cmd/tailscale/cli,feature: add support for identity federation (#17529)
Add new arguments to `tailscale up` so authkeys can be generated dynamically via identity federation. Updates #9192 Signed-off-by: mcoulombe <max@tailscale.com>main
Max Coulombe
6 months ago
committed by
GitHub
parent
54cee33bae
commit
6a73c0bdf5
@ -0,0 +1,13 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Code generated by gen.go; DO NOT EDIT.
|
||||||
|
|
||||||
|
//go:build ts_omit_identity_federation
|
||||||
|
|
||||||
|
package buildfeatures |
||||||
|
|
||||||
|
// HasIdentityFederation is whether the binary was built with support for modular feature "Identity token exchange for auth key support".
|
||||||
|
// Specifically, it's whether the binary was NOT built with the "ts_omit_identity_federation" build tag.
|
||||||
|
// It's a const so it can be used for dead code elimination.
|
||||||
|
const HasIdentityFederation = false |
||||||
@ -0,0 +1,13 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Code generated by gen.go; DO NOT EDIT.
|
||||||
|
|
||||||
|
//go:build !ts_omit_identity_federation
|
||||||
|
|
||||||
|
package buildfeatures |
||||||
|
|
||||||
|
// HasIdentityFederation is whether the binary was built with support for modular feature "Identity token exchange for auth key support".
|
||||||
|
// Specifically, it's whether the binary was NOT built with the "ts_omit_identity_federation" build tag.
|
||||||
|
// It's a const so it can be used for dead code elimination.
|
||||||
|
const HasIdentityFederation = true |
||||||
@ -0,0 +1,7 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package identityfederation registers support for authkey resolution
|
||||||
|
// via identity federation if it's not disabled by the
|
||||||
|
// ts_omit_identityfederation build tag.
|
||||||
|
package identityfederation |
||||||
@ -0,0 +1,8 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
//go:build !ts_omit_identityfederation
|
||||||
|
|
||||||
|
package identityfederation |
||||||
|
|
||||||
|
import _ "tailscale.com/feature/identityfederation" |
||||||
@ -0,0 +1,127 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package identityfederation registers support for using ID tokens to
|
||||||
|
// automatically request authkeys for logging in.
|
||||||
|
package identityfederation |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"errors" |
||||||
|
"fmt" |
||||||
|
"net/http" |
||||||
|
"net/url" |
||||||
|
"strconv" |
||||||
|
"strings" |
||||||
|
"time" |
||||||
|
|
||||||
|
"golang.org/x/oauth2" |
||||||
|
"tailscale.com/feature" |
||||||
|
"tailscale.com/internal/client/tailscale" |
||||||
|
"tailscale.com/ipn" |
||||||
|
) |
||||||
|
|
||||||
|
func init() { |
||||||
|
feature.Register("identityfederation") |
||||||
|
tailscale.HookResolveAuthKeyViaWIF.Set(resolveAuthKey) |
||||||
|
} |
||||||
|
|
||||||
|
// resolveAuthKey uses OIDC identity federation to exchange the provided ID token and client ID for an authkey.
|
||||||
|
func resolveAuthKey(ctx context.Context, baseURL, clientID, idToken string, tags []string) (string, error) { |
||||||
|
if clientID == "" { |
||||||
|
return "", nil // Short-circuit, no client ID means not using identity federation
|
||||||
|
} |
||||||
|
|
||||||
|
if idToken == "" { |
||||||
|
return "", errors.New("federated identity authkeys require --id-token") |
||||||
|
} |
||||||
|
if len(tags) == 0 { |
||||||
|
return "", errors.New("federated identity authkeys require --advertise-tags") |
||||||
|
} |
||||||
|
if baseURL == "" { |
||||||
|
baseURL = ipn.DefaultControlURL |
||||||
|
} |
||||||
|
|
||||||
|
ephemeral, preauth, err := parseOptionalAttributes(clientID) |
||||||
|
if err != nil { |
||||||
|
return "", fmt.Errorf("failed to parse optional config attributes: %w", err) |
||||||
|
} |
||||||
|
|
||||||
|
accessToken, err := exchangeJWTForToken(ctx, baseURL, clientID, idToken) |
||||||
|
if err != nil { |
||||||
|
return "", fmt.Errorf("failed to exchange JWT for access token: %w", err) |
||||||
|
} |
||||||
|
if accessToken == "" { |
||||||
|
return "", errors.New("received empty access token from Tailscale") |
||||||
|
} |
||||||
|
|
||||||
|
tsClient := tailscale.NewClient("-", tailscale.APIKey(accessToken)) |
||||||
|
tsClient.UserAgent = "tailscale-cli-identity-federation" |
||||||
|
tsClient.BaseURL = baseURL |
||||||
|
|
||||||
|
authkey, _, err := tsClient.CreateKey(ctx, tailscale.KeyCapabilities{ |
||||||
|
Devices: tailscale.KeyDeviceCapabilities{ |
||||||
|
Create: tailscale.KeyDeviceCreateCapabilities{ |
||||||
|
Reusable: false, |
||||||
|
Ephemeral: ephemeral, |
||||||
|
Preauthorized: preauth, |
||||||
|
Tags: tags, |
||||||
|
}, |
||||||
|
}, |
||||||
|
}) |
||||||
|
if err != nil { |
||||||
|
return "", fmt.Errorf("unexpected error while creating authkey: %w", err) |
||||||
|
} |
||||||
|
if authkey == "" { |
||||||
|
return "", errors.New("received empty authkey from control server") |
||||||
|
} |
||||||
|
|
||||||
|
return authkey, nil |
||||||
|
} |
||||||
|
|
||||||
|
func parseOptionalAttributes(clientID string) (ephemeral bool, preauthorized bool, err error) { |
||||||
|
_, attrs, found := strings.Cut(clientID, "?") |
||||||
|
if !found { |
||||||
|
return true, false, nil |
||||||
|
} |
||||||
|
|
||||||
|
parsed, err := url.ParseQuery(attrs) |
||||||
|
if err != nil { |
||||||
|
return false, false, fmt.Errorf("failed to parse optional config attributes: %w", err) |
||||||
|
} |
||||||
|
|
||||||
|
for k := range parsed { |
||||||
|
switch k { |
||||||
|
case "ephemeral": |
||||||
|
ephemeral, err = strconv.ParseBool(parsed.Get(k)) |
||||||
|
case "preauthorized": |
||||||
|
preauthorized, err = strconv.ParseBool(parsed.Get(k)) |
||||||
|
default: |
||||||
|
return false, false, fmt.Errorf("unknown optional config attribute %q", k) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
return ephemeral, preauthorized, err |
||||||
|
} |
||||||
|
|
||||||
|
// exchangeJWTForToken exchanges a JWT for a Tailscale access token.
|
||||||
|
func exchangeJWTForToken(ctx context.Context, baseURL, clientID, idToken string) (string, error) { |
||||||
|
httpClient := &http.Client{Timeout: 10 * time.Second} |
||||||
|
ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient) |
||||||
|
|
||||||
|
token, err := (&oauth2.Config{ |
||||||
|
Endpoint: oauth2.Endpoint{ |
||||||
|
TokenURL: fmt.Sprintf("%s/api/v2/oauth/token-exchange", baseURL), |
||||||
|
}, |
||||||
|
}).Exchange(ctx, "", oauth2.SetAuthURLParam("client_id", clientID), oauth2.SetAuthURLParam("jwt", idToken)) |
||||||
|
if err != nil { |
||||||
|
// Try to extract more detailed error message
|
||||||
|
var retrieveErr *oauth2.RetrieveError |
||||||
|
if errors.As(err, &retrieveErr) { |
||||||
|
return "", fmt.Errorf("token exchange failed with status %d: %s", retrieveErr.Response.StatusCode, string(retrieveErr.Body)) |
||||||
|
} |
||||||
|
return "", fmt.Errorf("unexpected token exchange request error: %w", err) |
||||||
|
} |
||||||
|
|
||||||
|
return token.AccessToken, nil |
||||||
|
} |
||||||
@ -0,0 +1,167 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package identityfederation |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
"net/http" |
||||||
|
"net/http/httptest" |
||||||
|
"strings" |
||||||
|
"testing" |
||||||
|
) |
||||||
|
|
||||||
|
func TestResolveAuthKey(t *testing.T) { |
||||||
|
tests := []struct { |
||||||
|
name string |
||||||
|
clientID string |
||||||
|
idToken string |
||||||
|
tags []string |
||||||
|
wantAuthKey string |
||||||
|
wantErr string |
||||||
|
}{ |
||||||
|
{ |
||||||
|
name: "success", |
||||||
|
clientID: "client-123", |
||||||
|
idToken: "token", |
||||||
|
tags: []string{"tag:test"}, |
||||||
|
wantAuthKey: "tskey-auth-xyz", |
||||||
|
wantErr: "", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "missing client id short-circuits without error", |
||||||
|
clientID: "", |
||||||
|
idToken: "token", |
||||||
|
tags: []string{"tag:test"}, |
||||||
|
wantAuthKey: "", |
||||||
|
wantErr: "", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "missing id token", |
||||||
|
clientID: "client-123", |
||||||
|
idToken: "", |
||||||
|
tags: []string{"tag:test"}, |
||||||
|
wantErr: "federated identity authkeys require --id-token", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "missing tags", |
||||||
|
clientID: "client-123", |
||||||
|
idToken: "token", |
||||||
|
tags: []string{}, |
||||||
|
wantErr: "federated identity authkeys require --advertise-tags", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "invalid client id attributes", |
||||||
|
clientID: "client-123?invalid=value", |
||||||
|
idToken: "token", |
||||||
|
tags: []string{"tag:test"}, |
||||||
|
wantErr: `failed to parse optional config attributes: unknown optional config attribute "invalid"`, |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
for _, tt := range tests { |
||||||
|
t.Run(tt.name, func(t *testing.T) { |
||||||
|
srv := mockedControlServer(t) |
||||||
|
defer srv.Close() |
||||||
|
|
||||||
|
authKey, err := resolveAuthKey(context.Background(), srv.URL, tt.clientID, tt.idToken, tt.tags) |
||||||
|
if tt.wantErr != "" { |
||||||
|
if err == nil { |
||||||
|
t.Errorf("resolveAuthKey() error = nil, want %q", tt.wantErr) |
||||||
|
return |
||||||
|
} |
||||||
|
if err.Error() != tt.wantErr { |
||||||
|
t.Errorf("resolveAuthKey() error = %q, want %q", err.Error(), tt.wantErr) |
||||||
|
} |
||||||
|
} else if err != nil { |
||||||
|
t.Fatalf("resolveAuthKey() unexpected error = %v", err) |
||||||
|
} |
||||||
|
if authKey != tt.wantAuthKey { |
||||||
|
t.Errorf("resolveAuthKey() = %q, want %q", authKey, tt.wantAuthKey) |
||||||
|
} |
||||||
|
}) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func TestParseOptionalAttributes(t *testing.T) { |
||||||
|
tests := []struct { |
||||||
|
name string |
||||||
|
clientID string |
||||||
|
wantEphemeral bool |
||||||
|
wantPreauth bool |
||||||
|
wantErr string |
||||||
|
}{ |
||||||
|
{ |
||||||
|
name: "default values", |
||||||
|
clientID: "client-123", |
||||||
|
wantEphemeral: true, |
||||||
|
wantPreauth: false, |
||||||
|
wantErr: "", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "custom values", |
||||||
|
clientID: "client-123?ephemeral=false&preauthorized=true", |
||||||
|
wantEphemeral: false, |
||||||
|
wantPreauth: true, |
||||||
|
wantErr: "", |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "unknown attribute", |
||||||
|
clientID: "client-123?unknown=value", |
||||||
|
wantEphemeral: false, |
||||||
|
wantPreauth: false, |
||||||
|
wantErr: `unknown optional config attribute "unknown"`, |
||||||
|
}, |
||||||
|
{ |
||||||
|
name: "invalid value", |
||||||
|
clientID: "client-123?ephemeral=invalid", |
||||||
|
wantEphemeral: false, |
||||||
|
wantPreauth: false, |
||||||
|
wantErr: `strconv.ParseBool: parsing "invalid": invalid syntax`, |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
for _, tt := range tests { |
||||||
|
t.Run(tt.name, func(t *testing.T) { |
||||||
|
ephemeral, preauth, err := parseOptionalAttributes(tt.clientID) |
||||||
|
if tt.wantErr != "" { |
||||||
|
if err == nil { |
||||||
|
t.Errorf("parseOptionalAttributes() error = nil, want %q", tt.wantErr) |
||||||
|
return |
||||||
|
} |
||||||
|
if err.Error() != tt.wantErr { |
||||||
|
t.Errorf("parseOptionalAttributes() error = %q, want %q", err.Error(), tt.wantErr) |
||||||
|
} |
||||||
|
} else { |
||||||
|
if err != nil { |
||||||
|
t.Errorf("parseOptionalAttributes() error = %v, want nil", err) |
||||||
|
return |
||||||
|
} |
||||||
|
} |
||||||
|
if ephemeral != tt.wantEphemeral { |
||||||
|
t.Errorf("parseOptionalAttributes() ephemeral = %v, want %v", ephemeral, tt.wantEphemeral) |
||||||
|
} |
||||||
|
if preauth != tt.wantPreauth { |
||||||
|
t.Errorf("parseOptionalAttributes() preauth = %v, want %v", preauth, tt.wantPreauth) |
||||||
|
} |
||||||
|
}) |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
func mockedControlServer(t *testing.T) *httptest.Server { |
||||||
|
t.Helper() |
||||||
|
|
||||||
|
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
||||||
|
switch { |
||||||
|
case strings.Contains(r.URL.Path, "/oauth/token-exchange"): |
||||||
|
// OAuth2 library sends the token exchange request
|
||||||
|
w.Header().Set("Content-Type", "application/json") |
||||||
|
w.Write([]byte(`{"access_token":"access-123","token_type":"Bearer","expires_in":3600}`)) |
||||||
|
case strings.Contains(r.URL.Path, "/api/v2/tailnet") && strings.Contains(r.URL.Path, "/keys"): |
||||||
|
// Tailscale client creates the authkey
|
||||||
|
w.Write([]byte(`{"key":"tskey-auth-xyz","created":"2024-01-01T00:00:00Z"}`)) |
||||||
|
default: |
||||||
|
w.WriteHeader(http.StatusNotFound) |
||||||
|
} |
||||||
|
})) |
||||||
|
} |
||||||
@ -0,0 +1,19 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package tailscale |
||||||
|
|
||||||
|
import ( |
||||||
|
"context" |
||||||
|
|
||||||
|
"tailscale.com/feature" |
||||||
|
) |
||||||
|
|
||||||
|
// HookResolveAuthKeyViaWIF resolves to [identityfederation.ResolveAuthKey] when the
|
||||||
|
// corresponding feature tag is enabled in the build process.
|
||||||
|
//
|
||||||
|
// baseURL is the URL of the control server used for token exchange and authkey generation.
|
||||||
|
// clientID is the federated client ID used for token exchange, the format is <tailnet ID>/<oauth client ID>
|
||||||
|
// idToken is the Identity token from the identity provider
|
||||||
|
// tags is the list of tags to be associated with the auth key
|
||||||
|
var HookResolveAuthKeyViaWIF feature.Hook[func(ctx context.Context, baseURL, clientID, idToken string, tags []string) (string, error)] |
||||||
Loading…
Reference in new issue