Implement Authintercept interface to communicate with configured http service #53
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
adamncasey
reviewed
Aug 11, 2021
adamncasey
reviewed
Aug 20, 2021
dfab862 to
dac4cec
Compare
adamncasey
approved these changes
Aug 23, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue number of the reported bug or feature request: RDSIRABBIT-1972
Implement Authintercept interface
The interface for authintercept was already introduced(#11). This PR basically add an implementation for that interface. So that all connecting clients can be authorised using external configured http auth gate service. The PR also adds custom AUTH (SERVICE hostname port target | ALWAYS_ALLOW | PRINT) command, which can be used to configure http auth gate service or disable/enable auth mechanism. The PR also adds the schema for http auth gate service. The auth gate service will be plugable easily in amqpprox setup. By default all the connecting clients will not be authenticated and will be allowed to connect to broker directly during initial handshake. But one can easily enable, disable or configure auth gate service using control command. Each connection handshake request will be passed to authintercept component before starting handshake with broker. The SASL information retrieved from client START-OK method is forwarded to external http service, if configured. The external http service will authenticate client based on that information, and can provide the auth result(allow/deny) with reason and modified SASL information. Then the modified SASL information will be passed to the broker during handshake. If external http service doesn't provide any SASL information, in that case amqpprox will forward same SASL information, provided by client, to the broker during handshake.
Testing performed
This PR adds unit tests for implemented interface. The testing is also performed by manually running control commands to configure http auth gate service or disable auth mechanism.