Improve the metrics for the proxy service.
* extend the instrumenter middleware to add a label with the name of
the service the request is being dispatched to
* add a native Prometheus histogram that tracks the durations and also
includes a label for the name of the service the request is being
dispatched to, as well as a 'result' label ('success',
'client-error', 'server-error') based on the HTTP status code of the
response
* add per-service gauge functions to count the number of in-flight
requests
* add a counter for routing failures, for when an inbound request
cannot be mapped to a route
* extend the route.RoutingInfo struct with a service attribute, and a
Service() getter
* remove the 'routing_failure_count' metric, as it is redundant
When the tenant id coming in via the OIDC claims doesn't match the
tenant id on the provisioned user, a mapping can be configured and
resolved via the reva TenantAPI service (now started as part of the
"users" service).
Closes: #2310
When multi-tenancy is enable we now allow to specify an OIDC claim
against which the tenantid of the user resolved via CS3 apis is matched.
Partial: #2310
This is required for allowing the web office to download images to
insert into documents.
The secret is generated by `opencloud init` and the server refuses
to start now without a secret being set. (Breaking Change)
Also the setting is now moved to the shared options as all involved
services need the same secret to work properly.
Related: https://github.com/opencloud-eu/web/issues/704
With the ocdav service being able to provided signed download URLs we
need the proxy to be able to verify the signatures.
This should also be a first step towards phasing out the weird ocs based
client side signed urls.
Related Tickets: #1104
When successfully authenticating a user via apptoken, resolve the user's
roles and add the user and the token returned by the auth service to the
request context. Rely on the account_resolve middleware to add the reva
token to the outgoing request as the other auth middlewares do.
Every time the OIDC middleware sees a new access token (i.e when it needs
to update the userinfo cache) we consider that as a new login. In this case
the middleware add a new flag to the context, which is then used by the
accountresolver middleware to publish a UserSignedIn event.
The event needs to be sent by the accountresolver middleware, because only
at that point we know the user id of the user that just logged in.
(It would probably makes sense to merge the auth and account middleware into a
single component to avoid passing flags around via context)
Pascal Bleser