2022-03-28 08:05:09 +00:00
|
|
|
package command
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"time"
|
|
|
|
|
2022-05-03 13:58:38 +00:00
|
|
|
"golang.org/x/text/language"
|
|
|
|
|
2022-04-26 23:01:45 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/ui/console"
|
|
|
|
"github.com/zitadel/zitadel/internal/command/preparation"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
|
|
"github.com/zitadel/zitadel/internal/errors"
|
|
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
|
|
"github.com/zitadel/zitadel/internal/id"
|
2022-05-13 12:13:07 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/notification/channels/smtp"
|
2022-04-26 23:01:45 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/repository/instance"
|
|
|
|
"github.com/zitadel/zitadel/internal/repository/org"
|
|
|
|
"github.com/zitadel/zitadel/internal/repository/project"
|
|
|
|
"github.com/zitadel/zitadel/internal/repository/user"
|
2022-03-28 08:05:09 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
zitadelProjectName = "ZITADEL"
|
|
|
|
mgmtAppName = "Management-API"
|
|
|
|
adminAppName = "Admin-API"
|
|
|
|
authAppName = "Auth-API"
|
|
|
|
consoleAppName = "Console"
|
|
|
|
consoleRedirectPath = console.HandlerPrefix + "/auth/callback"
|
|
|
|
consolePostLogoutPath = console.HandlerPrefix + "/signedout"
|
|
|
|
)
|
|
|
|
|
|
|
|
type InstanceSetup struct {
|
2022-05-02 09:18:17 +00:00
|
|
|
zitadel ZitadelConfig
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
idGenerator id.Generator
|
2022-05-02 09:18:17 +00:00
|
|
|
InstanceName string
|
|
|
|
CustomDomain string
|
2022-05-03 13:58:38 +00:00
|
|
|
DefaultLanguage language.Tag
|
2022-05-02 09:18:17 +00:00
|
|
|
Org OrgSetup
|
2022-04-12 14:20:17 +00:00
|
|
|
SecretGenerators struct {
|
|
|
|
PasswordSaltCost uint
|
|
|
|
ClientSecret *crypto.GeneratorConfig
|
|
|
|
InitializeUserCode *crypto.GeneratorConfig
|
|
|
|
EmailVerificationCode *crypto.GeneratorConfig
|
|
|
|
PhoneVerificationCode *crypto.GeneratorConfig
|
|
|
|
PasswordVerificationCode *crypto.GeneratorConfig
|
|
|
|
PasswordlessInitCode *crypto.GeneratorConfig
|
|
|
|
DomainVerification *crypto.GeneratorConfig
|
|
|
|
}
|
2022-03-28 08:05:09 +00:00
|
|
|
PasswordComplexityPolicy struct {
|
|
|
|
MinLength uint64
|
|
|
|
HasLowercase bool
|
|
|
|
HasUppercase bool
|
|
|
|
HasNumber bool
|
|
|
|
HasSymbol bool
|
|
|
|
}
|
|
|
|
PasswordAgePolicy struct {
|
|
|
|
ExpireWarnDays uint64
|
|
|
|
MaxAgeDays uint64
|
|
|
|
}
|
|
|
|
DomainPolicy struct {
|
2022-05-16 14:08:47 +00:00
|
|
|
UserLoginMustBeDomain bool
|
|
|
|
ValidateOrgDomains bool
|
|
|
|
SMTPSenderAddressMatchesInstanceDomain bool
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
LoginPolicy struct {
|
|
|
|
AllowUsernamePassword bool
|
|
|
|
AllowRegister bool
|
|
|
|
AllowExternalIDP bool
|
|
|
|
ForceMFA bool
|
|
|
|
HidePasswordReset bool
|
2022-05-16 13:39:09 +00:00
|
|
|
IgnoreUnknownUsername bool
|
2022-03-28 08:05:09 +00:00
|
|
|
PasswordlessType domain.PasswordlessType
|
2022-05-16 13:39:09 +00:00
|
|
|
DefaultRedirectURI string
|
2022-03-28 08:05:09 +00:00
|
|
|
PasswordCheckLifetime time.Duration
|
|
|
|
ExternalLoginCheckLifetime time.Duration
|
|
|
|
MfaInitSkipLifetime time.Duration
|
|
|
|
SecondFactorCheckLifetime time.Duration
|
|
|
|
MultiFactorCheckLifetime time.Duration
|
|
|
|
}
|
|
|
|
PrivacyPolicy struct {
|
|
|
|
TOSLink string
|
|
|
|
PrivacyLink string
|
|
|
|
HelpLink string
|
|
|
|
}
|
2022-03-29 09:53:19 +00:00
|
|
|
LabelPolicy struct {
|
|
|
|
PrimaryColor string
|
|
|
|
BackgroundColor string
|
|
|
|
WarnColor string
|
|
|
|
FontColor string
|
|
|
|
PrimaryColorDark string
|
|
|
|
BackgroundColorDark string
|
|
|
|
WarnColorDark string
|
|
|
|
FontColorDark string
|
|
|
|
HideLoginNameSuffix bool
|
|
|
|
ErrorMsgPopup bool
|
|
|
|
DisableWatermark bool
|
|
|
|
}
|
2022-03-28 08:05:09 +00:00
|
|
|
LockoutPolicy struct {
|
|
|
|
MaxAttempts uint64
|
|
|
|
ShouldShowLockoutFailure bool
|
|
|
|
}
|
2022-05-13 12:13:07 +00:00
|
|
|
EmailTemplate []byte
|
|
|
|
MessageTexts []*domain.CustomMessageText
|
|
|
|
SMTPConfiguration *smtp.EmailConfig
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ZitadelConfig struct {
|
2022-04-12 14:20:17 +00:00
|
|
|
projectID string
|
|
|
|
mgmtAppID string
|
|
|
|
adminAppID string
|
|
|
|
authAppID string
|
|
|
|
consoleAppID string
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
func (s *InstanceSetup) generateIDs(idGenerator id.Generator) (err error) {
|
|
|
|
s.zitadel.projectID, err = idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
s.zitadel.mgmtAppID, err = idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
s.zitadel.adminAppID, err = idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
s.zitadel.authAppID, err = idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
s.zitadel.consoleAppID, err = idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-04-28 08:30:41 +00:00
|
|
|
func (c *Commands) SetUpInstance(ctx context.Context, setup *InstanceSetup) (string, *domain.ObjectDetails, error) {
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
instanceID, err := c.idGenerator.Next()
|
2022-04-05 05:58:09 +00:00
|
|
|
if err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-04-05 05:58:09 +00:00
|
|
|
}
|
2022-04-13 05:42:48 +00:00
|
|
|
|
2022-04-20 14:59:37 +00:00
|
|
|
if err = c.eventstore.NewInstance(ctx, instanceID); err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-04-13 05:42:48 +00:00
|
|
|
}
|
|
|
|
|
2022-04-28 08:30:41 +00:00
|
|
|
ctx = authz.SetCtxData(authz.WithRequestedDomain(authz.WithInstanceID(ctx, instanceID), c.externalDomain), authz.CtxData{OrgID: instanceID, ResourceOwner: instanceID})
|
2022-03-28 08:05:09 +00:00
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
orgID, err := c.idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
userID, err := c.idGenerator.Next()
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
if err = setup.generateIDs(c.idGenerator); err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
2022-04-25 09:16:36 +00:00
|
|
|
ctx = authz.WithConsole(ctx, setup.zitadel.projectID, setup.zitadel.consoleAppID)
|
2022-03-28 08:05:09 +00:00
|
|
|
|
2022-04-05 05:58:09 +00:00
|
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
2022-04-20 14:59:37 +00:00
|
|
|
orgAgg := org.NewAggregate(orgID)
|
2022-03-28 08:05:09 +00:00
|
|
|
userAgg := user.NewAggregate(userID, orgID)
|
2022-04-21 10:37:39 +00:00
|
|
|
projectAgg := project.NewAggregate(setup.zitadel.projectID, orgID)
|
2022-03-28 08:05:09 +00:00
|
|
|
|
|
|
|
validations := []preparation.Validation{
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddInstance(instanceAgg, setup.InstanceName, setup.DefaultLanguage),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeAppSecret, setup.SecretGenerators.ClientSecret),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInitCode, setup.SecretGenerators.InitializeUserCode),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyEmailCode, setup.SecretGenerators.EmailVerificationCode),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyPhoneCode, setup.SecretGenerators.PhoneVerificationCode),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypePasswordResetCode, setup.SecretGenerators.PasswordVerificationCode),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypePasswordlessInitCode, setup.SecretGenerators.PasswordlessInitCode),
|
|
|
|
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyDomain, setup.SecretGenerators.DomainVerification),
|
|
|
|
|
|
|
|
prepareAddDefaultPasswordComplexityPolicy(
|
2022-03-28 08:05:09 +00:00
|
|
|
instanceAgg,
|
|
|
|
setup.PasswordComplexityPolicy.MinLength,
|
|
|
|
setup.PasswordComplexityPolicy.HasLowercase,
|
|
|
|
setup.PasswordComplexityPolicy.HasUppercase,
|
|
|
|
setup.PasswordComplexityPolicy.HasNumber,
|
|
|
|
setup.PasswordComplexityPolicy.HasSymbol,
|
|
|
|
),
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultPasswordAgePolicy(
|
2022-03-28 08:05:09 +00:00
|
|
|
instanceAgg,
|
|
|
|
setup.PasswordAgePolicy.ExpireWarnDays,
|
|
|
|
setup.PasswordAgePolicy.MaxAgeDays,
|
|
|
|
),
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultDomainPolicy(
|
2022-03-28 08:05:09 +00:00
|
|
|
instanceAgg,
|
|
|
|
setup.DomainPolicy.UserLoginMustBeDomain,
|
2022-04-13 09:24:03 +00:00
|
|
|
setup.DomainPolicy.ValidateOrgDomains,
|
2022-05-16 14:08:47 +00:00
|
|
|
setup.DomainPolicy.SMTPSenderAddressMatchesInstanceDomain,
|
2022-03-28 08:05:09 +00:00
|
|
|
),
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultLoginPolicy(
|
2022-03-28 08:05:09 +00:00
|
|
|
instanceAgg,
|
|
|
|
setup.LoginPolicy.AllowUsernamePassword,
|
|
|
|
setup.LoginPolicy.AllowRegister,
|
|
|
|
setup.LoginPolicy.AllowExternalIDP,
|
|
|
|
setup.LoginPolicy.ForceMFA,
|
|
|
|
setup.LoginPolicy.HidePasswordReset,
|
2022-05-16 13:39:09 +00:00
|
|
|
setup.LoginPolicy.IgnoreUnknownUsername,
|
2022-03-28 08:05:09 +00:00
|
|
|
setup.LoginPolicy.PasswordlessType,
|
2022-05-16 13:39:09 +00:00
|
|
|
setup.LoginPolicy.DefaultRedirectURI,
|
2022-03-28 08:05:09 +00:00
|
|
|
setup.LoginPolicy.PasswordCheckLifetime,
|
|
|
|
setup.LoginPolicy.ExternalLoginCheckLifetime,
|
|
|
|
setup.LoginPolicy.MfaInitSkipLifetime,
|
|
|
|
setup.LoginPolicy.SecondFactorCheckLifetime,
|
|
|
|
setup.LoginPolicy.MultiFactorCheckLifetime,
|
|
|
|
),
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddSecondFactorToDefaultLoginPolicy(instanceAgg, domain.SecondFactorTypeOTP),
|
|
|
|
prepareAddSecondFactorToDefaultLoginPolicy(instanceAgg, domain.SecondFactorTypeU2F),
|
|
|
|
prepareAddMultiFactorToDefaultLoginPolicy(instanceAgg, domain.MultiFactorTypeU2FWithPIN),
|
2022-03-28 08:05:09 +00:00
|
|
|
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultPrivacyPolicy(instanceAgg, setup.PrivacyPolicy.TOSLink, setup.PrivacyPolicy.PrivacyLink, setup.PrivacyPolicy.HelpLink),
|
|
|
|
prepareAddDefaultLockoutPolicy(instanceAgg, setup.LockoutPolicy.MaxAttempts, setup.LockoutPolicy.ShouldShowLockoutFailure),
|
2022-03-28 08:05:09 +00:00
|
|
|
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultLabelPolicy(
|
2022-03-29 09:53:19 +00:00
|
|
|
instanceAgg,
|
|
|
|
setup.LabelPolicy.PrimaryColor,
|
|
|
|
setup.LabelPolicy.BackgroundColor,
|
|
|
|
setup.LabelPolicy.WarnColor,
|
|
|
|
setup.LabelPolicy.FontColor,
|
|
|
|
setup.LabelPolicy.PrimaryColorDark,
|
|
|
|
setup.LabelPolicy.BackgroundColorDark,
|
|
|
|
setup.LabelPolicy.WarnColorDark,
|
|
|
|
setup.LabelPolicy.FontColorDark,
|
|
|
|
setup.LabelPolicy.HideLoginNameSuffix,
|
|
|
|
setup.LabelPolicy.ErrorMsgPopup,
|
|
|
|
setup.LabelPolicy.DisableWatermark,
|
|
|
|
),
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareActivateDefaultLabelPolicy(instanceAgg),
|
2022-03-29 09:53:19 +00:00
|
|
|
|
2022-05-24 09:28:17 +00:00
|
|
|
prepareAddDefaultEmailTemplate(instanceAgg, setup.EmailTemplate),
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, msg := range setup.MessageTexts {
|
2022-05-24 09:28:17 +00:00
|
|
|
validations = append(validations, prepareSetInstanceCustomMessageTexts(instanceAgg, msg))
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
2022-04-12 14:20:17 +00:00
|
|
|
console := &addOIDCApp{
|
|
|
|
AddApp: AddApp{
|
|
|
|
Aggregate: *projectAgg,
|
2022-04-21 10:37:39 +00:00
|
|
|
ID: setup.zitadel.consoleAppID,
|
2022-04-12 14:20:17 +00:00
|
|
|
Name: consoleAppName,
|
|
|
|
},
|
|
|
|
Version: domain.OIDCVersionV1,
|
2022-04-25 09:16:36 +00:00
|
|
|
RedirectUris: []string{},
|
2022-04-12 14:20:17 +00:00
|
|
|
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
|
|
|
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
|
|
|
ApplicationType: domain.OIDCApplicationTypeUserAgent,
|
|
|
|
AuthMethodType: domain.OIDCAuthMethodTypeNone,
|
2022-04-25 09:16:36 +00:00
|
|
|
PostLogoutRedirectUris: []string{},
|
2022-04-28 08:30:41 +00:00
|
|
|
DevMode: !c.externalSecure,
|
2022-04-12 14:20:17 +00:00
|
|
|
AccessTokenType: domain.OIDCTokenTypeBearer,
|
|
|
|
AccessTokenRoleAssertion: false,
|
|
|
|
IDTokenRoleAssertion: false,
|
|
|
|
IDTokenUserinfoAssertion: false,
|
|
|
|
ClockSkew: 0,
|
|
|
|
}
|
|
|
|
|
2022-03-28 08:05:09 +00:00
|
|
|
validations = append(validations,
|
2022-04-12 14:20:17 +00:00
|
|
|
AddOrgCommand(ctx, orgAgg, setup.Org.Name),
|
2022-04-25 14:36:10 +00:00
|
|
|
AddHumanCommand(userAgg, &setup.Org.Human, c.userPasswordAlg, c.userEncryption),
|
2022-04-20 14:59:37 +00:00
|
|
|
c.AddOrgMemberCommand(orgAgg, userID, domain.RoleOrgOwner),
|
|
|
|
c.AddInstanceMemberCommand(instanceAgg, userID, domain.RoleIAMOwner),
|
2022-03-28 08:05:09 +00:00
|
|
|
|
2022-04-12 14:20:17 +00:00
|
|
|
AddProjectCommand(projectAgg, zitadelProjectName, userID, false, false, false, domain.PrivateLabelingSettingUnspecified),
|
2022-03-28 08:05:09 +00:00
|
|
|
SetIAMProject(instanceAgg, projectAgg.ID),
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
c.AddAPIAppCommand(
|
2022-04-12 14:20:17 +00:00
|
|
|
&addAPIApp{
|
|
|
|
AddApp: AddApp{
|
|
|
|
Aggregate: *projectAgg,
|
2022-04-21 10:37:39 +00:00
|
|
|
ID: setup.zitadel.mgmtAppID,
|
2022-04-12 14:20:17 +00:00
|
|
|
Name: mgmtAppName,
|
|
|
|
},
|
|
|
|
AuthMethodType: domain.APIAuthMethodTypePrivateKeyJWT,
|
|
|
|
},
|
2022-03-28 08:05:09 +00:00
|
|
|
nil,
|
|
|
|
),
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
c.AddAPIAppCommand(
|
2022-04-12 14:20:17 +00:00
|
|
|
&addAPIApp{
|
|
|
|
AddApp: AddApp{
|
|
|
|
Aggregate: *projectAgg,
|
2022-04-21 10:37:39 +00:00
|
|
|
ID: setup.zitadel.adminAppID,
|
2022-04-12 14:20:17 +00:00
|
|
|
Name: adminAppName,
|
|
|
|
},
|
|
|
|
AuthMethodType: domain.APIAuthMethodTypePrivateKeyJWT,
|
|
|
|
},
|
2022-03-28 08:05:09 +00:00
|
|
|
nil,
|
|
|
|
),
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
c.AddAPIAppCommand(
|
2022-04-12 14:20:17 +00:00
|
|
|
&addAPIApp{
|
|
|
|
AddApp: AddApp{
|
|
|
|
Aggregate: *projectAgg,
|
2022-04-21 10:37:39 +00:00
|
|
|
ID: setup.zitadel.authAppID,
|
2022-04-12 14:20:17 +00:00
|
|
|
Name: authAppName,
|
|
|
|
},
|
|
|
|
AuthMethodType: domain.APIAuthMethodTypePrivateKeyJWT,
|
|
|
|
},
|
2022-03-28 08:05:09 +00:00
|
|
|
nil,
|
|
|
|
),
|
|
|
|
|
feat: Configurable Unique Machine Identification (#3626)
* feat: Configurable Unique Machine Identification
This change fixes Segfault on AWS App Runner with v2 #3625
The change introduces two new dependencies:
* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.
The change ads new configuration (see `defaults.yaml`):
* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request. Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.
The new flow for getting a unique machine id is:
1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.
It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.
Misc changes:
* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.
* Update internal/id/config.go
Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>
* Fix authored by @livio-a for tests
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 14:57:57 +00:00
|
|
|
c.AddOIDCAppCommand(console, nil),
|
2022-04-21 10:37:39 +00:00
|
|
|
SetIAMConsoleID(instanceAgg, &console.ClientID, &setup.zitadel.consoleAppID),
|
2022-04-25 14:36:10 +00:00
|
|
|
)
|
2022-05-30 15:39:18 +00:00
|
|
|
|
|
|
|
addGeneratedDomain, err := c.addGeneratedInstanceDomain(ctx, instanceAgg, setup.InstanceName)
|
2022-05-16 09:26:24 +00:00
|
|
|
if err != nil {
|
|
|
|
return "", nil, err
|
|
|
|
}
|
2022-05-30 15:39:18 +00:00
|
|
|
validations = append(validations, addGeneratedDomain...)
|
2022-04-25 09:16:36 +00:00
|
|
|
if setup.CustomDomain != "" {
|
2022-04-25 14:36:10 +00:00
|
|
|
validations = append(validations,
|
|
|
|
c.addInstanceDomain(instanceAgg, setup.CustomDomain, false),
|
|
|
|
setPrimaryInstanceDomain(instanceAgg, setup.CustomDomain),
|
|
|
|
)
|
2022-04-25 09:16:36 +00:00
|
|
|
}
|
2022-03-28 08:05:09 +00:00
|
|
|
|
2022-05-30 15:39:18 +00:00
|
|
|
if setup.SMTPConfiguration != nil {
|
|
|
|
validations = append(validations,
|
|
|
|
c.prepareAddSMTPConfig(
|
|
|
|
instanceAgg,
|
|
|
|
setup.SMTPConfiguration.From,
|
|
|
|
setup.SMTPConfiguration.FromName,
|
|
|
|
setup.SMTPConfiguration.SMTP.Host,
|
|
|
|
setup.SMTPConfiguration.SMTP.User,
|
|
|
|
[]byte(setup.SMTPConfiguration.SMTP.Password),
|
|
|
|
setup.SMTPConfiguration.Tls,
|
|
|
|
),
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2022-04-20 14:59:37 +00:00
|
|
|
cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validations...)
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
|
|
|
|
2022-04-20 14:59:37 +00:00
|
|
|
events, err := c.eventstore.Push(ctx, cmds...)
|
2022-03-28 08:05:09 +00:00
|
|
|
if err != nil {
|
2022-04-21 10:37:39 +00:00
|
|
|
return "", nil, err
|
2022-03-28 08:05:09 +00:00
|
|
|
}
|
2022-04-21 10:37:39 +00:00
|
|
|
return instanceID, &domain.ObjectDetails{
|
2022-03-28 08:05:09 +00:00
|
|
|
Sequence: events[len(events)-1].Sequence(),
|
|
|
|
EventDate: events[len(events)-1].CreationDate(),
|
|
|
|
ResourceOwner: orgID,
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2022-05-03 13:58:38 +00:00
|
|
|
func (c *Commands) SetDefaultLanguage(ctx context.Context, defaultLanguage language.Tag) (*domain.ObjectDetails, error) {
|
|
|
|
instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
|
|
|
|
validation := c.prepareSetDefaultLanguage(instanceAgg, defaultLanguage)
|
|
|
|
cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validation)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
events, err := c.eventstore.Push(ctx, cmds...)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &domain.ObjectDetails{
|
|
|
|
Sequence: events[len(events)-1].Sequence(),
|
|
|
|
EventDate: events[len(events)-1].CreationDate(),
|
|
|
|
ResourceOwner: events[len(events)-1].Aggregate().InstanceID,
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2022-05-24 09:28:17 +00:00
|
|
|
func prepareAddInstance(a *instance.Aggregate, instanceName string, defaultLanguage language.Tag) preparation.Validation {
|
2022-04-21 10:37:39 +00:00
|
|
|
return func() (preparation.CreateCommands, error) {
|
|
|
|
return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
|
|
|
|
return []eventstore.Command{
|
|
|
|
instance.NewInstanceAddedEvent(ctx, &a.Aggregate, instanceName),
|
2022-05-03 13:58:38 +00:00
|
|
|
instance.NewDefaultLanguageSetEvent(ctx, &a.Aggregate, defaultLanguage),
|
2022-04-21 10:37:39 +00:00
|
|
|
}, nil
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-03-29 09:53:19 +00:00
|
|
|
//SetIAMProject defines the command to set the id of the IAM project onto the instance
|
2022-03-28 08:05:09 +00:00
|
|
|
func SetIAMProject(a *instance.Aggregate, projectID string) preparation.Validation {
|
|
|
|
return func() (preparation.CreateCommands, error) {
|
|
|
|
return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
|
|
|
|
return []eventstore.Command{
|
|
|
|
instance.NewIAMProjectSetEvent(ctx, &a.Aggregate, projectID),
|
|
|
|
}, nil
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
}
|
2022-03-29 09:53:19 +00:00
|
|
|
|
|
|
|
//SetIAMConsoleID defines the command to set the clientID of the Console App onto the instance
|
2022-04-14 12:19:18 +00:00
|
|
|
func SetIAMConsoleID(a *instance.Aggregate, clientID, appID *string) preparation.Validation {
|
2022-03-29 09:53:19 +00:00
|
|
|
return func() (preparation.CreateCommands, error) {
|
|
|
|
return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
|
|
|
|
return []eventstore.Command{
|
2022-04-14 12:19:18 +00:00
|
|
|
instance.NewIAMConsoleSetEvent(ctx, &a.Aggregate, clientID, appID),
|
2022-03-29 09:53:19 +00:00
|
|
|
}, nil
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
}
|
2022-04-12 14:20:17 +00:00
|
|
|
|
|
|
|
func (c *Commands) setGlobalOrg(ctx context.Context, iamAgg *eventstore.Aggregate, iamWriteModel *InstanceWriteModel, orgID string) (eventstore.Command, error) {
|
|
|
|
err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if iamWriteModel.GlobalOrgID != "" {
|
|
|
|
return nil, errors.ThrowPreconditionFailed(nil, "IAM-HGG24", "Errors.IAM.GlobalOrgAlreadySet")
|
|
|
|
}
|
|
|
|
return instance.NewGlobalOrgSetEventEvent(ctx, iamAgg, orgID), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Commands) setIAMProject(ctx context.Context, iamAgg *eventstore.Aggregate, iamWriteModel *InstanceWriteModel, projectID string) (eventstore.Command, error) {
|
|
|
|
err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if iamWriteModel.ProjectID != "" {
|
|
|
|
return nil, errors.ThrowPreconditionFailed(nil, "IAM-EGbw2", "Errors.IAM.IAMProjectAlreadySet")
|
|
|
|
}
|
|
|
|
return instance.NewIAMProjectSetEvent(ctx, iamAgg, projectID), nil
|
|
|
|
}
|
2022-05-03 13:58:38 +00:00
|
|
|
|
|
|
|
func (c *Commands) prepareSetDefaultLanguage(a *instance.Aggregate, defaultLanguage language.Tag) preparation.Validation {
|
|
|
|
return func() (preparation.CreateCommands, error) {
|
|
|
|
if defaultLanguage == language.Und {
|
|
|
|
return nil, errors.ThrowInvalidArgument(nil, "INST-28nlD", "Errors.Invalid.Argument")
|
|
|
|
}
|
|
|
|
return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
|
|
|
|
writeModel, err := getInstanceWriteModel(ctx, filter)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if writeModel.DefaultLanguage == defaultLanguage {
|
|
|
|
return nil, errors.ThrowPreconditionFailed(nil, "INST-DS3rq", "Errors.Instance.NotChanged")
|
|
|
|
}
|
|
|
|
return []eventstore.Command{instance.NewDefaultLanguageSetEvent(ctx, &a.Aggregate, defaultLanguage)}, nil
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func getInstanceWriteModel(ctx context.Context, filter preparation.FilterToQueryReducer) (*InstanceWriteModel, error) {
|
|
|
|
writeModel := NewInstanceWriteModel(authz.GetInstance(ctx).InstanceID())
|
|
|
|
events, err := filter(ctx, writeModel.Query())
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if len(events) == 0 {
|
|
|
|
return writeModel, nil
|
|
|
|
}
|
|
|
|
writeModel.AppendEvents(events...)
|
|
|
|
err = writeModel.Reduce()
|
|
|
|
return writeModel, err
|
|
|
|
}
|