habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

outposts: clean up flow executor

Browse Source 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer
2021-12-24 19:52:19 +01:00
parent abec906677
commit 884c546f32
3 changed files with 22 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
internal/outpost/flow/const.go Normal file
View File

@ -0,0 +1,15 @@
package flow
type StageComponent string
const (
StageIdentification = StageComponent("ak-stage-identification")
StagePassword = StageComponent("ak-stage-password")
StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
StageAccessDenied = StageComponent("ak-stage-access-denied")
)
const (
HeaderAuthentikRemoteIP = "X-authentik-remote-ip"
HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
)

18
internal/outpost/flow.go → internal/outpost/flow/executor.go
View File

@ -1,4 +1,4 @@
package outpost package flow
import ( import (
"context" "context"
@ -19,8 +19,6 @@ import (
"goauthentik.io/internal/outpost/ak" "goauthentik.io/internal/outpost/ak"
) )
type StageComponent string
var ( var (
FlowTimingGet = promauto.NewHistogramVec(prometheus.HistogramOpts{ FlowTimingGet = promauto.NewHistogramVec(prometheus.HistogramOpts{
Name: "authentik_outpost_flow_timing_get", Name: "authentik_outpost_flow_timing_get",
@ -32,18 +30,6 @@ var (
}, []string{"stage", "flow", "client", "user"}) }, []string{"stage", "flow", "client", "user"})
) )
const (
StageIdentification = StageComponent("ak-stage-identification")
StagePassword = StageComponent("ak-stage-password")
StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
StageAccessDenied = StageComponent("ak-stage-access-denied")
)
const (
HeaderAuthentikRemoteIP = "X-authentik-remote-ip"
HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
)
type FlowExecutor struct { type FlowExecutor struct {
Params url.Values Params url.Values
Answers map[StageComponent]string Answers map[StageComponent]string
@ -183,7 +169,7 @@ func (fe *FlowExecutor) solveFlowChallenge(depth int) (bool, error) {
} }
} }
if deviceChallenge == nil { if deviceChallenge == nil {
return false, errors.New("got ak-stage-authenticator-validate without duo") return false, errors.New("no compatible authenticator class found")
} }
devId, err := strconv.Atoi(deviceChallenge.DeviceUid) devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
if err != nil { if err != nil {

10
internal/outpost/ldap/bind/direct/direct.go
View File

@ -11,7 +11,7 @@ import (
"github.com/prometheus/client_golang/prometheus" "github.com/prometheus/client_golang/prometheus"
log "github.com/sirupsen/logrus" log "github.com/sirupsen/logrus"
"goauthentik.io/api" "goauthentik.io/api"
"goauthentik.io/internal/outpost" "goauthentik.io/internal/outpost/flow"
"goauthentik.io/internal/outpost/ldap/bind" "goauthentik.io/internal/outpost/ldap/bind"
"goauthentik.io/internal/outpost/ldap/flags" "goauthentik.io/internal/outpost/ldap/flags"
"goauthentik.io/internal/outpost/ldap/metrics" "goauthentik.io/internal/outpost/ldap/metrics"
@ -53,7 +53,7 @@ func (db *DirectBinder) GetUsername(dn string) (string, error) {
} }
func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) { func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) {
fe := outpost.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{ fe := flow.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{
"bindDN": req.BindDN, "bindDN": req.BindDN,
"client": req.RemoteAddr(), "client": req.RemoteAddr(),
"requestId": req.ID(), "requestId": req.ID(),
@ -61,8 +61,8 @@ func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResul
fe.DelegateClientIP(req.RemoteAddr()) fe.DelegateClientIP(req.RemoteAddr())
fe.Params.Add("goauthentik.io/outpost/ldap", "true") fe.Params.Add("goauthentik.io/outpost/ldap", "true")
fe.Answers[outpost.StageIdentification] = username fe.Answers[flow.StageIdentification] = username
fe.Answers[outpost.StagePassword] = req.BindPW fe.Answers[flow.StagePassword] = req.BindPW
passed, err := fe.Execute() passed, err := fe.Execute()
if !passed { if !passed {
@ -152,7 +152,7 @@ func (db *DirectBinder) SearchAccessCheck(user api.UserSelf) *string {
} }
func (db *DirectBinder) TimerFlowCacheExpiry() { func (db *DirectBinder) TimerFlowCacheExpiry() {
fe := outpost.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{}) fe := flow.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{})
fe.Params.Add("goauthentik.io/outpost/ldap", "true") fe.Params.Add("goauthentik.io/outpost/ldap", "true")
fe.Params.Add("goauthentik.io/outpost/ldap-warmup", "true") fe.Params.Add("goauthentik.io/outpost/ldap-warmup", "true")