diff --git a/go.mod b/go.mod index a71fad8..6dba30e 100644 --- a/go.mod +++ b/go.mod @@ -3,9 +3,12 @@ module github.com/snapp-incubator/simple-authenticator go 1.19 require ( + github.com/go-logr/logr v1.2.3 + github.com/johnaoss/htpasswd v0.0.0-20190120213328-a0cc59f788da github.com/onsi/ginkgo/v2 v2.6.0 github.com/onsi/gomega v1.24.1 github.com/opdev/subreconciler v0.0.0-20230302151718-c4c8b5ec17c5 + github.com/pkg/errors v0.9.1 github.com/spf13/viper v1.17.0 k8s.io/api v0.26.0 k8s.io/apimachinery v0.26.0 @@ -20,7 +23,6 @@ require ( github.com/emicklei/go-restful/v3 v3.9.0 // indirect github.com/evanphx/json-patch/v5 v5.6.0 // indirect github.com/fsnotify/fsnotify v1.6.0 // indirect - github.com/go-logr/logr v1.2.3 // indirect github.com/go-logr/zapr v1.2.3 // indirect github.com/go-openapi/jsonpointer v0.19.5 // indirect github.com/go-openapi/jsonreference v0.20.0 // indirect @@ -44,7 +46,6 @@ require ( github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pelletier/go-toml/v2 v2.1.0 // indirect - github.com/pkg/errors v0.9.1 // indirect github.com/prometheus/client_golang v1.14.0 // indirect github.com/prometheus/client_model v0.3.0 // indirect github.com/prometheus/common v0.37.0 // indirect @@ -62,9 +63,9 @@ require ( golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect golang.org/x/net v0.15.0 // indirect golang.org/x/oauth2 v0.12.0 // indirect - golang.org/x/sys v0.12.0 // indirect - golang.org/x/term v0.12.0 // indirect - golang.org/x/text v0.13.0 // indirect + golang.org/x/sys v0.15.0 // indirect + golang.org/x/term v0.15.0 // indirect + golang.org/x/text v0.14.0 // indirect golang.org/x/time v0.3.0 // indirect gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index b2cacc8..99287b0 100644 --- a/go.sum +++ b/go.sum @@ -188,6 +188,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1: github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU= github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= +github.com/johnaoss/htpasswd v0.0.0-20190120213328-a0cc59f788da h1:HV5jj72yOUw49JuFGCVWyS5aIJLhRgtc+WZW8wWAHew= +github.com/johnaoss/htpasswd v0.0.0-20190120213328-a0cc59f788da/go.mod h1:ZyzRn1mEXMs9GCPP3+tUmolnCuHRikkIo57/8F8sbag= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= @@ -293,6 +295,7 @@ github.com/spf13/afero v1.10.0 h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY= github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ= github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA= github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48= +github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.17.0 h1:I5txKw7MJasPL/BrfkbA0Jyo/oELqVmux4pR/UxOMfI= @@ -336,6 +339,7 @@ go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60= go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= @@ -486,12 +490,12 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc= +golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= -golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= +golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4= +golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -500,8 +504,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= -golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/internal/controller/basic_authenticator/provision.go b/internal/controller/basic_authenticator/provision.go index fe68ebc..c853841 100644 --- a/internal/controller/basic_authenticator/provision.go +++ b/internal/controller/basic_authenticator/provision.go @@ -136,12 +136,12 @@ func (r *BasicAuthenticatorReconciler) ensureSecret(ctx context.Context, req ctr } err = updateHtpasswdField(&credentialSecret) if err != nil { - r.logger.Error(err, "failed to add secret to include htpasswd field", "credential secret", credentialSecret) + r.logger.Error(err, "failed to update secret to include htpasswd field") return subreconciler.RequeueWithError(err) } err = r.Update(ctx, &credentialSecret) if err != nil { - r.logger.Error(err, "failed to update secret to add htpasswd field") + r.logger.Error(err, "failed to update secret") return subreconciler.RequeueWithError(err) } r.credentialName = credentialSecret.Name diff --git a/internal/controller/basic_authenticator/workload.go b/internal/controller/basic_authenticator/workload.go index 5c452b4..228f253 100644 --- a/internal/controller/basic_authenticator/workload.go +++ b/internal/controller/basic_authenticator/workload.go @@ -7,7 +7,7 @@ import ( "github.com/pkg/errors" "github.com/snapp-incubator/simple-authenticator/api/v1alpha1" "github.com/snapp-incubator/simple-authenticator/internal/config" - "github.com/snapp-incubator/simple-authenticator/pkg/md5" + "github.com/snapp-incubator/simple-authenticator/pkg/htpasswd" "github.com/snapp-incubator/simple-authenticator/pkg/random_generator" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" @@ -62,7 +62,6 @@ func createNginxDeployment(basicAuthenticator *v1alpha1.BasicAuthenticator, conf { Name: credentialName, MountPath: SecretMountDir, - SubPath: SecretHtpasswdField, }, }, }, @@ -83,6 +82,12 @@ func createNginxDeployment(basicAuthenticator *v1alpha1.BasicAuthenticator, conf VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ SecretName: credentialName, + Items: []corev1.KeyToPath{ + { + Key: SecretHtpasswdField, + Path: SecretHtpasswdField, + }, + }, }, }, }, @@ -123,7 +128,15 @@ func updateHtpasswdField(secret *corev1.Secret) error { if !ok { return defaultError.New("password not found in secret") } - htpasswdString := fmt.Sprintf("%s:%s", string(username), md5.MD5Hash(string(password))) + salt, err := random_generator.GenerateRandomString(8) + if err != nil { + return errors.Wrap(err, "failed to generate salt") + } + hashedPassword, err := htpasswd.ApacheHash(string(password), salt) + if err != nil { + return err + } + htpasswdString := fmt.Sprintf("%s:%s", string(username), hashedPassword) secret.Data["htpasswd"] = []byte(htpasswdString) return nil } @@ -222,7 +235,6 @@ func injector(ctx context.Context, basicAuthenticator *v1alpha1.BasicAuthenticat { Name: credentialName, MountPath: SecretMountDir, - SubPath: SecretHtpasswdField, }, }, }) diff --git a/pkg/htpasswd/hash.go b/pkg/htpasswd/hash.go new file mode 100644 index 0000000..86eb7e5 --- /dev/null +++ b/pkg/htpasswd/hash.go @@ -0,0 +1,11 @@ +package htpasswd + +import "github.com/johnaoss/htpasswd/apr1" + +func ApacheHash(pass, salt string) (string, error) { + hashedPassword, err := apr1.Hash(pass, salt) + if err != nil { + return "", err + } + return hashedPassword, nil +} diff --git a/pkg/md5/md5.go b/pkg/md5/md5.go deleted file mode 100644 index ca73218..0000000 --- a/pkg/md5/md5.go +++ /dev/null @@ -1,15 +0,0 @@ -package md5 - -import ( - "crypto/md5" - "encoding/hex" -) - -func MD5Hash(input string) string { - hasher := md5.New() - hasher.Write([]byte(input)) - hashBytes := hasher.Sum(nil) - hashString := hex.EncodeToString(hashBytes) - - return hashString -}