ID-Token verifier

Author: everesio

.gitignore

@@ -1,7 +1,8 @@
 # Build
 build/
 /kafka-proxy
-testcerts/
+/google-id-info
+/google-id-provider
 
 # Intellij
 .idea/

.travis.yml

@@ -3,7 +3,7 @@ sudo: false
 language: go
 
 go:
-  - "1.9.x"
+  - "1.10.x"
 
 env:
   global:
@@ -24,6 +24,7 @@ notifications:
 
 script:
   - go build .
+  - go build -o google-id-info cmd/plugin-googleid-info/main.go
   - export TAG=`if [[ $TRAVIS_PULL_REQUEST == "false" ]] && [[ $TRAVIS_BRANCH == "master" ]]; then echo "latest"; else echo "${TRAVIS_PULL_REQUEST_BRANCH:-${TRAVIS_BRANCH}}"; fi`
   - docker build -t $REPO:$TAG -f Dockerfile .
 

Dockerfile

@@ -1,4 +1,9 @@
-FROM scratch
+FROM alpine:3.7
+
+RUN apk add --no-cache ca-certificates
+
 ADD kafka-proxy /kafka-proxy
+ADD google-id-info /google-id-info
+
 ENTRYPOINT ["/kafka-proxy"]
 CMD ["--help"]

Dockerfile.build

@@ -1,4 +1,4 @@
-FROM golang:1.9.4
+FROM golang:1.10
 
 ARG target=build
 

Makefile

@@ -38,12 +38,15 @@ build: build/$(BINARY)
 
 build/$(BINARY): $(SOURCES)
 	CGO_ENABLED=0 go build -o build/$(BINARY) $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" .
+	CGO_ENABLED=0 go build -o build/google-id-info $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" cmd/plugin-googleid-info/main.go
 
 build/linux/$(BINARY): $(SOURCES)
 	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o build/linux/$(BINARY) $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" .
+	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o build/linux/google-id-info $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" cmd/plugin-googleid-info/main.go
 
 build/osx/$(BINARY): $(SOURCES)
 	GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 go build -o build/osx/$(BINARY) $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" .
+	GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 go build -o build/linux/google-id-info $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" cmd/plugin-googleid-info/main.go
 
 build.docker-build: $(BUILD_DOCKER_BUILD)
 
@@ -55,6 +58,7 @@ build.docker-build.linux:
     echo "containerId: $$buildContainer" ;\
     mkdir -p build ;\
     docker cp $$buildContainer:/go/src/github.com/grepplabs/kafka-proxy/build/linux/${BINARY} build/${BINARY} ;\
+    docker cp $$buildContainer:/go/src/github.com/grepplabs/kafka-proxy/build/linux/google-id-info build/google-id-info ;\
     docker rm $$buildContainer ;\
     docker rmi $$buildContainerName ;\
 
@@ -66,6 +70,7 @@ build.docker-build.osx:
     echo "containerId: $$buildContainer" ;\
     mkdir -p build ;\
     docker cp $$buildContainer:/go/src/github.com/grepplabs/kafka-proxy/build/osx/${BINARY} build/${BINARY} ;\
+    docker cp $$buildContainer:/go/src/github.com/grepplabs/kafka-proxy/build/linux/google-id-info build/google-id-info ;\
     docker rm $$buildContainer ;\
     docker rmi $$buildContainerName ;\
 
@@ -94,7 +99,10 @@ plugin.auth-ldap:
 plugin.google-id-provider:
 	CGO_ENABLED=0 go build -o build/google-id-provider $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" cmd/plugin-googleid-provider/main.go
 
-all: build plugin.auth-user plugin.auth-ldap plugin.google-id-provider
+plugin.google-id-info:
+	CGO_ENABLED=0 go build -o build/google-id-info $(BUILD_FLAGS) -ldflags "$(LDFLAGS)" cmd/plugin-googleid-info/main.go
+
+all: build plugin.auth-user plugin.auth-ldap plugin.google-id-provider plugin.google-id-info
 
 clean:
 	@rm -rf build

README.md

@@ -203,7 +203,7 @@ spec:
 * [X] Pluggable proxy authentication
 * [X] Deploying Kafka Proxy as a sidecar container
 * [X] Advertised proxy listeners e.g. bootstrap-server-mapping (remotehost:remoteport,localhost:localport,advhost:advport)
-* [ ] Pluggable authentication between client kafka-proxy and broker kafka-proxy a.k.a kafka-gateway
+* [X] Pluggable authentication between client kafka-proxy and broker kafka-proxy a.k.a kafka-gateway
   1. additional handshake - protocol: magic, method, data
   2. google-id method
 * [ ] Registry for built in plugins (avoid grpc communication)

cmd/kafka-proxy/server.go

@@ -21,6 +21,7 @@ import (
 	"errors"
 	"github.com/grepplabs/kafka-proxy/pkg/apis"
 	gatewayclient "github.com/grepplabs/kafka-proxy/plugin/gateway-client/shared"
+	gatewayserver "github.com/grepplabs/kafka-proxy/plugin/gateway-server/shared"
 	localauth "github.com/grepplabs/kafka-proxy/plugin/local-auth/shared"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin"
@@ -161,7 +162,7 @@ func Run(_ *cobra.Command, _ []string) {
 		var ok bool
 		passwordAuthenticator, ok = raw.(apis.PasswordAuthenticator)
 		if !ok {
-			logrus.Fatal(errors.New("unsupported plugin type"))
+			logrus.Fatal(errors.New("unsupported PasswordAuthenticator plugin type"))
 		}
 	}
 
@@ -181,7 +182,27 @@ func Run(_ *cobra.Command, _ []string) {
 		var ok bool
 		tokenProvider, ok = raw.(apis.TokenProvider)
 		if !ok {
-			logrus.Fatal(errors.New("unsupported plugin type"))
+			logrus.Fatal(errors.New("unsupported TokenProvider plugin type"))
+		}
+	}
+
+	var tokenInfo apis.TokenInfo
+	if c.Auth.Gateway.Server.Enable {
+		client := NewGatewayServerPluginClient()
+		defer client.Kill()
+
+		rpcClient, err := client.Client()
+		if err != nil {
+			logrus.Fatal(err)
+		}
+		raw, err := rpcClient.Dispense("tokenInfo")
+		if err != nil {
+			logrus.Fatal(err)
+		}
+		var ok bool
+		tokenInfo, ok = raw.(apis.TokenInfo)
+		if !ok {
+			logrus.Fatal(errors.New("unsupported TokenInfo plugin type"))
 		}
 	}
 
@@ -198,7 +219,7 @@ func Run(_ *cobra.Command, _ []string) {
 		if err != nil {
 			logrus.Fatal(err)
 		}
-		proxyClient, err := proxy.NewClient(connset, c, listeners.GetNetAddressMapping, passwordAuthenticator, tokenProvider)
+		proxyClient, err := proxy.NewClient(connset, c, listeners.GetNetAddressMapping, passwordAuthenticator, tokenProvider, tokenInfo)
 		if err != nil {
 			logrus.Fatal(err)
 		}
@@ -300,7 +321,9 @@ func SetLogger() {
 func NewGatewayClientPluginClient() *plugin.Client {
 	return NewPluginClient(gatewayclient.Handshake, gatewayclient.PluginMap, c.Auth.Gateway.Client.LogLevel, c.Auth.Gateway.Client.Command, c.Auth.Gateway.Client.Parameters)
 }
-
+func NewGatewayServerPluginClient() *plugin.Client {
+	return NewPluginClient(gatewayserver.Handshake, gatewayserver.PluginMap, c.Auth.Gateway.Server.LogLevel, c.Auth.Gateway.Server.Command, c.Auth.Gateway.Server.Parameters)
+}
 func NewLocalAuthPluginClient() *plugin.Client {
 	return NewPluginClient(localauth.Handshake, localauth.PluginMap, c.Auth.Local.LogLevel, c.Auth.Local.Command, c.Auth.Local.Parameters)
 }