func (s *service) Middleware(resources []*config.Resource) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// Get logger
			logEntry := log.GetLoggerFromContext(r.Context())
			// Get response handler
			resHan := responsehandler.GetResponseHandlerFromContext(r.Context())

			// Check if resources are empty
			if len(resources) == 0 {
				// In this case, continue without authentication
				logEntry.Info("no resource declared => skip authentication")
				next.ServeHTTP(w, r)

				return
			}

			// Get request data
			requestURI := r.URL.RequestURI()
			httpMethod := r.Method

			// Get bucket request context
			brctx := bucket.GetBucketRequestContextFromContext(r.Context())
			// Find resource
			res, err := findResource(resources, requestURI, httpMethod)
			if err != nil {
				// Check if bucket request context doesn't exist to use local default files
				if brctx == nil {
					responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
				} else {
					resHan.InternalServerError(brctx.LoadFileContent, err)
				}

				return
			}

			// Check if resource isn't found
			if res == nil {
				// In this case, resource isn't found because not path not declared
				// So access is forbidden
				err2 := fmt.Errorf("no resource found for path %s and method %s => Forbidden access", requestURI, httpMethod)
				// Add stack trace
				err2 = errors.WithStack(err2)
				// Check if bucket request context doesn't exist to use local default files
				if brctx == nil {
					responsehandler.GeneralForbiddenError(r, w, s.cfgManager, err2)
				} else {
					resHan.ForbiddenError(brctx.LoadFileContent, err2)
				}

				return
			}

			// Resource found case

			// Add resource to request context in order to keep it ready for authorization
			ctx := models.SetRequestResourceInContext(r.Context(), res)
			// Create new request with new context
			r = r.WithContext(ctx)

			// Check if OIDC is enabled
			if res.OIDC != nil {
				logEntry.Debug("authentication with oidc detected")
				s.oidcAuthorizationMiddleware(res)(next).ServeHTTP(w, r)

				return
			}

			// Check if Basic auth is enabled
			if res.Basic != nil {
				logEntry.Debug("authentication with basic auth detected")
				s.basicAuthMiddleware(res)(next).ServeHTTP(w, r)

				return
			}

			// Last case must be whitelist
			if *res.WhiteList {
				logEntry.Debug("authentication skipped because resource is whitelisted")
				next.ServeHTTP(w, r)

				return
			}

			// Error, this case shouldn't arrive
			err = errAuthenticationMiddlewareNotSupported
			// Check if bucket request context doesn't exist to use local default files
			if brctx == nil {
				responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
			} else {
				resHan.InternalServerError(brctx.LoadFileContent, err)
			}
		})
	}
}
// Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
// Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared .
func (s *service) Middleware(resources []*config.Resource) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			logEntry := log.GetLoggerFromContext(r.Context())
			resHan := responsehandler.GetResponseHandlerFromContext(r.Context())
			if len(resources) == 0 {
				logEntry.Info("no resource declared => skip authentication")
				next.ServeHTTP(w, r)
				return
			}
			requestURI := r.URL.RequestURI()
			httpMethod := r.Method
			brctx := bucket.GetBucketRequestContextFromContext(r.Context())
			res, err := findResource(resources, requestURI, httpMethod)
			if err != nil {
				if brctx == nil {
					responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
				} else {
					resHan.InternalServerError(brctx.LoadFileContent, err)
				}
				return
			}
			if res == nil {
				err2 := fmt.Errorf("no resource found for path %s and method %s => Forbidden access", requestURI, httpMethod)
				err2 = errors.WithStack(err2)
				if brctx == nil {
					responsehandler.GeneralForbiddenError(r, w, s.cfgManager, err2)
				} else {
					resHan.ForbiddenError(brctx.LoadFileContent, err2)
				}
				return
			}
			ctx := models.SetRequestResourceInContext(r.Context(), res)
			r = r.WithContext(ctx)
			if res.OIDC != nil {
				logEntry.Debug("authentication with oidc detected")
				s.oidcAuthorizationMiddleware(res)(next).ServeHTTP(w, r)
				return
			}
			if res.Basic != nil {
				logEntry.Debug("authentication with basic auth detected")
				s.basicAuthMiddleware(res)(next).ServeHTTP(w, r)
				return
			}
			if *res.WhiteList {
				logEntry.Debug("authentication skipped because resource is whitelisted")
				next.ServeHTTP(w, r)
				return
			}
			err = errAuthenticationMiddlewareNotSupported
			if brctx == nil {
				responsehandler.GeneralInternalServerError(r, w, s.cfgManager, err)
			} else {
				resHan.InternalServerError(brctx.LoadFileContent, err)
			}
		})
	}
}
func ( s * service ) Middleware ( resources [ ] * config . Resource ) func ( http . Handler ) http . Handler { return func ( next http . Handler ) http . Handler { return http . HandlerFunc ( func ( w http . ResponseWriter , r * http . Request ) { logEntry := log . GetLoggerFromContext ( r . Context ( ) ) resHan := responsehandler . GetResponseHandlerFromContext ( r . Context ( ) ) if len ( resources ) == 0 { logEntry . Info ( " " ) next . ServeHTTP ( w , r ) return } requestURI := r . URL . RequestURI ( ) httpMethod := r . Method brctx := bucket . GetBucketRequestContextFromContext ( r . Context ( ) ) res , err := findResource ( resources , requestURI , httpMethod ) if err != nil { if brctx == nil { responsehandler . GeneralInternalServerError ( r , w , s . cfgManager , err ) } else { resHan . InternalServerError ( brctx . LoadFileContent , err ) } return } if res == nil { err2 := fmt . Errorf ( " " , requestURI , httpMethod ) err2 = errors . WithStack ( err2 ) if brctx == nil { responsehandler . GeneralForbiddenError ( r , w , s . cfgManager , err2 ) } else { resHan . ForbiddenError ( brctx . LoadFileContent , err2 ) } return } ctx := models . SetRequestResourceInContext ( r . Context ( ) , res ) r = r . WithContext ( ctx ) if res . OIDC != nil { logEntry . Debug ( " " ) s . oidcAuthorizationMiddleware ( res ) ( next ) . ServeHTTP ( w , r ) return } if res . Basic != nil { logEntry . Debug ( " " ) s . basicAuthMiddleware ( res ) ( next ) . ServeHTTP ( w , r ) return } if * res . WhiteList { logEntry . Debug ( " " ) next . ServeHTTP ( w , r ) return } err = errAuthenticationMiddlewareNotSupported if brctx == nil { responsehandler . GeneralInternalServerError ( r , w , s . cfgManager , err ) } else { resHan . InternalServerError ( brctx . LoadFileContent , err ) } } ) } }
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared.
Middleware will redirect authentication to basic auth or OIDC depending on request path and resources declared .
// Get logger // Get response handler // Check if resources are empty // In this case, continue without authentication // Get request data // Get bucket request context // Find resource // Check if bucket request context doesn't exist to use local default files // Check if resource isn't found // In this case, resource isn't found because not path not declared // So access is forbidden // Add stack trace // Check if bucket request context doesn't exist to use local default files // Resource found case // Add resource to request context in order to keep it ready for authorization // Create new request with new context // Check if OIDC is enabled // Check if Basic auth is enabled // Last case must be whitelist // Error, this case shouldn't arrive // Check if bucket request context doesn't exist to use local default files