diff --git a/authorizer/src/asapo_authorizer/server/authorize.go b/authorizer/src/asapo_authorizer/server/authorize.go index bab6e96b6ffa45a5dbc834c2012b2d69c0f0e49b..aaaade1b34aca6afa722a4798afd785ef68a4f38 100644 --- a/authorizer/src/asapo_authorizer/server/authorize.go +++ b/authorizer/src/asapo_authorizer/server/authorize.go @@ -201,7 +201,7 @@ func canUseHostAuthorization(creds SourceCredentials) bool { func checkToken(token string, subject_expect string) (accessTypes []string, err error) { var extra_claim structs.AccessTokenExtraClaim - subject,err := Auth.UserAuth().CheckAndGetContent(token,&extra_claim) + claim,err := Auth.UserAuth().CheckAndGetContent(token,&extra_claim) if err!=nil { return nil,err } @@ -210,7 +210,7 @@ func checkToken(token string, subject_expect string) (accessTypes []string, err return nil,errors.New("missing access types") } - if subject!=subject_expect { + if claim.Subject!=subject_expect { return nil,errors.New("wrong token for "+subject_expect) } return extra_claim.AccessTypes,err diff --git a/authorizer/src/asapo_authorizer/server/introspect.go b/authorizer/src/asapo_authorizer/server/introspect.go index 1cc6bd37add60a6f8604ef0c47bc91b7eecb5345..b846e395dcb677175d0e02aaaacb85395280a287 100644 --- a/authorizer/src/asapo_authorizer/server/introspect.go +++ b/authorizer/src/asapo_authorizer/server/introspect.go @@ -19,10 +19,11 @@ func extractToken(r *http.Request) (string, error) { func verifyUserToken(token string) (response structs.IntrospectTokenResponse, err error) { var extra_claim structs.AccessTokenExtraClaim - response.Sub,err = Auth.UserAuth().CheckAndGetContent(token,&extra_claim) + claim,err := Auth.UserAuth().CheckAndGetContent(token,&extra_claim) if err!=nil { return } + response.Sub = claim.Subject response.AccessTypes = extra_claim.AccessTypes return } diff --git a/common/go/src/asapo_common/utils/authorization.go b/common/go/src/asapo_common/utils/authorization.go index c913611730477d2611c0e6410a77bbf25e72f05b..d707819b9d11758a87f5f3538b204e8d76ed5ee3 100644 --- a/common/go/src/asapo_common/utils/authorization.go +++ b/common/go/src/asapo_common/utils/authorization.go @@ -17,7 +17,7 @@ type Auth interface { GenerateToken(...interface{}) (string, error) ProcessAuth(http.HandlerFunc, string) http.HandlerFunc Name() string - CheckAndGetContent(token string, extraClaims interface{}, payload ...interface{}) (string,error) + CheckAndGetContent(token string, extraClaims interface{}, payload ...interface{}) (*jwt.StandardClaims,error) } func SubjectFromBeamtime(bt string)string { @@ -147,23 +147,21 @@ func ProcessJWTAuth(fn http.HandlerFunc, key string) http.HandlerFunc { } } -func (a *JWTAuth) CheckAndGetContent(token string, extraClaims interface{}, payload ...interface{}) (subject string,err error) { +func (a *JWTAuth) CheckAndGetContent(token string, extraClaims interface{}, payload ...interface{}) (claims *jwt.StandardClaims, err error) { // payload ignored c, ok := CheckJWTToken(token,a.Key) if !ok { - return "",errors.New("wrong JWT token") + return nil,errors.New("wrong JWT token") } claim,ok := c.(*CustomClaims) if !ok { - return "",errors.New("cannot get CustomClaims") + return nil,errors.New("cannot get CustomClaims") } - subject = claim.Subject - if extraClaims!=nil { err = MapToStruct(claim.ExtraClaims.(map[string]interface{}), extraClaims) } - return subject,err + return &claim.StandardClaims,err } @@ -264,20 +262,22 @@ func ProcessHMACAuth(fn http.HandlerFunc, payload, key string) http.HandlerFunc } } -func (a *HMACAuth) CheckAndGetContent(token string, _ interface{}, payload ...interface{}) (string,error) { +func (a *HMACAuth) CheckAndGetContent(token string, _ interface{}, payload ...interface{}) (*jwt.StandardClaims,error) { if len(payload) != 1 { - return "",errors.New("wrong payload") + return nil,errors.New("wrong payload") } value, ok := payload[0].(string) if !ok { - return "",errors.New("wrong payload") + return nil,errors.New("wrong payload") } ok = CheckHMACToken(token,value,a.Key) if !ok { - return "",errors.New("wrong HMAC token") + return nil,errors.New("wrong HMAC token") } - return value,nil + claim := jwt.StandardClaims{} + claim.Subject = value + return &claim,nil } diff --git a/tests/automatic/high_avail/services_restart/check_linux.sh b/tests/automatic/high_avail/services_restart/check_linux.sh index 7043c1ac971b7c8dac5b21cd1b8b3bc02a384a8c..e3260de4c2d00bda08cb724e69af0e19ea69157e 100644 --- a/tests/automatic/high_avail/services_restart/check_linux.sh +++ b/tests/automatic/high_avail/services_restart/check_linux.sh @@ -25,6 +25,7 @@ Cleanup() { echo cleanup rm -rf ${receiver_folder} echo "db.dropDatabase()" | mongo ${beamtime_id}_detector + set +e influx -execute "drop database ${monitor_database_name}" }