Moved internal/auth to configauth

Signed-off-by: Juraci Paixão Kröhling <juraci@kroehling.de>
open-telemetry · Sep 30, 2020 · 5c2247d · 5c2247d
1 parent e893ac4
commit 5c2247d
Show file tree

Hide file tree

Showing 10 changed files with 92 additions and 65 deletions.
diff --git a/internal/auth/authenticator.go → config/configauth/authenticator.go b/internal/auth/authenticator.go → config/configauth/authenticator.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"context"
@@ -21,8 +21,6 @@ import (
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
-
-	"go.opentelemetry.io/collector/config/configauth"
 )
 
 var (
@@ -52,8 +50,8 @@ type authenticateFunc func(context.Context, map[string][]string) (context.Contex
 type unaryInterceptorFunc func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, authenticate authenticateFunc) (interface{}, error)
 type streamInterceptorFunc func(srv interface{}, stream grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler, authenticate authenticateFunc) error
 
-// New creates an authenticator based on the given configuration
-func New(cfg configauth.Authentication) (Authenticator, error) {
+// NewAuthenticator creates an authenticator based on the given configuration
+func NewAuthenticator(cfg Authentication) (Authenticator, error) {
 	if cfg.OIDC == nil {
 		return nil, errNoOIDCProvided
 	}

diff --git a/internal/auth/authenticator_test.go → config/configauth/authenticator_test.go b/internal/auth/authenticator_test.go → config/configauth/authenticator_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"context"
@@ -22,14 +22,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
-
-	"go.opentelemetry.io/collector/config/configauth"
 )
 
-func TestNew(t *testing.T) {
+func TestNewAuthenticator(t *testing.T) {
 	// test
-	p, err := New(configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	p, err := NewAuthenticator(Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com",
 		},
@@ -42,7 +40,7 @@ func TestNew(t *testing.T) {
 
 func TestMissingOIDC(t *testing.T) {
 	// test
-	p, err := New(configauth.Authentication{})
+	p, err := NewAuthenticator(Authentication{})
 
 	// verify
 	assert.Nil(t, p)

diff --git a/config/configauth/configauth.go b/config/configauth/configauth.go
@@ -14,6 +14,12 @@
 
 package configauth
 
+import (
+	"context"
+
+	"google.golang.org/grpc"
+)
+
 // Authentication defines the auth settings for the receiver
 type Authentication struct {
 	// The attribute (header name) to look for auth data. Optional, default value: "authentication".
@@ -47,3 +53,22 @@ type OIDC struct {
 	// Optional.
 	GroupsClaim string `mapstructure:"groups_claim"`
 }
+
+// ToServerOptions builds a set of server options ready to be used by the gRPC server
+func (a *Authentication) ToServerOptions() ([]grpc.ServerOption, error) {
+	auth, err := NewAuthenticator(*a)
+	if err != nil {
+		return nil, err
+	}
+
+	// perhaps we should use a timeout here?
+	// TODO: we need a hook to call auth.Close()
+	if err := auth.Start(context.Background()); err != nil {
+		return nil, err
+	}
+
+	return []grpc.ServerOption{
+		grpc.UnaryInterceptor(auth.UnaryInterceptor),
+		grpc.StreamInterceptor(auth.StreamInterceptor),
+	}, nil
+}
diff --git a/config/configauth/empty_test.go → config/configauth/configauth_test.go b/config/configauth/empty_test.go → config/configauth/configauth_test.go
@@ -13,3 +13,23 @@
 // limitations under the License.
 
 package configauth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToServerOptions(t *testing.T) {
+	// prepare
+	auth := &Authentication{
+		OIDC: &OIDC{},
+	}
+	// test
+	opts, err := auth.ToServerOptions()
+
+	// verify
+	// an error here is a positive confirmation that Auth kicked in
+	assert.Error(t, err)
+	assert.Nil(t, opts)
+}
diff --git a/internal/auth/context.go → config/configauth/context.go b/internal/auth/context.go → config/configauth/context.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import "context"
 

diff --git a/internal/auth/context_test.go → config/configauth/context_test.go b/internal/auth/context_test.go → config/configauth/context_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"context"

diff --git a/internal/auth/oidc_authenticator.go → config/configauth/oidc_authenticator.go b/internal/auth/oidc_authenticator.go → config/configauth/oidc_authenticator.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"context"
@@ -29,13 +29,11 @@ import (
 
 	"github.com/coreos/go-oidc"
 	"google.golang.org/grpc"
-
-	"go.opentelemetry.io/collector/config/configauth"
 )
 
 type oidcAuthenticator struct {
 	attribute string
-	config    configauth.OIDC
+	config    OIDC
 	provider  *oidc.Provider
 	verifier  *oidc.IDTokenVerifier
 
@@ -56,7 +54,7 @@ var (
 	errNotAuthenticated                  = errors.New("authentication didn't succeed")
 )
 
-func newOIDCAuthenticator(cfg configauth.Authentication) (*oidcAuthenticator, error) {
+func newOIDCAuthenticator(cfg Authentication) (*oidcAuthenticator, error) {
 	if cfg.OIDC.Audience == "" {
 		return nil, errNoClientIDProvided
 	}
@@ -189,7 +187,7 @@ func getGroupsFromClaims(claims map[string]interface{}, groupsClaim string) ([]s
 	return []string{}, nil
 }
 
-func getProviderForConfig(config configauth.OIDC) (*oidc.Provider, error) {
+func getProviderForConfig(config OIDC) (*oidc.Provider, error) {
 	t := &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		DialContext: (&net.Dialer{

diff --git a/internal/auth/oidc_authenticator_test.go → config/configauth/oidc_authenticator_test.go b/internal/auth/oidc_authenticator_test.go → config/configauth/oidc_authenticator_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"context"
@@ -34,8 +34,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
-
-	"go.opentelemetry.io/collector/config/configauth"
 )
 
 func TestOIDCAuthenticationSucceeded(t *testing.T) {
@@ -45,8 +43,8 @@ func TestOIDCAuthenticationSucceeded(t *testing.T) {
 	oidcServer.Start()
 	defer oidcServer.Close()
 
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			IssuerURL:   oidcServer.URL,
 			Audience:    "unit-test",
 			GroupsClaim: "memberships",
@@ -122,7 +120,7 @@ func TestOIDCProviderForConfigWithTLS(t *testing.T) {
 	oidcServer.StartTLS()
 
 	// prepare the processor configuration
-	config := configauth.OIDC{
+	config := OIDC{
 		IssuerURL:    oidcServer.URL,
 		IssuerCAPath: caFile.Name(),
 		Audience:     "unit-test",
@@ -196,7 +194,7 @@ func TestOIDCFailedToLoadIssuerCAFromPathInvalidContent(t *testing.T) {
 	defer os.Remove(file.Name())
 	file.Write([]byte("foobar"))
 
-	config := configauth.OIDC{
+	config := OIDC{
 		IssuerCAPath: file.Name(),
 	}
 
@@ -210,8 +208,8 @@ func TestOIDCFailedToLoadIssuerCAFromPathInvalidContent(t *testing.T) {
 
 func TestOIDCInvalidAuthHeader(t *testing.T) {
 	// prepare
-	p, err := newOIDCAuthenticator(configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	p, err := newOIDCAuthenticator(Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com",
 		},
@@ -228,8 +226,8 @@ func TestOIDCInvalidAuthHeader(t *testing.T) {
 
 func TestOIDCNotAuthenticated(t *testing.T) {
 	// prepare
-	p, err := newOIDCAuthenticator(configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	p, err := newOIDCAuthenticator(Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com",
 		},
@@ -246,8 +244,8 @@ func TestOIDCNotAuthenticated(t *testing.T) {
 
 func TestProviderNotReacheable(t *testing.T) {
 	// prepare
-	p, err := newOIDCAuthenticator(configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	p, err := newOIDCAuthenticator(Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com",
 		},
@@ -268,8 +266,8 @@ func TestFailedToVerifyToken(t *testing.T) {
 	oidcServer.Start()
 	defer oidcServer.Close()
 
-	p, err := newOIDCAuthenticator(configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	p, err := newOIDCAuthenticator(Authentication{
+		OIDC: &OIDC{
 			IssuerURL: oidcServer.URL,
 			Audience:  "unit-test",
 		},
@@ -296,13 +294,13 @@ func TestFailedToGetGroupsClaimFromToken(t *testing.T) {
 
 	for _, tt := range []struct {
 		casename      string
-		config        configauth.Authentication
+		config        Authentication
 		expectedError error
 	}{
 		{
 			"groupsClaimNonExisting",
-			configauth.Authentication{
-				OIDC: &configauth.OIDC{
+			Authentication{
+				OIDC: &OIDC{
 					IssuerURL:   oidcServer.URL,
 					Audience:    "unit-test",
 					GroupsClaim: "non-existing-claim",
@@ -312,8 +310,8 @@ func TestFailedToGetGroupsClaimFromToken(t *testing.T) {
 		},
 		{
 			"usernameClaimNonExisting",
-			configauth.Authentication{
-				OIDC: &configauth.OIDC{
+			Authentication{
+				OIDC: &OIDC{
 					IssuerURL:     oidcServer.URL,
 					Audience:      "unit-test",
 					UsernameClaim: "non-existing-claim",
@@ -323,8 +321,8 @@ func TestFailedToGetGroupsClaimFromToken(t *testing.T) {
 		},
 		{
 			"usernameNotString",
-			configauth.Authentication{
-				OIDC: &configauth.OIDC{
+			Authentication{
+				OIDC: &OIDC{
 					IssuerURL:     oidcServer.URL,
 					Audience:      "unit-test",
 					UsernameClaim: "some-non-string-field",
@@ -438,8 +436,8 @@ func TestEmptyGroupsClaim(t *testing.T) {
 
 func TestMissingClient(t *testing.T) {
 	// prepare
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			IssuerURL: "http://example.com/",
 		},
 	}
@@ -454,8 +452,8 @@ func TestMissingClient(t *testing.T) {
 
 func TestMissingIssuerURL(t *testing.T) {
 	// prepare
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			Audience: "some-audience",
 		},
 	}
@@ -470,8 +468,8 @@ func TestMissingIssuerURL(t *testing.T) {
 
 func TestClose(t *testing.T) {
 	// prepare
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com/",
 		},
@@ -489,8 +487,8 @@ func TestClose(t *testing.T) {
 
 func TestUnaryInterceptor(t *testing.T) {
 	// prepare
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com/",
 		},
@@ -519,8 +517,8 @@ func TestUnaryInterceptor(t *testing.T) {
 
 func TestStreamInterceptor(t *testing.T) {
 	// prepare
-	config := configauth.Authentication{
-		OIDC: &configauth.OIDC{
+	config := Authentication{
+		OIDC: &OIDC{
 			Audience:  "some-audience",
 			IssuerURL: "http://example.com/",
 		},

diff --git a/internal/auth/oidc_server_test.go → config/configauth/oidc_server_test.go b/internal/auth/oidc_server_test.go → config/configauth/oidc_server_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package auth
+package configauth
 
 import (
 	"bytes"