// Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
// Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared .
func (s *service) Middleware(resources []*config.Resource) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			logEntry := log.GetLoggerFromContext(r.Context())
			resHan := responsehandler.GetResponseHandlerFromContext(r.Context())
			if len(resources) == 0 {
				logEntry.Info("no resource declared => skip authentication")
				next.ServeHTTP(w, r)
				return
			}
			requestURI := r.URL.RequestURI()
			httpMethod := r.Method
			brctx := bucket.GetBucketRequestContextFromContext(r.Context())
			res, err := findResource(resources, requestURI, httpMethod)
			if err != nil {
				if brctx == nil {
					responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
				} else {
					resHan.InternalServerError(brctx.LoadFileContent, err)
				}
				return
			}
			if res == nil {
				err2 := fmt.Errorf("no resource found for path %s and method %s => Forbidden access", requestURI, httpMethod)
				err2 = errors.WithStack(err2)
				if brctx == nil {
					responsehandler.GeneralForbiddenError(r, w, s.cfgManager, err2)
				} else {
					resHan.ForbiddenError(brctx.LoadFileContent, err2)
				}
				return
			}
			ctx := models.SetRequestResourceInContext(r.Context(), res)
			r = r.WithContext(ctx)
			if res.OIDC != nil {
				logEntry.Debug("authentication with oidc detected")
				s.oidcAuthorizationMiddleware(res)(next).ServeHTTP(w, r)
				return
			}
			if res.Basic != nil {
				logEntry.Debug("authentication with basic auth detected")
				s.basicAuthMiddleware(res)(next).ServeHTTP(w, r)
				return
			}
			if *res.WhiteList {
				logEntry.Debug("authentication skipped because resource is whitelisted")
				next.ServeHTTP(w, r)
				return
			}
			err = errAuthenticationMiddlewareNotSupported
			if brctx == nil {
				responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
			} else {
				resHan.InternalServerError(brctx.LoadFileContent, err)
			}
		})
	}
}
func ( s * service ) Middleware ( resources [ ] * config . Resource ) func ( http . Handler ) http . Handler { return func ( next http . Handler ) http . Handler { return http . HandlerFunc ( func ( w http . ResponseWriter , r * http . Request ) { logEntry := log . GetLoggerFromContext ( r . Context ( ) ) resHan := responsehandler . GetResponseHandlerFromContext ( r . Context ( ) ) if len ( resources ) == 0 { logEntry . Info ( " " ) next . ServeHTTP ( w , r ) return } requestURI := r . URL . RequestURI ( ) httpMethod := r . Method brctx := bucket . GetBucketRequestContextFromContext ( r . Context ( ) ) res , err := findResource ( resources , requestURI , httpMethod ) if err != nil { if brctx == nil { responsehandler . GeneralInternalServerError ( r , w , s . cfgManager , err ) } else { resHan . InternalServerError ( brctx . LoadFileContent , err ) } return } if res == nil { err2 := fmt . Errorf ( " " , requestURI , httpMethod ) err2 = errors . WithStack ( err2 ) if brctx == nil { responsehandler . GeneralForbiddenError ( r , w , s . cfgManager , err2 ) } else { resHan . ForbiddenError ( brctx . LoadFileContent , err2 ) } return } ctx := models . SetRequestResourceInContext ( r . Context ( ) , res ) r = r . WithContext ( ctx ) if res . OIDC != nil { logEntry . Debug ( " " ) s . oidcAuthorizationMiddleware ( res ) ( next ) . ServeHTTP ( w , r ) return } if res . Basic != nil { logEntry . Debug ( " " ) s . basicAuthMiddleware ( res ) ( next ) . ServeHTTP ( w , r ) return } if * res . WhiteList { logEntry . Debug ( " " ) next . ServeHTTP ( w , r ) return } err = errAuthenticationMiddlewareNotSupported if brctx == nil { responsehandler . GeneralInternalServerError ( r , w , s . cfgManager , err ) } else { resHan . InternalServerError ( brctx . LoadFileContent , err ) } } ) } }
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared .
// Get logger // Get response handler // Check if resources are empty // In this case, continue without authentication // Get request data // Get bucket request context // Find resource // Check if bucket request context doesn't exist to use local default files // Check if resource isn't found // In this case, resource isn't found because not path not declared // So access is forbidden // Add stack trace // Check if bucket request context doesn't exist to use local default files // Resource found case // Add resource to request context in order to keep it ready for authorization // Create new request with new context // Check if OIDC is enabled // Check if Basic auth is enabled // Last case must be whitelist // Error, this case shouldn't arrive // Check if bucket request context doesn't exist to use local default files