lawliet89/rowdy

A Rocket based JSON Web Token authentication server.

rowdy

Documentation: Stable | Master

rowdy is a Rocket based JSON Web token based authentication server based off Docker Registry's authentication protocol.

Requirements

Rocket requires nightly Rust. You should probably install Rust with rustup, then override the code directory to use nightly instead of stable. See installation instructions.

In particular, rowdy is currently targetted for nightly-2017-10-11.

Testing

The crate is set up to make use of workspaces for various parts of rowdy.

To run tests for rowdy-diesel, you will need to run the Docker containers for the various databases.

docker-compose -f diesel/docker-compose.db.yml up

To run tests on everything, do cargo test --all --all-features --no-fail-fast.

Docker Image

An musl-linked image can be built from the Dockerfile in the repository root. You will need at least Docker 17.05 (API version 1.29) to build.

By default, the Docker image will not start Rowdy for you. You will need to provide your own configuration file and command line arguments. The provided docker-compose.yml should get you started.

You can simply define your own docker-compose.override.yml file. For example:

version: "2.1"
services:
  rowdy:
    environment:
      ROCKET_ENV: production
    expose:
      - "80"
    volumes:
      - ./config:/app/config
    command: [rowdy-cli, csv, config/Config.json]
networks:
  nginx:
    external: true

Then, you can simply start the containers with docker-compose up --build -d.

rowdy's Issues

Use `rust-toolchain` to fix Rust toolchain

See https://users.rust-lang.org/t/rustup-1-5-0-released/11529

Separate Diesel support into a separate crate

• Separate the functionality into a separate crate (#69)
• Use r2d2-diesel (#70)
• Generic DB agnostic implementation (#71)
• Implement migration for Library (#73)
• Implement Migration in CLI (#77)
• Improve test harness wrt database servers setup (maybe with Docker Compose to run the databases) (also perhaps via integration tests instead)
• Support SQLite (#78)
• Support Postgres (#79)
• Add tests for "non default" DB schema
• Add CLI tools for managing users
• Improve documentation

Migrate CLI to Clap

For more flexibility

Update Diesel Crate to 1.0 (beta)

https://github.com/diesel-rs/diesel/releases/tag/v1.0.0-beta1

Document no `offline_token` when refreshing tokens

Serve JWK used to sign/encrypt

And include the kid in the tokens issued.

Usually /token_key endpoint.

`JWTError` should not give HTTP 500

Allow authenticators to provide user visible authentication failure information

The shape of the information will be authenticator dependent. And should be configurable

• Library changes
• LDAP
• Diesel based ones

These will only show non username/password related errors.

rowdy and Docker Registry

Since it's based on Docker Registry's authentication protocol, I think I can put rowdy in front of Docker Registry in order to provide authentication, right? (Maybe I'm missing something.)

DOS protection

• Exponential Backoff
• Total lockout?

Simple authenticator fails authentication when a trailing new line is missing from the CSV

What gives?

Major Features

• "Proper" Basic Auth response
• LDAP integration
• Refresh Token
• Scope resolution (maybe some kind of API?)
• Session "remembering" login (for some form of SSO)
• Single Logout
• Blacklisting Access/Refresh Token

Examples on integration

Hey there,
apologies for the noobish question - are there examples somewhere on how this might be integrated into an existing project?

Support Kerberos

Consider https://github.com/erickt/rust-gssapi

Update csv to 1.0

Replace terrible salt + password SHA hash in simple authenticator

Even if it's not for production, at least have some semblance of proper security.

Use argon2 (https://github.com/bryant/argon2rs) or https://dnaq.github.io/sodiumoxide/sodiumoxide/crypto/pwhash/scryptsalsa208sha256/index.html

Replace LDAP Library

https://crates.io/crates/ldap3

Update cli to docopt 0.8

And maybe we can finally be rid of rustc-serialize.

Integration tests

Specifically, launch is not tested.

[LDAP] Warn if more than one DN is returned from a search

Allow user to pass in the scope he wants returned

Here's a sample of the fields available:

('CN=Daniel Sim,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg',
  {'accountExpires': ['9223372036854775807'],
   'badPasswordTime': ['131408687478170480'],
   'badPwdCount': ['0'],
   'cn': ['Daniel Sim'],
   'codePage': ['0'],
   'company': ['GovTech'],
   'countryCode': ['0'],
   'dSCorePropagationData': ['20160928023533.0Z',
    '20160928020831.0Z',
    '16010101000001.0Z'],
   'department': ['DSD'],
   'displayName': ['Daniel Sim'],
   'distinguishedName': ['CN=Daniel Sim,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg'],
   'givenName': ['Daniel Sim'],
   'instanceType': ['4'],
   'lastLogoff': ['0'],
   'lastLogon': ['131408688359644108'],
   'lastLogonTimestamp': ['131408636685082554'],
   'lockoutTime': ['0'],
   'logonCount': ['0'],
   'mail': ['[email protected]'],
   'memberOf': ['CN=DanielTesting2,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg',
    'CN=DanielTesting,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg'],
   'name': ['Daniel Sim'],
   'objectCategory': ['CN=Person,CN=Schema,CN=Configuration,DC=dsd,DC=example,DC=gov,DC=sg'],
   'objectClass': ['top', 'person', 'organizationalPerson', 'user'],
   'objectGUID': ['P\xebV\xe5\xaebYB\xa5)\xf6\x93[ \x12^'],
   'objectSid': ['\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x1c\xcf\x13\x90\n\xfe,\xe0\xb7y\x98\xa5\\\x04\x00\x00'],
   'physicalDeliveryOfficeName': ['X'],
   'primaryGroupID': ['513'],
   'pwdLastSet': ['131408636244939448'],
   'sAMAccountName': ['daniel_sim'],
   'sAMAccountType': ['805306368'],
   'uSNChanged': ['55404'],
   'uSNCreated': ['12915'],
   'userAccountControl': ['512'],
   'userPrincipalName': ['[email protected]'],
   'whenChanged': ['20170602075428.0Z'],
   'whenCreated': ['20160928020831.0Z']}),

If the user specifies scope=userPrincipalName,memberOf,mail, the JSON web token should also include the following fields:

{
    userPrincipalName: ['[email protected]'],
    memberOf: [
        'CN=DanielTesting2,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg',
        'CN=DanielTesting,CN=Users,DC=dsd,DC=example,DC=gov,DC=sg'
    ],
    mail: ['[email protected]']
}

This way, we can perform group checks without hitting the LDAP server

Relevant line of code: https://github.com/lawliet89/rowdy/blob/master/src/auth/ldap.rs#L101

Need to escape string in LDAP filter

I can break the LDAP search filter by passing illegal characters into the username, e.g. ''

Return CORS headers for Error Responses

Update Travis Tests to test all possible feature combination

Better error messages on LDAP initialisation errors

Return Allowed verbs in CORS OPTIONS request

Under the Allow header.

Replace binary crate with lib crate in "root" workspace

Otherwise... travis-cargo does not know how to upload docs.

Clean up code due to prelude

Remove use that are in prelude:

• std::default::Default
• std::convert::{From, Into};

Don't do format!("{}", x) because impl<T> ToString for T where T: Display + ?Sized

Cannot get rowdy to return refresh token

If I run the docker example, and submit a request with offline_token=true, it doesn't return a refresh token in the response. Same thing if I configure the csv fixture for refresh tokens.