Add kratos oidc provider secret support (#162)

* zero#203 : Add support for OIDC provider secret and documentation around kratos and oathkeeper

* Add support for creating and using JWKS file for oathkeeper

* Changed oidc comment in kratos values file

* Disable secret loading if user auth is not enabled

* Fixed json structure in oidc docs

* Removed unnecessary comment

Author: bmonkman

templates/Makefile

@@ -6,6 +6,8 @@ export AWS_DEFAULT_REGION = <% index .Params `region` %>
 export AWS_PAGER =
 KUBE_CONTEXT := $(PROJECT)-$(ENVIRONMENT)-$(AWS_DEFAULT_REGION)
 
+.EXPORT_ALL_VARIABLES:
+
 apply: apply-remote-state apply-shared-remote-state apply-secrets apply-shared-env apply-env update-k8s-conf pre-k8s apply-k8s-utils post-apply-setup
 
 apply-remote-state:
@@ -40,12 +42,7 @@ apply-env:
 	terraform apply $(AUTO_APPROVE)
 
 pre-k8s:
-	@aws secretsmanager describe-secret --region $(AWS_DEFAULT_REGION) --secret-id $(PROJECT)-$(ENVIRONMENT)-vpn-wg-privatekey-<% index .Params `randomSeed` %> > /dev/null 2>&1 || ( \
-	echo "Creating VPN private key..." && \
-	kubectl run --context $(KUBE_CONTEXT) -i --tty zero-k8s-utilities --image=commitdev/zero-k8s-utilities:0.0.3 --restart=Never -- wg genkey | \
-	xargs aws secretsmanager create-secret --region $(AWS_DEFAULT_REGION) --name $(PROJECT)-$(ENVIRONMENT)-vpn-wg-privatekey-<% index .Params `randomSeed` %> --description "Auto-generated Wireguard VPN private key" --tags '[{"Key":"wg","Value":"$(PROJECT)-$(ENVIRONMENT)"}]' --secret-string && \
-	kubectl delete --context $(KUBE_CONTEXT) pod/zero-k8s-utilities && \
-	echo "Done VPN private key creation" )
+	cd scripts && sh pre-k8s.sh
 
 apply-k8s-utils:
 	cd kubernetes/terraform/environments/$(ENVIRONMENT) && \
@@ -56,7 +53,7 @@ update-k8s-conf:
 	aws eks --region $(AWS_DEFAULT_REGION) update-kubeconfig --role "arn:aws:iam::<% index .Params `accountId` %>:role/$(PROJECT)-kubernetes-$(ROLE)-$(ENVIRONMENT)" --name $(KUBE_CONTEXT) --alias $(KUBE_CONTEXT)
 
 post-apply-setup:
-	cd scripts && ENVIRONMENT=$(ENVIRONMENT) PROJECT=$(PROJECT) sh post-apply.sh
+	cd scripts && sh post-apply.sh
 
 teardown: teardown-k8s-utils teardown-env teardown-shared-env teardown-secrets teardown-remote-state teardown-shared-remote-state
 

templates/README.md

@@ -95,6 +95,39 @@ A database user will automatically be created for a backend application with a r
 
 _Note: the user creation only happens once during `zero apply`. The creation happens in the script `zero-aws-eks-stack/dp-ops/create-db-user.sh`. This script should most likely not be run again as it could remove any subsequent changes to the db user or kubernetes secret._
 
+#### User management / authentication
+If you initialized your infrastructure with the userAuth parameter, Ory [Kratos][kratos] and [Oathkeeper][oathkeeper] will be configured in the Kubernetes cluster.
+
+Kratos is an OIDC-compliant user management tool, it manages the users in your system, including signup, login, password reset, Single Sign-On, etc.
+Oathkeeper is a zero-trust Identity & Access Proxy which sits in front of your application and handles authentication, passing traffic on to your backend only when a user is logged in, or in cases where you want to expose something publicly.
+
+All these components should be working out of the box and you can style a front-end for Kratos however you like.
+To enable SSO support for Kratos (to log in with Github, Google, etc.) you will need to set up the OIDC providers you want to support. See [the Kratos documentation][kratos-oidc] for a guide.
+
+To specify your provider config you need to create a secret containing your provider configuration in JSON format like so:
+```sh
+kubectl create secret generic oidc-providers -n user-auth  --from-literal=SELFSERVICE_METHODS_OIDC='{"enabled":true,"config":{"providers":[{"id":"github","provider":"github","client_id":"<id>","client_secret":"<secret>","mapper_url":"http://your-url/github.data-mapper.jsonnet","scope":["user:email"]}]}}'
+```
+
+This also requires specifying a mapper file which maps claims from the provider to fields which will be exposed to your app. This must be provided in the `mapper_url` field in the config above. It can be provided as a HTTP URL, a file, or a base64 encoded string.
+Here is a simple example for GitHub:
+```js
+local claims = std.extVar('claims');
+
+{
+  identity: {
+    traits: {
+      email: claims.email, // If email is not set the Jsonnet snippet will fail with an error.
+      [if "website" in claims then "website" else null]: claims.website, // The website claim is optional.
+    },
+  },
+}
+```
+
+Next, edit `kubernetes/terraform/modules/kubernetes/files/kratos-values.yml` and set `deployment.environmentSecretsName` to the name of the secret you created above.
+After restarting kratos, you should see a button appear on the login / signup pages to use the providers you set up.
+
+_Note: Oathkeeper requires a `JWKS` file which should have been created automatically during project setup and saved into a secret in AWS secret manager._
 
 # Resources
 ###  Infrastructure
@@ -150,6 +183,10 @@ make teardown-remote-state
 <!-- Links -->
 [tf-workflow]: https://www.terraform.io/guides/core-workflow.html
 [why-infra-as-code]: https://www.oreilly.com/library/view/terraform-up-and/9781491977071/ch01.html
+[kratos]: https://www.ory.sh/kratos/
+[oathkeeper]: https://www.ory.sh/oathkeeper/
+[kratos-oidc]: https://www.ory.sh/kratos/docs/guides/sign-in-with-github-google-facebook-linkedin
+
 <!-- code -->
 [tf-remote-state]: ./terraform/bootstrap/remote-state
 [tf-secrets]: ./terraform/bootstrap/secrets

templates/kubernetes/terraform/modules/kubernetes/files/kratos-values.yml

@@ -1,6 +1,6 @@
 image:
   repository:  oryd/kratos
-  # tag: v0.4.6-alpha.1-sqlite
+  tag: v0.5.4-alpha.1-sqlite
   pullPolicy: IfNotPresent
 
 ingress:
@@ -26,6 +26,12 @@ ingress:
     tls:
       - secretName: kratos-admin-tls-secret
 
+# To set up OIDC you can uncomment this and create a secret which contains the
+# OIDC provider configuration in JSON format in an env var called SELFSERVICE_METHODS_OIDC
+# See README.md for more info
+# deployment:
+  # environmentSecretsName: secretName
+
 kratos:
   development: false
   autoMigrate: true
@@ -82,26 +88,13 @@ kratos:
       default_schema_url: file:///etc/config/identity.default.schema.json
 
     selfservice:
+      # To set up OIDC (Github, Google login, etc.) the 'oidc' method section can be provided via env var, see the deployment section above
       methods:
         # TODO: Look in to error when this is enabled
         # link:
           # enabled: true
         password:
           enabled: true
-        oidc: # TODO: allow methods to be configured with parameters
-          enabled: true
-          # config:
-          # TODO: use SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS to set via secrets
-          # [{"id":"github","provider":"github","client_id":"id","client_secret":"secret","mapper_url":"http://zombism.ca/github.data-mapper.jsonnet","scope":["user:email"]}]
-            # providers:
-            #   - id: github
-            #     provider: github
-            #     client_id: # TODO: load secret
-            #     client_secret: # TODO : load secret
-            #     # TODO: Change to static or deploy somewhere within infra
-            #     mapper_url: http://zombism.ca/github.data-mapper.jsonnet
-            #     scope:
-            #       - user:email
 
       default_browser_return_url: / # Overridden by user_auth.tf
       whitelisted_return_urls:

templates/kubernetes/terraform/modules/kubernetes/user_auth.tf

@@ -4,7 +4,18 @@ locals {
     "postgres" : "postgres",
     "mysql" : "mysql",
   }
-  db_type = local.type_map[data.aws_db_instance.database.engine]
+  db_type          = local.type_map[data.aws_db_instance.database.engine]
+  jwks_secret_name = "${var.project}-${var.environment}-oathkeeper-jwks-${var.random_seed}" # Created in pre-k8s.sh
+}
+
+## Get generated JWKS content from secret
+data "aws_secretsmanager_secret" "jwks_content" {
+  count = var.auth_enabled ? 1 : 0
+  name  = local.jwks_secret_name
+}
+data "aws_secretsmanager_secret_version" "jwks_content" {
+  count     = var.auth_enabled ? 1 : 0
+  secret_id = data.aws_secretsmanager_secret.jwks_content[0].id
 }
 
 resource "kubernetes_namespace" "user_auth" {
@@ -32,16 +43,10 @@ resource "helm_release" "oathkeeper" {
     value = "https://${var.backend_service_domain}"
   }
 
-  # This will read the local jwks file and
-  # Nope, this won't work. Need to create the secret OOB.
-  # set {
-  #   name  = "oathkeeper.mutatorIdTokenJWKs"
-  #   value = file("${path.module}/files/id_token.jwks.json")
-  # }
-
-  set {
-    name  = "oathkeeper.config.mutators.id_token.config.jwks_url"
-    value = "http://zombism.ca/id_token.jwks.json"
+  # Clean up and set the JWKS content. This will become a secret mounted into the pod
+  set_sensitive {
+    name  = "oathkeeper.mutatorIdTokenJWKs"
+    value = replace(jsonencode(jsondecode(data.aws_secretsmanager_secret_version.jwks_content[0].secret_string)), "/([,\\[\\]{}])/", "\\$1")
   }
 
   set {
@@ -206,9 +211,9 @@ resource "helm_release" "kratos" {
 data "template_file" "oathkeeper_kratos_proxy_rules" {
   template = file("${path.module}/files/oathkeeper_kratos_proxy_rules.yaml.tpl")
   vars = {
-    backend_service_domain = var.backend_service_domain
+    backend_service_domain    = var.backend_service_domain
     public_selfserve_endpoint = "/.ory/kratos/public"
-    admin_selfserve_endpoint = "/.ory/kratos"
+    admin_selfserve_endpoint  = "/.ory/kratos"
   }
 }
 

templates/scripts/pre-k8s.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+ZERO_K8S_UTILS_VERSION=0.0.3
+OATHKEEPER_VERSION=v0.38.4-beta.1-alpine
+
+VPN_SECRET_NAME=${PROJECT}-${ENVIRONMENT}-vpn-wg-privatekey-<% index .Params `randomSeed` %>
+OATHKEEPER_SECRET_NAME=${PROJECT}-${ENVIRONMENT}-oathkeeper-jwks-<% index .Params `randomSeed` %>
+
+# Create VPN private key if the secret doesn't already exist
+aws secretsmanager describe-secret --region ${AWS_DEFAULT_REGION} --secret-id ${VPN_SECRET_NAME} > /dev/null 2>&1
+if [[ $? -ne 0 ]]; then
+    echo "Creating VPN private key..."
+    secret=$(kubectl run --rm --quiet --attach=true --context ${KUBE_CONTEXT} zero-k8s-utilities --image=commitdev/zero-k8s-utilities:${ZERO_K8S_UTILS_VERSION} --restart=Never -- wg genkey)
+    aws secretsmanager create-secret --region ${AWS_DEFAULT_REGION} --name ${VPN_SECRET_NAME} --description "Auto-generated Wireguard VPN private key" --tags "[{\"Key\":\"wg\",\"Value\":\"${PROJECT}-${ENVIRONMENT}\"}]" --secret-string "${secret}"
+
+    if [[ $? -eq 0 ]]; then
+        echo "Done VPN private key creation"
+    fi
+fi
+
+<% if eq (index .Params `userAuth`) "yes" %>
+# Create oathkeeper JWKS file if the secret doesn't already exist
+aws secretsmanager describe-secret --region ${AWS_DEFAULT_REGION} --secret-id ${OATHKEEPER_SECRET_NAME} > /dev/null 2>&1
+if [[ $? -ne 0 ]]; then
+    echo "Creating Oathkeeper JWKS file..."
+    secret=$(kubectl run --rm --quiet --attach=true --context ${KUBE_CONTEXT} oathkeeper --image=oryd/oathkeeper:${OATHKEEPER_VERSION} --restart=Never -- credentials generate --alg RS256)
+    aws secretsmanager create-secret --region ${AWS_DEFAULT_REGION} --name ${OATHKEEPER_SECRET_NAME} --description "Auto-generated Oathkeeper JWKS file" --tags "[{\"Key\":\"oathkeeper-jwks\",\"Value\":\"${PROJECT}-${ENVIRONMENT}\"}]" --secret-string "${secret}"
+    if [[ $? -eq 0 ]]; then
+        echo "Done Oathkeeper JWKS file creation..."
+    fi
+fi
+<% end %>