This repository has been archived by the owner on Mar 17, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 51
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rh-che #541: Login to user project using oc CLI in workspace containers
- Loading branch information
Oleksandr Garagatyi
committed
Feb 27, 2018
1 parent
9cc154c
commit 72acec8
Showing
7 changed files
with
420 additions
and
138 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
113 changes: 113 additions & 0 deletions
113
...i-tenant-manager/src/main/java/com/redhat/che/multitenant/OpenshiftUserTokenProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| /* | ||
| * Copyright (c) 2012-2017 Red Hat, Inc. | ||
| * All rights reserved. This program and the accompanying materials | ||
| * are made available under the terms of the Eclipse Public License v1.0 | ||
| * which accompanies this distribution, and is available at | ||
| * http://www.eclipse.org/legal/epl-v10.html | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package com.redhat.che.multitenant; | ||
|
|
||
| import com.google.common.cache.CacheBuilder; | ||
| import com.google.common.cache.CacheLoader; | ||
| import com.google.common.cache.LoadingCache; | ||
|
|
||
| import org.eclipse.che.api.core.BadRequestException; | ||
| import org.eclipse.che.api.core.ConflictException; | ||
| import org.eclipse.che.api.core.ForbiddenException; | ||
| import org.eclipse.che.api.core.NotFoundException; | ||
| import org.eclipse.che.api.core.ServerException; | ||
| import org.eclipse.che.api.core.UnauthorizedException; | ||
| import org.eclipse.che.commons.annotation.Nullable; | ||
| import org.eclipse.che.commons.subject.Subject; | ||
| import org.eclipse.che.multiuser.keycloak.token.provider.service.KeycloakTokenProvider; | ||
| import org.eclipse.che.plugin.openshift.client.exception.OpenShiftException; | ||
|
|
||
| import javax.inject.Inject; | ||
| import javax.inject.Singleton; | ||
| import java.io.IOException; | ||
| import java.util.concurrent.ExecutionException; | ||
| import java.util.concurrent.TimeUnit; | ||
|
|
||
| /** | ||
| * Retrieves Openshift user token by keycloak token from {@link Subject}. | ||
| * | ||
| * @author Oleksandr Garagatyi | ||
| */ | ||
| @Singleton | ||
| public class OpenshiftUserTokenProvider { | ||
| private static final int CACHE_TIMEOUT_MINUTES = 10; | ||
| private static final int CONCURRENT_USERS = 500; | ||
|
|
||
| private KeycloakTokenProvider keycloakTokenProvider; | ||
| private LoadingCache<String, String> tokenCache; | ||
|
|
||
| @Inject | ||
| public OpenshiftUserTokenProvider(KeycloakTokenProvider keycloakTokenProvider) { | ||
| this.keycloakTokenProvider = keycloakTokenProvider; | ||
| this.tokenCache = | ||
| CacheBuilder.newBuilder() | ||
| .maximumSize(CONCURRENT_USERS) | ||
| .expireAfterWrite(CACHE_TIMEOUT_MINUTES, TimeUnit.MINUTES) | ||
| .build(CacheLoader.from(this::loadOpenShiftTokenForUser)); | ||
| } | ||
|
|
||
| /** | ||
| * Returns Openshift token corresponding to a keycloak token retrieved from provided {@link Subject} | ||
| * | ||
| * @param subject | ||
| * subject with user's keycloak token | ||
| * @return Openshift user token | ||
| * @throws OpenShiftException | ||
| * when there is no keycloak token in subject or OSO token retrieval failed | ||
| */ | ||
| public String getToken(Subject subject) throws OpenShiftException { | ||
| checkSubject(subject); | ||
|
|
||
| String keycloakToken = subject.getToken(); | ||
| if (keycloakToken == null) { | ||
| throw new OpenShiftException( | ||
| "User Openshift token is needed but cannot be retrieved since there is no Keycloak token for user: " | ||
| + getUserDescription(subject)); | ||
| } | ||
| try { | ||
| return tokenCache.get(keycloakToken); | ||
| } catch (ExecutionException e) { | ||
| throw new OpenShiftException( | ||
| "Could not retrieve OSO token from Keycloak token for user: " | ||
| + getUserDescription(subject), | ||
| e.getCause()); | ||
| } | ||
| } | ||
|
|
||
| private void checkSubject(Subject subject) throws OpenShiftException { | ||
| if (subject == null) { | ||
| throw new OpenShiftException("No Subject is found to perform this action"); | ||
| } | ||
| if (subject == Subject.ANONYMOUS) { | ||
| throw new OpenShiftException( | ||
| "The anonymous subject is used, and won't be able to perform this action"); | ||
| } | ||
| } | ||
|
|
||
| private String getUserDescription(Subject subject) { | ||
| return subject.getUserName() + "(" + subject.getUserId() + ")"; | ||
| } | ||
|
|
||
| @Nullable | ||
| private String loadOpenShiftTokenForUser(String keycloakToken) { | ||
| try { | ||
| return keycloakTokenProvider.obtainOsoToken("Bearer " + keycloakToken); | ||
| } catch (ServerException | ||
| | UnauthorizedException | ||
| | ForbiddenException | ||
| | NotFoundException | ||
| | ConflictException | ||
| | BadRequestException | ||
| | IOException e) { | ||
| throw new RuntimeException("Could not retrieve OSO token from Keycloak token", e); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.