rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Inline OAuth2 signing key in config

Browse Source 
The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.

The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.

Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-04-21 17:56:00 +02:00
parent a622c610d7
commit c4e81ed092
12 changed files with 288 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
pkg/bootstrap/builder.go
View File

@@ -26,9 +26,10 @@ import (
type EnvGetter func(key string) string
type Builder struct {
getEnv EnvGetter
samlCertificate string
samlPrivateKey string
getEnv EnvGetter
samlCertificate string
samlPrivateKey string
oauth2SigningKey string
}
func NewBuilder(getEnv EnvGetter) *Builder {
@@ -48,6 +49,8 @@ func (b *Builder) Build() (*probod.FullConfig, error) {
return nil, fmt.Errorf("cannot get SAML credentials: %w", err)
}
oauth2SigningKey := b.getOAuth2SigningKey()
pgCACertBundle := b.getPgCACertBundle()
cfg := &probod.FullConfig{
@@ -120,6 +123,17 @@ func (b *Builder) Build() (*probod.FullConfig, error) {
ClientSecret: b.getEnv("AUTH_MICROSOFT_CLIENT_SECRET"),
Enabled: b.getEnv("AUTH_MICROSOFT_CLIENT_ID") != "" && b.getEnv("AUTH_MICROSOFT_CLIENT_SECRET") != "",
},
OAuth2Server: probod.OAuth2ServerConfig{
SigningKeys: []probod.OAuth2SigningKeyConfig{{
PrivateKey: oauth2SigningKey,
KID: b.getEnvOrDefault("OAUTH2_SERVER_SIGNING_KEY_KID", "default"),
Active: true,
}},
AccessTokenDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_ACCESS_TOKEN_DURATION", 3600),
RefreshTokenDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_REFRESH_TOKEN_DURATION", 2592000),
AuthorizationCodeDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_AUTHORIZATION_CODE_DURATION", 600),
DeviceCodeDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_DEVICE_CODE_DURATION", 600),
},
},
TrustCenter: probod.TrustCenterConfig{
HTTPAddr: b.getEnvOrDefault("TRUST_CENTER_HTTP_ADDR", ":80"),
@@ -323,6 +337,10 @@ func (b *Builder) validateRequired() error {
}
}
if b.oauth2SigningKey == "" && b.getEnv("OAUTH2_SERVER_SIGNING_KEY") == "" {
missing = append(missing, "OAUTH2_SERVER_SIGNING_KEY")
}
if slackClientID := b.getEnv("CONNECTOR_SLACK_CLIENT_ID"); slackClientID != "" {
slackRequired := []string{
"CONNECTOR_SLACK_CLIENT_SECRET",
@@ -388,6 +406,13 @@ func (b *Builder) getSAMLCredentials() (cert, key string, err error) {
return cert, key, nil
}
func (b *Builder) getOAuth2SigningKey() string {
if b.oauth2SigningKey != "" {
return b.oauth2SigningKey
}
return b.getEnv("OAUTH2_SERVER_SIGNING_KEY")
}
func (b *Builder) getPgCACertBundle() string {
if path := b.getEnv("PG_CA_BUNDLE_PATH"); path != "" {
data, err := os.ReadFile(path)

76
pkg/bootstrap/builder_test.go
View File

@@ -32,9 +32,10 @@ func mockEnv(env map[string]string) EnvGetter {
func requiredEnv() map[string]string {
return map[string]string{
"PROBOD_ENCRYPTION_KEY": "test-encryption-key-32-bytes-long",
"AUTH_COOKIE_SECRET": "test-cookie-secret-32-bytes-long!",
"AUTH_PASSWORD_PEPPER": "test-password-pepper-32-bytes-lo",
"PROBOD_ENCRYPTION_KEY": "test-encryption-key-32-bytes-long",
"AUTH_COOKIE_SECRET": "test-cookie-secret-32-bytes-long!",
"AUTH_PASSWORD_PEPPER": "test-password-pepper-32-bytes-lo",
"OAUTH2_SERVER_SIGNING_KEY": "test-oauth2-signing-key",
}
}
@@ -47,7 +48,16 @@ func TestBuilder_Build_MissingRequiredEnvVars(t *testing.T) {
{
name: "all missing",
env: map[string]string{},
wantMissing: []string{"PROBOD_ENCRYPTION_KEY", "AUTH_COOKIE_SECRET", "AUTH_PASSWORD_PEPPER"},
wantMissing: []string{"PROBOD_ENCRYPTION_KEY", "AUTH_COOKIE_SECRET", "AUTH_PASSWORD_PEPPER", "OAUTH2_SERVER_SIGNING_KEY"},
},
{
name: "missing oauth2 signing key",
env: map[string]string{
"PROBOD_ENCRYPTION_KEY": "key",
"AUTH_COOKIE_SECRET": "secret",
"AUTH_PASSWORD_PEPPER": "pepper",
},
wantMissing: []string{"OAUTH2_SERVER_SIGNING_KEY"},
},
{
name: "missing encryption key",
@@ -415,6 +425,64 @@ func TestBuilder_Build_SAMLPreset(t *testing.T) {
assert.Equal(t, "preset-key", cfg.Probod.Auth.SAML.PrivateKey)
}
func TestBuilder_Build_OAuth2Defaults(t *testing.T) {
b := NewBuilder(mockEnv(requiredEnv()))
cfg, err := b.Build()
require.NoError(t, err)
require.Len(t, cfg.Probod.Auth.OAuth2Server.SigningKeys, 1)
sk := cfg.Probod.Auth.OAuth2Server.SigningKeys[0]
assert.Equal(t, "test-oauth2-signing-key", sk.PrivateKey)
assert.Equal(t, "default", sk.KID)
assert.True(t, sk.Active)
assert.Equal(t, 3600, cfg.Probod.Auth.OAuth2Server.AccessTokenDuration)
assert.Equal(t, 2592000, cfg.Probod.Auth.OAuth2Server.RefreshTokenDuration)
assert.Equal(t, 600, cfg.Probod.Auth.OAuth2Server.AuthorizationCodeDuration)
assert.Equal(t, 600, cfg.Probod.Auth.OAuth2Server.DeviceCodeDuration)
}
func TestBuilder_Build_OAuth2FromEnv(t *testing.T) {
env := requiredEnv()
env["OAUTH2_SERVER_SIGNING_KEY"] = "env-signing-key"
env["OAUTH2_SERVER_SIGNING_KEY_KID"] = "env-kid"
env["OAUTH2_SERVER_ACCESS_TOKEN_DURATION"] = "10"
env["OAUTH2_SERVER_REFRESH_TOKEN_DURATION"] = "20"
env["OAUTH2_SERVER_AUTHORIZATION_CODE_DURATION"] = "30"
env["OAUTH2_SERVER_DEVICE_CODE_DURATION"] = "40"
b := NewBuilder(mockEnv(env))
cfg, err := b.Build()
require.NoError(t, err)
require.Len(t, cfg.Probod.Auth.OAuth2Server.SigningKeys, 1)
sk := cfg.Probod.Auth.OAuth2Server.SigningKeys[0]
assert.Equal(t, "env-signing-key", sk.PrivateKey)
assert.Equal(t, "env-kid", sk.KID)
assert.True(t, sk.Active)
assert.Equal(t, 10, cfg.Probod.Auth.OAuth2Server.AccessTokenDuration)
assert.Equal(t, 20, cfg.Probod.Auth.OAuth2Server.RefreshTokenDuration)
assert.Equal(t, 30, cfg.Probod.Auth.OAuth2Server.AuthorizationCodeDuration)
assert.Equal(t, 40, cfg.Probod.Auth.OAuth2Server.DeviceCodeDuration)
}
func TestBuilder_Build_OAuth2Preset(t *testing.T) {
env := requiredEnv()
delete(env, "OAUTH2_SERVER_SIGNING_KEY")
b := NewBuilder(mockEnv(env))
b.oauth2SigningKey = "preset-signing-key"
cfg, err := b.Build()
require.NoError(t, err)
require.Len(t, cfg.Probod.Auth.OAuth2Server.SigningKeys, 1)
assert.Equal(t, "preset-signing-key", cfg.Probod.Auth.OAuth2Server.SigningKeys[0].PrivateKey)
}
func TestBuilder_Build_PgCABundleFromEnv(t *testing.T) {
env := requiredEnv()
env["PG_CA_BUNDLE"] = "test-ca-bundle-content"

41
pkg/bootstrap/oauth2.go Normal file
View File

@@ -0,0 +1,41 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package bootstrap
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"encoding/pem"
"fmt"
)
const oauth2SigningKeyBits = 2048
// GenerateOAuth2SigningKey returns a freshly generated 2048-bit RSA
// private key PKCS#1-encoded as PEM.
func GenerateOAuth2SigningKey() (string, error) {
privateKey, err := rsa.GenerateKey(rand.Reader, oauth2SigningKeyBits)
if err != nil {
return "", fmt.Errorf("generate RSA key: %w", err)
}
keyPEM := pem.EncodeToMemory(&pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
})
return string(keyPEM), nil
}

52
pkg/bootstrap/oauth2_test.go Normal file
View File

@@ -0,0 +1,52 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package bootstrap
import (
"crypto/x509"
"encoding/pem"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestGenerateOAuth2SigningKey(t *testing.T) {
t.Parallel()
key, err := GenerateOAuth2SigningKey()
require.NoError(t, err)
block, _ := pem.Decode([]byte(key))
require.NotNil(t, block, "private key should be valid PEM")
assert.Equal(t, "RSA PRIVATE KEY", block.Type)
parsed, err := x509.ParsePKCS1PrivateKey(block.Bytes)
require.NoError(t, err)
assert.Equal(t, oauth2SigningKeyBits, parsed.N.BitLen())
}
func TestGenerateOAuth2SigningKey_Unique(t *testing.T) {
t.Parallel()
key1, err := GenerateOAuth2SigningKey()
require.NoError(t, err)
key2, err := GenerateOAuth2SigningKey()
require.NoError(t, err)
assert.NotEqual(t, key1, key2)
}

6
pkg/probod/auth_config.go
View File

@@ -41,9 +41,9 @@ type OAuth2ServerConfig struct {
}
type OAuth2SigningKeyConfig struct {
KeyFile string `json:"key-file"`
KID string `json:"kid"`
Active bool `json:"active"`
PrivateKey string `json:"private-key"`
KID string `json:"kid"`
Active bool `json:"active"`
}
type CookieConfig struct {

8
pkg/probod/probod.go
View File

@@ -25,7 +25,6 @@ import (
"fmt"
"net"
"net/http"
"os"
"strings"
"sync"
"time"
@@ -389,12 +388,7 @@ func (impl *Implm) Run(
var oauth2SigningKeys oauth2server.SigningKeys
var hasActive bool
for _, keyCfg := range impl.cfg.Auth.OAuth2Server.SigningKeys {
keyPEM, err := os.ReadFile(keyCfg.KeyFile)
if err != nil {
return fmt.Errorf("cannot read OAuth2 server signing key file: %w", err)
}
signer, err := pemutil.DecodePrivateKey(keyPEM)
signer, err := pemutil.DecodePrivateKey([]byte(keyCfg.PrivateKey))
if err != nil {
return fmt.Errorf("cannot decode OAuth2 server signing key: %w", err)
}