Upgrade OpenShift and its dependencies.

OpenShift version 1.4.0-alpha.0
2016-10-18 12:04:00 +02:00
parent 5e1a5cbb3b
commit 1f8a0e06c9
1786 changed files with 424709 additions and 33395 deletions
@@ -0,0 +1,85 @@
+package api
+
+import (
+	"k8s.io/kubernetes/pkg/auth/user"
+)
+
+const (
+	// IdentityDisplayNameKey is the key for an optional display name in an identity's Extra map
+	IdentityDisplayNameKey = "name"
+	// IdentityEmailKey is the key for an optional email address in an identity's Extra map
+	IdentityEmailKey = "email"
+	// IdentityPreferredUsernameKey is the key for an optional preferred username in an identity's Extra map.
+	// This is useful when the immutable providerUserName is different than the login used to authenticate
+	// If present, this extra value is used as the preferred username
+	IdentityPreferredUsernameKey = "preferred_username"
+
+	ImpersonateUserHeader      = "Impersonate-User"
+	ImpersonateGroupHeader     = "Impersonate-Group"
+	ImpersonateUserScopeHeader = "Impersonate-User-Scope"
+)
+
+// UserIdentityInfo contains information about an identity.  Identities are distinct from users.  An authentication server of
+// some kind (like oauth for example) describes an identity.  Our system controls the users mapped to this identity.
+type UserIdentityInfo interface {
+	// GetIdentityName returns the name of this identity. It must be equal to GetProviderName() + ":" + GetProviderUserName()
+	GetIdentityName() string
+	// GetProviderName returns the name of the provider of this identity.
+	GetProviderName() string
+	// GetProviderUserName uniquely identifies this particular identity for this provider.  It is NOT guaranteed to be unique across providers
+	GetProviderUserName() string
+	// GetExtra is a map to allow providers to add additional fields that they understand
+	GetExtra() map[string]string
+}
+
+// UserIdentityMapper maps UserIdentities into user.Info objects to allow different user abstractions within auth code.
+type UserIdentityMapper interface {
+	// UserFor takes an identity, ignores the passed identity.Provider, forces the provider value to some other value and then creates the mapping.
+	// It returns the corresponding user.Info
+	UserFor(identityInfo UserIdentityInfo) (user.Info, error)
+}
+
+type Client interface {
+	GetId() string
+	ValidateSecret(secret string) bool
+	GetRedirectUri() string
+	GetUserData() interface{}
+}
+
+type Grant struct {
+	Client      Client
+	Scope       string
+	Expiration  int64
+	RedirectURI string
+}
+
+type DefaultUserIdentityInfo struct {
+	ProviderName     string
+	ProviderUserName string
+	Extra            map[string]string
+}
+
+// NewDefaultUserIdentityInfo returns a DefaultUserIdentityInfo with a non-nil Extra component
+func NewDefaultUserIdentityInfo(providerName, providerUserName string) *DefaultUserIdentityInfo {
+	return &DefaultUserIdentityInfo{
+		ProviderName:     providerName,
+		ProviderUserName: providerUserName,
+		Extra:            map[string]string{},
+	}
+}
+
+func (i *DefaultUserIdentityInfo) GetIdentityName() string {
+	return i.ProviderName + ":" + i.ProviderUserName
+}
+
+func (i *DefaultUserIdentityInfo) GetProviderName() string {
+	return i.ProviderName
+}
+
+func (i *DefaultUserIdentityInfo) GetProviderUserName() string {
+	return i.ProviderUserName
+}
+
+func (i *DefaultUserIdentityInfo) GetExtra() map[string]string {
+	return i.Extra
+}
@@ -0,0 +1,34 @@
+package authenticator
+
+import (
+	"net/http"
+
+	"github.com/openshift/origin/pkg/auth/api"
+	"k8s.io/kubernetes/pkg/auth/user"
+)
+
+type Token interface {
+	AuthenticateToken(token string) (user.Info, bool, error)
+}
+
+type Request interface {
+	AuthenticateRequest(req *http.Request) (user.Info, bool, error)
+}
+
+type Password interface {
+	AuthenticatePassword(user, password string) (user.Info, bool, error)
+}
+
+type Assertion interface {
+	AuthenticateAssertion(assertionType, data string) (user.Info, bool, error)
+}
+
+type Client interface {
+	AuthenticateClient(client api.Client) (user.Info, bool, error)
+}
+
+type RequestFunc func(req *http.Request) (user.Info, bool, error)
+
+func (f RequestFunc) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {
+	return f(req)
+}
@@ -0,0 +1,3 @@
+// Package x509request provides a request authenticator that validates and
+// extracts user information from client certificates
+package x509request
@@ -0,0 +1,173 @@
+package x509request
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"fmt"
+	"net/http"
+
+	"github.com/golang/glog"
+	"github.com/openshift/origin/pkg/auth/authenticator"
+	"k8s.io/kubernetes/pkg/auth/user"
+	kerrors "k8s.io/kubernetes/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/util/sets"
+)
+
+// UserConversion defines an interface for extracting user info from a client certificate chain
+type UserConversion interface {
+	User(chain []*x509.Certificate) (user.Info, bool, error)
+}
+
+// UserConversionFunc is a function that implements the UserConversion interface.
+type UserConversionFunc func(chain []*x509.Certificate) (user.Info, bool, error)
+
+// User implements x509.UserConversion
+func (f UserConversionFunc) User(chain []*x509.Certificate) (user.Info, bool, error) {
+	return f(chain)
+}
+
+// Authenticator implements request.Authenticator by extracting user info from verified client certificates
+type Authenticator struct {
+	opts x509.VerifyOptions
+	user UserConversion
+}
+
+// New returns a request.Authenticator that verifies client certificates using the provided
+// VerifyOptions, and converts valid certificate chains into user.Info using the provided UserConversion
+func New(opts x509.VerifyOptions, user UserConversion) *Authenticator {
+	return &Authenticator{opts, user}
+}
+
+// AuthenticateRequest authenticates the request using presented client certificates
+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {
+	if req.TLS == nil {
+		return nil, false, nil
+	}
+
+	var errlist []error
+	for _, cert := range req.TLS.PeerCertificates {
+		chains, err := cert.Verify(a.opts)
+		if err != nil {
+			errlist = append(errlist, err)
+			continue
+		}
+
+		for _, chain := range chains {
+			user, ok, err := a.user.User(chain)
+			if err != nil {
+				errlist = append(errlist, err)
+				continue
+			}
+
+			if ok {
+				return user, ok, err
+			}
+		}
+	}
+	return nil, false, kerrors.NewAggregate(errlist)
+}
+
+// Verifier implements request.Authenticator by verifying a client cert on the request, then delegating to the wrapped auth
+type Verifier struct {
+	opts x509.VerifyOptions
+	auth authenticator.Request
+
+	// allowedCommonNames contains the common names which a verified certificate is allowed to have.
+	// If empty, all verified certificates are allowed.
+	allowedCommonNames sets.String
+}
+
+func NewVerifier(opts x509.VerifyOptions, auth authenticator.Request, allowedCommonNames sets.String) authenticator.Request {
+	return &Verifier{opts, auth, allowedCommonNames}
+}
+
+// AuthenticateRequest verifies the presented client certificates, then delegates to the wrapped auth
+func (a *Verifier) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {
+	if req.TLS == nil {
+		return nil, false, nil
+	}
+
+	var errlist []error
+	for _, cert := range req.TLS.PeerCertificates {
+		if _, err := cert.Verify(a.opts); err != nil {
+			errlist = append(errlist, err)
+			continue
+		}
+		if err := a.verifySubject(cert.Subject); err != nil {
+			errlist = append(errlist, err)
+			continue
+		}
+		return a.auth.AuthenticateRequest(req)
+	}
+	return nil, false, kerrors.NewAggregate(errlist)
+}
+
+func (a *Verifier) verifySubject(subject pkix.Name) error {
+	// No CN restrictions
+	if len(a.allowedCommonNames) == 0 {
+		return nil
+	}
+	// Enforce CN restrictions
+	if a.allowedCommonNames.Has(subject.CommonName) {
+		return nil
+	}
+	glog.Warningf("x509: subject with cn=%s is not in the allowed list: %v", subject.CommonName, a.allowedCommonNames.List())
+	return fmt.Errorf("x509: subject with cn=%s is not allowed", subject.CommonName)
+}
+
+// DefaultVerifyOptions returns VerifyOptions that use the system root certificates, current time,
+// and requires certificates to be valid for client auth (x509.ExtKeyUsageClientAuth)
+func DefaultVerifyOptions() x509.VerifyOptions {
+	return x509.VerifyOptions{
+		KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+	}
+}
+
+// SubjectToUserConversion calls SubjectToUser on the subject of the first certificate in the chain.
+// If the resulting user has no name, it returns nil, false, nil
+var SubjectToUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {
+	user := SubjectToUser(chain[0].Subject)
+	if len(user.GetName()) == 0 {
+		return nil, false, nil
+	}
+	return user, true, nil
+})
+
+// CommonNameUserConversion builds user info from a certificate chain using the subject's CommonName
+var CommonNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {
+	if len(chain[0].Subject.CommonName) == 0 {
+		return nil, false, nil
+	}
+	return &user.DefaultInfo{Name: chain[0].Subject.CommonName}, true, nil
+})
+
+// DNSNameUserConversion builds user info from a certificate chain using the first DNSName on the certificate
+var DNSNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {
+	if len(chain[0].DNSNames) == 0 {
+		return nil, false, nil
+	}
+	return &user.DefaultInfo{Name: chain[0].DNSNames[0]}, true, nil
+})
+
+// EmailAddressUserConversion builds user info from a certificate chain using the first EmailAddress on the certificate
+var EmailAddressUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {
+	if len(chain[0].EmailAddresses) == 0 {
+		return nil, false, nil
+	}
+	return &user.DefaultInfo{Name: chain[0].EmailAddresses[0]}, true, nil
+})
+
+func UserToSubject(u user.Info) pkix.Name {
+	return pkix.Name{
+		CommonName:   u.GetName(),
+		SerialNumber: u.GetUID(),
+		Organization: u.GetGroups(),
+	}
+}
+func SubjectToUser(subject pkix.Name) user.Info {
+	return &user.DefaultInfo{
+		Name:   subject.CommonName,
+		UID:    subject.SerialNumber,
+		Groups: subject.Organization,
+	}
+}