Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Workaround for OIDC core issue #23

Merged
merged 2 commits into from
Mar 16, 2023
Merged

Workaround for OIDC core issue #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5f38cc1
Bump Dex 2.35
iaean Mar 16, 2023
146db4b
Add client ID with trustedPeers
iaean Mar 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM dexidp/dex:v2.33.0
FROM dexidp/dex:v2.35.3

LABEL org.opencontainers.image.title="dns3l auth"
LABEL org.opencontainers.image.description="An OIDC provider for DNS3L"
Expand Down
11 changes: 10 additions & 1 deletion config.docker.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ web:
https: 0.0.0.0:5554
tlsCert: {{.Env.DEXPATH}}/tls.crt
tlsKey: {{.Env.DEXPATH}}/tls.key
allowedOrigins: ['*']
allowedOrigins: ['*'] # .Env.DNS3L_FQDN

grpc:
addr: 0.0.0.0:5557
Expand Down Expand Up @@ -71,6 +71,15 @@ staticClients:
# https://tools.ietf.org/html/rfc6749#section-4.3
secret: {{.Env.DNS3L_API_SECRET}}
name: 'DNS3L API'
- id: dns3ld
# dns3ld can only validate against a single client ID actually...
# https://github.com/dns3l/dns3l-core/issues/59
secret: {{.Env.DNS3L_DAEMON_SECRET}}
name: 'DNS3L daemon validator'
trustedPeers:
- dns3l-app # new scope: audience:server:client_id:dns3ld
- dns3l-api # new scope: audience:server:client_id:dns3ld
- dns3l-cli # new scope: audience:server:client_id:dns3ld

{{if eq .Env.production "false" -}}
# Note: Prod SHOULD NOT provide mock and local
Expand Down
28 changes: 28 additions & 0 deletions docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,38 @@ function random_token() {
tr -cd '[:alnum:]' </dev/urandom | fold -w32 | head -n1
}

# inspired by https://www.rfc-editor.org/rfc/rfc3986#appendix-B
# //URL prefix required. Not for IPv6 ([2001:db8::7]) addresses.
readonly URI_REGEX='^(([^:/?#]+):)?(//((([^:/?#]+)@)?([^:/?#]+)(:([0-9]+))?))?(/([^?#]*))?(\?([^#]*))?(#(.*))?'
protFromURL () {
[[ "$@" =~ $URI_REGEX ]] && echo "${BASH_REMATCH[2],,}"
}
hostFromURL () {
[[ "$@" =~ $URI_REGEX ]] && echo "${BASH_REMATCH[7],,}"
}
portFromURL () {
if [[ "$@" =~ $URI_REGEX ]]; then
if [[ -z "${BASH_REMATCH[9]}" ]]; then
case "${BASH_REMATCH[2],,}" in
# some default ports...
http) echo "80" ;;
https) echo "443" ;;
ldap) echo "389" ;;
ldaps) echo "636" ;;
esac
else
echo "${BASH_REMATCH[9]}"
fi
fi
}

SERVICE_TIMEOUT=${SERVICE_TIMEOUT:-300s} # wait for dependencies

echo Running: "$@"

export DEX_URL=${DEX_URL:-"http://localhost:5556/auth"}
export DNS3L_URL=${DNS3L_URL:-"http://localhost:3000"}
export DNS3L_FQDN=`hostFromURL ${DNS3L_URL}`
export HELP_URL=${HELP_URL:-"https://github.com/dns3l/dns3l"}

export LDAP_CONNECTOR_ID=${LDAP_CONNECTOR_ID:-"ldap"}
Expand Down Expand Up @@ -110,6 +136,8 @@ P=$(random_token)
export DNS3L_CLI_SECRET=${DNS3L_CLI_SECRET:-$P}
P=$(random_token)
export DNS3L_API_SECRET=${DNS3L_API_SECRET:-$P}
P=$(random_token)
export DNS3L_DAEMON_SECRET=${DNS3L_DAEMON_SECRET:-$P}

# Avoid destroying bootstrapping by simple start/stop
if [[ ! -e ${DEXPATH}/.bootstrapped ]]; then
Expand Down