云原生丨一文教你轻松借助DEX实现单点登录！

version: "3"
services:
openldap:
image: bitnami/openldap:latest
ports:
- 1389:1389
environment:
- LDAP_ADMIN_USERNAME=admin
- LDAP_ADMIN_PASSWORD=adminpassword
dex:
image: bitnami/dex:latest
ports:
- 5556:5556
- 5557:5557
command:
- serve
- dex/config.yaml
volumes:
- config.yaml:/dex/config.yaml
redis:
image: redis:latest
ports:
- 6379:6379

enablePasswordDB: true
# dex服务地址
issuer: http://localhost:5556/dex
oauth2:
# 可⽤的返回类型
responseTypes: [ "code","token","id_token" ]
skipApprovalScreen: true
staticClients:
- id: app1
name: app1
redirectURIs:
- http://localhost:8080/callback
secret: app1-secret
# trustedPeers表app2⽣成的token可⽤于app1的认证。
trustedPeers:
- app2
- id: app2
name: app2
redirectURIs:
- http://localhost:8081/callback
secret: app2-secret
trustedPeers:
- app1
storage:
type: sqlite3
config:
file: local-example/dex.db
web:
# http 接⼝地址
http: 0.0.0.0:5556
grpc:
# grpc接⼝地址。⽀持通过grpc来扩充dex配置。
addr: 0.0.0.0:5557
# # Server certs. If TLS credentials aren't provided dex will run in
plaintext (HTTP) mode.
# tlsCert: Users/liujian/work/006-yhplatform/code/yunhang-platform￾service/cert/dex-server.crt
# tlsKey: Users/liujian/work/006-yhplatform/code/yunhang-platform￾service/cert/dex-server.key
#
# # Client auth CA.
# tlsClientCA: Users/liujian/work/006-yhplatform/code/yunhang-platform￾service/cert/dex-client.crt
# enable reflection
reflection: true
connectors:
# 指定账号连接器。这⾥配置的是openldap
- type: ldap
name: OpenLDAP
id: ldap
config:
# The following configurations seem to work with OpenLDAP:
#
# 1) Plain LDAP, without TLS:
host: openldap:1389
insecureNoSSL: true
#
# 2) LDAPS without certificate validation:
#host: localhost:636
#insecureNoSSL: false
#insecureSkipVerify: true
#
# 3) LDAPS with certificate validation:
#host: YOUR-HOSTNAME:636
#insecureNoSSL: false
#insecureSkipVerify: false
#rootCAData: 'CERT'
# ...where CERT
=
"$( base64 -w 0 your-cert.crt )"
# This would normally be a read-only user.
bindDN: cn=admin,dc=example,dc=org
bindPW: adminpassword
usernamePrompt: LDAP ⽤户名
userSearch:
baseDN: ou=users,dc=example,dc=org
filter: "(objectClass=person)"
username: cn
# "DN" (case sensitive) is a special attribute name. It
indicates that
# this value should be taken from the entity's DN not an
attribute on
# the entity.
idAttr: DN
emailAttr: mail
nameAttr: cn
groupSearch:
baseDN: ou=Groups,dc=example,dc=org
filter: "(objectClass=groupOfNames)"
userMatchers:
# A user is a member of a group when their DN matches
# the value of a "member" attribute on the group entity.
- userAttr: DN
groupAttr: member
# The group name should be the "cn" value.
nameAttr: cn
# 超时时间设置
expiry:
deviceRequests: "5m"
signingKeys: "6h"
idTokens: "24h"
refreshTokens:
reuseInterval: "30s"
validIfNotUsedFor: "2160h" # 90 days
absoluteLifetime: "3960h" # 165 days

curl http://localhost:5556/dex/auth/ldap?
client_id=app1&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback&response_t
ype=code&scope=openid+profile+email+federated:id+offline_access+audience:server
:client_id:zadig+audience:server:client_id:app2&state=gHoisYYgsmpc

func TestAuthCode(t *testing.T) {
ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)
defer cancel()
// 连接dex
provider, err := oidc.NewProvider(ctx, "http://localhost:5556/dex")
if err != nil {
t.Error(err)
}
oauth2Config := &oauth2.Config{
ClientID: "app1",
ClientSecret: "app1-secret",
Endpoint: provider.Endpoint(),
RedirectURL: "http://localhost:8080/callback",
Scopes: []string{"openid", "profile", "email", "groups"},
}
// 请求dex的token端点获取token
oauth2Token, err := oauth2Config.Exchange(ctx, authCode)
if err != nil {
t.Error(err)
}
rawIDToken, _ = oauth2Token.Extra("id_token").(string)
t.Logf("accessToken:%v", oauth2Token.AccessToken)
t.Logf("refreshToken:%v", oauth2Token.RefreshToken)
t.Logf("idToken:%v", rawIDToken)
}

func TestIDToken(t *testing.T) {
// 连接dex
provider, err := oidc.NewProvider(ctx, "http://localhost:5556/dex")
if err != nil {
t.Error(err)
}
// 验证idToken
idTokenVerifier := provider.Verifier(&oidc.Config{ClientID: "app1"})
idToken, err := idTokenVerifier.Verify(ctx, rawIDToken)
if err != nil {
t.Error(err)
}
ac := make(map[string]any)
if err := idToken.Claims(ac); err != nil {
t.Error(err)
}
t.Logf("claims:%v", ac)
}

func TestSession(t *testing.T){
sk := "xxxxx" // base64格式的pem私钥
// ⽣成局部会话
accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256,
jwt.StandardClaims{
Subject: "user1",
ExpiresAt: time.Now().Add(time.Hour).Unix(), // Second
})
accessTokenStr, err := accessToken.SignedString([]byte(sk))
if err != nil {
t.Error(err)
}
refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256,
jwt.StandardClaims{
Subject: "user1",
ExpiresAt: time.Now().Add(time.Hour*2).Unix(), // Second
})
refreshTokenStr, err := refreshToken.SignedString([]byte(sk))
if err != nil {
t.Error(err)
}
// 构建全局会话
ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)
defer cancel()
sid := uuid.New().String()
rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})
rc.Set(ctx, sid, map[string]any{
"dex": map[string]any{ // 存储dex信息
"accessToken": "xxxx",
"refreshToken": "xxxx",
"idToken": "xxxx",
},
"local": map[string]string { // 存储局部会话
accessTokenStr: refreshTokenStr,
},
}.Hour)
}

func TestRefreshToken(t *testing.T){
sid := "xxxx" //全局会话
refreshTokenLocal := "xxxxx" // 局部会话的refreshToken
refreshTokenDex := "xxxxx" // dex的refreshToken
// 解析局部会话的refreshToken中的jwt.Cl。重新⽣成accessToken
...
// 获取全局会话
ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)
defer cancel()
sid := uuid.New().String()
rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})
val := make(map[string]any)
err := rc.Get(ctx, sid).Scan(val)
if err != nil {
t.Error(err)
}
// 更新dex的token
oauth2Config := &oauth2.Config{
ClientID: "app1",
ClientSecret: "app1-secret",
Endpoint: provider.Endpoint(),
RedirectURL: "http://localhost:8080/callback",
Scopes: []string{"openid", "profile", "email", "groups"},
}
oauth2Token, err := oauth2Config.TokenSource(ctx,
&oauth2.Token{RefreshToken: ac.Metadata["refreshToken"]}).Token()
if err != nil {
t.Error(err)
}
rawIDToken, _ = oauth2Token.Extra("id_token").(string)
newLocal := val["local"].(map[string]string)
newLocal[newAccessTokenLocal] = newRefreshTokenLocal
// 更新全局会话
rc.Set(ctx, sid, map[string]any{
"dex": map[string]any{ // 存储dex信息
"accessToken": oauth2Token.AccessToken,
"refreshToken": oauth2Token.RefreshToken,
"idToken": rawIDToken,
},
"local": newLocal,
}.Hour)
}

func TestLogout(t *testing.T) {
sid := "xxxxx" // 前端传⼊
ctx, cancel := context.WithTimeout(context.TODO(), time.Second*10)
defer cancel()
rc := redis.NewClient(&redis.Options{Addr: "localhost:6379", DB: 0})
rc.Set(ctx, sid, map[string]any{
"accessToken": accessTokenStr,
"refreshToken": refreshTokenStr,
}, time.Hour)
}

以上就是本期

DEX在SSO中的实践

如果大家感兴趣可以试一试

也欢迎关注云原生的你

加入我们一起讨论哦⬇