203 lines
4.9 KiB
Go
203 lines
4.9 KiB
Go
package main
|
|
|
|
import (
|
|
// "flag"
|
|
"fmt"
|
|
// "html"
|
|
"code.google.com/p/go-uuid/uuid"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
// "fmt"
|
|
"github.com/golang/groupcache/lru"
|
|
// "html"
|
|
"github.com/namsral/flag"
|
|
"log"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
var nonceCache = lru.New(20)
|
|
|
|
func main() {
|
|
|
|
proxyUriPtr := flag.String("proxy-url", "", "uri to listen on eg: http://localhost:2000")
|
|
originUriPtr := flag.String("origin-url", "", "origin to proxy eg: http://somesecrethost:2001")
|
|
ssoSecretPtr := flag.String("sso-secret", "", "SSO secret for origin")
|
|
ssoUriPtr := flag.String("sso-url", "", "SSO endpoint eg: http://yourdiscourse.com")
|
|
|
|
flag.Parse()
|
|
|
|
originUrl, err := url.Parse(*originUriPtr)
|
|
|
|
if err != nil {
|
|
flag.Usage()
|
|
log.Fatal("invalid origin url")
|
|
}
|
|
|
|
_, err = url.Parse(*ssoUriPtr)
|
|
|
|
if err != nil {
|
|
log.Fatal("invalid sso url, should point at Discourse site with enable sso")
|
|
}
|
|
|
|
proxyUrl, err2 := url.Parse(*proxyUriPtr)
|
|
|
|
if err2 != nil {
|
|
log.Fatal("invalid proxy uri")
|
|
}
|
|
|
|
cookieSecret := uuid.New()
|
|
|
|
proxy := httputil.NewSingleHostReverseProxy(originUrl)
|
|
|
|
// origDirector := proxy.Director
|
|
// proxy.Director = func(req *http.Request) {
|
|
// fmt.Printf("I WAS CALLED")
|
|
// req.Header.Set("Original-Request", req.URL.String())
|
|
// origDirector(req)
|
|
// }
|
|
|
|
handler := redirectIfCookieMissing(proxy, *ssoSecretPtr, cookieSecret, *ssoUriPtr)
|
|
|
|
server := &http.Server{
|
|
Addr: proxyUrl.Host,
|
|
Handler: handler,
|
|
ReadTimeout: 10 * time.Second,
|
|
WriteTimeout: 10 * time.Second,
|
|
MaxHeaderBytes: 1 << 20,
|
|
}
|
|
|
|
log.Fatal(server.ListenAndServe())
|
|
}
|
|
|
|
func envOrFlag(name, help string) string {
|
|
flag.String(name, "", help)
|
|
|
|
return ""
|
|
}
|
|
|
|
func redirectIfCookieMissing(handler http.Handler, ssoSecret, cookieSecret, ssoUri string) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
cookie, _ := r.Cookie("__discourse_proxy")
|
|
|
|
var username string
|
|
var err error
|
|
|
|
if cookie != nil {
|
|
username, err = parseCookie(cookie.Value, cookieSecret)
|
|
}
|
|
|
|
if err == nil {
|
|
r.Header.Set("Discourse-User-Name", username)
|
|
handler.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
query := r.URL.Query()
|
|
sso := query.Get("sso")
|
|
sig := query.Get("sig")
|
|
|
|
if len(sso) == 0 {
|
|
url := ssoUri + "/session/sso_provider?" + sso_payload(ssoSecret, "http://"+r.Host, r.URL.String())
|
|
http.Redirect(w, r, url, 302)
|
|
} else {
|
|
decoded, _ := base64.StdEncoding.DecodeString(sso)
|
|
decodedString := string(decoded)
|
|
parsedQuery, _ := url.ParseQuery(decodedString)
|
|
|
|
username := parsedQuery["username"]
|
|
admin := parsedQuery["admin"]
|
|
nonce := parsedQuery["nonce"]
|
|
|
|
if len(nonce) > 0 && len(admin) > 0 && len(username) > 0 && admin[0] == "true" {
|
|
returnUrl, err := getReturnUrl(ssoSecret, sso, sig, nonce[0])
|
|
|
|
if err != nil {
|
|
fmt.Fprintf(w, "Invalid request")
|
|
return
|
|
}
|
|
|
|
// we have a valid auth
|
|
expiration := time.Now().Add(365 * 24 * time.Hour)
|
|
|
|
cookie := http.Cookie{Name: "__discourse_proxy", Value: signCookie(username[0], cookieSecret), Expires: expiration, HttpOnly: true}
|
|
http.SetCookie(w, &cookie)
|
|
// works around weird safari stuff
|
|
fmt.Fprintf(w, "<html><head></head><body><script>window.location = '%v'</script></body>", returnUrl)
|
|
}
|
|
}
|
|
|
|
})
|
|
}
|
|
|
|
func getReturnUrl(secret string, payload string, sig string, nonce string) (returnUrl string, err error) {
|
|
value, gotNonce := nonceCache.Get(nonce)
|
|
returnUrl = value.(string)
|
|
nonceCache.Remove(nonce)
|
|
valid := ComputeHmac256(payload, secret) == sig && gotNonce
|
|
if !valid {
|
|
err = fmt.Errorf("Signature is invalid")
|
|
}
|
|
return
|
|
}
|
|
|
|
func sameHost(handler http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
r.Host = r.URL.Host
|
|
handler.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func signCookie(data, secret string) string {
|
|
return data + "," + ComputeHmac256(data, secret)
|
|
}
|
|
|
|
func parseCookie(data, secret string) (parsed string, err error) {
|
|
err = nil
|
|
parsed = ""
|
|
|
|
split := strings.Split(data, ",")
|
|
|
|
if len(split) < 2 {
|
|
err = fmt.Errorf("Expecting a semi column in cookie")
|
|
return
|
|
}
|
|
|
|
signature := split[len(split)-1]
|
|
parsed = strings.Join(split[:len(split)-1], ",")
|
|
expected := ComputeHmac256(parsed, secret)
|
|
|
|
if expected != signature {
|
|
parsed = ""
|
|
err = fmt.Errorf("Expecting signature to match")
|
|
return
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func sso_payload(secret string, return_sso_url string, returnUrl string) string {
|
|
result := "return_sso_url=" + return_sso_url + "&nonce=" + addNonce(returnUrl)
|
|
payload := base64.StdEncoding.EncodeToString([]byte(result))
|
|
|
|
return "sso=" + payload + "&sig=" + ComputeHmac256(payload, secret)
|
|
}
|
|
|
|
func addNonce(returnUrl string) string {
|
|
guid := uuid.New()
|
|
nonceCache.Add(guid, returnUrl)
|
|
return guid
|
|
}
|
|
|
|
func ComputeHmac256(message string, secret string) string {
|
|
key := []byte(secret)
|
|
h := hmac.New(sha256.New, key)
|
|
h.Write([]byte(message))
|
|
return hex.EncodeToString(h.Sum(nil))
|
|
}
|