2021-09-08 18:04:56 +00:00
|
|
|
package application
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
2021-12-13 12:33:20 +00:00
|
|
|
"math"
|
2022-05-11 08:08:38 +00:00
|
|
|
"net/url"
|
2021-12-12 16:59:31 +00:00
|
|
|
"os"
|
2023-02-02 20:18:59 +00:00
|
|
|
"path"
|
2021-09-08 18:04:56 +00:00
|
|
|
"strconv"
|
2023-02-02 20:18:59 +00:00
|
|
|
"strings"
|
2021-09-08 18:04:56 +00:00
|
|
|
|
2023-02-02 20:18:59 +00:00
|
|
|
"github.com/garyburd/redigo/redis"
|
|
|
|
"github.com/gorilla/securecookie"
|
2021-09-08 18:04:56 +00:00
|
|
|
"github.com/gorilla/sessions"
|
2022-03-03 09:40:07 +00:00
|
|
|
"goauthentik.io/api/v3"
|
2021-09-08 18:04:56 +00:00
|
|
|
"goauthentik.io/internal/config"
|
2023-02-02 20:18:59 +00:00
|
|
|
"goauthentik.io/internal/outpost/proxyv2/constants"
|
2021-09-08 18:04:56 +00:00
|
|
|
"gopkg.in/boj/redistore.v1"
|
|
|
|
)
|
|
|
|
|
2023-02-02 20:18:59 +00:00
|
|
|
const RedisKeyPrefix = "authentik_proxy_session_"
|
|
|
|
|
2022-05-11 08:08:38 +00:00
|
|
|
func (a *Application) getStore(p api.ProxyOutpostConfig, externalHost *url.URL) sessions.Store {
|
2021-09-08 18:04:56 +00:00
|
|
|
var store sessions.Store
|
2022-07-26 09:33:35 +00:00
|
|
|
if config.Get().Redis.Host != "" {
|
2022-11-15 13:31:29 +00:00
|
|
|
rs, err := redistore.NewRediStoreWithDB(10, "tcp", fmt.Sprintf("%s:%d", config.Get().Redis.Host, config.Get().Redis.Port), config.Get().Redis.Password, strconv.Itoa(config.Get().Redis.DB), []byte(*p.CookieSecret))
|
2021-09-08 18:04:56 +00:00
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
2022-01-21 22:11:17 +00:00
|
|
|
rs.SetMaxLength(math.MaxInt)
|
2023-02-02 20:18:59 +00:00
|
|
|
rs.SetKeyPrefix(RedisKeyPrefix)
|
2021-09-25 14:12:59 +00:00
|
|
|
if p.TokenValidity.IsSet() {
|
|
|
|
t := p.TokenValidity.Get()
|
|
|
|
// Add one to the validity to ensure we don't have a session with indefinite length
|
2021-12-21 12:10:57 +00:00
|
|
|
rs.SetMaxAge(int(*t) + 1)
|
|
|
|
} else {
|
|
|
|
rs.SetMaxAge(0)
|
2021-09-25 14:12:59 +00:00
|
|
|
}
|
2021-09-08 18:04:56 +00:00
|
|
|
rs.Options.Domain = *p.CookieDomain
|
2022-05-21 11:18:06 +00:00
|
|
|
a.log.Trace("using redis session backend")
|
2021-09-08 18:04:56 +00:00
|
|
|
store = rs
|
|
|
|
} else {
|
2021-12-13 12:33:20 +00:00
|
|
|
dir := os.TempDir()
|
|
|
|
cs := sessions.NewFilesystemStore(dir, []byte(*p.CookieSecret))
|
|
|
|
// https://github.com/markbates/goth/commit/7276be0fdf719ddff753f3574ef0f967e4a5a5f7
|
|
|
|
// set the maxLength of the cookies stored on the disk to a larger number to prevent issues with:
|
|
|
|
// securecookie: the value is too long
|
|
|
|
// when using OpenID Connect , since this can contain a large amount of extra information in the id_token
|
|
|
|
|
|
|
|
// Note, when using the FilesystemStore only the session.ID is written to a browser cookie, so this is explicit for the storage on disk
|
2022-01-21 22:11:17 +00:00
|
|
|
cs.MaxLength(math.MaxInt)
|
2021-09-25 14:12:59 +00:00
|
|
|
if p.TokenValidity.IsSet() {
|
|
|
|
t := p.TokenValidity.Get()
|
|
|
|
// Add one to the validity to ensure we don't have a session with indefinite length
|
2021-12-21 12:10:57 +00:00
|
|
|
cs.MaxAge(int(*t) + 1)
|
|
|
|
} else {
|
|
|
|
cs.MaxAge(0)
|
2021-09-25 14:12:59 +00:00
|
|
|
}
|
2021-12-21 12:10:57 +00:00
|
|
|
cs.Options.Domain = *p.CookieDomain
|
2022-05-21 11:18:06 +00:00
|
|
|
a.log.WithField("dir", dir).Trace("using filesystem session backend")
|
2021-09-08 18:04:56 +00:00
|
|
|
store = cs
|
|
|
|
}
|
|
|
|
return store
|
|
|
|
}
|
2023-02-02 20:18:59 +00:00
|
|
|
|
|
|
|
func (a *Application) Logout(sub string) error {
|
|
|
|
if fs, ok := a.sessions.(*sessions.FilesystemStore); ok {
|
|
|
|
files, err := os.ReadDir(os.TempDir())
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
for _, file := range files {
|
|
|
|
s := sessions.Session{}
|
|
|
|
if !strings.HasPrefix(file.Name(), "session_") {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
fullPath := path.Join(os.TempDir(), file.Name())
|
|
|
|
data, err := os.ReadFile(fullPath)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to read file")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
err = securecookie.DecodeMulti(
|
|
|
|
constants.SessionName, string(data),
|
|
|
|
&s.Values, fs.Codecs...,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Trace("failed to decode session")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
claims := s.Values[constants.SessionClaims].(Claims)
|
|
|
|
if claims.Sub == sub {
|
|
|
|
a.log.WithField("path", fullPath).Trace("deleting session")
|
|
|
|
err := os.Remove(fullPath)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to delete session")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if rs, ok := a.sessions.(*redistore.RediStore); ok {
|
|
|
|
pool := rs.Pool.Get()
|
|
|
|
defer pool.Close()
|
|
|
|
rep, err := pool.Do("KEYS", fmt.Sprintf("%s*", RedisKeyPrefix))
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
keys, err := redis.Strings(rep, err)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ser := redistore.GobSerializer{}
|
|
|
|
for _, key := range keys {
|
|
|
|
v, err := pool.Do("GET", key)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to get value")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
b, err := redis.Bytes(v, err)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to load value")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
s := sessions.Session{}
|
|
|
|
err = ser.Deserialize(b, &s)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to deserialize")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
c := s.Values[constants.SessionClaims]
|
|
|
|
if c == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
claims := c.(Claims)
|
|
|
|
if claims.Sub == sub {
|
|
|
|
a.log.WithField("key", key).Trace("deleting session")
|
|
|
|
_, err := pool.Do("DEL", key)
|
|
|
|
if err != nil {
|
|
|
|
a.log.WithError(err).Warning("failed to delete key")
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|