct machine auth api key

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
kobergj
2022-05-04 15:48:02 +02:00
committed by GitHub
parent 2bd63509e3
commit eb59d2291e
18 changed files with 61 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
changelog/unreleased/split-machineauth-and-systemuserauth.md Normal file
View File

@@ -0,0 +1,6 @@
Change: Split MachineAuth from SystemUser
We now have two different APIKeys: MachineAuth for the machine-auth service
and SystemUser for the system user used e.g. by settings service
https://github.com/owncloud/ocis/pull/3672

6
extensions/settings/pkg/config/config.go
View File

@@ -39,7 +39,7 @@ type Metadata struct {
GatewayAddress string `yaml:"gateway_addr" env:"STORAGE_GATEWAY_GRPC_ADDR"`
StorageAddress string `yaml:"storage_addr" env:"STORAGE_GRPC_ADDR"`
ServiceUserID string `yaml:"service_user_id" env:"METADATA_SERVICE_USER_UUID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"METADATA_SERVICE_USER_IDP"`
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY"`
ServiceUserID string `yaml:"service_user_id" env:"METADATA_SERVICE_USER_UUID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"METADATA_SERVICE_USER_IDP"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"OCIS_SYSTEM_USER_API_KEY"`
}

4
extensions/settings/pkg/config/defaults/defaultconfig.go
View File

@@ -89,8 +89,8 @@ func EnsureDefaults(cfg *config.Config) {
cfg.TokenManager = &config.TokenManager{}
}
if cfg.Metadata.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
cfg.Metadata.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
if cfg.Metadata.SystemUserAPIKey == "" && cfg.Commons != nil && cfg.Commons.SystemUserAPIKey != "" {
cfg.Metadata.SystemUserAPIKey = cfg.Commons.SystemUserAPIKey
}
if cfg.Metadata.ServiceUserID == "" && cfg.Commons != nil && cfg.Commons.SystemUserID != "" {

4
extensions/settings/pkg/config/parser/parse.go
View File

@@ -37,8 +37,8 @@ func Validate(cfg *config.Config) error {
return shared.MissingJWTTokenError(cfg.Service.Name)
}
if cfg.Metadata.MachineAuthAPIKey == "" {
return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
if cfg.Metadata.SystemUserAPIKey == "" {
return shared.MissingSystemUserApiKeyError(cfg.Service.Name)
}
if cfg.AdminUserID == "" {

2
extensions/settings/pkg/store/metadata/store.go
View File

@@ -84,7 +84,7 @@ func New(cfg *config.Config) settings.Manager {
// NewMetadataClient returns the MetadataClient
func NewMetadataClient(cfg config.Metadata) MetadataClient {
mdc, err := metadata.NewCS3Storage(cfg.GatewayAddress, cfg.StorageAddress, cfg.ServiceUserID, cfg.ServiceUserIDP, cfg.MachineAuthAPIKey)
mdc, err := metadata.NewCS3Storage(cfg.GatewayAddress, cfg.StorageAddress, cfg.ServiceUserID, cfg.ServiceUserIDP, cfg.SystemUserAPIKey)
if err != nil {
log.Fatal("error connecting to mdc:", err)
}

16
extensions/sharing/pkg/config/config.go
View File

@@ -94,10 +94,10 @@ type UserSharingOwnCloudSQLDriver struct {
}
type UserSharingCS3Driver struct {
ProviderAddr string `yaml:"provider_addr" env:"SHARING_USER_CS3_PROVIDER_ADDR"`
ServiceUserID string `yaml:"service_user_id" env:"SHARING_USER_CS3_SERVICE_USER_ID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"OCIS_URL;SHARING_USER_CS3_SERVICE_USER_IDP"`
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;SHARING_USER_CS3_MACHINE_AUTH_API_KEY"`
ProviderAddr string `yaml:"provider_addr" env:"SHARING_USER_CS3_PROVIDER_ADDR"`
ServiceUserID string `yaml:"service_user_id" env:"SHARING_USER_CS3_SERVICE_USER_ID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"OCIS_URL;SHARING_USER_CS3_SERVICE_USER_IDP"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"OCIS_SYSTEM_USER_API_KEY;SHARING_USER_CS3_SYSTEM_USER_API_KEY"`
}
type PublicSharingDrivers struct {
@@ -124,10 +124,10 @@ type PublicSharingSQLDriver struct {
}
type PublicSharingCS3Driver struct {
ProviderAddr string `yaml:"provider_addr" env:"SHARING_PUBLIC_CS3_PROVIDER_ADDR"`
ServiceUserID string `yaml:"service_user_id" env:"SHARING_PUBLIC_CS3_SERVICE_USER_ID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"OCIS_URL;SHARING_PUBLIC_CS3_SERVICE_USER_IDP"`
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;SHARING_PUBLIC_CS3_MACHINE_AUTH_API_KEY"`
ProviderAddr string `yaml:"provider_addr" env:"SHARING_PUBLIC_CS3_PROVIDER_ADDR"`
ServiceUserID string `yaml:"service_user_id" env:"SHARING_PUBLIC_CS3_SERVICE_USER_ID"`
ServiceUserIDP string `yaml:"service_user_idp" env:"OCIS_URL;SHARING_PUBLIC_CS3_SERVICE_USER_IDP"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"OCIS_SYSTEM_USER_API_KEY;SHARING_USER_CS3_SYSTEM_USER_API_KEY"`
}
type Events struct {

8
extensions/sharing/pkg/config/defaults/defaultconfig.go
View File

@@ -100,16 +100,16 @@ func EnsureDefaults(cfg *config.Config) {
cfg.TokenManager = &config.TokenManager{}
}
if cfg.UserSharingDrivers.CS3.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
cfg.UserSharingDrivers.CS3.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
if cfg.UserSharingDrivers.CS3.SystemUserAPIKey == "" && cfg.Commons != nil && cfg.Commons.SystemUserAPIKey != "" {
cfg.UserSharingDrivers.CS3.SystemUserAPIKey = cfg.Commons.SystemUserAPIKey
}
if cfg.UserSharingDrivers.CS3.ServiceUserID == "" && cfg.Commons != nil && cfg.Commons.SystemUserID != "" {
cfg.UserSharingDrivers.CS3.ServiceUserID = cfg.Commons.SystemUserID
}
if cfg.PublicSharingDrivers.CS3.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
cfg.PublicSharingDrivers.CS3.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
if cfg.PublicSharingDrivers.CS3.SystemUserAPIKey == "" && cfg.Commons != nil && cfg.Commons.SystemUserAPIKey != "" {
cfg.PublicSharingDrivers.CS3.SystemUserAPIKey = cfg.Commons.SystemUserAPIKey
}
if cfg.PublicSharingDrivers.CS3.ServiceUserID == "" && cfg.Commons != nil && cfg.Commons.SystemUserID != "" {

8
extensions/sharing/pkg/config/parser/parse.go
View File

@@ -38,16 +38,16 @@ func Validate(cfg *config.Config) error {
return shared.MissingJWTTokenError(cfg.Service.Name)
}
if cfg.PublicSharingDriver == "cs3" && cfg.PublicSharingDrivers.CS3.MachineAuthAPIKey == "" {
return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
if cfg.PublicSharingDriver == "cs3" && cfg.PublicSharingDrivers.CS3.SystemUserAPIKey == "" {
return shared.MissingSystemUserApiKeyError(cfg.Service.Name)
}
if cfg.PublicSharingDriver == "cs3" && cfg.PublicSharingDrivers.CS3.ServiceUserID == "" {
return shared.MissingSystemUserID(cfg.Service.Name)
}
if cfg.UserSharingDriver == "cs3" && cfg.UserSharingDrivers.CS3.MachineAuthAPIKey == "" {
return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
if cfg.UserSharingDriver == "cs3" && cfg.UserSharingDrivers.CS3.SystemUserAPIKey == "" {
return shared.MissingSystemUserApiKeyError(cfg.Service.Name)
}
if cfg.UserSharingDriver == "cs3" && cfg.UserSharingDrivers.CS3.ServiceUserID == "" {

4
extensions/sharing/pkg/revaconfig/config.go
View File

@@ -52,7 +52,7 @@ func SharingConfigFromStruct(cfg *config.Config) map[string]interface{} {
"provider_addr": cfg.UserSharingDrivers.CS3.ProviderAddr,
"service_user_id": cfg.UserSharingDrivers.CS3.ServiceUserID,
"service_user_idp": cfg.UserSharingDrivers.CS3.ServiceUserIDP,
"machine_auth_apikey": cfg.UserSharingDrivers.CS3.MachineAuthAPIKey,
"machine_auth_apikey": cfg.UserSharingDrivers.CS3.SystemUserAPIKey,
},
},
},
@@ -77,7 +77,7 @@ func SharingConfigFromStruct(cfg *config.Config) map[string]interface{} {
"provider_addr": cfg.PublicSharingDrivers.CS3.ProviderAddr,
"service_user_id": cfg.PublicSharingDrivers.CS3.ServiceUserID,
"service_user_idp": cfg.PublicSharingDrivers.CS3.ServiceUserIDP,
"machine_auth_apikey": cfg.PublicSharingDrivers.CS3.MachineAuthAPIKey,
"machine_auth_apikey": cfg.PublicSharingDrivers.CS3.SystemUserAPIKey,
},
},
},

8
extensions/storage-system/pkg/config/config.go
View File

@@ -16,10 +16,10 @@ type Config struct {
GRPC GRPCConfig `yaml:"grpc"`
HTTP HTTPConfig `yaml:"http"`
TokenManager *TokenManager `yaml:"token_manager"`
Reva *Reva `yaml:"reva"`
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"STORAGE_SYSTEM_MACHINE_AUTH_API_KEY"`
SystemUserID string `yaml:"system_user_id"`
TokenManager *TokenManager `yaml:"token_manager"`
Reva *Reva `yaml:"reva"`
SystemUserID string `yaml:"system_user_id"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"OCIS_SYSTEM_USER_API_KEY"`
SkipUserGroupsInToken bool `yaml:"skip_user_groups_in_token" env:"STORAGE_SYSTEM_SKIP_USER_GROUPS_IN_TOKEN"`

4
extensions/storage-system/pkg/config/defaults/defaultconfig.go
View File

@@ -89,8 +89,8 @@ func EnsureDefaults(cfg *config.Config) {
cfg.TokenManager = &config.TokenManager{}
}
if cfg.MachineAuthAPIKey == "" && cfg.Commons != nil && cfg.Commons.MachineAuthAPIKey != "" {
cfg.MachineAuthAPIKey = cfg.Commons.MachineAuthAPIKey
if cfg.SystemUserAPIKey == "" && cfg.Commons != nil && cfg.Commons.SystemUserAPIKey != "" {
cfg.SystemUserAPIKey = cfg.Commons.SystemUserAPIKey
}
if cfg.SystemUserID == "" && cfg.Commons != nil && cfg.Commons.SystemUserID != "" {

4
extensions/storage-system/pkg/config/parser/parse.go
View File

@@ -38,8 +38,8 @@ func Validate(cfg *config.Config) error {
return shared.MissingJWTTokenError(cfg.Service.Name)
}
if cfg.MachineAuthAPIKey == "" {
return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
if cfg.SystemUserAPIKey == "" {
return shared.MissingSystemUserApiKeyError(cfg.Service.Name)
}
if cfg.SystemUserID == "" {

2
extensions/storage-system/pkg/revaconfig/config.go
View File

@@ -67,7 +67,7 @@ func StorageSystemFromStruct(cfg *config.Config) map[string]interface{} {
"auth_manager": "machine",
"auth_managers": map[string]interface{}{
"machine": map[string]interface{}{
"api_key": cfg.MachineAuthAPIKey,
"api_key": cfg.SystemUserAPIKey,
"gateway_addr": cfg.GRPC.Addr,
},
},

1
ocis-pkg/config/config.go
View File

@@ -70,6 +70,7 @@ type Config struct {
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY"`
TransferSecret string `yaml:"transfer_secret" env:"STORAGE_TRANSFER_SECRET"`
SystemUserID string `yaml:"system_user_id" env:"OCIS_SYSTEM_USER_ID"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"OCIS_SYSTEM_USER_API_KEY"`
AdminUserID string `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID"`
Runtime Runtime `yaml:"runtime"`

4
ocis-pkg/config/parser/parse.go
View File

@@ -89,6 +89,10 @@ func EnsureCommons(cfg *config.Config) {
cfg.Commons.MachineAuthAPIKey = cfg.MachineAuthAPIKey
}
if cfg.SystemUserAPIKey != "" {
cfg.Commons.SystemUserAPIKey = cfg.SystemUserAPIKey
}
// copy transfer secret to the commons part if set
if cfg.TransferSecret != "" {
cfg.Commons.TransferSecret = cfg.TransferSecret

8
ocis-pkg/shared/errors.go
View File

@@ -14,6 +14,14 @@ func MissingMachineAuthApiKeyError(service string) error {
service, defaults.BaseConfigPath())
}
func MissingSystemUserApiKeyError(service string) error {
return fmt.Errorf("The SystemUser API key has not been configured for %s. "+
"Make sure your %s config contains the proper values "+
"(e.g. by running ocis init or setting it manually in "+
"the config/corresponding environment variable).",
service, defaults.BaseConfigPath())
}
func MissingJWTTokenError(service string) error {
return fmt.Errorf("jwt_secret has not been set properly in your config for %s. "+
"Make sure your %s config contains the proper values "+

1
ocis-pkg/shared/shared_types.go
View File

@@ -45,5 +45,6 @@ type Commons struct {
MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY"`
TransferSecret string `yaml:"transfer_secret,omitempty" env:"REVA_TRANSFER_SECRET"`
SystemUserID string `yaml:"system_user_id" env:"OCIS_SYSTEM_USER_ID"`
SystemUserAPIKey string `yaml:"system_user_api_key" env:"SYSTEM_USER_API_KEY"`
AdminUserID string `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID"`
}

6
ocis/pkg/init/init.go
View File

@@ -98,6 +98,7 @@ type ThumbNailExtension struct {
type OcisConfig struct {
TokenManager TokenManager `yaml:"token_manager"`
MachineAuthApiKey string `yaml:"machine_auth_api_key"`
SystemUserAPIKey string `yaml:"system_user_api_key"`
TransferSecret string `yaml:"transfer_secret"`
SystemUserID string `yaml:"system_user_id"`
AdminUserID string `yaml:"admin_user_id"`
@@ -193,6 +194,10 @@ func CreateConfig(insecure, forceOverwrite bool, configPath, adminPassword strin
if err != nil {
return fmt.Errorf("could not generate random password for machineauthsecret: %s", err)
}
systemUserApiKey, err := generators.GenerateRandomPassword(passwordLength)
if err != nil {
return fmt.Errorf("could not generate random system user API key: %s", err)
}
revaTransferSecret, err := generators.GenerateRandomPassword(passwordLength)
if err != nil {
return fmt.Errorf("could not generate random password for machineauthsecret: %s", err)
@@ -203,6 +208,7 @@ func CreateConfig(insecure, forceOverwrite bool, configPath, adminPassword strin
JWTSecret: tokenManagerJwtSecret,
},
MachineAuthApiKey: machineAuthApiKey,
SystemUserAPIKey: systemUserApiKey,
TransferSecret: revaTransferSecret,
SystemUserID: systemUserID,
AdminUserID: adminUserID,