Machine Installation id based Oauth 2
This commit is contained in:
BIN
scripts/__pycache__/generate_workflow_docx.cpython-313.pyc
Normal file
BIN
scripts/__pycache__/generate_workflow_docx.cpython-313.pyc
Normal file
Binary file not shown.
299
scripts/setup-local-communication.sh
Normal file
299
scripts/setup-local-communication.sh
Normal file
@@ -0,0 +1,299 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
||||
CONFIG_DIR="${PROJECT_ROOT}/config"
|
||||
KEY_DIR="${CONFIG_DIR}/keys"
|
||||
CLIENT_ROOT="${CONFIG_DIR}/clients"
|
||||
|
||||
CLIENT_ID=""
|
||||
INSTALLATION_ID=""
|
||||
CLOUD_BASE_URL=""
|
||||
TOKEN_URL=""
|
||||
CLIENT_DIR=""
|
||||
CLIENT_CONFIG="${CONFIG_DIR}/clients.yml"
|
||||
CLIENT_PRIVATE_KEY=""
|
||||
CLIENT_PUBLIC_KEY=""
|
||||
MACHINE_ASSERTION=""
|
||||
SKIP_BUILD_CONFIGURED="${CYGNUS_SETUP_SKIP_BUILD+x}"
|
||||
SKIP_BUILD="${CYGNUS_SETUP_SKIP_BUILD:-false}"
|
||||
FORCE_ASSERTION="${CYGNUS_SETUP_FORCE_ASSERTION:-false}"
|
||||
NON_INTERACTIVE="${CYGNUS_SETUP_NON_INTERACTIVE:-false}"
|
||||
|
||||
log() {
|
||||
printf '\n==> %s\n' "$1"
|
||||
}
|
||||
|
||||
fail() {
|
||||
printf '\nERROR: %s\n' "$1" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_command() {
|
||||
command -v "$1" >/dev/null 2>&1 || fail "Required command '$1' was not found."
|
||||
}
|
||||
|
||||
prompt_value() {
|
||||
local prompt="$1"
|
||||
local default_value="$2"
|
||||
local value=""
|
||||
|
||||
if [[ "${NON_INTERACTIVE}" == "true" ]] || [[ ! -t 0 ]]; then
|
||||
printf '%s' "${default_value}"
|
||||
return
|
||||
fi
|
||||
|
||||
read -r -p "${prompt} [${default_value}]: " value
|
||||
printf '%s' "${value:-${default_value}}"
|
||||
}
|
||||
|
||||
prompt_yes_no() {
|
||||
local prompt="$1"
|
||||
local default_value="$2"
|
||||
local answer=""
|
||||
local hint="y/N"
|
||||
|
||||
[[ "${default_value}" == "true" ]] && hint="Y/n"
|
||||
if [[ "${NON_INTERACTIVE}" == "true" ]] || [[ ! -t 0 ]]; then
|
||||
printf '%s' "${default_value}"
|
||||
return
|
||||
fi
|
||||
|
||||
read -r -p "${prompt} [${hint}]: " answer
|
||||
case "${answer}" in
|
||||
y|Y|yes|YES) printf '%s' "true" ;;
|
||||
n|N|no|NO) printf '%s' "false" ;;
|
||||
"") printf '%s' "${default_value}" ;;
|
||||
*) fail "Please answer yes or no." ;;
|
||||
esac
|
||||
}
|
||||
|
||||
validate_identifier() {
|
||||
local label="$1"
|
||||
local value="$2"
|
||||
[[ "${value}" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]] || fail \
|
||||
"${label} must contain no spaces and use only letters, numbers, '-' or '_'."
|
||||
}
|
||||
|
||||
collect_client_inputs() {
|
||||
local default_client="${CYGNUS_SETUP_CLIENT_ID:-customer-a}"
|
||||
local default_installation="${CYGNUS_SETUP_INSTALLATION_ID:-site-01}"
|
||||
local default_url="${CYGNUS_SETUP_CLOUD_URL:-http://localhost:8090}"
|
||||
|
||||
log "Client provisioning details"
|
||||
CLIENT_ID="$(prompt_value \
|
||||
"Customer identifier (no spaces; used in key and directory names)" \
|
||||
"${default_client}")"
|
||||
validate_identifier "Customer identifier" "${CLIENT_ID}"
|
||||
|
||||
INSTALLATION_ID="$(prompt_value \
|
||||
"Installation identifier (no spaces)" \
|
||||
"${default_installation}")"
|
||||
validate_identifier "Installation identifier" "${INSTALLATION_ID}"
|
||||
|
||||
CLOUD_BASE_URL="$(prompt_value "Cloud service base URL" "${default_url}")"
|
||||
[[ "${CLOUD_BASE_URL}" =~ ^https?://[^[:space:]]+$ ]] || fail \
|
||||
"Cloud service base URL must be a valid http:// or https:// URL."
|
||||
|
||||
if [[ -z "${SKIP_BUILD_CONFIGURED}" ]]; then
|
||||
if [[ "$(prompt_yes_no "Run the complete Maven verification" "true")" == "true" ]]; then
|
||||
SKIP_BUILD="false"
|
||||
else
|
||||
SKIP_BUILD="true"
|
||||
fi
|
||||
fi
|
||||
|
||||
TOKEN_URL="${CLOUD_BASE_URL%/}/oauth2/token"
|
||||
CLIENT_DIR="${CLIENT_ROOT}/${CLIENT_ID}"
|
||||
CLIENT_PRIVATE_KEY="${CLIENT_DIR}/${CLIENT_ID}-signing-private.pem"
|
||||
CLIENT_PUBLIC_KEY="${CLIENT_DIR}/${CLIENT_ID}-signing-public.pem"
|
||||
MACHINE_ASSERTION="${CLIENT_DIR}/${CLIENT_ID}-${INSTALLATION_ID}-assertion.jwt"
|
||||
|
||||
printf '\nProvisioning summary:\n'
|
||||
printf ' Customer: %s\n' "${CLIENT_ID}"
|
||||
printf ' Installation: %s\n' "${INSTALLATION_ID}"
|
||||
printf ' Cloud URL: %s\n' "${CLOUD_BASE_URL}"
|
||||
printf ' Token audience: %s\n' "${TOKEN_URL}"
|
||||
printf ' Verify build: %s\n' "$([[ "${SKIP_BUILD}" == "true" ]] && printf no || printf yes)"
|
||||
|
||||
if [[ "$(prompt_yes_no "Continue with these values" "true")" != "true" ]]; then
|
||||
fail "Provisioning cancelled."
|
||||
fi
|
||||
}
|
||||
|
||||
generate_private_key() {
|
||||
local path="$1"
|
||||
if [[ -f "${path}" ]]; then
|
||||
printf 'Keeping existing private key: %s\n' "${path}"
|
||||
return
|
||||
fi
|
||||
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out "${path}"
|
||||
chmod 600 "${path}"
|
||||
}
|
||||
|
||||
generate_public_key() {
|
||||
local private_path="$1"
|
||||
local public_path="$2"
|
||||
if [[ -f "${public_path}" ]]; then
|
||||
printf 'Keeping existing public key: %s\n' "${public_path}"
|
||||
return
|
||||
fi
|
||||
openssl pkey -in "${private_path}" -pubout -out "${public_path}"
|
||||
chmod 644 "${public_path}"
|
||||
}
|
||||
|
||||
configure_java_21() {
|
||||
local java_major
|
||||
|
||||
if [[ "$(uname -s)" == "Darwin" ]] && [[ -x /usr/libexec/java_home ]]; then
|
||||
if java_home_21="$(/usr/libexec/java_home -v 21 2>/dev/null)"; then
|
||||
export JAVA_HOME="${java_home_21}"
|
||||
export PATH="${JAVA_HOME}/bin:${PATH}"
|
||||
fi
|
||||
fi
|
||||
|
||||
require_command java
|
||||
java_major="$(java -version 2>&1 | awk -F '[".]' '/version/ {print $2; exit}')"
|
||||
[[ "${java_major}" == "21" ]] || fail \
|
||||
"JDK 21 is required. Current java is: $(java -version 2>&1 | head -n 1)"
|
||||
}
|
||||
|
||||
write_client_configuration() {
|
||||
local public_key_uri="file:${CLIENT_PUBLIC_KEY}"
|
||||
local existing_installation=""
|
||||
|
||||
if [[ ! -f "${CLIENT_CONFIG}" ]]; then
|
||||
{
|
||||
printf '%s\n' "cygnus:"
|
||||
printf '%s\n' " security:"
|
||||
printf '%s\n' " clients:"
|
||||
} > "${CLIENT_CONFIG}"
|
||||
elif grep -Fq " ${CLIENT_ID}:" "${CLIENT_CONFIG}"; then
|
||||
existing_installation="$(awk \
|
||||
-v client=" ${CLIENT_ID}:" \
|
||||
'$0 == client { found = 1; next }
|
||||
found && /installation-id:/ {
|
||||
sub(/^.*installation-id:[[:space:]]*/, "");
|
||||
print;
|
||||
exit
|
||||
}
|
||||
found && /^ [^[:space:]]/ { exit }' \
|
||||
"${CLIENT_CONFIG}")"
|
||||
if [[ "${existing_installation}" != "${INSTALLATION_ID}" ]]; then
|
||||
fail "Client '${CLIENT_ID}' already uses installation '${existing_installation}' in ${CLIENT_CONFIG}; requested '${INSTALLATION_ID}'. Use the existing installation ID or provision a different customer identifier."
|
||||
fi
|
||||
printf 'Keeping existing configuration for client: %s\n' "${CLIENT_ID}"
|
||||
return
|
||||
fi
|
||||
|
||||
{
|
||||
printf ' %s:\n' "${CLIENT_ID}"
|
||||
printf '%s\n' " enabled: true"
|
||||
printf ' installation-id: %s\n' "${INSTALLATION_ID}"
|
||||
printf ' assertion-public-key: %s\n' "${public_key_uri}"
|
||||
printf '%s\n' " scopes:"
|
||||
printf '%s\n' " - identity.login"
|
||||
} >> "${CLIENT_CONFIG}"
|
||||
chmod 600 "${CLIENT_CONFIG}"
|
||||
printf 'Added client %s to: %s\n' "${CLIENT_ID}" "${CLIENT_CONFIG}"
|
||||
}
|
||||
|
||||
generate_machine_assertion() {
|
||||
if [[ -f "${MACHINE_ASSERTION}" ]] \
|
||||
&& [[ "${FORCE_ASSERTION}" != "true" ]]; then
|
||||
if [[ "$(prompt_yes_no \
|
||||
"Machine assertion already exists. Regenerate it" \
|
||||
"false")" == "true" ]]; then
|
||||
FORCE_ASSERTION="true"
|
||||
else
|
||||
printf 'Keeping existing machine assertion: %s\n' "${MACHINE_ASSERTION}"
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ -f "${CLIENT_PRIVATE_KEY}" ]] || fail \
|
||||
"Customer signing key was not found: ${CLIENT_PRIVATE_KEY}"
|
||||
[[ -f "${KEY_DIR}/assertion-decryption-public.pem" ]] || fail \
|
||||
"Cloud assertion public key was not found: ${KEY_DIR}/assertion-decryption-public.pem"
|
||||
|
||||
rm -f "${MACHINE_ASSERTION}"
|
||||
mvn -q -pl cygnus-cloud-client exec:java \
|
||||
-Dexec.mainClass=com.cygnus.client.provisioning.MachineAssertionGenerator \
|
||||
-Dexec.args="${CLIENT_ID} ${INSTALLATION_ID} ${TOKEN_URL} ${CLIENT_PRIVATE_KEY} ${KEY_DIR}/assertion-decryption-public.pem ${MACHINE_ASSERTION}"
|
||||
[[ -s "${MACHINE_ASSERTION}" ]] || fail \
|
||||
"Machine assertion generation did not create: ${MACHINE_ASSERTION}"
|
||||
chmod 600 "${MACHINE_ASSERTION}"
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "${PROJECT_ROOT}"
|
||||
|
||||
collect_client_inputs
|
||||
|
||||
log "Checking JDK 21, Maven, and OpenSSL"
|
||||
require_command awk
|
||||
require_command openssl
|
||||
require_command mvn
|
||||
configure_java_21
|
||||
java -version
|
||||
mvn -version
|
||||
openssl version
|
||||
|
||||
if [[ "${SKIP_BUILD}" != "true" ]]; then
|
||||
log "Building and verifying all modules"
|
||||
mvn clean verify
|
||||
else
|
||||
log "Skipping Maven verification because CYGNUS_SETUP_SKIP_BUILD=true"
|
||||
mvn -q -pl cygnus-cloud-client -am compile
|
||||
fi
|
||||
|
||||
log "Creating protected local configuration directories"
|
||||
mkdir -p "${KEY_DIR}" "${CLIENT_DIR}"
|
||||
chmod 700 "${CONFIG_DIR}" "${KEY_DIR}" "${CLIENT_ROOT}" "${CLIENT_DIR}"
|
||||
|
||||
log "Generating cloud assertion-encryption keys"
|
||||
generate_private_key "${KEY_DIR}/assertion-decryption-private.pem"
|
||||
generate_public_key \
|
||||
"${KEY_DIR}/assertion-decryption-private.pem" \
|
||||
"${KEY_DIR}/assertion-decryption-public.pem"
|
||||
|
||||
log "Generating cloud access-token signing keys"
|
||||
generate_private_key "${KEY_DIR}/access-token-private.pem"
|
||||
generate_public_key \
|
||||
"${KEY_DIR}/access-token-private.pem" \
|
||||
"${KEY_DIR}/access-token-public.pem"
|
||||
|
||||
log "Generating cloud login-payload encryption keys"
|
||||
generate_private_key "${KEY_DIR}/login-private.pem"
|
||||
generate_public_key \
|
||||
"${KEY_DIR}/login-private.pem" \
|
||||
"${KEY_DIR}/login-public.pem"
|
||||
|
||||
log "Generating on-premises installation signing keys"
|
||||
generate_private_key "${CLIENT_PRIVATE_KEY}"
|
||||
generate_public_key \
|
||||
"${CLIENT_PRIVATE_KEY}" \
|
||||
"${CLIENT_PUBLIC_KEY}"
|
||||
|
||||
log "Writing cloud machine-client configuration"
|
||||
write_client_configuration
|
||||
|
||||
log "Generating encrypted machine assertion"
|
||||
generate_machine_assertion
|
||||
|
||||
log "Local communication security setup completed"
|
||||
printf '%s\n' \
|
||||
"Client ID: ${CLIENT_ID}" \
|
||||
"Installation ID: ${INSTALLATION_ID}" \
|
||||
"Token audience: ${TOKEN_URL}" \
|
||||
"Client config: ${CLIENT_CONFIG}" \
|
||||
"Assertion file: ${MACHINE_ASSERTION}" \
|
||||
"Login public key: ${KEY_DIR}/login-public.pem" \
|
||||
"" \
|
||||
"Next: configure the cloud and on-prem environment variables, then start" \
|
||||
"the cloud service on ${CLOUD_BASE_URL} before starting the on-prem app."
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Reference in New Issue
Block a user