github/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/ZeroTier/ZeroTierOne synced 2025-08-22 22:33:58 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

update central controller querries for upcoming oidc changes

Browse source
This commit is contained in:
Grant Limberg 2022-12-15 13:16:03 -08:00
commit 280acb4b76
No known key found for this signature in database
GPG key ID: 8F2F97D3BE8D7735
7 changed files with 63 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
controller/DB.hpp
View file

@ -53,6 +53,7 @@ public:
, ssoNonce()
, ssoState()
, ssoClientID()
, ssoProvider("default")
{}
bool enabled;
@ -64,6 +65,7 @@ public:
std::string ssoNonce;
std::string ssoState;
std::string ssoClientID;
std::string ssoProvider;
};
/**

48
controller/PostgreSQL.cpp
View file

@ -442,24 +442,29 @@ AuthInfo PostgreSQL::getSSOAuthInfo(const nlohmann::json &member, const std::str
exit(7);
}
r = w.exec_params("SELECT oc.client_id, oc.authorization_endpoint, oc.issuer, oc.sso_impl_version "
"FROM ztc_network n "
"INNER JOIN ztc_network_oidc_config noc "
" ON noc.network_id = n.id "
"INNER JOIN ztc_oidc_config oc "
" ON noc.client_id = oc.client_id "
"WHERE n.id = $1 AND n.sso_enabled = true", networkId);
r = w.exec_params(
"SELECT oc.client_id, oc.authorization_endpoint, oc.issuer, oc.provider, oc.sso_impl_version "
"FROM ztc_network AS n "
"INNER JOIN ztc_org o "
" ON o.owner_id = n.owner_id "
"LEFT OUTER JOIN ztc_network_oidc_config noc "
" ON noc.network_id = n.id "
"LEFT OUTER JOIN ztc_oidc_config oc "
" ON noc.client_id = oc.client_id AND noc.org_id = o.org_id "
"WHERE n.id = $1 AND n.sso_enabled = true", networkId);
std::string client_id = "";
std::string authorization_endpoint = "";
std::string issuer = "";
std::string provider = "";
uint64_t sso_version = 0;
if (r.size() == 1) {
client_id = r.at(0)[0].as<std::string>();
authorization_endpoint = r.at(0)[1].as<std::string>();
issuer = r.at(0)[2].as<std::string>();
sso_version = r.at(0)[3].as<uint64_t>();
provider = r.at(0)[3].as<std::string>();
sso_version = r.at(0)[4].as<uint64_t>();
} else if (r.size() > 1) {
fprintf(stderr, "ERROR: More than one auth endpoint for an organization?!?!? NetworkID: %s\n", networkId.c_str());
} else {
@ -489,18 +494,20 @@ AuthInfo PostgreSQL::getSSOAuthInfo(const nlohmann::json &member, const std::str
} else if (info.version == 1) {
info.ssoClientID = client_id;
info.issuerURL = issuer;
info.ssoProvider = provider;
info.ssoNonce = nonce;
info.ssoState = std::string(state_hex) + "_" +networkId;
info.centralAuthURL = redirectURL;
#ifdef ZT_DEBUG
fprintf(
stderr,
"ssoClientID: %s\nissuerURL: %s\nssoNonce: %s\nssoState: %s\ncentralAuthURL: %s\n",
"ssoClientID: %s\nissuerURL: %s\nssoNonce: %s\nssoState: %s\ncentralAuthURL: %s\nprovider: %s\n",
info.ssoClientID.c_str(),
info.issuerURL.c_str(),
info.ssoNonce.c_str(),
info.ssoState.c_str(),
info.centralAuthURL.c_str());
info.centralAuthURL.c_str(),
provider.c_str());
#endif
}
} else {
@ -539,10 +546,12 @@ void PostgreSQL::initializeNetworks()
std::unordered_set<std::string> networkSet;
char qbuf[2048] = {0};
sprintf(qbuf, "SELECT n.id, (EXTRACT(EPOCH FROM n.creation_time AT TIME ZONE 'UTC')*1000)::bigint as creation_time, n.capabilities, "
sprintf(qbuf,
"SELECT n.id, (EXTRACT(EPOCH FROM n.creation_time AT TIME ZONE 'UTC')*1000)::bigint as creation_time, n.capabilities, "
"n.enable_broadcast, (EXTRACT(EPOCH FROM n.last_modified AT TIME ZONE 'UTC')*1000)::bigint AS last_modified, n.mtu, n.multicast_limit, n.name, n.private, n.remote_trace_level, "
"n.remote_trace_target, n.revision, n.rules, n.tags, n.v4_assign_mode, n.v6_assign_mode, n.sso_enabled, (CASE WHEN n.sso_enabled THEN o.client_id ELSE NULL END) as client_id, "
"(CASE WHEN n.sso_enabled THEN o.authorization_endpoint ELSE NULL END) as authorization_endpoint, d.domain, d.servers, "
"n.remote_trace_target, n.revision, n.rules, n.tags, n.v4_assign_mode, n.v6_assign_mode, n.sso_enabled, (CASE WHEN n.sso_enabled THEN noc.client_id ELSE NULL END) as client_id, "
"(CASE WHEN n.sso_enabled THEN oc.authorization_endpoint ELSE NULL END) as authorization_endpoint, "
"(CASE WHEN n.sso_enabled THEN oc.provider ELSE NULL END) as provider, d.domain, d.servers, "
"ARRAY(SELECT CONCAT(host(ip_range_start),'|', host(ip_range_end)) FROM ztc_network_assignment_pool WHERE network_id = n.id) AS assignment_pool, "
"ARRAY(SELECT CONCAT(host(address),'/',bits::text,'|',COALESCE(host(via), 'NULL'))FROM ztc_network_route WHERE network_id = n.id) AS routes "
"FROM ztc_network n "
@ -551,7 +560,7 @@ void PostgreSQL::initializeNetworks()
"LEFT OUTER JOIN ztc_network_oidc_config noc "
" ON noc.network_id = n.id "
"LEFT OUTER JOIN ztc_oidc_config oc "
" ON noc.client_id = oc.client_id AND o.org_id = oc.org_id "
" ON noc.client_id = oc.client_id AND oc.org_id = o.org_id "
"LEFT OUTER JOIN ztc_network_dns d "
" ON d.network_id = n.id "
"WHERE deleted = false AND controller_id = '%s'", _myAddressStr.c_str());
@ -582,6 +591,7 @@ void PostgreSQL::initializeNetworks()
, std::optional<bool> // ssoEnabled
, std::optional<std::string> // clientId
, std::optional<std::string> // authorizationEndpoint
, std::optional<std::string> // ssoProvider
, std::optional<std::string> // domain
, std::optional<std::string> // servers
, std::string // assignmentPoolString
@ -618,10 +628,11 @@ void PostgreSQL::initializeNetworks()
std::optional<bool> ssoEnabled = std::get<16>(row);
std::optional<std::string> clientId = std::get<17>(row);
std::optional<std::string> authorizationEndpoint = std::get<18>(row);
std::optional<std::string> dnsDomain = std::get<19>(row);
std::optional<std::string> dnsServers = std::get<20>(row);
std::string assignmentPoolString = std::get<21>(row);
std::string routesString = std::get<22>(row);
std::optional<std::string> ssoProvider = std::get<19>(row);
std::optional<std::string> dnsDomain = std::get<20>(row);
std::optional<std::string> dnsServers = std::get<21>(row);
std::string assignmentPoolString = std::get<22>(row);
std::string routesString = std::get<23>(row);
config["id"] = nwid;
config["nwid"] = nwid;
@ -646,6 +657,7 @@ void PostgreSQL::initializeNetworks()
config["routes"] = json::array();
config["clientId"] = clientId.value_or("");
config["authorizationEndpoint"] = authorizationEndpoint.value_or("");
config["provider"] = ssoProvider.value_or("");
networkSet.insert(nwid);

8
node/IncomingPacket.cpp
View file

@ -217,6 +217,7 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,void *tPtr,const Shar
char ssoNonce[64] = { 0 };
char ssoState[128] = {0};
char ssoClientID[256] = { 0 };
char ssoProvider[64] = { 0 };
if (authInfo.get(ZT_AUTHINFO_DICT_KEY_ISSUER_URL, issuerURL, sizeof(issuerURL)) > 0) {
issuerURL[sizeof(issuerURL) - 1] = 0;
@ -233,8 +234,13 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,void *tPtr,const Shar
if (authInfo.get(ZT_AUTHINFO_DICT_KEY_CLIENT_ID, ssoClientID, sizeof(ssoClientID)) > 0) {
ssoClientID[sizeof(ssoClientID) - 1] = 0;
}
if (authInfo.get(ZT_AUTHINFO_DICT_KEY_SSO_PROVIDER, ssoProvider, sizeof(ssoProvider)) > 0 ) {
ssoProvider[sizeof(ssoProvider) - 1] = 0;
} else {
strncpy(ssoProvider, "default", sizeof(ssoProvider));
}
network->setAuthenticationRequired(tPtr, issuerURL, centralAuthURL, ssoClientID, ssoNonce, ssoState);
network->setAuthenticationRequired(tPtr, issuerURL, centralAuthURL, ssoClientID, ssoProvider, ssoNonce, ssoState);
}
}
} else {

3
node/Network.cpp
View file

@ -1556,7 +1556,7 @@ Membership &Network::_membership(const Address &a)
return _memberships[a];
}
void Network::setAuthenticationRequired(void *tPtr, const char* issuerURL, const char* centralEndpoint, const char* clientID, const char* nonce, const char* state)
void Network::setAuthenticationRequired(void *tPtr, const char* issuerURL, const char* centralEndpoint, const char* clientID, const char *ssoProvider, const char* nonce, const char* state)
{
Mutex::Lock _l(_lock);
_netconfFailure = NETCONF_FAILURE_AUTHENTICATION_REQUIRED;
@ -1568,6 +1568,7 @@ void Network::setAuthenticationRequired(void *tPtr, const char* issuerURL, const
Utils::scopy(_config.ssoClientID, sizeof(_config.ssoClientID), clientID);
Utils::scopy(_config.ssoNonce, sizeof(_config.ssoNonce), nonce);
Utils::scopy(_config.ssoState, sizeof(_config.ssoState), state);
Utils::scopy(_config.ssoProvider, sizeof(_config.ssoProvider), ssoProvider);
_sendUpdateEvent(tPtr);
}

2
node/Network.hpp
View file

@ -241,7 +241,7 @@ public:
* set netconf failure to 'authentication required' along with info needed
* for sso full flow authentication.
*/
void setAuthenticationRequired(void *tPtr, const char* issuerURL, const char* centralEndpoint, const char* clientID, const char* nonce, const char* state);
void setAuthenticationRequired(void *tPtr, const char* issuerURL, const char* centralEndpoint, const char* clientID, const char *ssoProvider, const char* nonce, const char* state);
/**
* Causes this network to request an updated configuration from its master node now

7
node/NetworkConfig.cpp
View file

@ -201,6 +201,7 @@ bool NetworkConfig::toDictionary(Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d,b
if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_NONCE, this->ssoNonce)) return false;
if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_STATE, this->ssoState)) return false;
if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_CLIENT_ID, this->ssoClientID)) return false;
if (!d.add(ZT_NETWORKCONFIG_DICT_KEY_SSO_PROVIDER, this->ssoProvider)) return false;
}
delete tmp;
@ -424,6 +425,11 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
if (d.get(ZT_NETWORKCONFIG_DICT_KEY_CLIENT_ID, this->ssoClientID, (unsigned int)sizeof(this->ssoClientID)) > 0) {
this->ssoClientID[sizeof(this->ssoClientID) - 1] = 0;
}
if (d.get(ZT_NETWORKCONFIG_DICT_KEY_SSO_PROVIDER, this->ssoProvider, (unsigned int)(sizeof(this->ssoProvider))) > 0) {
this->ssoProvider[sizeof(this->ssoProvider) - 1] = 0;
} else {
strncpy(this->ssoProvider, "default", sizeof(this->ssoProvider));
}
} else {
this->authenticationURL[0] = 0;
this->authenticationExpiryTime = 0;
@ -432,6 +438,7 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
this->ssoState[0] = 0;
this->ssoClientID[0] = 0;
this->issuerURL[0] = 0;
this->ssoProvider[0] = 0;
}
}
}

14
node/NetworkConfig.hpp
View file

@ -195,6 +195,8 @@ namespace ZeroTier {
#define ZT_NETWORKCONFIG_DICT_KEY_STATE "ssos"
// client ID
#define ZT_NETWORKCONFIG_DICT_KEY_CLIENT_ID "ssocid"
// SSO Provider
#define ZT_NETWORKCONFIG_DICT_KEY_SSO_PROVIDER "ssop"
// AuthInfo fields -- used by ncSendError for sso
@ -212,6 +214,8 @@ namespace ZeroTier {
#define ZT_AUTHINFO_DICT_KEY_STATE "aS"
// Client ID
#define ZT_AUTHINFO_DICT_KEY_CLIENT_ID "aCID"
// SSO Provider
#define ZT_AUTHINFO_DICT_KEY_SSO_PROVIDER "aSSOp"
// Legacy fields -- these are obsoleted but are included when older clients query
@ -289,6 +293,7 @@ public:
memset(ssoNonce, 0, sizeof(ssoNonce));
memset(ssoState, 0, sizeof(ssoState));
memset(ssoClientID, 0, sizeof(ssoClientID));
strncpy(ssoProvider, "default", sizeof(ssoProvider));
}
/**
@ -699,6 +704,15 @@ public:
* oidc client id
*/
char ssoClientID[256];
/**
* oidc provider
*
* because certain providers require specific scopes to be requested
* and others to be not requested in order to make everything work
* correctly
**/
char ssoProvider[64];
};
} // namespace ZeroTier