-
Notifications
You must be signed in to change notification settings - Fork 88
/
iam.go
137 lines (114 loc) · 3.36 KB
/
iam.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
package authentication
import (
"encoding/base64"
"fmt"
bluemix "github.com/IBM-Cloud/bluemix-go"
"github.com/IBM-Cloud/bluemix-go/bmxerror"
"github.com/IBM-Cloud/bluemix-go/rest"
)
//IAMError ...
type IAMError struct {
ErrorCode string `json:"errorCode"`
ErrorMessage string `json:"errorMessage"`
ErrorDetails string `json:"errorDetails"`
}
//Description ...
func (e IAMError) Description() string {
if e.ErrorDetails != "" {
return e.ErrorDetails
}
return e.ErrorMessage
}
//IAMTokenResponse ...
type IAMTokenResponse struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
UAAAccessToken string `json:"uaa_token"`
UAARefreshToken string `json:"uaa_refresh_token"`
TokenType string `json:"token_type"`
}
//IAMAuthRepository ...
type IAMAuthRepository struct {
config *bluemix.Config
client *rest.Client
endpoint string
}
//NewIAMAuthRepository ...
func NewIAMAuthRepository(config *bluemix.Config, client *rest.Client) (*IAMAuthRepository, error) {
var endpoint string
if config.TokenProviderEndpoint != nil {
endpoint = *config.TokenProviderEndpoint
} else {
var err error
endpoint, err = config.EndpointLocator.IAMEndpoint()
if err != nil {
return nil, err
}
}
return &IAMAuthRepository{
config: config,
client: client,
endpoint: endpoint,
}, nil
}
//AuthenticatePassword ...
func (auth *IAMAuthRepository) AuthenticatePassword(username string, password string) error {
return auth.getToken(map[string]string{
"grant_type": "password",
"username": username,
"password": password,
})
}
//AuthenticateAPIKey ...
func (auth *IAMAuthRepository) AuthenticateAPIKey(apiKey string) error {
return auth.getToken(map[string]string{
"grant_type": "urn:ibm:params:oauth:grant-type:apikey",
"apikey": apiKey,
})
}
//AuthenticateSSO ...
func (auth *IAMAuthRepository) AuthenticateSSO(passcode string) error {
return auth.getToken(map[string]string{
"grant_type": "urn:ibm:params:oauth:grant-type:passcode",
"passcode": passcode,
})
}
//RefreshToken ...
func (auth *IAMAuthRepository) RefreshToken() (string, error) {
data := map[string]string{
"grant_type": "refresh_token",
"refresh_token": auth.config.IAMRefreshToken,
}
err := auth.getToken(data)
if err != nil {
return "", err
}
return auth.config.IAMAccessToken, nil
}
func (auth *IAMAuthRepository) getToken(data map[string]string) error {
request := rest.PostRequest(auth.endpoint+"/oidc/token").
Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte("bx:bx"))).
Field("response_type", "cloud_iam,uaa").
Field("uaa_client_id", "cf").
Field("uaa_client_secret", "")
for k, v := range data {
request.Field(k, v)
}
var tokens IAMTokenResponse
var apiErr IAMError
resp, err := auth.client.Do(request, &tokens, &apiErr)
if err != nil {
return err
}
if apiErr.ErrorCode != "" {
if apiErr.ErrorCode == "BXNIM0407E" {
return bmxerror.New(ErrCodeInvalidToken, apiErr.Description())
}
return bmxerror.NewRequestFailure(apiErr.ErrorCode, apiErr.Description(), resp.StatusCode)
}
auth.config.IAMAccessToken = fmt.Sprintf("%s %s", tokens.TokenType, tokens.AccessToken)
auth.config.IAMRefreshToken = tokens.RefreshToken
auth.config.UAAAccessToken = fmt.Sprintf("%s %s", tokens.TokenType, tokens.UAAAccessToken)
auth.config.UAARefreshToken = tokens.UAARefreshToken
return nil
}