LibreOffice/online
1
0
Fork 0
mirror of https://github.com/LibreOffice/online.git synced 2025-08-01 16:04:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

don't use ssl key file for admin console auth, use a generated key instead

Browse Source 
Change-Id: I424afe0184a64b7f069d896bde6941e42b7b5531
rational: setup is easier in case, when user does not use ssl in loolwsd config
Reviewed-on: https://gerrit.libreoffice.org/61076
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Andras Timar <andras.timar@collabora.com>
This commit is contained in:
Andras Timar
2018-09-28 11:54:20 +02:00
parent c745732ac7
commit 2d62529359
5 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
wsd/Admin.cpp
View File

@ -76,11 +76,9 @@ void AdminSocketHandler::handleMessage(bool /* fin */, WSOpCode /* code */,
} }
std::string jwtToken; std::string jwtToken;
LOOLProtocol::getTokenString(tokens[1], "jwt", jwtToken); LOOLProtocol::getTokenString(tokens[1], "jwt", jwtToken);
const auto& config = Application::instance().config();
const std::string sslKeyPath = config.getString("ssl.key_file_path", "");
LOG_INF("Verifying JWT token: " << jwtToken); LOG_INF("Verifying JWT token: " << jwtToken);
JWTAuth authAgent(sslKeyPath, "admin", "admin", "admin"); JWTAuth authAgent("admin", "admin", "admin");
if (authAgent.verify(jwtToken)) if (authAgent.verify(jwtToken))
{ {
LOG_TRC("JWT token is valid"); LOG_TRC("JWT token is valid");

2
wsd/Auth.cpp
View File

@ -37,6 +37,8 @@ using Poco::Base64Decoder;
using Poco::Base64Encoder; using Poco::Base64Encoder;
using Poco::OutputLineEndingConverter; using Poco::OutputLineEndingConverter;
const Poco::Crypto::RSAKey JWTAuth::_key(Poco::Crypto::RSAKey(Poco::Crypto::RSAKey::KL_2048, Poco::Crypto::RSAKey::EXP_LARGE));
void Authorization::authorizeURI(Poco::URI& uri) const void Authorization::authorizeURI(Poco::URI& uri) const
{ {
if (_type == Authorization::Type::Token) if (_type == Authorization::Type::Token)

5
wsd/Auth.hpp
View File

@ -73,11 +73,10 @@ public:
class JWTAuth : public AuthBase class JWTAuth : public AuthBase
{ {
public: public:
JWTAuth(const std::string& keyPath, const std::string& name, const std::string& sub, const std::string& aud) JWTAuth(const std::string& name, const std::string& sub, const std::string& aud)
: _name(name), : _name(name),
_sub(sub), _sub(sub),
_aud(aud), _aud(aud),
_key(Poco::Crypto::RSAKey("", keyPath)),
_digestEngine(_key, "SHA256") _digestEngine(_key, "SHA256")
{ {
} }
@ -100,7 +99,7 @@ private:
const std::string _sub; const std::string _sub;
const std::string _aud; const std::string _aud;
const Poco::Crypto::RSAKey _key; static const Poco::Crypto::RSAKey _key;
Poco::Crypto::RSADigestEngine _digestEngine; Poco::Crypto::RSADigestEngine _digestEngine;
}; };

5
wsd/FileServer.cpp
View File

@ -196,7 +196,6 @@ bool FileServerRequestHandler::isAdminLoggedIn(const HTTPRequest& request,
assert(LOOLWSD::AdminEnabled); assert(LOOLWSD::AdminEnabled);
const auto& config = Application::instance().config(); const auto& config = Application::instance().config();
const std::string& sslKeyPath = config.getString("ssl.key_file_path", "");
NameValueCollection cookies; NameValueCollection cookies;
request.getCookies(cookies); request.getCookies(cookies);
@ -204,7 +203,7 @@ bool FileServerRequestHandler::isAdminLoggedIn(const HTTPRequest& request,
{ {
const std::string jwtToken = cookies.get("jwt"); const std::string jwtToken = cookies.get("jwt");
LOG_INF("Verifying JWT token: " << jwtToken); LOG_INF("Verifying JWT token: " << jwtToken);
JWTAuth authAgent(sslKeyPath, "admin", "admin", "admin"); JWTAuth authAgent("admin", "admin", "admin");
if (authAgent.verify(jwtToken)) if (authAgent.verify(jwtToken))
{ {
LOG_TRC("JWT token is valid"); LOG_TRC("JWT token is valid");
@ -247,7 +246,7 @@ bool FileServerRequestHandler::isAdminLoggedIn(const HTTPRequest& request,
} }
// authentication passed, generate and set the cookie // authentication passed, generate and set the cookie
JWTAuth authAgent(sslKeyPath, "admin", "admin", "admin"); JWTAuth authAgent("admin", "admin", "admin");
const std::string jwtToken = authAgent.getAccessToken(); const std::string jwtToken = authAgent.getAccessToken();
Poco::Net::HTTPCookie cookie("jwt", jwtToken); Poco::Net::HTTPCookie cookie("jwt", jwtToken);

3
wsd/README
View File

@ -183,8 +183,7 @@ there is a less verbose way, but this worked for me:
openssl ca -keyfile private/ca.key.pem -cert ca.cert.pem -extensions usr_cert -notext -md sha256 -in csr.pem -out cert.pem openssl ca -keyfile private/ca.key.pem -cert ca.cert.pem -extensions usr_cert -notext -md sha256 -in csr.pem -out cert.pem
HTTPS is the default. HTTP-only mode can be enabled with --disable-ssl HTTPS is the default. HTTP-only mode can be enabled with --disable-ssl
configure option. key.pem is required even in HTTP-only mode, because it is configure option.
used to generate the secure token for the admin console.
If you plan to hack on loolwsd, you probably want to familiarize If you plan to hack on loolwsd, you probably want to familiarize
yourself with loolwsd's --numprespawns switch, and the 'connect' yourself with loolwsd's --numprespawns switch, and the 'connect'