Provide API to generate CLI secret

This commit provide an API to allow a user that is onboarded via OIDC authn update his CLI secret. Signed-off-by: Daniel Jiang <jiangd@vmware.com>
2025-05-14 21:43:53 +00:00 · 2019-04-19 18:44:24 +08:00 · 2019-04-19 18:44:24 +08:00 · 1fdc2e6ba9
commit 1fdc2e6ba9
parent 71cd51c9f4
6 changed files with 230 additions and 136 deletions
--- a/docs/swagger.yaml
+++ b/docs/swagger.yaml
@ -940,6 +940,44 @@ paths:
          description: User ID does not exist.
        '500':
          description: Unexpected internal errors.
+  '/users/{user_id}/gen_cli_secret':
+    post:
+      summary: Generate new CLI secret for a user.
+      description: |
+        This endpoint let user generate a new CLI secret for himself.  This API only works when auth mode is set to 'OIDC'.
+        Once this API returns with successful status, the old secret will be invalid, as there will be only one CLI secret
+        for a user.  The new secret will be returned in the response.
+      parameters:
+        - name: user_id
+          in: path
+          type: integer
+          format: int
+          required: true
+          description: User ID
+      tags:
+        - Products
+      responses:
+        '200':
+          description: The secret is successfully generated.
+          schema:
+            type: object
+            properties:
+              secret:
+                type: string
+                description: The new secret
+        '400':
+          description: Invalid user ID.  Or user is not onboarded via OIDC authentication.
+        '401':
+          description: User need to log in first.
+        '403':
+          description: Non-admin user can only generate the cli secret of himself.
+        '404':
+          description: User ID does not exist.
+        '412':
+          description: The auth mode of the system is not "oidc_auth", or the user is not onboarded via OIDC AuthN.
+        '500':
+          description: Unexpected internal errors.
+
  /repositories:
    get:
      summary: Get repositories accompany with relevant project and repo name.
@ -1884,14 +1922,14 @@ paths:
      description: |
        Delete the replication policy specified by ID.
      parameters:
-      - name: id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Replication policy ID
+        - name: id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Replication policy ID
      tags:
-      - Products
+        - Products
      responses:
        '200':
          $ref: '#/responses/OK'
@ -2297,18 +2335,18 @@ paths:
      description: |
        This endpoint let user list namespaces of registry according to query.
      parameters:
-      - name: id
-        in: path
-        type: integer
-        required: true
-        description: The registry ID.
-      - name: name
-        in: query
-        type: string
-        required: false
-        description: The name of namespace.
+        - name: id
+          in: path
+          type: integer
+          required: true
+          description: The registry ID.
+        - name: name
+          in: query
+          type: string
+          required: false
+          description: The name of namespace.
      tags:
-      - Products
+        - Products
      responses:
        '200':
          description: Success
@ -2661,7 +2699,7 @@ paths:
        '200':
          description: Get gc results successfully.
          schema:
-              $ref: '#/definitions/GCResult'
+            $ref: '#/definitions/GCResult'
        '401':
          description: User need to log in first.
        '403':
@ -2706,7 +2744,7 @@ paths:
        '200':
          description: Get gc's schedule.
          schema:
-              $ref: '#/definitions/AdminJobSchedule'
+            $ref: '#/definitions/AdminJobSchedule'
        '401':
          description: User need to log in first.
        '403':
@ -2768,12 +2806,12 @@ paths:
      summary: Get scan_all's schedule.
      description: This endpoint is for getting a schedule for the scan all job, which scans all of images in Harbor.
      tags:
-      - Products
+        - Products
      responses:
        '200':
          description: Get a schedule for the scan all job, which scans all of images in Harbor.
          schema:
-              $ref: '#/definitions/AdminJobSchedule'
+            $ref: '#/definitions/AdminJobSchedule'
        '401':
          description: User need to log in first.
        '403':
@ -2785,14 +2823,14 @@ paths:
      description: |
        This endpoint is for updating the schedule of scan all job, which scans all of images in Harbor.
      parameters:
-      - name: schedule
-        in: body
-        required: true
-        schema:
-          $ref: '#/definitions/AdminJobSchedule'
-        description: Updates the schedule of scan all job, which scans all of images in Harbor.
+        - name: schedule
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/AdminJobSchedule'
+          description: Updates the schedule of scan all job, which scans all of images in Harbor.
      tags:
-      - Products
+        - Products
      responses:
        '200':
          description: Updated scan_all's schedule successfully.
@ -2809,14 +2847,14 @@ paths:
      description: |
        This endpoint is for creating a schedule or a manual trigger for the scan all job, which scans all of images in Harbor.
      parameters:
-      - name: schedule
-        in: body
-        required: true
-        schema:
-          $ref: '#/definitions/AdminJobSchedule'
-        description: Create a schedule or a manual trigger for the scan all job.
+        - name: schedule
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/AdminJobSchedule'
+          description: Create a schedule or a manual trigger for the scan all job.
      tags:
-      - Products
+        - Products
      responses:
        '200':
          description: Updated scan_all's schedule successfully.
@ -3289,15 +3327,15 @@ paths:
      summary: Get all robot accounts of specified project
      description: Get all robot accounts of specified project
      parameters:
-      - name: project_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Relevant project ID.
+        - name: project_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Relevant project ID.
      tags:
-      - Products
-      - Robot Account
+        - Products
+        - Robot Account
      responses:
        '200':
          description: Get project robot accounts successfully.
@ -3319,21 +3357,21 @@ paths:
      summary: Create a robot account for project
      description: Create a robot account for project
      tags:
-      - Products
-      - Robot Account
+        - Products
+        - Robot Account
      parameters:
-      - name: project_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Relevant project ID.
-      - name: robot
-        in: body
-        description: Request body of creating a robot account.
-        required: true
-        schema:
-          $ref: '#/definitions/RobotAccountCreate'
+        - name: project_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Relevant project ID.
+        - name: robot
+          in: body
+          description: Request body of creating a robot account.
+          required: true
+          schema:
+            $ref: '#/definitions/RobotAccountCreate'
      responses:
        '201':
          description: Project member created successfully.
@ -3354,21 +3392,21 @@ paths:
      summary: Return the infor of the specified robot account.
      description: Return the infor of the specified robot account.
      tags:
-      - Products
-      - Robot Account
+        - Products
+        - Robot Account
      parameters:
-      - name: project_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Relevant project ID.
-      - name: robot_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: The ID of robot account.
+        - name: project_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Relevant project ID.
+        - name: robot_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: The ID of robot account.
      responses:
        '200':
          description: Robot account information.
@ -3386,27 +3424,27 @@ paths:
      summary: Update status of robot account.
      description: Used to disable/enable a specified robot account.
      tags:
-      - Products
-      - Robot Account
+        - Products
+        - Robot Account
      parameters:
-      - name: project_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Relevant project ID.
-      - name: robot_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: The ID of robot account.
-      - name: robot
-        in: body
-        description: Request body of enable/disable a robot account.
-        required: true
-        schema:
-          $ref: '#/definitions/RobotAccountUpdate'
+        - name: project_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Relevant project ID.
+        - name: robot_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: The ID of robot account.
+        - name: robot
+          in: body
+          description: Request body of enable/disable a robot account.
+          required: true
+          schema:
+            $ref: '#/definitions/RobotAccountUpdate'
      responses:
        '200':
          description: Robot account has been modified success.
@ -3416,21 +3454,21 @@ paths:
      summary: Delete the specified robot account
      description: Delete the specified robot account
      tags:
-      - Products
-      - Robot Account
+        - Products
+        - Robot Account
      parameters:
-      - name: project_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: Relevant project ID.
-      - name: robot_id
-        in: path
-        type: integer
-        format: int64
-        required: true
-        description: The ID of robot account.
+        - name: project_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: Relevant project ID.
+        - name: robot_id
+          in: path
+          type: integer
+          format: int64
+          required: true
+          description: The ID of robot account.
      responses:
        '200':
          description: The specified robot account is successfully deleted.
--- a/make/migrations/postgresql/0004_1.8.0_schema.up.sql
+++ b/make/migrations/postgresql/0004_1.8.0_schema.up.sql
@ -38,7 +38,7 @@ CREATE TABLE oidc_user (
 UNIQUE (subiss)
 );

-CREATE TRIGGER odic_user_update_time_at_modtime BEFORE UPDATE ON oidc_user FOR EACH ROW EXECUTE PROCEDURE update_update_time_at_column();
+CREATE TRIGGER oidc_user_update_time_at_modtime BEFORE UPDATE ON oidc_user FOR EACH ROW EXECUTE PROCEDURE update_update_time_at_column();

 /*add master role*/
 INSERT INTO role (role_code, name) VALUES ('DRWS', 'master');
--- a/src/common/dao/oidc_user.go
+++ b/src/common/dao/oidc_user.go
@ -92,10 +92,17 @@ func GetOIDCUserByUserID(userID int) (*models.OIDCUser, error) {
 	return &oidcUsers[0], nil
 }

-// UpdateOIDCUser ...
+// UpdateOIDCUser updates the OIDCUser based on the input parm, only the column "secret" and "token" can be updated
 func UpdateOIDCUser(oidcUser *models.OIDCUser) error {
-	oidcUser.UpdateTime = time.Now()
-	_, err := GetOrmer().Update(oidcUser)
+	cols := []string{"secret", "token"}
+	_, err := GetOrmer().Update(oidcUser, cols...)
+	return err
+}
+
+// UpdateOIDCUserSecret updates the secret of the OIDC User.  The secret in the input parm should be encrypted before
+// calling this func
+func UpdateOIDCUserSecret(oidcUser *models.OIDCUser) error {
+	_, err := GetOrmer().Update(oidcUser, "secret")
 	return err
 }

--- a/src/common/dao/oidc_user_test.go
+++ b/src/common/dao/oidc_user_test.go
@ -80,15 +80,13 @@ func TestOIDCUserMetaDaoMethods(t *testing.T) {
 		ID:     ou111.ID,
 		UserID: ou111.UserID,
 		SubIss: "newSub",
+		Secret: "newSecret",
 	}
 	require.Nil(t, UpdateOIDCUser(meta3))
 	oidcUser1Update, err := GetOIDCUserByID(ou111.ID)
 	require.Nil(t, err)
-	assert.Equal(t, "newSub", oidcUser1Update.SubIss)
-
-	user, err := GetUserBySubIss("new", "Sub")
-	require.Nil(t, err)
-	assert.Equal(t, "user111", user.Username)
+	assert.Equal(t, "QWE123123RT1", oidcUser1Update.SubIss)
+	assert.Equal(t, "newSecret", oidcUser1Update.Secret)

 	// clear data
 	defer func() {
--- a/src/core/api/user.go
+++ b/src/core/api/user.go
@ -38,6 +38,7 @@ type UserAPI struct {
 	SelfRegistration bool
 	IsAdmin          bool
 	AuthMode         string
+	secretKey        string
 }

 type passwordReq struct {
@ -50,6 +51,10 @@ type userSearch struct {
 	Username string `json:"username"`
 }

+type secretResp struct {
+	Secret string `json:"secret"`
+}
+
 // Prepare validates the URL and parms
 func (ua *UserAPI) Prepare() {
 	ua.BaseController.Prepare()
@ -61,6 +66,15 @@ func (ua *UserAPI) Prepare() {
 	}

 	ua.AuthMode = mode
+	if mode == common.OIDCAuth {
+		key, err := config.SecretKey()
+		if err != nil {
+			log.Errorf("failed to get secret key: %v", err)
+			ua.SendInternalServerError(fmt.Errorf("failed to get secret key: %v", err))
+			return
+		}
+		ua.secretKey = key
+	}

 	self, err := config.SelfRegistration()
 	if err != nil {
@ -475,17 +489,53 @@ func (ua *UserAPI) ListUserPermissions() {
 	return
 }

-func (ua *UserAPI) getOIDCUserInfo() (*models.OIDCUser, error) {
-	key, err := config.SecretKey()
-	if err != nil {
-		return nil, err
+// GenCLISecret generates a new CLI secret and replace the old one
+func (ua *UserAPI) GenCLISecret() {
+	if ua.AuthMode != common.OIDCAuth {
+		ua.SendPreconditionFailedError(errors.New("the auth mode has to be oidc auth"))
+		return
 	}
+	if ua.userID != ua.currentUserID && !ua.IsAdmin {
+		ua.SendForbiddenError(errors.New(""))
+		return
+	}
+	oidcData, err := dao.GetOIDCUserByUserID(ua.userID)
+	if err != nil {
+		log.Errorf("Failed to get OIDC User meta for user, id: %d, error: %v", ua.userID, err)
+		ua.SendInternalServerError(errors.New("failed to get OIDC meta data for user"))
+		return
+	}
+	if oidcData == nil {
+		log.Errorf("User is not onboarded via OIDC AuthN, user id: %d", ua.userID)
+		ua.SendPreconditionFailedError(errors.New("user is not onboarded via OIDC AuthN"))
+		return
+	}
+
+	sec := utils.GenerateRandomString()
+	encSec, err := utils.ReversibleEncrypt(sec, ua.secretKey)
+	if err != nil {
+		log.Errorf("Failed to encrypt secret, error: %v", err)
+		ua.SendInternalServerError(errors.New("failed to encrypt secret"))
+		return
+	}
+	oidcData.Secret = encSec
+	err = dao.UpdateOIDCUserSecret(oidcData)
+	if err != nil {
+		log.Errorf("Failed to update secret in DB, error: %v", err)
+		ua.SendInternalServerError(errors.New("failed to update secret in DB"))
+		return
+	}
+	ua.Data["json"] = secretResp{sec}
+	ua.ServeJSON()
+}
+
+func (ua *UserAPI) getOIDCUserInfo() (*models.OIDCUser, error) {
 	o, err := dao.GetOIDCUserByUserID(ua.userID)
 	if err != nil || o == nil {
 		return nil, err
 	}
 	if len(o.Secret) > 0 {
-		p, err := utils.ReversibleDecrypt(o.Secret, key)
+		p, err := utils.ReversibleDecrypt(o.Secret, ua.secretKey)
 		if err != nil {
 			return nil, err
 		}
--- a/src/core/router.go
+++ b/src/core/router.go
@ -53,6 +53,7 @@ func initRouters() {
 		beego.Router("/api/users/:id([0-9]+)/password", &api.UserAPI{}, "put:ChangePassword")
 		beego.Router("/api/users/:id/permissions", &api.UserAPI{}, "get:ListUserPermissions")
 		beego.Router("/api/users/:id/sysadmin", &api.UserAPI{}, "put:ToggleUserAdminRole")
+		beego.Router("/api/users/:id/gen_cli_secret", &api.UserAPI{}, "post:GenCLISecret")
 		beego.Router("/api/usergroups/?:ugid([0-9]+)", &api.UserGroupAPI{})
 		beego.Router("/api/ldap/ping", &api.LdapAPI{}, "post:Ping")
 		beego.Router("/api/ldap/users/search", &api.LdapAPI{}, "get:Search")