support new SAT v2 and multi-tenancy in auth-N/auth-Z

Makefile

@@ -28,13 +28,16 @@ build: ## Build a version
 	go build -v -ldflags="-X ${REPO}/common.BinaryBranch=${BRANCH} -X ${REPO}/common.BinaryVersion=${Version} -X ${REPO}/common.BinaryBuildTime=${BUILDTIME}" -o bin/xconfadmin-${GOOS}-${GOARCH} main.go
 
 test:
+	ulimit -n 10000 ; go test ./... -p 1 -parallel 1 -cover -count=1 -timeout=45m
+
+test-verbose:
 	bash contrib/scripts/run_tests_with_summary.sh
 
 localtest:
 	export RUN_IN_LOCAL=true ; go test ./... -cover -count=1 -failfast
 
 cover:
-	go test ./... -count=1 -coverprofile=coverage.out -timeout=45m
+	go test ./... -count=1 -p 1 -coverprofile=coverage.out -timeout=45m
 
 html:
 	go tool cover -html=coverage.out

adminapi/adminapi_common.go

@@ -112,50 +112,53 @@ func WebServerInjection(ws *xhttp.WebconfigServer, xc *dataapi.XconfConfigs) {
 	Xc = xc
 }
 
-func initDB() {
-	queries.CreateFirmwareRuleTemplates() // Initialize FirmwareRule templates
-	initAppSettings()                     // Initialize Application settings
+func initDB(tenantId string) error {
+	// Initialize FirmwareRule templates
+	if err := queries.CreateFirmwareRuleTemplates(tenantId); err != nil {
+		return err
+	}
+	// Initialize Application settings
+	if err := initAppSettings(tenantId); err != nil {
+		return err
+	}
+	return nil
 }
 
-func initAppSettings() {
-	settings, err := common.GetAppSettings()
+func initAppSettings(tenantId string) error {
+	settings, err := common.GetAppSettings(tenantId)
 	if err != nil {
-		panic(err)
+		return err
 	}
 	if _, ok := settings[common.PROP_LOCKDOWN_ENABLED]; !ok {
-		common.SetAppSetting(common.PROP_LOCKDOWN_ENABLED, false)
+		common.SetAppSetting(tenantId, common.PROP_LOCKDOWN_ENABLED, false)
 	}
 	if _, ok := settings[common.PROP_CANARY_MAXSIZE]; !ok {
-		common.SetAppSetting(common.PROP_CANARY_MAXSIZE, common.CanarySize)
+		common.SetAppSetting(tenantId, common.PROP_CANARY_MAXSIZE, common.CanarySize)
 	}
 	if _, ok := settings[common.PROP_CANARY_DISTRIBUTION_PERCENTAGE]; !ok {
-		common.SetAppSetting(common.PROP_CANARY_DISTRIBUTION_PERCENTAGE, common.CanaryDistributionPercentage)
+		common.SetAppSetting(tenantId, common.PROP_CANARY_DISTRIBUTION_PERCENTAGE, common.CanaryDistributionPercentage)
 	}
 	if _, ok := settings[common.PROP_CANARY_FW_UPGRADE_STARTTIME]; !ok {
-		common.SetAppSetting(common.PROP_CANARY_FW_UPGRADE_STARTTIME, common.CanaryFwUpgradeStartTime)
+		common.SetAppSetting(tenantId, common.PROP_CANARY_FW_UPGRADE_STARTTIME, common.CanaryFwUpgradeStartTime)
 	}
 	if _, ok := settings[common.PROP_CANARY_FW_UPGRADE_ENDTIME]; !ok {
-		common.SetAppSetting(common.PROP_CANARY_FW_UPGRADE_ENDTIME, common.CanaryFwUpgradeEndTime)
+		common.SetAppSetting(tenantId, common.PROP_CANARY_FW_UPGRADE_ENDTIME, common.CanaryFwUpgradeEndTime)
 	}
-
 	if _, ok := settings[common.PROP_LOCKDOWN_STARTTIME]; !ok {
-		common.SetAppSetting(common.PROP_LOCKDOWN_STARTTIME, common.DefaultLockdownStartTime)
+		common.SetAppSetting(tenantId, common.PROP_LOCKDOWN_STARTTIME, common.DefaultLockdownStartTime)
 	}
-
 	if _, ok := settings[common.PROP_LOCKDOWN_ENDTIME]; !ok {
-		common.SetAppSetting(common.PROP_LOCKDOWN_ENDTIME, common.DefaultLockdownEndTime)
+		common.SetAppSetting(tenantId, common.PROP_LOCKDOWN_ENDTIME, common.DefaultLockdownEndTime)
 	}
-
 	if _, ok := settings[common.PROP_LOCKDOWN_MODULES]; !ok {
-		common.SetAppSetting(common.PROP_LOCKDOWN_MODULES, common.DefaultLockdownModules)
+		common.SetAppSetting(tenantId, common.PROP_LOCKDOWN_MODULES, common.DefaultLockdownModules)
 	}
-
 	if _, ok := settings[common.PROP_PRECOOK_LOCKDOWN_ENABLED]; !ok {
-		common.SetAppSetting(common.PROP_LOCKDOWN_ENABLED, common.DefaultPrecookLockdownEnabled)
+		common.SetAppSetting(tenantId, common.PROP_PRECOOK_LOCKDOWN_ENABLED, common.DefaultPrecookLockdownEnabled)
 	}
-
 	if _, ok := settings[common.PROP_CANARY_TIMEZONE_LIST]; !ok {
-		common.SetAppSetting(common.PROP_CANARY_TIMEZONE_LIST, common.DefaultCanaryTimezone)
+		common.SetAppSetting(tenantId, common.PROP_CANARY_TIMEZONE_LIST, common.DefaultCanaryTimezone)
 	}
 
+	return nil
 }

adminapi/auth/auth_handler.go

@@ -78,6 +78,15 @@ func BasicAuthHandler(w http.ResponseWriter, r *http.Request) {
 
 	var authRequest AuthRequest
 	err := json.NewDecoder(r.Body).Decode(&authRequest)
+	if err != nil {
+		if xw, ok := w.(*xwhttp.XResponseWriter); ok {
+			if body := xw.Body(); body != "" {
+				if err2 := json.Unmarshal([]byte(body), &authRequest); err2 == nil {
+					err = nil
+				}
+			}
+		}
+	}
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return

adminapi/auth/idp_service_handler.go

@@ -48,6 +48,11 @@ func GetAdminUIUrlFromCookies(r *http.Request) string {
 }
 
 func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	if Ws == nil || Ws.IdpServiceConnector == nil {
+		xhttp.WriteXconfResponse(w, http.StatusServiceUnavailable, []byte("IDP/Xerxes connector is not configured"))
+		return
+	}
+
 	http.SetCookie(w, xhttp.NewErasedAuthTokenCookie())
 
 	idpAuthServer := Ws.XW_XconfServer.ServerConfig.GetString("xconfwebconfig.xconf.idp_service_name")
@@ -72,7 +77,22 @@ func LogoutAfterHandler(w http.ResponseWriter, r *http.Request) {
 	xhttp.WriteXconfResponseWithHeaders(w, headers, http.StatusFound, []byte(""))
 }
 
+func AclLogoutHandler(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, xhttp.NewErasedAuthTokenCookie())
+
+	adminUrl := fmt.Sprintf("%s/#/authorization", GetAdminUIUrlFromCookies(r))
+	headers := map[string]string{
+		"Location": adminUrl,
+	}
+	xhttp.WriteXconfResponseWithHeaders(w, headers, http.StatusFound, []byte(""))
+}
+
 func CodeHandler(w http.ResponseWriter, r *http.Request) {
+	if Ws == nil || Ws.IdpServiceConnector == nil {
+		xhttp.WriteXconfResponse(w, http.StatusServiceUnavailable, []byte("IDP/Xerxes connector is not configured"))
+		return
+	}
+
 	codeList, ok := r.URL.Query()["code"]
 	if !ok {
 		xhttp.WriteXconfResponse(w, http.StatusBadRequest, []byte(""))
@@ -101,6 +121,11 @@ func CodeHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func LoginUrlHandler(w http.ResponseWriter, r *http.Request) {
+	if Ws == nil || Ws.IdpServiceConnector == nil {
+		xhttp.WriteXconfResponse(w, http.StatusServiceUnavailable, []byte("IDP/Xerxes connector is not configured"))
+		return
+	}
+
 	idpAuthServer := Ws.XW_XconfServer.ServerConfig.GetString("xconfwebconfig.xconf.idp_service_name")
 	continueUrl := GetAdminUIUrlFromCookies(r) + Ws.XW_XconfServer.ServerConfig.GetString(fmt.Sprintf("xconfwebconfig.%v.idp_code_path", idpAuthServer), "/"+getAuthProvider()+"/code")
 	loginUrl := Ws.IdpServiceConnector.GetFullLoginUrl(continueUrl)