Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support to authorization middleware for jwt based Authorizer #14972

Closed
GeorgeMac opened this issue Sep 5, 2019 · 0 comments · Fixed by #15152
Closed

Add support to authorization middleware for jwt based Authorizer #14972

GeorgeMac opened this issue Sep 5, 2019 · 0 comments · Fixed by #15152

Comments

@GeorgeMac
Copy link
Contributor

Add support for deserialization / validation of JWT based authorizer within authentication middleware:
https://github.com/influxdata/influxdb/blob/master/http/authentication_middleware.go

Steps:

  1. When attempting to deserialize a token (given we have a JWT secret), first attempt to deserialize it as a JWT token:
    func (h *AuthenticationHandler) extractAuthorization(ctx context.Context, r *http.Request) (context.Context, error) {
    t, err := GetToken(r)
    if err != nil {
    return ctx, err
    }
    a, err := h.AuthorizationService.FindAuthorizationByToken(ctx, t)
    if err != nil {
    return ctx, err
    }
    return platcontext.SetAuthorizer(ctx, a), nil
    }
  2. If an error is returned because it is not a well formed token or no JWT secret exists then attempt to find authorization using the token as we currently do so.
  3. If an error is returned because the token is well-formed, however, it is invalid (invalid signature, expired and so on) then return the error.
  4. If the token is valid and the permissions can be deserialized then set the authorizer on the context.

Success Criteria

When configured with a JWT secret, API actions can be triggered using a well formed token. e.g. a token with permissions with write action for a specific bucket within a specific org can be generated using a secret and then used to trigger a write.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants