05665c05f3
A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.
158 lines
6.5 KiB
Nix
158 lines
6.5 KiB
Nix
# Shared shell steps for authelia's OIDC client secrets, whose plaintext half
|
|
# lives in the swarm secret store and never on disk. authelia keeps only a
|
|
# digest of each, in `$clients/<id>.digest`, and starts from it whether or not
|
|
# the store answers.
|
|
#
|
|
# `mint_client_secret` keeps every client with a digest. A client without one
|
|
# gets it from the secret that exists: the plaintext file an earlier release
|
|
# left, else the store's value. Only a client with none of the three is minted,
|
|
# and then the store's leaf is created (`-cas=0`, so an existing value is never
|
|
# replaced) before the digest is written, so a digest on disk always has a
|
|
# secret behind it. A store that cannot be read never mints, because a second
|
|
# secret would rotate the first.
|
|
#
|
|
# `migrate_client_secret` moves the plaintext file an earlier release left in
|
|
# `$clients/<id>.secret` into the store and removes it once a read-back shows
|
|
# the store holds the same value. It never overwrites a store value and never
|
|
# removes a file the store does not match.
|
|
#
|
|
# Return statuses: 0 done, 1 retry later (the store could not answer, or a
|
|
# digest could not be computed), 3 (migration only) the file and the store hold
|
|
# different secrets, and only an operator can say which is right.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it after `./store-seeded-secret.nix`
|
|
# and `./atomic-write-secret.nix`, with `store_init` and `store_login` run and
|
|
# `$clients` set to the digest directory. Needs `authelia`, `bao`, `script`
|
|
# (util-linux), `coreutils`, `grep` and `sed` on the caller's `path`.
|
|
{ }:
|
|
''
|
|
# <leaf>. Sets CLIENT_SECRET_VALUE. 0: the store holds a value. 1: it holds
|
|
# none. 2: it cannot tell (not logged in, down, or refusing the read).
|
|
client_secret_read() {
|
|
CLIENT_SECRET_VALUE=""
|
|
[ "$STORE_UP" = 1 ] || return 2
|
|
if CLIENT_SECRET_VALUE="$(store_bao kv get -field=value "$1" 2>"$STORE_ERR")" \
|
|
&& [ -n "$CLIENT_SECRET_VALUE" ]; then
|
|
return 0
|
|
fi
|
|
CLIENT_SECRET_VALUE=""
|
|
if grep -q '^No value found at ' "$STORE_ERR"; then
|
|
return 1
|
|
fi
|
|
cat "$STORE_ERR" >&2
|
|
return 2
|
|
}
|
|
|
|
# <secret>. Prints authelia's digest of it, the form `mint` would have
|
|
# written. The CLI takes a password only on a terminal prompt or in argv,
|
|
# and argv is world-readable in /proc, so the prompt is answered through a
|
|
# pty from stdin. The pty echoes the password into the pipe, and only the
|
|
# `Digest:` line leaves it.
|
|
client_secret_digest() {
|
|
printf '%s\n' "$1" \
|
|
| timeout 60 script -qec "authelia crypto hash generate pbkdf2 --variant sha512 --no-confirm" /dev/null \
|
|
| tr -d '\r' | sed -n 's/^Digest: *//p'
|
|
}
|
|
|
|
# <client id> <secret> <where the secret came from>. Writes the digest of an
|
|
# existing secret; the secret itself is untouched.
|
|
client_secret_derive_digest() {
|
|
local id="$1" secret="$2" source="$3" digest
|
|
digest="$(client_secret_digest "$secret")" || digest=""
|
|
if [ -z "$digest" ]; then
|
|
echo "<3>oidc client $id: could not compute a digest from the secret in $source" >&2
|
|
return 1
|
|
fi
|
|
atomic_write_secret 0600 "" "$clients/$id.digest" "$digest" || return 1
|
|
MINTED=1
|
|
echo "oidc client $id: wrote the digest from the secret in $source; the secret is unchanged"
|
|
}
|
|
|
|
# <client id> <leaf>. Sets MINTED when it wrote a digest.
|
|
mint_client_secret() {
|
|
local id="$1" leaf="$2" dig="$clients/$1.digest" legacy="$clients/$1.secret"
|
|
local state=0 out secret digest
|
|
if [ -s "$legacy" ]; then
|
|
if [ -s "$dig" ]; then
|
|
return 0
|
|
fi
|
|
client_secret_derive_digest "$id" "$(< "$legacy")" "$legacy"
|
|
return
|
|
fi
|
|
client_secret_read "$leaf" || state=$?
|
|
if [ "$state" = 0 ]; then
|
|
if [ -s "$dig" ]; then
|
|
chmod 0600 "$dig"
|
|
return 0
|
|
fi
|
|
client_secret_derive_digest "$id" "$CLIENT_SECRET_VALUE" "the store at $leaf"
|
|
return
|
|
fi
|
|
if [ "$state" = 2 ]; then
|
|
if [ -s "$dig" ]; then
|
|
chmod 0600 "$dig"
|
|
echo "oidc client $id: the store cannot be read; keeping its digest" >&2
|
|
return 0
|
|
fi
|
|
echo "oidc client $id: the store cannot be read and there is no digest; not minting" >&2
|
|
return 1
|
|
fi
|
|
echo "oidc client $id: the store holds no secret at $leaf; minting one"
|
|
out="$(authelia crypto hash generate pbkdf2 --variant sha512 --random)"
|
|
secret="$(printf '%s' "$out" | sed -n 's/^Random Password: *//p')"
|
|
digest="$(printf '%s' "$out" | sed -n 's/^Digest: *//p')"
|
|
if [ -z "$secret" ] || [ -z "$digest" ]; then
|
|
echo "<3>authelia crypto hash generate produced no secret/digest for $id" >&2
|
|
return 1
|
|
fi
|
|
if ! printf '%s' "$secret" | store_bao kv put -cas=0 "$leaf" value=- >/dev/null 2>"$STORE_ERR"; then
|
|
cat "$STORE_ERR" >&2
|
|
echo "could not create $leaf; reading it back in case another run created it" >&2
|
|
fi
|
|
client_secret_read "$leaf" || return 1
|
|
if [ "$CLIENT_SECRET_VALUE" != "$secret" ]; then
|
|
echo "oidc client $id: $leaf holds a value another run created; using it"
|
|
client_secret_derive_digest "$id" "$CLIENT_SECRET_VALUE" "the store at $leaf"
|
|
return
|
|
fi
|
|
atomic_write_secret 0600 "" "$dig" "$digest" || return 1
|
|
MINTED=1
|
|
echo "minted client secret for $id into the store"
|
|
}
|
|
|
|
# <client id> <leaf>
|
|
migrate_client_secret() {
|
|
local id="$1" leaf="$2" legacy="$clients/$1.secret" value state=0
|
|
[ -e "$legacy" ] || return 0
|
|
value="$(< "$legacy")"
|
|
if [ -z "$value" ]; then
|
|
echo "<3>oidc client $id: $legacy is empty; keeping it" >&2
|
|
return 3
|
|
fi
|
|
client_secret_read "$leaf" || state=$?
|
|
if [ "$state" = 2 ]; then
|
|
echo "oidc client $id: the store cannot be read; keeping $legacy" >&2
|
|
return 1
|
|
fi
|
|
if [ "$state" = 0 ]; then
|
|
if [ "$CLIENT_SECRET_VALUE" != "$value" ]; then
|
|
echo "<3>oidc client $id: the store at $leaf and $legacy hold different secrets; keeping both" >&2
|
|
return 3
|
|
fi
|
|
rm -f "$legacy" || return 1
|
|
echo "oidc client $id: already in the store, removed the file $legacy"
|
|
return 0
|
|
fi
|
|
if ! printf '%s' "$value" | store_bao kv put -cas=0 "$leaf" value=- >/dev/null 2>"$STORE_ERR"; then
|
|
cat "$STORE_ERR" >&2
|
|
echo "oidc client $id: could not create $leaf; reading it back in case another run created it" >&2
|
|
fi
|
|
client_secret_read "$leaf" || return 1
|
|
if [ "$CLIENT_SECRET_VALUE" != "$value" ]; then
|
|
echo "<3>oidc client $id: the store at $leaf and $legacy hold different secrets; keeping both" >&2
|
|
return 3
|
|
fi
|
|
rm -f "$legacy" || return 1
|
|
echo "oidc client $id: stored in the store, removed the file $legacy"
|
|
}
|
|
''
|