Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(HMS-3416): Switch to service accounts for dev auth
For developement we have been using basic auth to authenticate against stage services. This switches the auth to Service accounts.
- Loading branch information
1 parent
90aad39
commit 2d274a1
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package headers | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "net/url" | ||
| "strconv" | ||
| "strings" | ||
|
|
||
| "github.com/coreos/go-oidc" | ||
| "github.com/rs/zerolog" | ||
| ) | ||
|
|
||
| type tokenResponse struct { | ||
| AccessToken string `json:"access_token"` | ||
| Scope string `json:"scope"` | ||
| } | ||
|
|
||
| const ( | ||
| scopes = "openid api.iam.service_accounts" | ||
| grant_type = "client_credentials" | ||
| ) | ||
|
|
||
| // https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token" -d "scope=openid api.iam.service_accounts | ||
| func getToken(ctx context.Context, issuerUrl, clientId, clientSecret string) (string, error) { | ||
| provider, err := oidc.NewProvider(ctx, issuerUrl) | ||
| if err != nil { | ||
| return "", err | ||
|
Check failure on line 31 in internal/headers/access_token.go
|
||
| } | ||
|
|
||
| data := url.Values{} | ||
| data.Add("grant_type", grant_type) | ||
| data.Add("scope", scopes) | ||
| data.Add("client_id", clientId) | ||
| data.Add("client_secret", clientSecret) | ||
|
|
||
| req, err := http.NewRequestWithContext(ctx, http.MethodPost, provider.Endpoint().TokenURL, strings.NewReader(data.Encode())) | ||
| if err != nil { | ||
| return "", fmt.Errorf("failed to form request: %w", err) | ||
| } | ||
| req.Header.Add("Content-Type", "application/x-www-form-urlencoded") | ||
| req.Header.Add("Content-Length", strconv.Itoa(len(data.Encode()))) | ||
| res, err := http.DefaultClient.Do(req) | ||
| if err != nil { | ||
| return "", fmt.Errorf("failed to request a token: %w", err) | ||
| } | ||
| defer res.Body.Close() | ||
|
|
||
| token := tokenResponse{} | ||
| body, err := io.ReadAll(res.Body) | ||
| if err != nil { | ||
| return "", fmt.Errorf("failed to parse a token response: %w", err) | ||
| } | ||
|
|
||
| err = json.Unmarshal(body, &token) | ||
| if err != nil { | ||
| return "", fmt.Errorf("failed to parse a token response: %w", err) | ||
| } | ||
|
|
||
| zerolog.Ctx(ctx).Debug().Msgf("Fetched access token: %s", token.AccessToken) | ||
|
|
||
| return token.AccessToken, nil | ||
| } | ||
Oops, something went wrong.