From 2a6ea4944d0498ceb2737e503510cd53fa8d6b19 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Fri, 20 May 2022 14:29:13 -0400 Subject: [PATCH 1/3] adds ext jwt update event listning for jwt auth mod cache --- controller/model/authenticator_mod_ext_jwt.go | 1 + 1 file changed, 1 insertion(+) diff --git a/controller/model/authenticator_mod_ext_jwt.go b/controller/model/authenticator_mod_ext_jwt.go index ffeca2292..c737f50ae 100644 --- a/controller/model/authenticator_mod_ext_jwt.go +++ b/controller/model/authenticator_mod_ext_jwt.go @@ -49,6 +49,7 @@ func NewAuthModuleExtJwt(env Env) *AuthModuleExtJwt { } env.GetStores().ExternalJwtSigner.AddListener(boltz.EventCreate, ret.onExternalSignerCreateOrUpdate) + env.GetStores().ExternalJwtSigner.AddListener(boltz.EventUpdate, ret.onExternalSignerCreateOrUpdate) env.GetStores().ExternalJwtSigner.AddListener(boltz.EventDelete, ret.onExternalSignerDelete) ret.loadExistingSigners() From a09104c3eafba163b06b571247d5bd1e3378b129 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Fri, 20 May 2022 14:35:26 -0400 Subject: [PATCH 2/3] remove debug output --- controller/model/enrollment_model.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/controller/model/enrollment_model.go b/controller/model/enrollment_model.go index dba266648..ad48c8db2 100644 --- a/controller/model/enrollment_model.go +++ b/controller/model/enrollment_model.go @@ -85,10 +85,7 @@ func (entity *Enrollment) FillJwtInfoWithExpiresAt(env Env, subject string, expi return err } - fmt.Printf("\nOld2: %s\n", entity.Jwt) - fmt.Printf("New2: %s\n", signedJwt) entity.Jwt = signedJwt - fmt.Printf("New2: %s\n", entity.Jwt) return nil } From 35cf029952d17fc45970d11da85bcbc583c63a8a Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Fri, 20 May 2022 14:51:09 -0400 Subject: [PATCH 3/3] fix partial update panic for ext jwt update events --- controller/model/authenticator_mod_ext_jwt.go | 43 ++++++++++++++++--- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/controller/model/authenticator_mod_ext_jwt.go b/controller/model/authenticator_mod_ext_jwt.go index c737f50ae..cbe49aac4 100644 --- a/controller/model/authenticator_mod_ext_jwt.go +++ b/controller/model/authenticator_mod_ext_jwt.go @@ -48,8 +48,8 @@ func NewAuthModuleExtJwt(env Env) *AuthModuleExtJwt { signers: cmap.New(), } - env.GetStores().ExternalJwtSigner.AddListener(boltz.EventCreate, ret.onExternalSignerCreateOrUpdate) - env.GetStores().ExternalJwtSigner.AddListener(boltz.EventUpdate, ret.onExternalSignerCreateOrUpdate) + env.GetStores().ExternalJwtSigner.AddListener(boltz.EventCreate, ret.onExternalSignerCreate) + env.GetStores().ExternalJwtSigner.AddListener(boltz.EventUpdate, ret.onExternalSignerUpdate) env.GetStores().ExternalJwtSigner.AddListener(boltz.EventDelete, ret.onExternalSignerDelete) ret.loadExistingSigners() @@ -295,11 +295,35 @@ func (a *AuthModuleExtJwt) getKnownSignerRecords() map[string]interface{} { return a.signers.Items() } -func (a *AuthModuleExtJwt) onExternalSignerCreateOrUpdate(args ...interface{}) { +func (a *AuthModuleExtJwt) onExternalSignerCreate(args ...interface{}) { + signer, ok := args[0].(*persistence.ExternalJwtSigner) + + if !ok { + pfxlog.Logger().Errorf("error on external signature create for authentication module %T: expected %T got %T", a, signer, args[0]) + return + } + + a.addSigner(signer) +} + +func (a *AuthModuleExtJwt) onExternalSignerUpdate(args ...interface{}) { signer, ok := args[0].(*persistence.ExternalJwtSigner) if !ok { pfxlog.Logger().Errorf("error on external signature update for authentication module %T: expected %T got %T", a, signer, args[0]) + return + } + + //read on update because patches can pass partial data + err := a.env.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error { + var err error + signer, err = a.env.GetStores().ExternalJwtSigner.LoadOneById(tx, signer.Id) + + return err + }) + + if err != nil { + pfxlog.Logger().Errorf("error on external signature update for authentication module %T: could not read entity: %v", a, err) } a.addSigner(signer) @@ -308,10 +332,14 @@ func (a *AuthModuleExtJwt) onExternalSignerCreateOrUpdate(args ...interface{}) { func (a *AuthModuleExtJwt) addSigner(signer *persistence.ExternalJwtSigner) { certs := nfPem.PemStringToCertificates(signer.CertPem) - a.signers.Set(signer.Kid, &signerRecord{ - externalJwtSigner: signer, - cert: certs[0], - }) + if len(certs) > 0 { + a.signers.Set(signer.Kid, &signerRecord{ + externalJwtSigner: signer, + cert: certs[0], + }) + } else { + pfxlog.Logger().Error("could not add signer, PEM did not parse to any certificates") + } } func (a *AuthModuleExtJwt) onExternalSignerDelete(args ...interface{}) { @@ -319,6 +347,7 @@ func (a *AuthModuleExtJwt) onExternalSignerDelete(args ...interface{}) { if !ok { pfxlog.Logger().Errorf("error on external signature update for authentication module %T: expected %T got %T", a, signer, args[0]) + return } a.signers.Remove(signer.Kid)