lxd/daemon.go
func (d *Daemon) setupExternalAuthentication(authEndpoint string, authPubkey string, expiry int64, domains string) error {
	// Parse the list of domains
	authDomains := []string{}
	for _, domain := range strings.Split(domains, ",") {
		if domain == "" {
			continue
		}

		authDomains = append(authDomains, strings.TrimSpace(domain))
	}

	// Allow disable external authentication
	if authEndpoint == "" {
		d.externalAuth = nil
		return nil
	}

	// Setup the candid client
	idmClient, err := candidclient.New(candidclient.NewParams{
		BaseURL: authEndpoint,
	})
	if err != nil {
		return err
	}

	idmClientWrapper := &IdentityClientWrapper{
		client:       idmClient,
		ValidDomains: authDomains,
	}

	// Generate an internal private key
	key, err := bakery.GenerateKey()
	if err != nil {
		return err
	}

	pkCache := bakery.NewThirdPartyStore()
	pkLocator := httpbakery.NewThirdPartyLocator(nil, pkCache)
	if authPubkey != "" {
		// Parse the public key
		pkKey := bakery.Key{}
		err := pkKey.UnmarshalText([]byte(authPubkey))
		if err != nil {
			return err
		}

		// Add the key information
		pkCache.AddInfo(authEndpoint, bakery.ThirdPartyInfo{
			PublicKey: bakery.PublicKey{Key: pkKey},
			Version:   3,
		})

		// Allow http URLs if we have a public key set
		if strings.HasPrefix(authEndpoint, "http://") {
			pkLocator.AllowInsecure()
		}
	}

	// Setup the bakery
	bakery := identchecker.NewBakery(identchecker.BakeryParams{
		Key:            key,
		Location:       authEndpoint,
		Locator:        pkLocator,
		Checker:        httpbakery.NewChecker(),
		IdentityClient: idmClientWrapper,
		Authorizer: identchecker.ACLAuthorizer{
			GetACL: func(ctx context.Context, op bakery.Op) ([]string, bool, error) {
				return []string{identchecker.Everyone}, false, nil
			},
		},
	})

	// Store our settings
	d.externalAuth = &externalAuth{
		endpoint: authEndpoint,
		expiry:   expiry,
		bakery:   bakery,
	}

	return nil
}
func (d *Daemon) setupExternalAuthentication(authEndpoint string, authPubkey string, expiry int64, domains string) error {
	// Parse the list of domains
	authDomains := []string{}
	for _, domain := range strings.Split(domains, ",") {
		if domain == "" {
			continue
		}

		authDomains = append(authDomains, strings.TrimSpace(domain))
	}

	// Allow disable external authentication
	if authEndpoint == "" {
		d.externalAuth = nil
		return nil
	}

	// Setup the candid client
	idmClient, err := candidclient.New(candidclient.NewParams{
		BaseURL: authEndpoint,
	})
	if err != nil {
		return err
	}

	idmClientWrapper := &IdentityClientWrapper{
		client:       idmClient,
		ValidDomains: authDomains,
	}

	// Generate an internal private key
	key, err := bakery.GenerateKey()
	if err != nil {
		return err
	}

	pkCache := bakery.NewThirdPartyStore()
	pkLocator := httpbakery.NewThirdPartyLocator(nil, pkCache)
	if authPubkey != "" {
		// Parse the public key
		pkKey := bakery.Key{}
		err := pkKey.UnmarshalText([]byte(authPubkey))
		if err != nil {
			return err
		}

		// Add the key information
		pkCache.AddInfo(authEndpoint, bakery.ThirdPartyInfo{
			PublicKey: bakery.PublicKey{Key: pkKey},
			Version:   3,
		})

		// Allow http URLs if we have a public key set
		if strings.HasPrefix(authEndpoint, "http://") {
			pkLocator.AllowInsecure()
		}
	}

	// Setup the bakery
	bakery := identchecker.NewBakery(identchecker.BakeryParams{
		Key:            key,
		Location:       authEndpoint,
		Locator:        pkLocator,
		Checker:        httpbakery.NewChecker(),
		IdentityClient: idmClientWrapper,
		Authorizer: identchecker.ACLAuthorizer{
			GetACL: func(ctx context.Context, op bakery.Op) ([]string, bool, error) {
				return []string{identchecker.Everyone}, false, nil
			},
		},
	})

	// Store our settings
	d.externalAuth = &externalAuth{
		endpoint: authEndpoint,
		expiry:   expiry,
		bakery:   bakery,
	}

	return nil
}
func ( d * Daemon ) setupExternalAuthentication ( authEndpoint string , authPubkey string , expiry int64 , domains string ) error { // Parse the list of domains authDomains := [ ] string { } for _ , domain := range strings . Split ( domains , " " ) { if domain == " " { continue } authDomains = append ( authDomains , strings . TrimSpace ( domain ) ) } // Allow disable external authentication if authEndpoint == " " { d . externalAuth = nil return nil } // Setup the candid client idmClient , err := candidclient . New ( candidclient . NewParams { BaseURL : authEndpoint , } ) if err != nil { return err } idmClientWrapper := & IdentityClientWrapper { client : idmClient , ValidDomains : authDomains , } // Generate an internal private key key , err := bakery . GenerateKey ( ) if err != nil { return err } pkCache := bakery . NewThirdPartyStore ( ) pkLocator := httpbakery . NewThirdPartyLocator ( nil , pkCache ) if authPubkey != " " { // Parse the public key pkKey := bakery . Key { } err := pkKey . UnmarshalText ( [ ] byte ( authPubkey ) ) if err != nil { return err } // Add the key information pkCache . AddInfo ( authEndpoint , bakery . ThirdPartyInfo { PublicKey : bakery . PublicKey { Key : pkKey } , Version : 3 , } ) // Allow http URLs if we have a public key set if strings . HasPrefix ( authEndpoint , " " ) { pkLocator . AllowInsecure ( ) } } // Setup the bakery bakery := identchecker . NewBakery ( identchecker . BakeryParams { Key : key , Location : authEndpoint , Locator : pkLocator , Checker : httpbakery . NewChecker ( ) , IdentityClient : idmClientWrapper , Authorizer : identchecker . ACLAuthorizer { GetACL : func ( ctx context . Context , op bakery . Op ) ( [ ] string , bool , error ) { return [ ] string { identchecker . Everyone } , false , nil } , } , } ) // Store our settings d . externalAuth = & externalAuth { endpoint : authEndpoint , expiry : expiry , bakery : bakery , } return nil }
// Setup external authentication
Setup external authentication