mirror of https://github.com/tailscale/tailscale/
cmd/tailscale/cli,feature: add support for identity federation (#17529)
Add new arguments to `tailscale up` so authkeys can be generated dynamically via identity federation. Updates #9192 Signed-off-by: mcoulombe <max@tailscale.com>bradfitz/test
Max Coulombe
2 months ago
committed by
GitHub
parent
54cee33bae
commit
6a73c0bdf5
@ -0,0 +1,13 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Code generated by gen.go; DO NOT EDIT.
|
||||||
|
|
||||||
|
//go:build ts_omit_identity_federation
|
||||||
|
|
||||||
|
package buildfeatures
|
||||||
|
|
||||||
|
// HasIdentityFederation is whether the binary was built with support for modular feature "Identity token exchange for auth key support".
|
||||||
|
// Specifically, it's whether the binary was NOT built with the "ts_omit_identity_federation" build tag.
|
||||||
|
// It's a const so it can be used for dead code elimination.
|
||||||
|
const HasIdentityFederation = false
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Code generated by gen.go; DO NOT EDIT.
|
||||||
|
|
||||||
|
//go:build !ts_omit_identity_federation
|
||||||
|
|
||||||
|
package buildfeatures
|
||||||
|
|
||||||
|
// HasIdentityFederation is whether the binary was built with support for modular feature "Identity token exchange for auth key support".
|
||||||
|
// Specifically, it's whether the binary was NOT built with the "ts_omit_identity_federation" build tag.
|
||||||
|
// It's a const so it can be used for dead code elimination.
|
||||||
|
const HasIdentityFederation = true
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package identityfederation registers support for authkey resolution
|
||||||
|
// via identity federation if it's not disabled by the
|
||||||
|
// ts_omit_identityfederation build tag.
|
||||||
|
package identityfederation
|
||||||
@ -0,0 +1,8 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
//go:build !ts_omit_identityfederation
|
||||||
|
|
||||||
|
package identityfederation
|
||||||
|
|
||||||
|
import _ "tailscale.com/feature/identityfederation"
|
||||||
@ -0,0 +1,127 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package identityfederation registers support for using ID tokens to
|
||||||
|
// automatically request authkeys for logging in.
|
||||||
|
package identityfederation
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"golang.org/x/oauth2"
|
||||||
|
"tailscale.com/feature"
|
||||||
|
"tailscale.com/internal/client/tailscale"
|
||||||
|
"tailscale.com/ipn"
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
feature.Register("identityfederation")
|
||||||
|
tailscale.HookResolveAuthKeyViaWIF.Set(resolveAuthKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
// resolveAuthKey uses OIDC identity federation to exchange the provided ID token and client ID for an authkey.
|
||||||
|
func resolveAuthKey(ctx context.Context, baseURL, clientID, idToken string, tags []string) (string, error) {
|
||||||
|
if clientID == "" {
|
||||||
|
return "", nil // Short-circuit, no client ID means not using identity federation
|
||||||
|
}
|
||||||
|
|
||||||
|
if idToken == "" {
|
||||||
|
return "", errors.New("federated identity authkeys require --id-token")
|
||||||
|
}
|
||||||
|
if len(tags) == 0 {
|
||||||
|
return "", errors.New("federated identity authkeys require --advertise-tags")
|
||||||
|
}
|
||||||
|
if baseURL == "" {
|
||||||
|
baseURL = ipn.DefaultControlURL
|
||||||
|
}
|
||||||
|
|
||||||
|
ephemeral, preauth, err := parseOptionalAttributes(clientID)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("failed to parse optional config attributes: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
accessToken, err := exchangeJWTForToken(ctx, baseURL, clientID, idToken)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("failed to exchange JWT for access token: %w", err)
|
||||||
|
}
|
||||||
|
if accessToken == "" {
|
||||||
|
return "", errors.New("received empty access token from Tailscale")
|
||||||
|
}
|
||||||
|
|
||||||
|
tsClient := tailscale.NewClient("-", tailscale.APIKey(accessToken))
|
||||||
|
tsClient.UserAgent = "tailscale-cli-identity-federation"
|
||||||
|
tsClient.BaseURL = baseURL
|
||||||
|
|
||||||
|
authkey, _, err := tsClient.CreateKey(ctx, tailscale.KeyCapabilities{
|
||||||
|
Devices: tailscale.KeyDeviceCapabilities{
|
||||||
|
Create: tailscale.KeyDeviceCreateCapabilities{
|
||||||
|
Reusable: false,
|
||||||
|
Ephemeral: ephemeral,
|
||||||
|
Preauthorized: preauth,
|
||||||
|
Tags: tags,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("unexpected error while creating authkey: %w", err)
|
||||||
|
}
|
||||||
|
if authkey == "" {
|
||||||
|
return "", errors.New("received empty authkey from control server")
|
||||||
|
}
|
||||||
|
|
||||||
|
return authkey, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func parseOptionalAttributes(clientID string) (ephemeral bool, preauthorized bool, err error) {
|
||||||
|
_, attrs, found := strings.Cut(clientID, "?")
|
||||||
|
if !found {
|
||||||
|
return true, false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
parsed, err := url.ParseQuery(attrs)
|
||||||
|
if err != nil {
|
||||||
|
return false, false, fmt.Errorf("failed to parse optional config attributes: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
for k := range parsed {
|
||||||
|
switch k {
|
||||||
|
case "ephemeral":
|
||||||
|
ephemeral, err = strconv.ParseBool(parsed.Get(k))
|
||||||
|
case "preauthorized":
|
||||||
|
preauthorized, err = strconv.ParseBool(parsed.Get(k))
|
||||||
|
default:
|
||||||
|
return false, false, fmt.Errorf("unknown optional config attribute %q", k)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return ephemeral, preauthorized, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// exchangeJWTForToken exchanges a JWT for a Tailscale access token.
|
||||||
|
func exchangeJWTForToken(ctx context.Context, baseURL, clientID, idToken string) (string, error) {
|
||||||
|
httpClient := &http.Client{Timeout: 10 * time.Second}
|
||||||
|
ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
|
||||||
|
|
||||||
|
token, err := (&oauth2.Config{
|
||||||
|
Endpoint: oauth2.Endpoint{
|
||||||
|
TokenURL: fmt.Sprintf("%s/api/v2/oauth/token-exchange", baseURL),
|
||||||
|
},
|
||||||
|
}).Exchange(ctx, "", oauth2.SetAuthURLParam("client_id", clientID), oauth2.SetAuthURLParam("jwt", idToken))
|
||||||
|
if err != nil {
|
||||||
|
// Try to extract more detailed error message
|
||||||
|
var retrieveErr *oauth2.RetrieveError
|
||||||
|
if errors.As(err, &retrieveErr) {
|
||||||
|
return "", fmt.Errorf("token exchange failed with status %d: %s", retrieveErr.Response.StatusCode, string(retrieveErr.Body))
|
||||||
|
}
|
||||||
|
return "", fmt.Errorf("unexpected token exchange request error: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return token.AccessToken, nil
|
||||||
|
}
|
||||||
@ -0,0 +1,167 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package identityfederation
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestResolveAuthKey(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
clientID string
|
||||||
|
idToken string
|
||||||
|
tags []string
|
||||||
|
wantAuthKey string
|
||||||
|
wantErr string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "success",
|
||||||
|
clientID: "client-123",
|
||||||
|
idToken: "token",
|
||||||
|
tags: []string{"tag:test"},
|
||||||
|
wantAuthKey: "tskey-auth-xyz",
|
||||||
|
wantErr: "",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "missing client id short-circuits without error",
|
||||||
|
clientID: "",
|
||||||
|
idToken: "token",
|
||||||
|
tags: []string{"tag:test"},
|
||||||
|
wantAuthKey: "",
|
||||||
|
wantErr: "",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "missing id token",
|
||||||
|
clientID: "client-123",
|
||||||
|
idToken: "",
|
||||||
|
tags: []string{"tag:test"},
|
||||||
|
wantErr: "federated identity authkeys require --id-token",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "missing tags",
|
||||||
|
clientID: "client-123",
|
||||||
|
idToken: "token",
|
||||||
|
tags: []string{},
|
||||||
|
wantErr: "federated identity authkeys require --advertise-tags",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "invalid client id attributes",
|
||||||
|
clientID: "client-123?invalid=value",
|
||||||
|
idToken: "token",
|
||||||
|
tags: []string{"tag:test"},
|
||||||
|
wantErr: `failed to parse optional config attributes: unknown optional config attribute "invalid"`,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
srv := mockedControlServer(t)
|
||||||
|
defer srv.Close()
|
||||||
|
|
||||||
|
authKey, err := resolveAuthKey(context.Background(), srv.URL, tt.clientID, tt.idToken, tt.tags)
|
||||||
|
if tt.wantErr != "" {
|
||||||
|
if err == nil {
|
||||||
|
t.Errorf("resolveAuthKey() error = nil, want %q", tt.wantErr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err.Error() != tt.wantErr {
|
||||||
|
t.Errorf("resolveAuthKey() error = %q, want %q", err.Error(), tt.wantErr)
|
||||||
|
}
|
||||||
|
} else if err != nil {
|
||||||
|
t.Fatalf("resolveAuthKey() unexpected error = %v", err)
|
||||||
|
}
|
||||||
|
if authKey != tt.wantAuthKey {
|
||||||
|
t.Errorf("resolveAuthKey() = %q, want %q", authKey, tt.wantAuthKey)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParseOptionalAttributes(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
clientID string
|
||||||
|
wantEphemeral bool
|
||||||
|
wantPreauth bool
|
||||||
|
wantErr string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "default values",
|
||||||
|
clientID: "client-123",
|
||||||
|
wantEphemeral: true,
|
||||||
|
wantPreauth: false,
|
||||||
|
wantErr: "",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "custom values",
|
||||||
|
clientID: "client-123?ephemeral=false&preauthorized=true",
|
||||||
|
wantEphemeral: false,
|
||||||
|
wantPreauth: true,
|
||||||
|
wantErr: "",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "unknown attribute",
|
||||||
|
clientID: "client-123?unknown=value",
|
||||||
|
wantEphemeral: false,
|
||||||
|
wantPreauth: false,
|
||||||
|
wantErr: `unknown optional config attribute "unknown"`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "invalid value",
|
||||||
|
clientID: "client-123?ephemeral=invalid",
|
||||||
|
wantEphemeral: false,
|
||||||
|
wantPreauth: false,
|
||||||
|
wantErr: `strconv.ParseBool: parsing "invalid": invalid syntax`,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
ephemeral, preauth, err := parseOptionalAttributes(tt.clientID)
|
||||||
|
if tt.wantErr != "" {
|
||||||
|
if err == nil {
|
||||||
|
t.Errorf("parseOptionalAttributes() error = nil, want %q", tt.wantErr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err.Error() != tt.wantErr {
|
||||||
|
t.Errorf("parseOptionalAttributes() error = %q, want %q", err.Error(), tt.wantErr)
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("parseOptionalAttributes() error = %v, want nil", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ephemeral != tt.wantEphemeral {
|
||||||
|
t.Errorf("parseOptionalAttributes() ephemeral = %v, want %v", ephemeral, tt.wantEphemeral)
|
||||||
|
}
|
||||||
|
if preauth != tt.wantPreauth {
|
||||||
|
t.Errorf("parseOptionalAttributes() preauth = %v, want %v", preauth, tt.wantPreauth)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func mockedControlServer(t *testing.T) *httptest.Server {
|
||||||
|
t.Helper()
|
||||||
|
|
||||||
|
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
switch {
|
||||||
|
case strings.Contains(r.URL.Path, "/oauth/token-exchange"):
|
||||||
|
// OAuth2 library sends the token exchange request
|
||||||
|
w.Header().Set("Content-Type", "application/json")
|
||||||
|
w.Write([]byte(`{"access_token":"access-123","token_type":"Bearer","expires_in":3600}`))
|
||||||
|
case strings.Contains(r.URL.Path, "/api/v2/tailnet") && strings.Contains(r.URL.Path, "/keys"):
|
||||||
|
// Tailscale client creates the authkey
|
||||||
|
w.Write([]byte(`{"key":"tskey-auth-xyz","created":"2024-01-01T00:00:00Z"}`))
|
||||||
|
default:
|
||||||
|
w.WriteHeader(http.StatusNotFound)
|
||||||
|
}
|
||||||
|
}))
|
||||||
|
}
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package tailscale
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
|
||||||
|
"tailscale.com/feature"
|
||||||
|
)
|
||||||
|
|
||||||
|
// HookResolveAuthKeyViaWIF resolves to [identityfederation.ResolveAuthKey] when the
|
||||||
|
// corresponding feature tag is enabled in the build process.
|
||||||
|
//
|
||||||
|
// baseURL is the URL of the control server used for token exchange and authkey generation.
|
||||||
|
// clientID is the federated client ID used for token exchange, the format is <tailnet ID>/<oauth client ID>
|
||||||
|
// idToken is the Identity token from the identity provider
|
||||||
|
// tags is the list of tags to be associated with the auth key
|
||||||
|
var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken string, tags []string) (string, error)]
|
||||||
Loading…
Reference in New Issue