Skip to content

Commit 7465267

Browse files
committed
Initial commit
0 parents  commit 7465267

File tree

12 files changed

+488
-0
lines changed

12 files changed

+488
-0
lines changed

.circleci/config.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
version: 2
2+
jobs:
3+
build:
4+
docker:
5+
- image: circleci/golang:1.11
6+
steps:
7+
- checkout
8+
- run: go build
9+
10+
release:
11+
docker:
12+
- image: circleci/golang:1.11
13+
steps:
14+
- checkout
15+
- setup_remote_docker
16+
- run:
17+
name: docker login
18+
command: docker login -u $DOCKER_USER -p $DOCKER_PASSWORD
19+
- run:
20+
name: build and release
21+
command: curl -sL https://git.io/goreleaser | bash
22+
workflows:
23+
version: 2
24+
build:
25+
jobs:
26+
- build:
27+
filters:
28+
tags:
29+
ignore: /.*/
30+
release:
31+
jobs:
32+
- release:
33+
filters:
34+
branches:
35+
ignore: /.*/
36+
tags:
37+
only: /[0-9]+(\.[0-9]+)*(-.*)*/

.gitignore

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
/*metadata.xml
2+
/*.cert
3+
/*.key
4+
5+
/dist/
6+
/saml-auth-proxy
7+
/saml-auth-proxy.exe
8+
/*.iml
9+
/.idea

.goreleaser.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
project_name: saml-proxy
2+
before:
3+
hooks:
4+
- go mod download
5+
builds:
6+
- env:
7+
- CGO_ENABLED=0
8+
goos:
9+
- linux
10+
- windows
11+
- darwin
12+
goarch:
13+
- amd64
14+
- arm
15+
archive:
16+
replacements:
17+
darwin: macosx
18+
386: x86_32
19+
amd64: x86_64
20+
format: binary
21+
files:
22+
- none*
23+
dockers:
24+
- image_templates:
25+
- "itzg/{{.ProjectName}}:latest"
26+
- "itzg/{{.ProjectName}}:{{ .Tag }}"
27+
checksum:
28+
name_template: 'checksums.txt'
29+
snapshot:
30+
name_template: "snapshot-{{ .ShortCommit }}"
31+
changelog:
32+
sort: asc
33+
filters:
34+
exclude:
35+
- '^docs:'
36+
- '^misc:'
37+
- '^ci:'
38+
- '^test:'
39+
scoop:
40+
bucket:
41+
owner: itzg
42+
name: scoop-bucket
43+
license: Apache2
44+
description: Provides a SAML SP authentication proxy for backend web services

LICENSE.txt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2019 Geoff Bourne
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

README.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
Provides a SAML SP authentication proxy for backend web services
2+
3+
## Usage
4+
5+
```text
6+
Usage:
7+
saml-auth-proxy [flags]
8+
9+
Flags:
10+
--attribute-header-mappings stringToString Comma separated list of attribute=header pairs mapping SAML IdP response attributes to forwarded request header [SAML_PROXY_ATTRIBUTE_HEADER_MAPPINGS] (default [])
11+
--backend-url string URL of the backend being proxied [SAML_PROXY_BACKEND_URL]
12+
--base-url string External URL of this proxy [SAML_PROXY_BASE_URL]
13+
--bind string host:port to bind for serving HTTP [SAML_PROXY_BIND] (default ":8080")
14+
-h, --help help for saml-auth-proxy
15+
--idp-metadata-url string URL of the IdP's metadata XML [SAML_PROXY_IDP_METADATA_URL]
16+
--new-auth-webhook-url string URL of webhook that will get POST'ed when a new authentication is processed [SAML_PROXY_NEW_AUTH_WEBHOOK_URL]
17+
--sp-cert-path string Path to the X509 public certificate PEM file for this SP [SAML_PROXY_SP_CERT_PATH] (default "saml-auth-proxy.cert")
18+
--sp-key-path string Path to the X509 private key PEM file for this SP [SAML_PROXY_SP_KEY_PATH] (default "saml-auth-proxy.key")
19+
--version version for saml-auth-proxy
20+
```
21+
22+
## Building
23+
24+
With Go 1.11 or newer:
25+
26+
```
27+
go build
28+
```
29+
30+
## Trying it out
31+
32+
The following procedure will enable you to try out the proxy running locally and using
33+
Grafana as a backend to proxy with authentication. It will use [SSOCircle](https://www.ssocircle.com)
34+
as a SAML IdP.
35+
36+
Start the supplied Grafana and Web Debug Server using Docker Compose:
37+
38+
```bash
39+
docker-compose up -d
40+
```
41+
42+
Create a domain name that resolves to 127.0.0.1 and use that as the `BASE_FQDN` in the following
43+
operations;
44+
45+
Generate the SP certificate and key material by running:
46+
47+
```bash
48+
openssl req -x509 -newkey rsa:2048 -keyout saml-auth-proxy.key -out saml-auth-proxy.cert -days 365 -nodes -subj "/CN=${BASE_FQDN}"
49+
```
50+
51+
Start saml-auth-proxy using:
52+
53+
```bash
54+
./saml-auth-proxy \
55+
--base-url http://${BASE_FQDN}:8080 \
56+
--backend-url http://locahost:3000 \
57+
--idp-metadata-url https://idp.ssocircle.com/
58+
```
59+
60+
Generate your SP's SAML metadata by accessing the built-in metadata endpoint:
61+
62+
```bash
63+
curl localhost:8000/saml/metadata > saml-sp-metadata.xml
64+
```
65+
66+
You can post the content of the `saml-sp-metadata.xml` file at
67+
[SSOCircle's SP metadata page](https://idp.ssocircle.com/sso/hos/ManageSPMetadata.jsp).
68+
69+
Now you can open your browser and navigate to `http://${BASE_FQDN}:8080`. You will be redirected
70+
via SSOCircle's login page and then be returned with access to Grafana.

cmd/root.go

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package cmd
2+
3+
import (
4+
"fmt"
5+
"github.com/itzg/saml-auth-proxy/server"
6+
"github.com/jamiealquiza/envy"
7+
"github.com/spf13/cobra"
8+
"log"
9+
"os"
10+
)
11+
12+
var serverConfig server.Config
13+
14+
var rootCmd = &cobra.Command{
15+
Use: "saml-auth-proxy",
16+
Short: "Provides a SAML SP authentication proxy for backend web services",
17+
Run: func(cmd *cobra.Command, args []string) {
18+
err := server.Start(&serverConfig)
19+
log.Fatal(err)
20+
},
21+
}
22+
23+
func init() {
24+
rootCmd.Flags().StringVar(&serverConfig.Bind, "bind", ":8080", "host:port to bind for serving HTTP")
25+
rootCmd.Flags().StringVar(&serverConfig.BaseUrl, "base-url", "", "External URL of this proxy")
26+
rootCmd.Flags().StringVar(&serverConfig.BackendUrl, "backend-url", "", "URL of the backend being proxied")
27+
rootCmd.Flags().StringVar(&serverConfig.NewAuthWebhookUrl, "new-auth-webhook-url", "", "URL of webhook that will get POST'ed when a new authentication is processed")
28+
rootCmd.Flags().StringVar(&serverConfig.IdpMetadataUrl, "idp-metadata-url", "", "URL of the IdP's metadata XML")
29+
rootCmd.Flags().StringVar(&serverConfig.SpKeyPath, "sp-key-path", "saml-auth-proxy.key", "Path to the X509 private key PEM file for this SP")
30+
rootCmd.Flags().StringVar(&serverConfig.SpCertPath, "sp-cert-path", "saml-auth-proxy.cert", "Path to the X509 public certificate PEM file for this SP")
31+
rootCmd.Flags().StringToStringVar(&serverConfig.AttributeHeaderMappings, "attribute-header-mappings", nil,
32+
"Comma separated list of attribute=header pairs mapping SAML IdP response attributes to forwarded request header")
33+
34+
_ = rootCmd.MarkFlagRequired("base-url")
35+
_ = rootCmd.MarkFlagRequired("backend-url")
36+
_ = rootCmd.MarkFlagRequired("idp-metadata-url")
37+
}
38+
39+
func Execute(version string) {
40+
41+
rootCmd.Version = version
42+
43+
cfg := envy.CobraConfig{
44+
Prefix: "SAML_PROXY",
45+
}
46+
47+
envy.ParseCobra(rootCmd, cfg)
48+
49+
if err := rootCmd.Execute(); err != nil {
50+
fmt.Println(err)
51+
os.Exit(1)
52+
}
53+
}

docker-compose.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: '3.4'
2+
3+
services:
4+
grafana:
5+
image: grafana/grafana
6+
ports:
7+
- 3000:3000
8+
environment:
9+
GF_SECURITY_ADMIN_PASSWORD: notsecret
10+
GF_AUTH_PROXY_ENABLED: "true"
11+
GF_AUTH_PROXY_HEADER_NAME: X-WEBAUTH-USER
12+
volumes:
13+
- grafana:/var/lib/grafana
14+
web-debug-server:
15+
image: itzg/web-debug-server:0.0.4
16+
ports:
17+
- 8081:8080
18+
19+
volumes:
20+
grafana: {}

go.mod

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
module github.com/itzg/saml-auth-proxy
2+
3+
require (
4+
github.com/beevik/etree v1.1.0 // indirect
5+
github.com/crewjam/saml v0.0.0-20180831135026-ebc5f787b786
6+
github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
7+
github.com/inconshreveable/mousetrap v1.0.0 // indirect
8+
github.com/jamiealquiza/envy v1.1.0
9+
github.com/jonboulle/clockwork v0.1.0 // indirect
10+
github.com/patrickmn/go-cache v2.1.0+incompatible
11+
github.com/pkg/errors v0.8.1
12+
github.com/russellhaering/goxmldsig v0.0.0-20180430223755-7acd5e4a6ef7 // indirect
13+
github.com/spf13/cobra v0.0.3
14+
github.com/spf13/pflag v1.0.3 // indirect
15+
golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67 // indirect
16+
)

go.sum

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
2+
github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
3+
github.com/crewjam/saml v0.0.0-20180831135026-ebc5f787b786 h1:8OVABJfT9iJh/uHeYlk1HWugxt7j50JPwW2uLOV9Yqs=
4+
github.com/crewjam/saml v0.0.0-20180831135026-ebc5f787b786/go.mod h1:w5eu+HNtubx+kRpQL6QFT2F3yIFfYVe6+EzOFVU7Hko=
5+
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
6+
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
7+
github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
8+
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
9+
github.com/jamiealquiza/envy v1.1.0 h1:Nwh4wqTZ28gDA8zB+wFkhnUpz3CEcO12zotjeqqRoKE=
10+
github.com/jamiealquiza/envy v1.1.0/go.mod h1:MP36BriGCLwEHhi1OU8E9569JNZrjWfCvzG7RsPnHus=
11+
github.com/jonboulle/clockwork v0.1.0 h1:VKV+ZcuP6l3yW9doeqz6ziZGgcynBVQO+obU0+0hcPo=
12+
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
13+
github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
14+
github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
15+
github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
16+
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
17+
github.com/russellhaering/goxmldsig v0.0.0-20180430223755-7acd5e4a6ef7 h1:J4AOUcOh/t1XbQcJfkEqhzgvMJ2tDxdCVvmHxW5QXao=
18+
github.com/russellhaering/goxmldsig v0.0.0-20180430223755-7acd5e4a6ef7/go.mod h1:Oz4y6ImuOQZxynhbSXk7btjEfNBtGlj2dcaOvXl2FSM=
19+
github.com/spf13/cobra v0.0.3 h1:ZlrZ4XsMRm04Fr5pSFxBgfND2EBVa1nLpiy1stUsX/8=
20+
github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
21+
github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
22+
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
23+
golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67 h1:ng3VDlRp5/DHpSWl02R4rM9I+8M2rhmsuLwAMmkLQWE=
24+
golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=

main.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package main
2+
3+
import (
4+
"github.com/itzg/saml-auth-proxy/cmd"
5+
)
6+
7+
var (
8+
version = "dev"
9+
commit = "HEAD"
10+
)
11+
12+
func main() {
13+
// delegate all the init work to cobra
14+
cmd.Execute(version + "-" + commit)
15+
}

0 commit comments

Comments
 (0)