module VaultPlugin::Authentication::Chef

Public Instance Methods

authenticate() click to toggle source
# File lib/smart_proxy_vault/authentication/chef.rb, line 37
def authenticate
  begin
    node = chefapi.clients.fetch vault_client
  rescue StandardError => e
    log_halt 401, 'Failed to authenticate to the Chef server: ' + e.message
  end
  log_halt(401, "Could not find Chef client - #{vault_client}") if node.nil?

  rsa = OpenSSL::PKey::RSA.new node.public_key
  decoded_signature = Base64.decode64(signature)
  # The body should contain the public key of the node
  body = Digest::MD5.hexdigest rsa.public_key.to_s

  rsa.verify(OpenSSL::Digest::SHA512.new, decoded_signature, body)
end
authorized?() click to toggle source
# File lib/smart_proxy_vault/authentication/chef.rb, line 14
def authorized?
  logger.info('Starting Chef client authentication for smart_proxy_vault')
  request.env.each do |key,value|
    logger.debug("header #{key}: #{value}")
  end if logger.level == 0

  if vault_client.nil? || signature.nil?
    log_halt 401, "Failed to authenticate Chef client - #{vault_client}. Missing headers."
  end

  unless authenticate
    log_halt 401, "Failed to authenticate Chef client - #{vault_client}. Verification failed."
  end
  logger.info("Successfully authenticated Chef client - #{vault_client}")
end
chefapi() click to toggle source
# File lib/smart_proxy_vault/authentication/chef.rb, line 30
def chefapi
  chefapi_settings = ::VaultPlugin::Plugin.settings.chef
  connection = ::ChefAPI::Connection.new(chefapi_settings)
  connection.ssl_verify = chefapi_settings[:ssl_verify] || false
  connection
end
signature() click to toggle source
# File lib/smart_proxy_vault/authentication/chef.rb, line 10
def signature
  request.env['HTTP_X_VAULT_SIGNATURE'] || request.env['HTTP_X_VAULT_SIGNATURE'].chomp
end
vault_client() click to toggle source
# File lib/smart_proxy_vault/authentication/chef.rb, line 6
def vault_client
  request.env['HTTP_X_VAULT_CLIENT']
end