netmaker/logic/jwts.go

151 lines
4.3 KiB
Go
Raw Normal View History

2021-10-27 00:27:29 +08:00
package logic
2021-03-26 00:17:52 +08:00
import (
2021-08-10 04:18:24 +08:00
"errors"
2022-02-15 22:51:21 +08:00
"fmt"
2021-08-10 04:18:24 +08:00
"time"
2021-10-09 03:07:12 +08:00
2021-08-10 05:57:40 +08:00
"github.com/golang-jwt/jwt/v4"
2022-02-15 22:51:21 +08:00
"github.com/gravitl/netmaker/logger"
2021-08-10 04:18:24 +08:00
"github.com/gravitl/netmaker/models"
"github.com/gravitl/netmaker/servercfg"
2021-03-26 00:17:52 +08:00
)
2022-02-15 22:51:21 +08:00
var jwtSecretKey []byte
// SetJWTSecret - sets the jwt secret on server startup
func SetJWTSecret() {
currentSecret, jwtErr := FetchJWTSecret()
if jwtErr != nil {
2022-02-16 10:50:47 +08:00
newValue, err := GenerateCryptoString(64)
if err != nil {
logger.FatalLog("something went wrong when generating JWT signature")
}
jwtSecretKey = []byte(newValue) // 512 bit random password
2022-02-15 22:51:21 +08:00
if err := StoreJWTSecret(string(jwtSecretKey)); err != nil {
logger.FatalLog("something went wrong when configuring JWT authentication")
}
} else {
jwtSecretKey = []byte(currentSecret)
}
}
2021-03-26 00:17:52 +08:00
// CreateJWT func will used to create the JWT while signing in and signing out
2022-01-11 06:52:21 +08:00
func CreateJWT(uuid string, macAddress string, network string) (response string, err error) {
2021-08-10 04:18:24 +08:00
expirationTime := time.Now().Add(5 * time.Minute)
claims := &models.Claims{
2022-01-11 06:52:21 +08:00
ID: uuid,
2021-08-10 04:18:24 +08:00
Network: network,
2022-01-11 06:52:21 +08:00
MacAddress: macAddress,
2022-06-27 22:47:28 +08:00
RegisteredClaims: jwt.RegisteredClaims{
2022-02-15 22:51:21 +08:00
Issuer: "Netmaker",
Subject: fmt.Sprintf("node|%s", uuid),
2022-06-27 22:47:28 +08:00
IssuedAt: jwt.NewNumericDate(time.Now()),
ExpiresAt: jwt.NewNumericDate(expirationTime),
2021-08-10 04:18:24 +08:00
},
}
2021-03-26 00:17:52 +08:00
2021-08-10 04:18:24 +08:00
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
tokenString, err := token.SignedString(jwtSecretKey)
if err == nil {
return tokenString, nil
}
return "", err
2021-03-26 00:17:52 +08:00
}
2022-09-14 03:25:56 +08:00
// CreateProUserJWT - creates a user jwt token
func CreateProUserJWT(username string, networks, groups []string, isadmin bool) (response string, err error) {
expirationTime := time.Now().Add(60 * 12 * time.Minute)
claims := &models.UserClaims{
UserName: username,
Networks: networks,
IsAdmin: isadmin,
Groups: groups,
RegisteredClaims: jwt.RegisteredClaims{
Issuer: "Netmaker",
Subject: fmt.Sprintf("user|%s", username),
IssuedAt: jwt.NewNumericDate(time.Now()),
ExpiresAt: jwt.NewNumericDate(expirationTime),
},
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
tokenString, err := token.SignedString(jwtSecretKey)
if err == nil {
return tokenString, nil
}
return "", err
}
2021-10-09 03:07:12 +08:00
// CreateUserJWT - creates a user jwt token
2021-07-02 12:03:46 +08:00
func CreateUserJWT(username string, networks []string, isadmin bool) (response string, err error) {
2021-08-10 05:57:40 +08:00
expirationTime := time.Now().Add(60 * 12 * time.Minute)
2021-08-10 04:18:24 +08:00
claims := &models.UserClaims{
UserName: username,
Networks: networks,
IsAdmin: isadmin,
2022-06-27 22:47:28 +08:00
RegisteredClaims: jwt.RegisteredClaims{
2022-02-15 22:51:21 +08:00
Issuer: "Netmaker",
Subject: fmt.Sprintf("user|%s", username),
2022-06-27 22:47:28 +08:00
IssuedAt: jwt.NewNumericDate(time.Now()),
ExpiresAt: jwt.NewNumericDate(expirationTime),
2021-08-10 04:18:24 +08:00
},
}
2021-03-26 00:17:52 +08:00
2021-08-10 04:18:24 +08:00
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
tokenString, err := token.SignedString(jwtSecretKey)
if err == nil {
return tokenString, nil
}
return "", err
2021-03-26 00:17:52 +08:00
}
// VerifyUserToken func will used to Verify the JWT Token while using APIS
2021-07-02 12:03:46 +08:00
func VerifyUserToken(tokenString string) (username string, networks []string, isadmin bool, err error) {
2021-08-10 04:18:24 +08:00
claims := &models.UserClaims{}
2021-03-26 00:17:52 +08:00
if tokenString == servercfg.GetMasterKey() && servercfg.GetMasterKey() != "" {
2021-08-10 04:18:24 +08:00
return "masteradministrator", nil, true, nil
}
2021-04-15 10:59:25 +08:00
2021-08-10 04:18:24 +08:00
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
return jwtSecretKey, nil
})
2021-03-26 00:17:52 +08:00
2021-08-10 04:18:24 +08:00
if token != nil && token.Valid {
var user *models.User
2021-08-10 04:18:24 +08:00
// check that user exists
user, err = GetUser(claims.UserName)
if err != nil {
2022-12-07 16:28:06 +08:00
return "", nil, false, err
}
if user.UserName != "" {
2021-08-10 04:18:24 +08:00
return claims.UserName, claims.Networks, claims.IsAdmin, nil
}
err = errors.New("user does not exist")
}
return "", nil, false, err
2021-03-26 00:17:52 +08:00
}
2022-04-22 03:53:44 +08:00
// VerifyToken - [nodes] Only
2022-01-11 06:52:21 +08:00
func VerifyToken(tokenString string) (nodeID string, mac string, network string, err error) {
2021-08-10 04:18:24 +08:00
claims := &models.Claims{}
2021-03-26 00:17:52 +08:00
// this may be a stupid way of serving up a master key
// TODO: look into a different method. Encryption?
if tokenString == servercfg.GetMasterKey() && servercfg.GetMasterKey() != "" {
2022-01-11 06:52:21 +08:00
return "mastermac", "", "", nil
2021-08-10 04:18:24 +08:00
}
2021-03-26 00:17:52 +08:00
2021-08-10 04:18:24 +08:00
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
return jwtSecretKey, nil
})
2021-03-26 00:17:52 +08:00
2021-08-10 04:18:24 +08:00
if token != nil {
2022-01-11 06:52:21 +08:00
return claims.ID, claims.MacAddress, claims.Network, nil
2021-08-10 04:18:24 +08:00
}
2022-01-11 06:52:21 +08:00
return "", "", "", err
2021-03-26 00:17:52 +08:00
}