Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
2020fengziyang
kubesphere
提交
d7607b3e
K
kubesphere
项目概览
2020fengziyang
/
kubesphere
与 Fork 源项目一致
Fork自
KubeSphere / kubesphere
通知
1
Star
1
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
K
kubesphere
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
未验证
提交
d7607b3e
编写于
12月 11, 2020
作者:
K
KubeSphere CI Bot
提交者:
GitHub
12月 11, 2020
浏览文件
操作
浏览文件
下载
差异文件
Merge pull request #3167 from wansir/sensitive-config
config data desensitization
上级
af5b1fe6
13ede7da
变更
3
显示空白变更内容
内联
并排
Showing
3 changed file
with
93 addition
and
18 deletion
+93
-18
pkg/apiserver/authentication/oauth/oauth_options.go
pkg/apiserver/authentication/oauth/oauth_options.go
+51
-0
pkg/apiserver/authentication/oauth/oauth_options_test.go
pkg/apiserver/authentication/oauth/oauth_options_test.go
+41
-0
pkg/kapis/config/v1alpha2/register.go
pkg/kapis/config/v1alpha2/register.go
+1
-18
未找到文件。
pkg/apiserver/authentication/oauth/oauth_options.go
浏览文件 @
d7607b3e
...
...
@@ -17,9 +17,11 @@ limitations under the License.
package
oauth
import
(
"encoding/json"
"errors"
"kubesphere.io/kubesphere/pkg/utils/sliceutil"
"net/url"
"strings"
"time"
)
...
...
@@ -75,8 +77,57 @@ type Options struct {
AccessTokenInactivityTimeout
time
.
Duration
`json:"accessTokenInactivityTimeout" yaml:"accessTokenInactivityTimeout"`
}
// the type of key must be string
type
DynamicOptions
map
[
string
]
interface
{}
func
(
o
DynamicOptions
)
MarshalJSON
()
([]
byte
,
error
)
{
data
,
err
:=
json
.
Marshal
(
desensitize
(
o
))
return
data
,
err
}
var
(
sensitiveKeys
=
[
...
]
string
{
"password"
,
"secret"
}
)
// isSensitiveData returns whether the input string contains sensitive information
func
isSensitiveData
(
key
string
)
bool
{
for
_
,
v
:=
range
sensitiveKeys
{
if
strings
.
Contains
(
strings
.
ToLower
(
key
),
v
)
{
return
true
}
}
return
false
}
// desensitize returns the desensitized data
func
desensitize
(
data
map
[
string
]
interface
{})
map
[
string
]
interface
{}
{
output
:=
make
(
map
[
string
]
interface
{})
for
k
,
v
:=
range
data
{
if
isSensitiveData
(
k
)
{
continue
}
switch
v
.
(
type
)
{
case
map
[
interface
{}]
interface
{}
:
output
[
k
]
=
desensitize
(
convert
(
v
.
(
map
[
interface
{}]
interface
{})))
default
:
output
[
k
]
=
v
}
}
return
output
}
// convert returns formatted data
func
convert
(
m
map
[
interface
{}]
interface
{})
map
[
string
]
interface
{}
{
output
:=
make
(
map
[
string
]
interface
{})
for
k
,
v
:=
range
m
{
switch
k
.
(
type
)
{
case
string
:
output
[
k
.
(
string
)]
=
v
}
}
return
output
}
type
IdentityProviderOptions
struct
{
// The provider name.
Name
string
`json:"name" yaml:"name"`
...
...
pkg/apiserver/authentication/oauth/oauth_options_test.go
浏览文件 @
d7607b3e
...
...
@@ -17,7 +17,9 @@ limitations under the License.
package
oauth
import
(
"encoding/json"
"github.com/google/go-cmp/cmp"
"gopkg.in/yaml.v3"
"testing"
"time"
)
...
...
@@ -101,3 +103,42 @@ func TestClientResolveRedirectURL(t *testing.T) {
}
}
}
func
TestDynamicOptions_MarshalJSON
(
t
*
testing
.
T
)
{
config
:=
`
accessTokenMaxAge: 1h
accessTokenInactivityTimeout: 30m
identityProviders:
- name: ldap
type: LDAPIdentityProvider
mappingMethod: auto
provider:
host: xxxx.sn.mynetname.net:389
managerDN: uid=root,cn=users,dc=xxxx,dc=sn,dc=mynetname,dc=net
managerPassword: xxxx
userSearchBase: dc=xxxx,dc=sn,dc=mynetname,dc=net
loginAttribute: uid
mailAttribute: mail
- name: github
type: GitHubIdentityProvider
mappingMethod: mixed
provider:
clientID: 'xxxxxx'
clientSecret: 'xxxxxx'
endpoint:
authURL: 'https://github.com/login/oauth/authorize'
tokenURL: 'https://github.com/login/oauth/access_token'
redirectURL: 'https://ks-console/oauth/redirect'
scopes:
- user
`
var
options
Options
if
err
:=
yaml
.
Unmarshal
([]
byte
(
config
),
&
options
);
err
!=
nil
{
t
.
Error
(
err
)
}
expected
:=
`{"identityProviders":[{"name":"ldap","mappingMethod":"auto","type":"LDAPIdentityProvider","provider":{"host":"xxxx.sn.mynetname.net:389","loginAttribute":"uid","mailAttribute":"mail","managerDN":"uid=root,cn=users,dc=xxxx,dc=sn,dc=mynetname,dc=net","userSearchBase":"dc=xxxx,dc=sn,dc=mynetname,dc=net"}},{"name":"github","mappingMethod":"mixed","type":"GitHubIdentityProvider","provider":{"clientID":"xxxxxx","endpoint":{"authURL":"https://github.com/login/oauth/authorize","tokenURL":"https://github.com/login/oauth/access_token"},"redirectURL":"https://ks-console/oauth/redirect","scopes":["user"]}}],"accessTokenMaxAge":3600000000000,"accessTokenInactivityTimeout":1800000000000}`
output
,
_
:=
json
.
Marshal
(
options
)
if
expected
!=
string
(
output
)
{
t
.
Errorf
(
"expected: %s, but got: %s"
,
expected
,
output
)
}
}
pkg/kapis/config/v1alpha2/register.go
浏览文件 @
d7607b3e
...
...
@@ -18,11 +18,7 @@ package v1alpha2
import
(
"github.com/emicklei/go-restful"
"gopkg.in/yaml.v3"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/klog"
"kubesphere.io/kubesphere/pkg/api"
"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
kubesphereconfig
"kubesphere.io/kubesphere/pkg/apiserver/config"
"kubesphere.io/kubesphere/pkg/apiserver/runtime"
)
...
...
@@ -39,20 +35,7 @@ func AddToContainer(c *restful.Container, config *kubesphereconfig.Config) error
webservice
.
Route
(
webservice
.
GET
(
"/configs/oauth"
)
.
Doc
(
"Information about the authorization server are published."
)
.
To
(
func
(
request
*
restful
.
Request
,
response
*
restful
.
Response
)
{
// workaround for this issue https://github.com/go-yaml/yaml/issues/139
// fixed in gopkg.in/yaml.v3
yamlData
,
err
:=
yaml
.
Marshal
(
config
.
AuthenticationOptions
.
OAuthOptions
)
if
err
!=
nil
{
klog
.
Error
(
err
)
api
.
HandleInternalError
(
response
,
request
,
err
)
}
var
options
oauth
.
Options
err
=
yaml
.
Unmarshal
(
yamlData
,
&
options
)
if
err
!=
nil
{
klog
.
Error
(
err
)
api
.
HandleInternalError
(
response
,
request
,
err
)
}
response
.
WriteEntity
(
options
)
response
.
WriteEntity
(
config
.
AuthenticationOptions
.
OAuthOptions
)
}))
webservice
.
Route
(
webservice
.
GET
(
"/configs/configz"
)
.
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录