From 6eaacf791cd8b1c9f6a9a523081d729c92c212f1 Mon Sep 17 00:00:00 2001 From: lohith-karlapudi Date: Thu, 11 Aug 2022 15:43:55 +0530 Subject: [PATCH 1/4] adding id token header --- pkg/apis/options/legacy_options.go | 34 +++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/pkg/apis/options/legacy_options.go b/pkg/apis/options/legacy_options.go index fded5867..01d32394 100644 --- a/pkg/apis/options/legacy_options.go +++ b/pkg/apis/options/legacy_options.go @@ -234,7 +234,7 @@ func (l *LegacyHeaders) getRequestHeaders() []Header { } if l.PassAuthorization { - requestHeaders = append(requestHeaders, getAuthorizationHeader()) + requestHeaders = append(requestHeaders, getAuthorizationHeader()...) } for i := range requestHeaders { @@ -259,7 +259,7 @@ func (l *LegacyHeaders) getResponseHeaders() []Header { } if l.SetAuthorization { - responseHeaders = append(responseHeaders, getAuthorizationHeader()) + responseHeaders = append(responseHeaders, getAuthorizationHeader()...) } if l.SetIntrospectionValue { @@ -356,18 +356,32 @@ func getPassAccessTokenHeader() Header { } } -func getAuthorizationHeader() Header { - return Header{ - Name: "Authorization", - Values: []HeaderValue{ - { - ClaimSource: &ClaimSource{ - Claim: "id_token", - Prefix: "Bearer ", +func getAuthorizationHeader() []Header { + headers := []Header{ + { + Name: "Authorization", + Values: []HeaderValue{ + { + ClaimSource: &ClaimSource{ + Claim: "id_token", + Prefix: "Bearer ", + }, + }, + }, + }, + { + Name: "x-auth-request-id-token", + Values: []HeaderValue{ + { + ClaimSource: &ClaimSource{ + Claim: "id_token", + Prefix: "Bearer ", + }, }, }, }, } + return headers } func getPreferredUsernameHeader() Header { From b516711042121a579a2919e57b1a224bae76a949 Mon Sep 17 00:00:00 2001 From: lohith-karlapudi Date: Thu, 11 Aug 2022 16:51:19 +0530 Subject: [PATCH 2/4] Update ci.yaml --- .github/workflows/ci.yaml | 116 +++++++++++++++++++------------------- 1 file changed, 58 insertions(+), 58 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 62bf35a2..2afcc297 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -3,7 +3,7 @@ name: CI on: push: branches: - - 'edi-foundation-integration' + - 'add_id_token_header' # - $default-branch paths-ignore: - 'VERSION' @@ -159,66 +159,66 @@ jobs: docker push ${{ env.CI_LATEST_IMAGE }} docker push ${{ env.CI_IMAGE }} - Deploy_Test_HDS_AUTH_GATEWAY: - needs: [Build, Blackduck, Fortify, unit-test] - uses: ./.github/workflows/deploy-hds-auth-gateway.yaml - with: - OAUTH2_PROXY_IMAGE: ${{ needs.Build.outputs.envoyAlphaTag }} - secrets: - VAULT_HOST: ${{ secrets.VAULT_HOST }} - VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} - VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} + # Deploy_Test_HDS_AUTH_GATEWAY: + # needs: [Build, Blackduck, Fortify, unit-test] + # uses: ./.github/workflows/deploy-hds-auth-gateway.yaml + # with: + # OAUTH2_PROXY_IMAGE: ${{ needs.Build.outputs.envoyAlphaTag }} + # secrets: + # VAULT_HOST: ${{ secrets.VAULT_HOST }} + # VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} + # VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} - Promote_Version: - needs: [Deploy_Test_HDS_AUTH_GATEWAY] - if: github.ref == 'refs/heads/edi-foundation-integration' - runs-on: ubuntu-20.04 - outputs: - versionTag: ${{ steps.setVariables.outputs.versionTag }} - steps: - - uses: actions/checkout@v2 + # Promote_Version: + # needs: [Deploy_Test_HDS_AUTH_GATEWAY] + # if: github.ref == 'refs/heads/edi-foundation-integration' + # runs-on: ubuntu-20.04 + # outputs: + # versionTag: ${{ steps.setVariables.outputs.versionTag }} + # steps: + # - uses: actions/checkout@v2 - - name: Import Secrets - id: secrets - uses: hashicorp/vault-action@v2.3.1 - with: - url: ${{ secrets.VAULT_HOST }} - method: approle - roleId: ${{ secrets.VAULT_ROLE_ID }} - secretId: ${{ secrets.VAULT_SECRET_ID }} - exportEnv: true - secrets: | - devops/data/docker-repos/hsdp-edi endPoint | HSDP_DOCKER_REGISTRY ; - devops/data/docker-repos/hsdp-edi user | HSDP_DOCKER_USER ; - devops/data/docker-repos/hsdp-edi password | HSDP_DOCKER_PASSWORD ; + # - name: Import Secrets + # id: secrets + # uses: hashicorp/vault-action@v2.3.1 + # with: + # url: ${{ secrets.VAULT_HOST }} + # method: approle + # roleId: ${{ secrets.VAULT_ROLE_ID }} + # secretId: ${{ secrets.VAULT_SECRET_ID }} + # exportEnv: true + # secrets: | + # devops/data/docker-repos/hsdp-edi endPoint | HSDP_DOCKER_REGISTRY ; + # devops/data/docker-repos/hsdp-edi user | HSDP_DOCKER_USER ; + # devops/data/docker-repos/hsdp-edi password | HSDP_DOCKER_PASSWORD ; - - name: Set env variables - id: setVariables - run: | - new_version=`cat VERSION` - echo "New version is: $new_version" - echo "CI_IMAGE=${{ env.HSDP_DOCKER_REGISTRY }}/edi-foundation-oauth2-proxy:${new_version}-alpha" >> "$GITHUB_ENV" - echo "RC_IMAGE=docker.na1.hsdp.io/edisp-releases/edi-foundation-oauth2-proxy:${new_version}-rc" >> "$GITHUB_ENV" - echo "::set-output name=versionTag::${new_version}-rc" - echo "${new_version}-rc" + # - name: Set env variables + # id: setVariables + # run: | + # new_version=`cat VERSION` + # echo "New version is: $new_version" + # echo "CI_IMAGE=${{ env.HSDP_DOCKER_REGISTRY }}/edi-foundation-oauth2-proxy:${new_version}-alpha" >> "$GITHUB_ENV" + # echo "RC_IMAGE=docker.na1.hsdp.io/edisp-releases/edi-foundation-oauth2-proxy:${new_version}-rc" >> "$GITHUB_ENV" + # echo "::set-output name=versionTag::${new_version}-rc" + # echo "${new_version}-rc" - - name: Docker login - run: | - docker login --username '${{ secrets.DOCKER_USER }}' --password '${{ secrets.DOCKER_PSWD }}' '${{ secrets.DOCKER_REPO }}' + # - name: Docker login + # run: | + # docker login --username '${{ secrets.DOCKER_USER }}' --password '${{ secrets.DOCKER_PSWD }}' '${{ secrets.DOCKER_REPO }}' - - name: Docker Push - run: | - docker pull ${{ env.CI_IMAGE }} - docker tag ${{ env.CI_IMAGE }} ${{ env.RC_IMAGE }} - docker push ${{ env.RC_IMAGE }} + # - name: Docker Push + # run: | + # docker pull ${{ env.CI_IMAGE }} + # docker tag ${{ env.CI_IMAGE }} ${{ env.RC_IMAGE }} + # docker push ${{ env.RC_IMAGE }} - Replace_OAuth2_Proxy_Tag_in_Terraform_API_Gateway: - needs: [Promote_Version] - if: github.ref == 'refs/heads/edi-foundation-integration' - uses: ./.github/workflows/update-oauth2-proxy-version-at-api-gw.yaml - with: - OAUTH2_PROXY_IMAGE: ${{ needs.Promote_Version.outputs.versionTag }} - secrets: - VAULT_HOST: ${{ secrets.VAULT_HOST }} - VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} - VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} + # Replace_OAuth2_Proxy_Tag_in_Terraform_API_Gateway: + # needs: [Promote_Version] + # if: github.ref == 'refs/heads/edi-foundation-integration' + # uses: ./.github/workflows/update-oauth2-proxy-version-at-api-gw.yaml + # with: + # OAUTH2_PROXY_IMAGE: ${{ needs.Promote_Version.outputs.versionTag }} + # secrets: + # VAULT_HOST: ${{ secrets.VAULT_HOST }} + # VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} + # VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} From 1d1e415277ed4fa6cfcc5c0e7ccb9c7926f39444 Mon Sep 17 00:00:00 2001 From: lohith-karlapudi Date: Thu, 11 Aug 2022 17:21:59 +0530 Subject: [PATCH 3/4] Update legacy_options_test.go --- pkg/apis/options/legacy_options_test.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/pkg/apis/options/legacy_options_test.go b/pkg/apis/options/legacy_options_test.go index d37f9548..19894994 100644 --- a/pkg/apis/options/legacy_options_test.go +++ b/pkg/apis/options/legacy_options_test.go @@ -471,6 +471,19 @@ var _ = Describe("Legacy Options", func() { }, } + idTokenHeader := Header{ + Name: "x-auth-request-id-token", + PreserveRequestValue: false, + Values: []HeaderValue{ + { + ClaimSource: &ClaimSource{ + Claim: "id_token", + Prefix: "Bearer ", + }, + }, + }, + } + DescribeTable("should convert to injectRequestHeaders", func(in legacyHeadersTableInput) { requestHeaders, responseHeaders := in.legacyHeaders.convert() @@ -771,9 +784,11 @@ var _ = Describe("Legacy Options", func() { }, expectedRequestHeaders: []Header{ authorizationHeader, + idTokenHeader, }, expectedResponseHeaders: []Header{ authorizationHeader, + idTokenHeader, }, }), Entry("with authorization headers and SkipAuthStripHeaders disabled", legacyHeadersTableInput{ @@ -793,9 +808,11 @@ var _ = Describe("Legacy Options", func() { }, expectedRequestHeaders: []Header{ withPreserveRequestValue(authorizationHeader, true), + withPreserveRequestValue(idTokenHeader, true), }, expectedResponseHeaders: []Header{ authorizationHeader, + idTokenHeader, }, }), ) From c0fe7f62daccedfa7f893f434bbedcfbddbf4857 Mon Sep 17 00:00:00 2001 From: lohith-karlapudi Date: Fri, 12 Aug 2022 15:25:54 +0530 Subject: [PATCH 4/4] Update legacy_options_test.go --- .github/workflows/ci.yaml | 116 ++++++++++++------------ pkg/apis/options/legacy_options.go | 3 +- pkg/apis/options/legacy_options_test.go | 3 +- 3 files changed, 60 insertions(+), 62 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2afcc297..62bf35a2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -3,7 +3,7 @@ name: CI on: push: branches: - - 'add_id_token_header' + - 'edi-foundation-integration' # - $default-branch paths-ignore: - 'VERSION' @@ -159,66 +159,66 @@ jobs: docker push ${{ env.CI_LATEST_IMAGE }} docker push ${{ env.CI_IMAGE }} - # Deploy_Test_HDS_AUTH_GATEWAY: - # needs: [Build, Blackduck, Fortify, unit-test] - # uses: ./.github/workflows/deploy-hds-auth-gateway.yaml - # with: - # OAUTH2_PROXY_IMAGE: ${{ needs.Build.outputs.envoyAlphaTag }} - # secrets: - # VAULT_HOST: ${{ secrets.VAULT_HOST }} - # VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} - # VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} + Deploy_Test_HDS_AUTH_GATEWAY: + needs: [Build, Blackduck, Fortify, unit-test] + uses: ./.github/workflows/deploy-hds-auth-gateway.yaml + with: + OAUTH2_PROXY_IMAGE: ${{ needs.Build.outputs.envoyAlphaTag }} + secrets: + VAULT_HOST: ${{ secrets.VAULT_HOST }} + VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} + VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} - # Promote_Version: - # needs: [Deploy_Test_HDS_AUTH_GATEWAY] - # if: github.ref == 'refs/heads/edi-foundation-integration' - # runs-on: ubuntu-20.04 - # outputs: - # versionTag: ${{ steps.setVariables.outputs.versionTag }} - # steps: - # - uses: actions/checkout@v2 + Promote_Version: + needs: [Deploy_Test_HDS_AUTH_GATEWAY] + if: github.ref == 'refs/heads/edi-foundation-integration' + runs-on: ubuntu-20.04 + outputs: + versionTag: ${{ steps.setVariables.outputs.versionTag }} + steps: + - uses: actions/checkout@v2 - # - name: Import Secrets - # id: secrets - # uses: hashicorp/vault-action@v2.3.1 - # with: - # url: ${{ secrets.VAULT_HOST }} - # method: approle - # roleId: ${{ secrets.VAULT_ROLE_ID }} - # secretId: ${{ secrets.VAULT_SECRET_ID }} - # exportEnv: true - # secrets: | - # devops/data/docker-repos/hsdp-edi endPoint | HSDP_DOCKER_REGISTRY ; - # devops/data/docker-repos/hsdp-edi user | HSDP_DOCKER_USER ; - # devops/data/docker-repos/hsdp-edi password | HSDP_DOCKER_PASSWORD ; + - name: Import Secrets + id: secrets + uses: hashicorp/vault-action@v2.3.1 + with: + url: ${{ secrets.VAULT_HOST }} + method: approle + roleId: ${{ secrets.VAULT_ROLE_ID }} + secretId: ${{ secrets.VAULT_SECRET_ID }} + exportEnv: true + secrets: | + devops/data/docker-repos/hsdp-edi endPoint | HSDP_DOCKER_REGISTRY ; + devops/data/docker-repos/hsdp-edi user | HSDP_DOCKER_USER ; + devops/data/docker-repos/hsdp-edi password | HSDP_DOCKER_PASSWORD ; - # - name: Set env variables - # id: setVariables - # run: | - # new_version=`cat VERSION` - # echo "New version is: $new_version" - # echo "CI_IMAGE=${{ env.HSDP_DOCKER_REGISTRY }}/edi-foundation-oauth2-proxy:${new_version}-alpha" >> "$GITHUB_ENV" - # echo "RC_IMAGE=docker.na1.hsdp.io/edisp-releases/edi-foundation-oauth2-proxy:${new_version}-rc" >> "$GITHUB_ENV" - # echo "::set-output name=versionTag::${new_version}-rc" - # echo "${new_version}-rc" + - name: Set env variables + id: setVariables + run: | + new_version=`cat VERSION` + echo "New version is: $new_version" + echo "CI_IMAGE=${{ env.HSDP_DOCKER_REGISTRY }}/edi-foundation-oauth2-proxy:${new_version}-alpha" >> "$GITHUB_ENV" + echo "RC_IMAGE=docker.na1.hsdp.io/edisp-releases/edi-foundation-oauth2-proxy:${new_version}-rc" >> "$GITHUB_ENV" + echo "::set-output name=versionTag::${new_version}-rc" + echo "${new_version}-rc" - # - name: Docker login - # run: | - # docker login --username '${{ secrets.DOCKER_USER }}' --password '${{ secrets.DOCKER_PSWD }}' '${{ secrets.DOCKER_REPO }}' + - name: Docker login + run: | + docker login --username '${{ secrets.DOCKER_USER }}' --password '${{ secrets.DOCKER_PSWD }}' '${{ secrets.DOCKER_REPO }}' - # - name: Docker Push - # run: | - # docker pull ${{ env.CI_IMAGE }} - # docker tag ${{ env.CI_IMAGE }} ${{ env.RC_IMAGE }} - # docker push ${{ env.RC_IMAGE }} + - name: Docker Push + run: | + docker pull ${{ env.CI_IMAGE }} + docker tag ${{ env.CI_IMAGE }} ${{ env.RC_IMAGE }} + docker push ${{ env.RC_IMAGE }} - # Replace_OAuth2_Proxy_Tag_in_Terraform_API_Gateway: - # needs: [Promote_Version] - # if: github.ref == 'refs/heads/edi-foundation-integration' - # uses: ./.github/workflows/update-oauth2-proxy-version-at-api-gw.yaml - # with: - # OAUTH2_PROXY_IMAGE: ${{ needs.Promote_Version.outputs.versionTag }} - # secrets: - # VAULT_HOST: ${{ secrets.VAULT_HOST }} - # VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} - # VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} + Replace_OAuth2_Proxy_Tag_in_Terraform_API_Gateway: + needs: [Promote_Version] + if: github.ref == 'refs/heads/edi-foundation-integration' + uses: ./.github/workflows/update-oauth2-proxy-version-at-api-gw.yaml + with: + OAUTH2_PROXY_IMAGE: ${{ needs.Promote_Version.outputs.versionTag }} + secrets: + VAULT_HOST: ${{ secrets.VAULT_HOST }} + VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} + VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} diff --git a/pkg/apis/options/legacy_options.go b/pkg/apis/options/legacy_options.go index 01d32394..4717bf56 100644 --- a/pkg/apis/options/legacy_options.go +++ b/pkg/apis/options/legacy_options.go @@ -374,8 +374,7 @@ func getAuthorizationHeader() []Header { Values: []HeaderValue{ { ClaimSource: &ClaimSource{ - Claim: "id_token", - Prefix: "Bearer ", + Claim: "id_token", }, }, }, diff --git a/pkg/apis/options/legacy_options_test.go b/pkg/apis/options/legacy_options_test.go index 19894994..05e3e073 100644 --- a/pkg/apis/options/legacy_options_test.go +++ b/pkg/apis/options/legacy_options_test.go @@ -477,8 +477,7 @@ var _ = Describe("Legacy Options", func() { Values: []HeaderValue{ { ClaimSource: &ClaimSource{ - Claim: "id_token", - Prefix: "Bearer ", + Claim: "id_token", }, }, },