feat(authentication): add a --no-auth flag to disable authentication (#553)

pull/547/head^2
Anthony Lapenna 2017-02-01 22:13:48 +13:00 committed by GitHub
parent 779fcf8e7f
commit 10f7744a62
16 changed files with 203 additions and 191 deletions

View File

@ -29,6 +29,7 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
Assets: kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
Data: kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
Templates: kingpin.Flag("templates", "URL to the templates (apps) definitions").Default(defaultTemplatesURL).Short('t').String(),
NoAuth: kingpin.Flag("no-auth", "Disable authentication").Default(defaultNoAuth).Bool(),
TLSVerify: kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
TLSCacert: kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
TLSCert: kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),

View File

@ -7,6 +7,7 @@ const (
defaultDataDirectory = "/data"
defaultAssetsDirectory = "."
defaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
defaultNoAuth = "false"
defaultTLSVerify = "false"
defaultTLSCACertPath = "/certs/ca.pem"
defaultTLSCertPath = "/certs/cert.pem"

View File

@ -5,6 +5,7 @@ const (
defaultDataDirectory = "C:\\data"
defaultAssetsDirectory = "."
defaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
defaultNoAuth = "false"
defaultTLSVerify = "false"
defaultTLSCACertPath = "C:\\certs\\ca.pem"
defaultTLSCertPath = "C:\\certs\\cert.pem"

View File

@ -27,6 +27,7 @@ func main() {
settings := &portainer.Settings{
HiddenLabels: *flags.Labels,
Logo: *flags.Logo,
Authentication: !*flags.NoAuth,
}
fileService, err := file.NewService(*flags.Data, "")
@ -41,10 +42,13 @@ func main() {
}
defer store.Close()
jwtService, err := jwt.NewService()
var jwtService portainer.JWTService
if !*flags.NoAuth {
jwtService, err = jwt.NewService()
if err != nil {
log.Fatal(err)
}
}
var cryptoService portainer.CryptoService = &crypto.Service{}
@ -76,6 +80,7 @@ func main() {
AssetsPath: *flags.Assets,
Settings: settings,
TemplatesURL: *flags.Templates,
AuthDisabled: *flags.NoAuth,
UserService: store.UserService,
EndpointService: store.EndpointService,
CryptoService: cryptoService,

View File

@ -16,6 +16,7 @@ import (
type AuthHandler struct {
*mux.Router
Logger *log.Logger
authDisabled bool
UserService portainer.UserService
CryptoService portainer.CryptoService
JWTService portainer.JWTService
@ -26,6 +27,9 @@ const (
ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
// ErrInvalidCredentials is an error raised when credentials for a user are invalid
ErrInvalidCredentials = portainer.Error("Invalid credentials")
// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
// when the server has been started with the --no-auth flag
ErrAuthDisabled = portainer.Error("Authentication is disabled")
)
// NewAuthHandler returns a new instance of AuthHandler.
@ -44,6 +48,11 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
return
}
if handler.authDisabled {
Error(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
return
}
var req postAuthRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)

View File

@ -10,6 +10,7 @@ import (
// Service represents a service to manage HTTP middlewares
type middleWareService struct {
jwtService portainer.JWTService
authDisabled bool
}
func addMiddleware(h http.Handler, middleware ...func(http.Handler) http.Handler) http.Handler {
@ -37,6 +38,7 @@ func (*middleWareService) middleWareSecureHeaders(next http.Handler) http.Handle
// middleWareAuthenticate provides Authentication middleware for handlers
func (service *middleWareService) middleWareAuthenticate(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if !service.authDisabled {
var token string
// Get token from the Authorization header
@ -56,6 +58,7 @@ func (service *middleWareService) middleWareAuthenticate(next http.Handler) http
Error(w, err, http.StatusUnauthorized, nil)
return
}
}
next.ServeHTTP(w, r)
return

View File

@ -10,6 +10,7 @@ import (
type Server struct {
BindAddress string
AssetsPath string
AuthDisabled bool
UserService portainer.UserService
EndpointService portainer.EndpointService
CryptoService portainer.CryptoService
@ -41,12 +42,14 @@ func (server *Server) updateActiveEndpoint(endpoint *portainer.Endpoint) error {
func (server *Server) Start() error {
middleWareService := &middleWareService{
jwtService: server.JWTService,
authDisabled: server.AuthDisabled,
}
var authHandler = NewAuthHandler()
authHandler.UserService = server.UserService
authHandler.CryptoService = server.CryptoService
authHandler.JWTService = server.JWTService
authHandler.authDisabled = server.AuthDisabled
var userHandler = NewUserHandler(middleWareService)
userHandler.UserService = server.UserService
userHandler.CryptoService = server.CryptoService

View File

@ -20,6 +20,7 @@ type (
Labels *[]Pair
Logo *string
Templates *string
NoAuth *bool
TLSVerify *bool
TLSCacert *string
TLSCert *string
@ -30,6 +31,7 @@ type (
Settings struct {
HiddenLabels []Pair `json:"hiddenLabels"`
Logo string `json:"logo"`
Authentication bool `json:"authentication"`
}
// User represent a user account.

View File

@ -67,124 +67,121 @@ angular.module('portainer', [
$urlRouterProvider.otherwise('/auth');
$stateProvider
.state('root', {
abstract: true,
resolve: {
requiresLogin: ['StateManager', function (StateManager) {
var applicationState = StateManager.getState();
return applicationState.application.authentication;
}]
}
})
.state('auth', {
parent: 'root',
url: '/auth',
params: {
logout: false,
error: ''
},
views: {
"content": {
"content@": {
templateUrl: 'app/components/auth/auth.html',
controller: 'AuthenticationController'
}
},
data: {
requiresLogin: false
}
})
.state('containers', {
parent: 'root',
url: '/containers/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/containers/containers.html',
controller: 'ContainersController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('container', {
url: "^/containers/:id",
views: {
"content": {
"content@": {
templateUrl: 'app/components/container/container.html',
controller: 'ContainerController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('stats', {
url: "^/containers/:id/stats",
views: {
"content": {
"content@": {
templateUrl: 'app/components/stats/stats.html',
controller: 'StatsController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('logs', {
url: "^/containers/:id/logs",
views: {
"content": {
"content@": {
templateUrl: 'app/components/containerLogs/containerlogs.html',
controller: 'ContainerLogsController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('console', {
url: "^/containers/:id/console",
views: {
"content": {
"content@": {
templateUrl: 'app/components/containerConsole/containerConsole.html',
controller: 'ContainerConsoleController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('dashboard', {
parent: 'root',
url: '/dashboard',
views: {
"content": {
"content@": {
templateUrl: 'app/components/dashboard/dashboard.html',
controller: 'DashboardController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('actions', {
abstract: true,
url: "/actions",
views: {
"content": {
template: '<div ui-view="content"></div>'
"content@": {
template: '<div ui-view="content@"></div>'
},
"sidebar": {
template: '<div ui-view="sidebar"></div>'
"sidebar@": {
template: '<div ui-view="sidebar@"></div>'
}
}
})
@ -192,344 +189,281 @@ angular.module('portainer', [
abstract: true,
url: "/create",
views: {
"content": {
template: '<div ui-view="content"></div>'
"content@": {
template: '<div ui-view="content@"></div>'
},
"sidebar": {
template: '<div ui-view="sidebar"></div>'
"sidebar@": {
template: '<div ui-view="sidebar@"></div>'
}
}
})
.state('actions.create.container', {
url: "/container",
views: {
"content": {
"content@": {
templateUrl: 'app/components/createContainer/createcontainer.html',
controller: 'CreateContainerController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('actions.create.network', {
url: "/network",
views: {
"content": {
"content@": {
templateUrl: 'app/components/createNetwork/createnetwork.html',
controller: 'CreateNetworkController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('actions.create.service', {
url: "/service",
views: {
"content": {
"content@": {
templateUrl: 'app/components/createService/createservice.html',
controller: 'CreateServiceController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('actions.create.volume', {
url: "/volume",
views: {
"content": {
"content@": {
templateUrl: 'app/components/createVolume/createvolume.html',
controller: 'CreateVolumeController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('docker', {
url: '/docker/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/docker/docker.html',
controller: 'DockerController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('endpoints', {
url: '/endpoints/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/endpoints/endpoints.html',
controller: 'EndpointsController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('endpoint', {
url: '^/endpoints/:id',
views: {
"content": {
"content@": {
templateUrl: 'app/components/endpoint/endpoint.html',
controller: 'EndpointController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('endpointInit', {
url: '/init/endpoint',
views: {
"content": {
"content@": {
templateUrl: 'app/components/endpointInit/endpointInit.html',
controller: 'EndpointInitController'
}
},
data: {
requiresLogin: true
}
})
.state('events', {
url: '/events/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/events/events.html',
controller: 'EventsController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('images', {
url: '/images/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/images/images.html',
controller: 'ImagesController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('image', {
url: '^/images/:id/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/image/image.html',
controller: 'ImageController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('networks', {
url: '/networks/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/networks/networks.html',
controller: 'NetworksController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('network', {
url: '^/networks/:id/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/network/network.html',
controller: 'NetworkController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('node', {
url: '^/nodes/:id/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/node/node.html',
controller: 'NodeController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('services', {
url: '/services/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/services/services.html',
controller: 'ServicesController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('service', {
url: '^/service/:id/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/service/service.html',
controller: 'ServiceController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('settings', {
url: '/settings/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/settings/settings.html',
controller: 'SettingsController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('task', {
url: '^/task/:id',
views: {
"content": {
"content@": {
templateUrl: 'app/components/task/task.html',
controller: 'TaskController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('templates', {
url: '/templates/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/templates/templates.html',
controller: 'TemplatesController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('volumes', {
url: '/volumes/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/volumes/volumes.html',
controller: 'VolumesController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
})
.state('swarm', {
url: '/swarm/',
views: {
"content": {
"content@": {
templateUrl: 'app/components/swarm/swarm.html',
controller: 'SwarmController'
},
"sidebar": {
"sidebar@": {
templateUrl: 'app/components/sidebar/sidebar.html',
controller: 'SidebarController'
}
},
data: {
requiresLogin: true
}
});
@ -550,18 +484,21 @@ angular.module('portainer', [
};
});
}])
.run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', function ($rootScope, $state, Authentication, authManager, StateManager) {
.run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'Messages', function ($rootScope, $state, Authentication, authManager, StateManager, Messages) {
StateManager.initialize().then(function success(state) {
if (state.application.authentication) {
authManager.checkAuthOnRefresh();
authManager.redirectWhenUnauthenticated();
Authentication.init();
StateManager.init();
$rootScope.$state = $state;
$rootScope.$on('tokenHasExpired', function($state) {
$state.go('auth', {error: 'Your session has expired'});
});
}
}, function error(err) {
Messages.error("Failure", err, 'Unable to retrieve application settings');
});
$rootScope.$state = $state;
}])
// This is your docker url that the api will use to make requests
// You need to set this to the api endpoint without the port i.e. http://192.168.1.9

View File

@ -13,6 +13,23 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
error: false
};
if (!$scope.applicationState.application.authentication) {
EndpointService.getActive().then(function success(data) {
StateManager.updateEndpointState(true)
.then(function success() {
$state.go('dashboard');
}, function error(err) {
Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
});
}, function error(err) {
if (err.status === 404) {
$state.go('endpointInit');
} else {
Messages.error("Failure", err, 'Unable to verify Docker endpoint existence');
}
});
}
if ($stateParams.logout) {
Authentication.logout();
}

View File

@ -47,7 +47,7 @@
<a ui-sref="docker" ui-sref-active="active">Docker <span class="menu-icon fa fa-th"></span></a>
</li>
<li class="sidebar-title"><span>Portainer settings</span></li>
<li class="sidebar-list">
<li class="sidebar-list" ng-if="applicationState.application.authentication">
<a ui-sref="settings" ui-sref-active="active">Password <span class="menu-icon fa fa-lock"></span></a>
</li>
<li class="sidebar-list">

View File

@ -1,11 +1,14 @@
angular
.module('portainer')
.directive('rdHeaderContent', function rdHeaderContent() {
.directive('rdHeaderContent', ['Authentication', function rdHeaderContent(Authentication) {
var directive = {
requires: '^rdHeader',
transclude: true,
template: '<div class="breadcrumb-links"><div class="pull-left" ng-transclude></div><div class="pull-right"><a ui-sref="auth({logout: true})" class="text-danger" style="margin-right: 25px;"><u>log out <i class="fa fa-sign-out" aria-hidden="true"></i></u></a></div></div>',
link: function (scope, iElement, iAttrs) {
scope.username = Authentication.getCredentials().username;
},
template: '<div class="breadcrumb-links"><div class="pull-left" ng-transclude></div><div class="pull-right" ng-if="username"><a ui-sref="auth({logout: true})" class="text-danger" style="margin-right: 25px;"><u>log out <i class="fa fa-sign-out" aria-hidden="true"></i></u></a></div></div>',
restrict: 'E'
};
return directive;
});
}]);

View File

@ -1,16 +1,16 @@
angular
.module('portainer')
.directive('rdHeaderTitle', ['$rootScope', function rdHeaderTitle($rootScope) {
.directive('rdHeaderTitle', ['Authentication', function rdHeaderTitle(Authentication) {
var directive = {
requires: '^rdHeader',
scope: {
title: '@'
},
link: function (scope, iElement, iAttrs) {
scope.username = $rootScope.username;
scope.username = Authentication.getCredentials().username;
},
transclude: true,
template: '<div class="page white-space-normal">{{title}}<span class="header_title_content" ng-transclude></span><span class="pull-right user-box"><i class="fa fa-user-circle-o" aria-hidden="true"></i> {{username}}</span></div>',
template: '<div class="page white-space-normal">{{title}}<span class="header_title_content" ng-transclude></span><span class="pull-right user-box" ng-if="username"><i class="fa fa-user-circle-o" aria-hidden="true"></i> {{username}}</span></div>',
restrict: 'E'
};
return directive;

View File

@ -1,12 +1,14 @@
angular.module('portainer.services')
.factory('Authentication', ['$q', '$rootScope', 'Auth', 'jwtHelper', 'LocalStorage', 'StateManager', function AuthenticationFactory($q, $rootScope, Auth, jwtHelper, LocalStorage, StateManager) {
.factory('Authentication', ['$q', 'Auth', 'jwtHelper', 'LocalStorage', 'StateManager', function AuthenticationFactory($q, Auth, jwtHelper, LocalStorage, StateManager) {
'use strict';
var credentials = {};
return {
init: function() {
var jwt = LocalStorage.getJWT();
if (jwt) {
var tokenPayload = jwtHelper.decodeToken(jwt);
$rootScope.username = tokenPayload.username;
credentials.username = tokenPayload.username;
}
},
login: function(username, password) {
@ -14,7 +16,7 @@ angular.module('portainer.services')
Auth.login({username: username, password: password}).$promise
.then(function(data) {
LocalStorage.storeJWT(data.jwt);
$rootScope.username = username;
credentials.username = username;
resolve();
}, function() {
reject();
@ -28,6 +30,9 @@ angular.module('portainer.services')
isAuthenticated: function() {
var jwt = LocalStorage.getJWT();
return jwt && !jwtHelper.isTokenExpired(jwt);
},
getCredentials: function() {
return credentials;
}
};
}]);

View File

@ -8,6 +8,12 @@ angular.module('portainer.services')
getEndpointState: function() {
return localStorageService.get('ENDPOINT_STATE');
},
storeApplicationState: function(state) {
localStorageService.set('APPLICATION_STATE', state);
},
getApplicationState: function() {
return localStorageService.get('APPLICATION_STATE');
},
storeJWT: function(jwt) {
localStorageService.set('JWT', jwt);
},

View File

@ -1,5 +1,5 @@
angular.module('portainer.services')
.factory('StateManager', ['$q', 'Info', 'InfoHelper', 'Version', 'LocalStorage', function StateManagerFactory($q, Info, InfoHelper, Version, LocalStorage) {
.factory('StateManager', ['$q', 'Config', 'Info', 'InfoHelper', 'Version', 'LocalStorage', function StateManagerFactory($q, Config, Info, InfoHelper, Version, LocalStorage) {
'use strict';
var state = {
@ -9,12 +9,31 @@ angular.module('portainer.services')
};
return {
init: function() {
initialize: function() {
var endpointState = LocalStorage.getEndpointState();
if (endpointState) {
state.endpoint = endpointState;
}
var deferred = $q.defer();
var applicationState = LocalStorage.getApplicationState();
if (applicationState) {
state.application = applicationState;
state.loading = false;
deferred.resolve(state);
} else {
Config.$promise.then(function success(data) {
state.application.authentication = data.authentication;
state.application.logo = data.logo;
LocalStorage.storeApplicationState(state.application);
state.loading = false;
deferred.resolve(state);
}, function error(err) {
state.loading = false;
deferred.reject({msg: 'Unable to retrieve server configuration', err: err});
});
}
return deferred.promise;
},
clean: function() {
state.endpoint = {};