Skip to content

Enable ESP to invoke Firebase Security rules. #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sarvaniv merged 22 commits into from
Feb 2, 2017
Merged

Enable ESP to invoke Firebase Security rules. #54

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
348f061
Enable ESP to invoke Firebase Security rules.
sarvaniv Jan 26, 2017
6339697
Address code review comments.
sarvaniv Jan 27, 2017
13caf68
Address code review comments
sarvaniv Jan 27, 2017
b0e48c7
Remove some debug logs
sarvaniv Jan 27, 2017
6f10a20
Add proto file to capture TestRulesetRequest.
sarvaniv Jan 31, 2017
c6ae0fa
clang-format files
sarvaniv Jan 31, 2017
01b50bf
Resolve a merge issue with previous commit
sarvaniv Jan 31, 2017
1a6704c
Allow security rules to disabled via serverconfig
sarvaniv Feb 1, 2017
6351cfa
format file
sarvaniv Feb 1, 2017
32d0023
Addressed Wayne's review comments.
sarvaniv Feb 1, 2017
75d6e7a
Add firebase server to Server Config.
sarvaniv Feb 1, 2017
b573770
Address Lizan's review comments
sarvaniv Feb 1, 2017
9887846
Address review comments.
sarvaniv Feb 1, 2017
7a2abe7
Disable check rules service by default.
sarvaniv Feb 1, 2017
b871e40
Address more review comments.
sarvaniv Feb 2, 2017
71c0d92
Fix a check.
sarvaniv Feb 2, 2017
50955e3
Delete unwanted constant.
sarvaniv Feb 2, 2017
35a61df
Address Wayne's comments and add a simple config test.
sarvaniv Feb 2, 2017
4ef505a
Address a review comment.
sarvaniv Feb 2, 2017
9dddcac
Add negative test case for config
sarvaniv Feb 2, 2017
c35348d
Address code review
sarvaniv Feb 2, 2017
4ccc606
Remove unwanted const std::string
sarvaniv Feb 2, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions contrib/endpoints/src/api_manager/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,19 @@ cc_proto_library(
visibility = ["//visibility:public"],
)

cc_proto_library(
name = "security_rules_proto",
srcs = [
"proto/security_rules.proto",
],
default_runtime = "//external:protobuf",
protoc = "//external:protoc",
visibility = ["//visibility:public"],
deps = [
"//external:cc_wkt_protos",
],
)

cc_library(
name = "auth_headers",
hdrs = [
Expand Down Expand Up @@ -99,6 +112,7 @@ cc_library(
":auth_headers",
":impl_headers",
":server_config_proto",
":security_rules_proto",
"//contrib/endpoints/src/api_manager/auth",
"//contrib/endpoints/src/api_manager/cloud_trace",
"//contrib/endpoints/src/api_manager/context",
Expand Down
3 changes: 3 additions & 0 deletions contrib/endpoints/src/api_manager/auth.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
#ifndef API_MANAGER_AUTH_H_
#define API_MANAGER_AUTH_H_

#include <map>

@liminw liminw Feb 1, 2017

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you include ?

@sarvaniv sarvaniv Feb 1, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed.

#include <set>
#include <sstream>
#include <string>
Expand All @@ -40,6 +41,8 @@ struct UserInfo {
// Authorized party of the incoming JWT.
// See http://openid.net/specs/openid-connect-core-1_0.html#IDToken
std::string authorized_party;
// String of claims
std::string claims;

// Returns audiences as a comma separated strings.
std::string AudiencesAsString() const {
Expand Down
10 changes: 9 additions & 1 deletion contrib/endpoints/src/api_manager/auth/lib/auth_jwt_validator.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -699,12 +699,20 @@ grpc_jwt_verifier_status JwtValidatorImpl::FillUserInfoAndSetExp(

// Optional field.
const grpc_json *grpc_json = grpc_jwt_claims_json(claims_);

/*for (grpc_json *cur = json->child; cur != nullptr; cur = cur->next) {
user_info->claims.emplace(std::string(cur->key), std::string(cur->value));
} */

@qiwzhang qiwzhang Feb 1, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is this commented out code for? If no needed, remove it

@sarvaniv sarvaniv Feb 1, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed.


char *json_str =

@lizan lizan Feb 1, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

json_str is leaked

@sarvaniv sarvaniv Feb 1, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you. Missed this while addressing review comments. I was freeing this in the first commit :-)

grpc_json_dump_to_string(const_cast<::grpc_json *>(grpc_json), 0);
user_info->claims = json_str == nullptr ? "" : json_str;

const char *email = GetStringValue(grpc_json, "email");
user_info->email = email == nullptr ? "" : email;
const char *authorized_party = GetStringValue(grpc_json, "azp");
user_info->authorized_party =
authorized_party == nullptr ? "" : authorized_party;

exp_ = system_clock::from_time_t(grpc_jwt_claims_expires_at(claims_).tv_sec);

return GRPC_JWT_VERIFIER_OK;
Expand Down
1 change: 1 addition & 0 deletions contrib/endpoints/src/api_manager/auth/service_account_token.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ class ServiceAccountToken {
enum JWT_TOKEN_TYPE {
JWT_TOKEN_FOR_SERVICE_CONTROL = 0,
JWT_TOKEN_FOR_CLOUD_TRACING,
JWT_TOKEN_FOR_FIREBASE,
JWT_TOKEN_TYPE_MAX,
};
// Set audience. Only calcualtes JWT token with specified audience.
Expand Down
2 changes: 2 additions & 0 deletions contrib/endpoints/src/api_manager/check_auth.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,8 @@ void AuthChecker::CheckAudience(bool cache_hit) {
context_->set_auth_audience(audience);
context_->set_auth_authorized_party(user_info_.authorized_party);

context_->set_auth_claims(user_info_.claims);

// Remove http/s header and trailing '/' for issuer.
std::string issuer = utils::GetUrlContent(user_info_.issuer);
if (!context_->method()->isIssuerAllowed(issuer)) {
Expand Down
Loading