nginx_omniauth_adapter 0.2.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: da45545a31a51031b94607551c7296f3011c3769
-  data.tar.gz: 79f17b771dffb86ff9527b78a7fbbe14d1a71bf1
+  metadata.gz: a96ef0739bfef47af1b4a8fb09debc9c19993268
+  data.tar.gz: 44aabb34e2c339f88e49db0bee0d4e192b150466
 SHA512:
-  metadata.gz: 84be2b3d973d457a98b52ba75498b3dd84557012dd8fc9ddadeb5e2873fd9a80efb146f2177024214eadbaf1524814869f250c5ce972fce3e5bad3f61aad7714
-  data.tar.gz: 432c64e9ec6b1953947d6a8ed72e6c4eb019db5cf984cd62de39361c4d594ca7800be2686f25caae168c9b14f5ec24ccf8ae58ff951916ab049129a613687a6d
+  metadata.gz: 261454c8ab6c76b725ea4eae8e14f4db6166c5d13e5aefa5f8208014c07c960b970eb941b2a916de39da700e314fedacaf17bd9ff9e13f9e4d4e722eb81be046
+  data.tar.gz: 02419d04c5c6a591088fe8c79834d5571bf341e47b91f9d993626b0a5e05b03f3d2349dcd5a2ae661b5758fac43d38c159904d342e204859c4306a21ec8cc7ae

data/Gemfile

@@ -5,3 +5,5 @@ gemspec
 
 gem 'omniauth-github'
 gem 'omniauth-google-oauth2'
+
+gem 'unicorn'

data/README.md

@@ -1,5 +1,7 @@
 # NginxOmniauthAdapter - Use omniauth for nginx `auth_request` 
 
+[![Circle CI](https://circleci.com/gh/sorah/nginx_omniauth_adapter.svg?style=svg)](https://circleci.com/gh/sorah/nginx_omniauth_adapter)
+
 Use [omniauth](https://github.com/intridea/omniauth) for your nginx's authentication via ngx_http_auth_request_module.
 
 NginxOmniauthAdapter provides small Rack app (built with Sinatra) for `auth_request`.
@@ -40,7 +42,12 @@ Then write `config.ru` then deploy it. (see ./config.ru for example)
 
 ### Using docker
 
-TBD
+- Prebuilt: https://quay.io/repository/sorah/nginx_omniauth_adapter
+  - Own your risk.
+  - They're built at circleci
+- Build manually: checkout this repo and run `docker build .`.
+  - Much safer.
+  - But if you can't trust upstream image `quay.io/sorah/rbenv:2.2`, write your own Dockerfile. This is just a simple Rack app.
 
 ## Configuration
 
@@ -94,6 +101,8 @@ run NginxOmniauthAdapter.app(
 
 ## How it works
 
+![](http://img.sorah.jp/2015-10-08_22.55_2s4hy.png)
+
 1. _browser_ access to restricted area (where `auth_request` has enabled)
 2. _nginx_ sends subrequest to `/_auth/challenge`. It will be proxied to _adapter app_ (`GET /test`)
 3. _adapter app_ `/test` returns 401 when _request (browser)_ doesn't have valid cookie

data/circle.yml

@@ -0,0 +1,35 @@
+machine:
+  services:
+    - docker
+  ruby:
+    version: 2.2.3
+
+dependencies:
+  cache_directories:
+    - bin
+    - ~/docker
+  pre:
+    - sudo apt-get install nginx
+    - if [ ! -d bin ]; then mkdir bin; fi
+    - if [ ! -x bin/git-set-mtime ]; then curl -o bin/git-set-mtime https://drone.io/github.com/rosylilly/git-set-mtime/files/artifacts/bin/linux_amd64/git-set-mtime && chmod +x bin/git-set-mtime; fi
+    - docker login -u "${DOCKER_USER}" -p "${DOCKER_PASSWORD}" -e "${DOCKER_EMAIL}" https://quay.io
+    - bin/git-set-mtime
+    - mkdir -p ~/docker
+    - if [[ -e ~/docker/cache.tar ]]; then docker load -i ~/docker/cache.tar; fi
+    - docker pull quay.io/sorah/rbenv:2.2
+    - BASE_ID="$(docker inspect -f '{{.Id}}' quay.io/sorah/rbenv:2.2)"; if [[ "_${BASE_ID}" != "_$(cat ~/docker/cache.id)" ]]; then docker save quay.io/sorah/rbenv:2.2 > ~/docker/cache.tar && echo "${BASE_ID}" > ~/docker/cache.id; fi
+    - docker pull quay.io/sorah/nginx_omniauth_adapter:latest
+    - docker build -t quay.io/sorah/nginx_omniauth_adapter:${CIRCLE_SHA1} .
+
+test:
+  override:
+    - bundle exec env ADAPTER_DOCKER=quay.io/sorah/nginx_omniauth_adapter:${CIRCLE_SHA1} rspec spec/integration_spec.rb
+    - "echo '==== LOG ====' && cat /tmp/nginx_omniauth_helper.spec.log"
+
+deployment:
+  production:
+    branch: master
+    commands:
+      - docker tag -f quay.io/sorah/nginx_omniauth_adapter:${CIRCLE_SHA1} quay.io/sorah/nginx_omniauth_adapter:latest
+      - docker push quay.io/sorah/nginx_omniauth_adapter:${CIRCLE_SHA1}
+      - docker push quay.io/sorah/nginx_omniauth_adapter:latest

data/example/nginx-site.conf

@@ -26,6 +26,7 @@ server {
   location / {
     auth_request /_auth/challenge;
     # Trick - do internal redirection when auth_request says "need auth". 
+    proxy_intercept_errors off;
     error_page 401 = /_auth/initiate;
 
     # Receive user info from adapter

data/example/nginx.conf

@@ -1,6 +1,7 @@
 # vim: ft=nginx
 worker_processes 1;
 daemon off;
+pid /tmp/nginx_omniauth_adapter-nginx.pid;
 
 error_log stderr;
 
@@ -13,5 +14,7 @@ http {
 
   server_names_hash_bucket_size 128;
 
+  access_log off;
+
   include nginx-site.conf;
 }

data/lib/nginx_omniauth_adapter/app.rb

@@ -3,6 +3,7 @@ require 'uri'
 require 'time'
 require 'openssl'
 require 'json'
+require 'securerandom'
 
 module NginxOmniauthAdapter
   class App < Sinatra::Base
@@ -60,13 +61,30 @@ module NginxOmniauthAdapter
         adapter_config[:policy_proc] || proc { true }
       end
 
+      def log(h={})
+        h = {
+          time: Time.now.xmlschema,
+          severity: :info,
+          logged_in: (!!current_user).inspect,
+          provider: current_user && current_user[:provider],
+          uid: current_user && current_user[:uid],
+          flow_id: current_flow_id,
+        }.merge(h)
+
+        str = h.map { |*kv| kv.join(?:) }.join(?\t)
+
+        puts str
+        if h[:severity] == :warning || h[:severity] == :error
+          $stderr.puts str
+        end
+      end
+
       def default_back_to
         # TODO:
         '/'
       end
 
       def sanitized_back_to_param
-        p params[:back_to]
         if allowed_back_to_url === params[:back_to]
           params[:back_to]
         else
@@ -75,7 +93,6 @@ module NginxOmniauthAdapter
       end
 
       def sanitized_app_callback_param
-        p params[:callback]
         if allowed_app_callback_url === params[:callback]
           params[:callback]
         else
@@ -83,6 +100,14 @@ module NginxOmniauthAdapter
         end
       end
 
+      def set_flow_id!
+        session[:flow_id] = SecureRandom.uuid
+      end
+
+      def current_flow_id
+        session[:flow_id]
+      end
+
       def current_user
         session[:user]
       end
@@ -117,6 +142,7 @@ module NginxOmniauthAdapter
 
       def update_session!(auth = nil)
         unless session[:app_callback]
+          log severity: :error, message: 'missing app_callback'
           raise '[BUG] app_callback is missing'
         end
 
@@ -148,7 +174,12 @@ module NginxOmniauthAdapter
         session.merge!(adapter_session)
 
         session_param = encrypt_session_param(app_session)
+
+        log(message: 'update_session', app_callback: session[:app_callback])
+
         redirect "#{session.delete(:app_callback)}?session=#{session_param}"
+      ensure
+        session[:flow_id] = nil
       end
 
       def secret_key
@@ -212,10 +243,12 @@ module NginxOmniauthAdapter
 
     get '/test' do
       unless current_user
+        log(message: 'test_not_logged_in', original_uri: request.env['HTTP_X_NGX_OMNIAUTH_ORIGINAL_URI'])
         halt 401
       end
 
       if app_authorization_expired?
+        log(message: 'test_app_authorization_expired', original_uri: request.env['HTTP_X_NGX_OMNIAUTH_ORIGINAL_URI'])
         halt 401
       end
 
@@ -238,34 +271,47 @@ module NginxOmniauthAdapter
       callback = URI.encode_www_form_component(request.env['HTTP_X_NGX_OMNIAUTH_INITIATE_CALLBACK'])
 
       if back_to == '' || callback == '' || back_to.nil? || callback.nil?
+        log(severity: :error, message: 'initiate_no_required_params', back_to: back_to, callback: callback)
         halt 400, {'Content-Type' => 'text/plain'}, 'x-ngx-omniauth-initiate-back-to and x-ngx-omniauth-initiate-callback header are required'
       end
 
+      log(message: 'initiate', adapter_host: adapter_host, back_to: back_to, callback: callback)
+
       redirect "#{adapter_host}/auth?back_to=#{back_to}&callback=#{callback}"
     end
 
     get '/auth' do
+      set_flow_id!
+
       # TODO: choose provider
       session[:back_to] = sanitized_back_to_param
       session[:app_callback] = sanitized_app_callback_param
-      p [:auth, session]
+
+      if session[:back_to] == '' || session[:app_callback] == '' || session[:back_to].nil? || session[:app_callback].nil?
+        log(severity: :error, message: 'auth_invalid_params', back_to: params[:back_to], callback: params[:callback])
+        halt 400, {'Content-Type' => 'text/plain'}, 'back_to or/and app_callback is invalid'
+      end
 
       if current_user && !adapter_authorization_expired?
-        p [:auth, :update]
+        log(message: 'auth_refresh_app', back_to: params[:back_to], callback: params[:callback])
         update_session!
       else
-        p [:auth, :redirect]
+        log(message: 'auth', provider: providers[0], back_to: params[:back_to], callback: params[:callback])
         redirect "#{adapter_host}/auth/#{providers[0]}"
       end
     end
 
     omniauth_callback = proc do
+
       session[:user_data] = {}
 
       unless instance_eval(&on_login_proc)
+        log(severity: :warning, message: 'omniauth_callback_forbidden', new_uid: env['omniauth.auth'][:uid])
         halt 403, {'Content-Type' => 'text/plain'}, 'Forbidden (on_login_proc policy)'
       end
 
+      log(message: 'omniauth_callback', new_uid: env['omniauth.auth'][:uid])
+
       session[:logged_in_at] = Time.now.xmlschema
       update_session! env['omniauth.auth']
     end
@@ -275,6 +321,7 @@ module NginxOmniauthAdapter
     get '/callback' do # app side
       app_session = decrypt_session_param(params[:session])
       session.merge!(app_session)
+      log(message: 'app_callback', back_to: session[:back_to])
       redirect session.delete(:back_to)
     end
   end

data/lib/nginx_omniauth_adapter/version.rb

@@ -1,3 +1,3 @@
 module NginxOmniauthAdapter
-  VERSION = "0.2.0"
+  VERSION = "1.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nginx_omniauth_adapter
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Shota Fukumori (sora_h)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-02 00:00:00.000000000 Z
+date: 2015-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -123,6 +123,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- circle.yml
 - config.ru
 - example/Procfile
 - example/nginx-site.conf