From d591f19c0f201fef84bfcd65e2fa81552c60ae07 Mon Sep 17 00:00:00 2001 From: Andrei Rykov Date: Mon, 6 Jan 2025 10:52:32 +0100 Subject: oidc cookie cleanup handler (#13097) Co-authored-by: Andrei Rykov --- ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp | 44 +++++++++++++++++++ ydb/mvp/oidc_proxy/oidc_cleanup_page.h | 49 ++++++++++++++++++++++ ydb/mvp/oidc_proxy/oidc_client.cpp | 7 ++++ .../oidc_impersonate_stop_page_nebius.cpp | 29 +------------ .../oidc_proxy/oidc_impersonate_stop_page_nebius.h | 20 --------- ydb/mvp/oidc_proxy/ya.make | 1 + 6 files changed, 103 insertions(+), 47 deletions(-) create mode 100644 ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp create mode 100644 ydb/mvp/oidc_proxy/oidc_cleanup_page.h diff --git a/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp b/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp new file mode 100644 index 00000000000..11934694e73 --- /dev/null +++ b/ydb/mvp/oidc_proxy/oidc_cleanup_page.cpp @@ -0,0 +1,44 @@ +#include "openid_connect.h" +#include "oidc_session_create.h" +#include "oidc_cleanup_page.h" + +namespace NMVP::NOIDC { + +THandlerCleanup::THandlerCleanup(const NActors::TActorId& sender, + const NHttp::THttpIncomingRequestPtr& request, + const NActors::TActorId& httpProxyId, + const TOpenIdConnectSettings& settings, + const TString& cookieName) + : Sender(sender) + , Request(request) + , HttpProxyId(httpProxyId) + , Settings(settings) + , CookieName(cookieName) +{} + +void THandlerCleanup::Bootstrap() { + BLOG_D("Clear cookie: (" << CookieName << ")"); + + NHttp::THeadersBuilder responseHeaders; + responseHeaders.Set("Set-Cookie", ClearSecureCookie(CookieName)); + SetCORS(Request, &responseHeaders); + + ReplyAndPassAway(Request->CreateResponse("200", "OK", responseHeaders)); +} + +void THandlerCleanup::ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse) { + Send(Sender, new NHttp::TEvHttpProxy::TEvHttpOutgoingResponse(std::move(httpResponse))); + PassAway(); +} + +TCleanupPageHandler::TCleanupPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings) + : TBase(&TCleanupPageHandler::StateWork) + , HttpProxyId(httpProxyId) + , Settings(settings) +{} + +void TCleanupPageHandler::Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event) { + Register(new THandlerCleanup(event->Sender, event->Get()->Request, HttpProxyId, Settings, CreateNameSessionCookie(Settings.ClientId))); +} + +} // NMVP::NOIDC diff --git a/ydb/mvp/oidc_proxy/oidc_cleanup_page.h b/ydb/mvp/oidc_proxy/oidc_cleanup_page.h new file mode 100644 index 00000000000..8e2fe0cb562 --- /dev/null +++ b/ydb/mvp/oidc_proxy/oidc_cleanup_page.h @@ -0,0 +1,49 @@ +#pragma once + +#include "oidc_settings.h" +#include "context.h" +#include + +namespace NMVP::NOIDC { + +class THandlerCleanup : public NActors::TActorBootstrapped { +private: + using TBase = NActors::TActorBootstrapped; + +protected: + const NActors::TActorId Sender; + const NHttp::THttpIncomingRequestPtr Request; + NActors::TActorId HttpProxyId; + const TOpenIdConnectSettings Settings; + const TString CookieName; + +public: + THandlerCleanup(const NActors::TActorId& sender, + const NHttp::THttpIncomingRequestPtr& request, + const NActors::TActorId& httpProxyId, + const TOpenIdConnectSettings& settings, + const TString& cookieName); + + void Bootstrap(); + void ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse); +}; + +class TCleanupPageHandler : public NActors::TActor { + using TBase = NActors::TActor; + + const NActors::TActorId HttpProxyId; + const TOpenIdConnectSettings Settings; + +public: + TCleanupPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings); + void Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event); + + STFUNC(StateWork) { + switch (ev->GetTypeRewrite()) { + hFunc(NHttp::TEvHttpProxy::TEvHttpIncomingRequest, Handle); + cFunc(NActors::TEvents::TEvPoisonPill::EventType, PassAway); + } + } +}; + +} // NMVP::NOIDC diff --git a/ydb/mvp/oidc_proxy/oidc_client.cpp b/ydb/mvp/oidc_proxy/oidc_client.cpp index 0277b80ebda..bd473beb071 100644 --- a/ydb/mvp/oidc_proxy/oidc_client.cpp +++ b/ydb/mvp/oidc_proxy/oidc_client.cpp @@ -1,6 +1,7 @@ #include "oidc_client.h" #include "oidc_protected_page_handler.h" #include "oidc_session_create_handler.h" +#include "oidc_cleanup_page.h" #include "oidc_impersonate_start_page_nebius.h" #include "oidc_impersonate_stop_page_nebius.h" @@ -15,6 +16,12 @@ void InitOIDC(NActors::TActorSystem& actorSystem, ) ); + actorSystem.Send(httpProxyId, new NHttp::TEvHttpProxy::TEvRegisterHandler( + "/auth/cleanup", + actorSystem.Register(new TCleanupPageHandler(httpProxyId, settings)) + ) + ); + if (settings.AccessServiceType == NMvp::nebius_v1) { actorSystem.Send(httpProxyId, new NHttp::TEvHttpProxy::TEvRegisterHandler( "/impersonate/start", diff --git a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp index 214b9b07dcf..417411dd796 100644 --- a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp +++ b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.cpp @@ -1,35 +1,10 @@ #include "openid_connect.h" #include "oidc_session_create.h" +#include "oidc_cleanup_page.h" #include "oidc_impersonate_stop_page_nebius.h" namespace NMVP::NOIDC { -THandlerImpersonateStop::THandlerImpersonateStop(const NActors::TActorId& sender, - const NHttp::THttpIncomingRequestPtr& request, - const NActors::TActorId& httpProxyId, - const TOpenIdConnectSettings& settings) - : Sender(sender) - , Request(request) - , HttpProxyId(httpProxyId) - , Settings(settings) -{} - -void THandlerImpersonateStop::Bootstrap() { - TString impersonatedCookieName = CreateNameImpersonatedCookie(Settings.ClientId); - BLOG_D("Clear impersonated cookie: (" << impersonatedCookieName << ")"); - - NHttp::THeadersBuilder responseHeaders; - responseHeaders.Set("Set-Cookie", ClearSecureCookie(impersonatedCookieName)); - SetCORS(Request, &responseHeaders); - - ReplyAndPassAway(Request->CreateResponse("200", "OK", responseHeaders)); -} - -void THandlerImpersonateStop::ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse) { - Send(Sender, new NHttp::TEvHttpProxy::TEvHttpOutgoingResponse(std::move(httpResponse))); - PassAway(); -} - TImpersonateStopPageHandler::TImpersonateStopPageHandler(const NActors::TActorId& httpProxyId, const TOpenIdConnectSettings& settings) : TBase(&TImpersonateStopPageHandler::StateWork) , HttpProxyId(httpProxyId) @@ -37,7 +12,7 @@ TImpersonateStopPageHandler::TImpersonateStopPageHandler(const NActors::TActorId {} void TImpersonateStopPageHandler::Handle(NHttp::TEvHttpProxy::TEvHttpIncomingRequest::TPtr event) { - Register(new THandlerImpersonateStop(event->Sender, event->Get()->Request, HttpProxyId, Settings)); + Register(new THandlerCleanup(event->Sender, event->Get()->Request, HttpProxyId, Settings, CreateNameImpersonatedCookie(Settings.ClientId))); } } // NMVP::NOIDC diff --git a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h index f298ef7147a..9e8091d7199 100644 --- a/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h +++ b/ydb/mvp/oidc_proxy/oidc_impersonate_stop_page_nebius.h @@ -6,26 +6,6 @@ namespace NMVP::NOIDC { -class THandlerImpersonateStop : public NActors::TActorBootstrapped { -private: - using TBase = NActors::TActorBootstrapped; - -protected: - const NActors::TActorId Sender; - const NHttp::THttpIncomingRequestPtr Request; - NActors::TActorId HttpProxyId; - const TOpenIdConnectSettings Settings; - -public: - THandlerImpersonateStop(const NActors::TActorId& sender, - const NHttp::THttpIncomingRequestPtr& request, - const NActors::TActorId& httpProxyId, - const TOpenIdConnectSettings& settings); - - void Bootstrap(); - void ReplyAndPassAway(NHttp::THttpOutgoingResponsePtr httpResponse); -}; - class TImpersonateStopPageHandler : public NActors::TActor { using TBase = NActors::TActor; diff --git a/ydb/mvp/oidc_proxy/ya.make b/ydb/mvp/oidc_proxy/ya.make index 61b522f7563..d812fa27a5b 100644 --- a/ydb/mvp/oidc_proxy/ya.make +++ b/ydb/mvp/oidc_proxy/ya.make @@ -10,6 +10,7 @@ SRCS( oidc_client.cpp openid_connect.cpp oidc_settings.cpp + oidc_cleanup_page.cpp oidc_impersonate_start_page_nebius.cpp oidc_impersonate_stop_page_nebius.cpp oidc_protected_page_handler.cpp -- cgit v1.3