trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

outposts: clean up flow executor

Browse source 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-12-24 19:52:19 +01:00
parent abec906677
commit 884c546f32
3 changed files with 22 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
internal/outpost/flow/const.go Normal file
View file

@ -0,0 +1,15 @@
package flow
type StageComponent string
const (
StageIdentification = StageComponent("ak-stage-identification")
StagePassword = StageComponent("ak-stage-password")
StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
StageAccessDenied = StageComponent("ak-stage-access-denied")
)
const (
HeaderAuthentikRemoteIP = "X-authentik-remote-ip"
HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
)

18
internal/outpost/flow.go → internal/outpost/flow/executor.go
View file

@ -1,4 +1,4 @@
package outpost
package flow
import (
"context"
@ -19,8 +19,6 @@ import (
"goauthentik.io/internal/outpost/ak"
)
type StageComponent string
var (
FlowTimingGet = promauto.NewHistogramVec(prometheus.HistogramOpts{
Name: "authentik_outpost_flow_timing_get",
@ -32,18 +30,6 @@ var (
}, []string{"stage", "flow", "client", "user"})
)
const (
StageIdentification = StageComponent("ak-stage-identification")
StagePassword = StageComponent("ak-stage-password")
StageAuthenticatorValidate = StageComponent("ak-stage-authenticator-validate")
StageAccessDenied = StageComponent("ak-stage-access-denied")
)
const (
HeaderAuthentikRemoteIP = "X-authentik-remote-ip"
HeaderAuthentikOutpostToken = "X-authentik-outpost-token"
)
type FlowExecutor struct {
Params url.Values
Answers map[StageComponent]string
@ -183,7 +169,7 @@ func (fe *FlowExecutor) solveFlowChallenge(depth int) (bool, error) {
}
}
if deviceChallenge == nil {
return false, errors.New("got ak-stage-authenticator-validate without duo")
return false, errors.New("no compatible authenticator class found")
}
devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
if err != nil {

10
internal/outpost/ldap/bind/direct/direct.go
View file

@ -11,7 +11,7 @@ import (
"github.com/prometheus/client_golang/prometheus"
log "github.com/sirupsen/logrus"
"goauthentik.io/api"
"goauthentik.io/internal/outpost"
"goauthentik.io/internal/outpost/flow"
"goauthentik.io/internal/outpost/ldap/bind"
"goauthentik.io/internal/outpost/ldap/flags"
"goauthentik.io/internal/outpost/ldap/metrics"
@ -53,7 +53,7 @@ func (db *DirectBinder) GetUsername(dn string) (string, error) {
}
func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) {
fe := outpost.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{
fe := flow.NewFlowExecutor(req.Context(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{
"bindDN": req.BindDN,
"client": req.RemoteAddr(),
"requestId": req.ID(),
@ -61,8 +61,8 @@ func (db *DirectBinder) Bind(username string, req *bind.Request) (ldap.LDAPResul
fe.DelegateClientIP(req.RemoteAddr())
fe.Params.Add("goauthentik.io/outpost/ldap", "true")
fe.Answers[outpost.StageIdentification] = username
fe.Answers[outpost.StagePassword] = req.BindPW
fe.Answers[flow.StageIdentification] = username
fe.Answers[flow.StagePassword] = req.BindPW
passed, err := fe.Execute()
if !passed {
@ -152,7 +152,7 @@ func (db *DirectBinder) SearchAccessCheck(user api.UserSelf) *string {
}
func (db *DirectBinder) TimerFlowCacheExpiry() {
fe := outpost.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{})
fe := flow.NewFlowExecutor(context.Background(), db.si.GetFlowSlug(), db.si.GetAPIClient().GetConfig(), log.Fields{})
fe.Params.Add("goauthentik.io/outpost/ldap", "true")
fe.Params.Add("goauthentik.io/outpost/ldap-warmup", "true")