2015-10-31 18:56:49 +00:00
|
|
|
/*
|
|
|
|
Copyright 2015 Gravitational, Inc.
|
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
You may obtain a copy of the License at
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
limitations under the License.
|
|
|
|
*/
|
2015-03-02 20:11:23 +00:00
|
|
|
// package auth implements certificate signing authority and access control server
|
|
|
|
// Authority server is composed of several parts:
|
|
|
|
//
|
|
|
|
// * Authority server itself that implements signing and acl logic
|
|
|
|
// * HTTP server wrapper for authority server
|
|
|
|
// * HTTP client wrapper
|
|
|
|
//
|
|
|
|
package auth
|
|
|
|
|
|
|
|
import (
|
|
|
|
"time"
|
|
|
|
|
2015-10-05 14:33:25 +00:00
|
|
|
"github.com/gravitational/teleport/lib/backend/encryptedbk"
|
2015-11-13 01:32:45 +00:00
|
|
|
"github.com/gravitational/teleport/lib/backend/encryptedbk/encryptor"
|
2015-10-05 17:36:55 +00:00
|
|
|
"github.com/gravitational/teleport/lib/services"
|
2015-11-13 01:32:45 +00:00
|
|
|
|
2016-01-20 15:52:25 +00:00
|
|
|
"github.com/gravitational/session"
|
|
|
|
"github.com/gravitational/trace"
|
|
|
|
"github.com/mailgun/lemma/secret"
|
2015-03-02 20:11:23 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// Authority implements minimal key-management facility for generating OpenSSH
|
|
|
|
//compatible public/private key pairs and OpenSSH certificates
|
|
|
|
type Authority interface {
|
2015-03-19 04:13:56 +00:00
|
|
|
GenerateKeyPair(passphrase string) (privKey []byte, pubKey []byte, err error)
|
2015-03-02 20:11:23 +00:00
|
|
|
|
2015-05-12 00:04:22 +00:00
|
|
|
// GenerateHostCert generates host certificate, it takes pkey as a signing
|
|
|
|
// private key (host certificate authority)
|
2015-11-13 01:32:45 +00:00
|
|
|
GenerateHostCert(pkey, key []byte, id, hostname, role string, ttl time.Duration) ([]byte, error)
|
2015-03-02 20:11:23 +00:00
|
|
|
|
2015-05-12 00:04:22 +00:00
|
|
|
// GenerateHostCert generates user certificate, it takes pkey as a signing
|
|
|
|
// private key (user certificate authority)
|
2015-03-02 20:11:23 +00:00
|
|
|
GenerateUserCert(pkey, key []byte, id, username string, ttl time.Duration) ([]byte, error)
|
|
|
|
}
|
|
|
|
|
2015-03-19 04:13:56 +00:00
|
|
|
type Session struct {
|
|
|
|
SID session.SecureID
|
|
|
|
PID session.PlainID
|
2015-08-25 17:54:16 +00:00
|
|
|
WS services.WebSession
|
2015-03-19 04:13:56 +00:00
|
|
|
}
|
|
|
|
|
2015-11-18 04:39:19 +00:00
|
|
|
func NewAuthServer(bk *encryptedbk.ReplicatedBackend, a Authority,
|
|
|
|
scrt secret.SecretService, hostname string) *AuthServer {
|
2015-08-25 17:54:16 +00:00
|
|
|
as := AuthServer{}
|
|
|
|
|
|
|
|
as.bk = bk
|
2015-08-27 14:39:33 +00:00
|
|
|
as.Authority = a
|
2015-08-25 17:54:16 +00:00
|
|
|
as.scrt = scrt
|
|
|
|
|
2015-08-27 14:39:33 +00:00
|
|
|
as.CAService = services.NewCAService(as.bk)
|
|
|
|
as.LockService = services.NewLockService(as.bk)
|
|
|
|
as.PresenceService = services.NewPresenceService(as.bk)
|
|
|
|
as.ProvisioningService = services.NewProvisioningService(as.bk)
|
|
|
|
as.UserService = services.NewUserService(as.bk)
|
|
|
|
as.WebService = services.NewWebService(as.bk)
|
2015-09-12 01:19:20 +00:00
|
|
|
as.BkKeysService = services.NewBkKeysService(as.bk)
|
2015-08-25 17:54:16 +00:00
|
|
|
|
2015-11-18 04:39:19 +00:00
|
|
|
as.Hostname = hostname
|
2015-08-25 17:54:16 +00:00
|
|
|
return &as
|
2015-03-02 20:11:23 +00:00
|
|
|
}
|
|
|
|
|
2015-05-12 00:04:22 +00:00
|
|
|
// AuthServer implements key signing, generation and ACL functionality
|
|
|
|
// used by teleport
|
2015-03-02 20:11:23 +00:00
|
|
|
type AuthServer struct {
|
2015-09-12 01:19:20 +00:00
|
|
|
bk *encryptedbk.ReplicatedBackend
|
2015-08-27 14:39:33 +00:00
|
|
|
Authority
|
2015-11-18 04:39:19 +00:00
|
|
|
scrt secret.SecretService
|
|
|
|
Hostname string
|
2015-08-25 17:54:16 +00:00
|
|
|
|
2015-08-27 14:39:33 +00:00
|
|
|
*services.CAService
|
|
|
|
*services.LockService
|
|
|
|
*services.PresenceService
|
|
|
|
*services.ProvisioningService
|
|
|
|
*services.UserService
|
|
|
|
*services.WebService
|
2015-09-12 01:19:20 +00:00
|
|
|
*services.BkKeysService
|
2015-03-02 20:11:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// UpsertUserKey takes user's public key, generates certificate for it
|
2015-05-12 00:04:22 +00:00
|
|
|
// and adds it to the authorized keys database. It returns certificate signed
|
2015-11-18 04:39:19 +00:00
|
|
|
// by user Certificate Authority in case of success, error otherwise. The certificate will be
|
2015-05-12 00:04:22 +00:00
|
|
|
// valid for the duration of the ttl passed in.
|
|
|
|
func (s *AuthServer) UpsertUserKey(
|
2015-08-25 17:54:16 +00:00
|
|
|
user string, key services.AuthorizedKey, ttl time.Duration) ([]byte, error) {
|
2015-05-12 00:04:22 +00:00
|
|
|
|
2015-03-02 20:11:23 +00:00
|
|
|
cert, err := s.GenerateUserCert(key.Value, key.ID, user, ttl)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
key.Value = cert
|
2015-08-27 14:39:33 +00:00
|
|
|
if err := s.UserService.UpsertUserKey(user, key, ttl); err != nil {
|
2015-03-02 20:11:23 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return cert, nil
|
|
|
|
}
|
|
|
|
|
2015-11-18 04:39:19 +00:00
|
|
|
// ResetHostCertificateAuthority generates host certificate authority and updates the backend
|
|
|
|
func (s *AuthServer) ResetHostCertificateAuthority(pass string) error {
|
2015-08-27 14:39:33 +00:00
|
|
|
priv, pub, err := s.Authority.GenerateKeyPair(pass)
|
2015-03-02 20:11:23 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2015-11-18 04:39:19 +00:00
|
|
|
return s.CAService.UpsertHostCertificateAuthority(
|
2015-11-20 21:15:48 +00:00
|
|
|
services.LocalCertificateAuthority{
|
|
|
|
CertificateAuthority: services.CertificateAuthority{
|
|
|
|
Type: services.HostCert,
|
|
|
|
DomainName: s.Hostname,
|
|
|
|
PublicKey: pub,
|
|
|
|
ID: string(pub),
|
2015-11-18 04:39:19 +00:00
|
|
|
},
|
2015-11-20 21:15:48 +00:00
|
|
|
PrivateKey: priv},
|
2015-11-18 04:39:19 +00:00
|
|
|
)
|
2015-03-02 20:11:23 +00:00
|
|
|
}
|
|
|
|
|
2015-11-18 04:39:19 +00:00
|
|
|
// ResetHostCertificateAuthority generates user certificate authority and updates the backend
|
|
|
|
func (s *AuthServer) ResetUserCertificateAuthority(pass string) error {
|
2015-08-27 14:39:33 +00:00
|
|
|
priv, pub, err := s.Authority.GenerateKeyPair(pass)
|
2015-03-02 20:11:23 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2015-11-18 04:39:19 +00:00
|
|
|
return s.CAService.UpsertUserCertificateAuthority(
|
2015-11-20 21:15:48 +00:00
|
|
|
services.LocalCertificateAuthority{
|
|
|
|
CertificateAuthority: services.CertificateAuthority{
|
|
|
|
Type: services.UserCert,
|
|
|
|
DomainName: s.Hostname,
|
|
|
|
PublicKey: pub,
|
|
|
|
ID: string(pub),
|
2015-11-18 04:39:19 +00:00
|
|
|
},
|
2015-11-20 21:15:48 +00:00
|
|
|
PrivateKey: priv},
|
2015-11-18 04:39:19 +00:00
|
|
|
)
|
2015-03-02 20:11:23 +00:00
|
|
|
}
|
|
|
|
|
2015-05-12 00:04:22 +00:00
|
|
|
// GenerateHostCert generates host certificate, it takes pkey as a signing
|
|
|
|
// private key (host certificate authority)
|
|
|
|
func (s *AuthServer) GenerateHostCert(
|
2015-11-13 01:32:45 +00:00
|
|
|
key []byte, id, hostname, role string,
|
|
|
|
ttl time.Duration) ([]byte, error) {
|
2015-05-12 00:04:22 +00:00
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
hk, err := s.CAService.GetHostPrivateCertificateAuthority()
|
2015-03-02 20:11:23 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
return s.Authority.GenerateHostCert(hk.PrivateKey, key, id, hostname, role, ttl)
|
2015-03-02 20:11:23 +00:00
|
|
|
}
|
|
|
|
|
2015-05-12 00:04:22 +00:00
|
|
|
// GenerateHostCert generates user certificate, it takes pkey as a signing
|
|
|
|
// private key (user certificate authority)
|
|
|
|
func (s *AuthServer) GenerateUserCert(
|
|
|
|
key []byte, id, username string, ttl time.Duration) ([]byte, error) {
|
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
hk, err := s.CAService.GetUserPrivateCertificateAuthority()
|
2015-03-02 20:11:23 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
return s.Authority.GenerateUserCert(hk.PrivateKey, key, id, username, ttl)
|
2015-03-19 04:13:56 +00:00
|
|
|
}
|
|
|
|
|
2015-10-23 20:34:09 +00:00
|
|
|
func (s *AuthServer) SignIn(user string, password []byte) (*Session, error) {
|
|
|
|
if err := s.CheckPasswordWOToken(user, password); err != nil {
|
2015-03-19 04:13:56 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
sess, err := s.NewWebSession(user)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-10-27 23:30:16 +00:00
|
|
|
if err := s.UpsertWebSession(user, sess, WebSessionTTL); err != nil {
|
2015-03-19 04:13:56 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return sess, nil
|
|
|
|
}
|
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
func (s *AuthServer) GenerateToken(domainName, role string, ttl time.Duration) (string, error) {
|
2015-05-07 03:10:44 +00:00
|
|
|
p, err := session.NewID(s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
if err := s.ProvisioningService.UpsertToken(string(p.PID), domainName, role, ttl); err != nil {
|
2015-05-07 03:10:44 +00:00
|
|
|
return "", err
|
|
|
|
}
|
|
|
|
return string(p.SID), nil
|
|
|
|
}
|
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
func (s *AuthServer) ValidateToken(token, domainName string) (role string, e error) {
|
2015-05-07 03:10:44 +00:00
|
|
|
pid, err := session.DecodeSID(session.SecureID(token), s.scrt)
|
|
|
|
if err != nil {
|
2015-11-13 01:32:45 +00:00
|
|
|
return "", trace.Wrap(err)
|
2015-05-07 03:10:44 +00:00
|
|
|
}
|
2015-11-13 01:32:45 +00:00
|
|
|
tok, err := s.ProvisioningService.GetToken(string(pid))
|
2015-05-07 03:10:44 +00:00
|
|
|
if err != nil {
|
2015-11-16 05:21:34 +00:00
|
|
|
return "", trace.Wrap(err)
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
if tok.DomainName != domainName {
|
|
|
|
return "", trace.Errorf("domainName does not match")
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
|
|
|
return tok.Role, nil
|
|
|
|
}
|
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
func (s *AuthServer) RegisterUsingToken(token, domainName, role string) (keys PackedKeys, e error) {
|
2015-11-13 01:32:45 +00:00
|
|
|
pid, err := session.DecodeSID(session.SecureID(token), s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return PackedKeys{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
tok, err := s.ProvisioningService.GetToken(string(pid))
|
|
|
|
if err != nil {
|
2015-11-16 05:21:34 +00:00
|
|
|
return PackedKeys{}, trace.Wrap(err)
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
if tok.DomainName != domainName {
|
|
|
|
return PackedKeys{}, trace.Errorf("domainName does not match")
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if tok.Role != role {
|
2015-11-16 05:21:34 +00:00
|
|
|
return PackedKeys{}, trace.Errorf("role does not match")
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
k, pub, err := s.GenerateKeyPair("")
|
|
|
|
if err != nil {
|
|
|
|
return PackedKeys{}, trace.Wrap(err)
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
c, err := s.GenerateHostCert(pub, domainName+"_"+role, domainName, role, 0)
|
2015-11-13 01:32:45 +00:00
|
|
|
if err != nil {
|
|
|
|
return PackedKeys{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
keys = PackedKeys{
|
|
|
|
Key: k,
|
|
|
|
Cert: c,
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.DeleteToken(token); err != nil {
|
|
|
|
return PackedKeys{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return keys, nil
|
|
|
|
}
|
|
|
|
|
2015-11-20 21:15:48 +00:00
|
|
|
func (s *AuthServer) RegisterNewAuthServer(domainName, token string,
|
2015-11-13 01:32:45 +00:00
|
|
|
publicSealKey encryptor.Key) (masterKey encryptor.Key, e error) {
|
|
|
|
pid, err := session.DecodeSID(session.SecureID(token), s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return encryptor.Key{}, trace.Wrap(err)
|
2015-05-07 03:10:44 +00:00
|
|
|
}
|
2015-11-13 01:32:45 +00:00
|
|
|
tok, err := s.ProvisioningService.GetToken(string(pid))
|
|
|
|
if err != nil {
|
2015-11-16 05:21:34 +00:00
|
|
|
return encryptor.Key{}, trace.Wrap(err)
|
2015-05-07 03:10:44 +00:00
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
if tok.DomainName != domainName {
|
|
|
|
return encryptor.Key{}, trace.Errorf("domainName does not match")
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if tok.Role != RoleAuth {
|
2015-11-16 05:21:34 +00:00
|
|
|
return encryptor.Key{}, trace.Errorf("role does not match")
|
2015-11-13 01:32:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.DeleteToken(token); err != nil {
|
|
|
|
return encryptor.Key{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := s.BkKeysService.AddSealKey(publicSealKey); err != nil {
|
|
|
|
return encryptor.Key{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
localKey, err := s.BkKeysService.GetSignKey()
|
|
|
|
if err != nil {
|
|
|
|
return encryptor.Key{}, trace.Wrap(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return localKey.Public(), nil
|
2015-05-07 03:10:44 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *AuthServer) DeleteToken(token string) error {
|
|
|
|
pid, err := session.DecodeSID(session.SecureID(token), s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2015-08-27 14:39:33 +00:00
|
|
|
return s.ProvisioningService.DeleteToken(string(pid))
|
2015-05-07 03:10:44 +00:00
|
|
|
}
|
|
|
|
|
2015-03-19 04:13:56 +00:00
|
|
|
func (s *AuthServer) NewWebSession(user string) (*Session, error) {
|
|
|
|
p, err := session.NewID(s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
priv, pub, err := s.GenerateKeyPair("")
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
hk, err := s.CAService.GetUserPrivateCertificateAuthority()
|
2015-03-19 04:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-11-20 21:15:48 +00:00
|
|
|
cert, err := s.Authority.GenerateUserCert(hk.PrivateKey, pub, user, user, WebSessionTTL)
|
2015-03-19 04:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
sess := &Session{
|
|
|
|
SID: p.SID,
|
|
|
|
PID: p.PID,
|
2015-08-25 17:54:16 +00:00
|
|
|
WS: services.WebSession{Priv: priv, Pub: cert},
|
2015-03-19 04:13:56 +00:00
|
|
|
}
|
|
|
|
return sess, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *AuthServer) UpsertWebSession(user string, sess *Session, ttl time.Duration) error {
|
2015-08-27 14:39:33 +00:00
|
|
|
return s.WebService.UpsertWebSession(user, string(sess.PID), sess.WS, ttl)
|
2015-03-19 04:13:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *AuthServer) GetWebSession(user string, sid session.SecureID) (*Session, error) {
|
|
|
|
pid, err := session.DecodeSID(sid, s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-08-27 14:39:33 +00:00
|
|
|
ws, err := s.WebService.GetWebSession(user, string(pid))
|
2015-03-19 04:13:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &Session{
|
|
|
|
SID: sid,
|
|
|
|
PID: pid,
|
|
|
|
WS: *ws,
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *AuthServer) DeleteWebSession(user string, sid session.SecureID) error {
|
|
|
|
pid, err := session.DecodeSID(sid, s.scrt)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2015-08-27 14:39:33 +00:00
|
|
|
return s.WebService.DeleteWebSession(user, string(pid))
|
2015-03-19 04:13:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
2015-10-27 23:30:16 +00:00
|
|
|
Week = time.Hour * 24 * 7
|
|
|
|
WebSessionTTL = time.Hour * 10
|
2015-03-19 04:13:56 +00:00
|
|
|
)
|