diff --git a/packages/system/dashboard/images/token-proxy/main.go b/packages/system/dashboard/images/token-proxy/main.go index 34690107..a4a177d1 100644 --- a/packages/system/dashboard/images/token-proxy/main.go +++ b/packages/system/dashboard/images/token-proxy/main.go @@ -44,20 +44,89 @@ func init() { /* ----------------------------- templates -------------------------------- */ var loginTmpl = template.Must(template.New("login").Parse(` -Login + + + + + Login + + -

Enter ServiceAccount / OIDC token

- {{if .Err}}

{{.Err}}

{{end}} -
- - -
-`)) +
+

Kubernetes API Token

+ {{if .Err}}

{{.Err}}

{{end}} +
+ + +
+
+ +`)) /* ----------------------------- helpers ---------------------------------- */ func decodeJWT(raw string) jwt.MapClaims { - tkn, _ := jwt.Parse(raw, nil) + if raw == "" { + return jwt.MapClaims{} + } + tkn, _, err := new(jwt.Parser).ParseUnverified(raw, jwt.MapClaims{}) + if err != nil || tkn == nil { + return jwt.MapClaims{} + } if c, ok := tkn.Claims.(jwt.MapClaims); ok { return c } @@ -88,7 +157,10 @@ func encodeSession(sc *securecookie.SecureCookie, token string, exp, issued int6 "expires": exp, "issued": issued, } - return sc.Encode(cookieName, v) + if sc != nil { + return sc.Encode(cookieName, v) + } + return token, nil } /* ----------------------------- main ------------------------------------- */ @@ -106,14 +178,16 @@ func main() { if cookieSecretB64 == "" { cookieSecretB64 = os.Getenv("COOKIE_SECRET") } - if cookieSecretB64 == "" { - log.Fatal("--cookie-secret or $COOKIE_SECRET is required") + var sc *securecookie.SecureCookie + if cookieSecretB64 != "" { + secret, err := base64.StdEncoding.DecodeString(cookieSecretB64) + if err != nil { + log.Fatalf("cookie-secret: %v", err) + } + sc = securecookie.New(secret, nil) + } else { + log.Println("warning: no cookie-secret provided, cookies will be stored unsigned") } - secret, err := base64.StdEncoding.DecodeString(cookieSecretB64) - if err != nil { - log.Fatalf("cookie-secret: %v", err) - } - sc := securecookie.New(secret, nil) // control paths signIn := path.Join(proxyPrefix, "sign_in") @@ -189,12 +263,21 @@ func main() { http.Error(w, "unauthorized", http.StatusUnauthorized) return } + var token string var sess map[string]interface{} - if err := sc.Decode(cookieName, c.Value, &sess); err != nil { - http.Error(w, "unauthorized", http.StatusUnauthorized) - return + if sc != nil { + if err := sc.Decode(cookieName, c.Value, &sess); err != nil { + http.Error(w, "unauthorized", http.StatusUnauthorized) + return + } + token, _ = sess["access_token"].(string) + } else { + token = c.Value + sess = map[string]interface{}{ + "expires": time.Now().Add(24 * time.Hour).Unix(), + "issued": time.Now().Unix(), + } } - token, _ := sess["access_token"].(string) claims := decodeJWT(token) out := map[string]interface{}{ @@ -219,12 +302,21 @@ func main() { http.Redirect(w, r, signIn, http.StatusFound) return } + var token string var sess map[string]interface{} - if err := sc.Decode(cookieName, c.Value, &sess); err != nil { - http.Redirect(w, r, signIn, http.StatusFound) - return + if sc != nil { + if err := sc.Decode(cookieName, c.Value, &sess); err != nil { + http.Redirect(w, r, signIn, http.StatusFound) + return + } + token, _ = sess["access_token"].(string) + } else { + token = c.Value + sess = map[string]interface{}{ + "expires": time.Now().Add(24 * time.Hour).Unix(), + "issued": time.Now().Unix(), + } } - token, _ := sess["access_token"].(string) if token == "" { http.Redirect(w, r, signIn, http.StatusFound) return