mirror of
https://github.com/zitadel/zitadel.git
synced 2026-07-25 18:28:00 +00:00
Livio SpringandGitHub
1e0b810dca
# Which Problems Are Solved Zitadel exposes the secrets generator configuration through its admin api. This allows instance admins to manage them on their own and they can create overwrite the system / runtime defaults (incl. expiration). This very much needed in multi-instance scenarios such as zitadel.cloud. Currently the invite code configuration was not manageable through the API, but only runtime config. # How the Problems Are Solved - added the `invite_code` type to the API allowing it to be set and retrieved. - added the type to console's management list - added the type to be stored on instance setup - change the `GetSecretGenerator` endpoint to fall back to the runtime config if no config is stored on the instance itself - ensure the `length` and at least one charset is enabled, return an error otherwise - expiry is not enforced, so 0 allows codes with no expiry (current state) # Additional Changes None # Additional Context - closes https://github.com/zitadel/zitadel/issues/10474
852 lines
31 KiB
Go
852 lines
31 KiB
Go
package start
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
_ "embed"
|
|
"errors"
|
|
"fmt"
|
|
"math"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"slices"
|
|
"syscall"
|
|
"time"
|
|
|
|
clockpkg "github.com/benbjohnson/clock"
|
|
"github.com/common-nighthawk/go-figure"
|
|
"github.com/fatih/color"
|
|
"github.com/gorilla/mux"
|
|
"github.com/spf13/cobra"
|
|
"github.com/spf13/viper"
|
|
"github.com/zitadel/oidc/v3/pkg/op"
|
|
"github.com/zitadel/saml/pkg/provider"
|
|
"golang.org/x/net/http2"
|
|
"golang.org/x/net/http2/h2c"
|
|
"golang.org/x/text/language"
|
|
|
|
new_domain "github.com/zitadel/zitadel/backend/v3/domain"
|
|
"github.com/zitadel/zitadel/backend/v3/instrumentation/logging"
|
|
v3_postgres "github.com/zitadel/zitadel/backend/v3/storage/database/dialect/postgres"
|
|
"github.com/zitadel/zitadel/cmd/build"
|
|
"github.com/zitadel/zitadel/cmd/encryption"
|
|
"github.com/zitadel/zitadel/cmd/key"
|
|
cmd_tls "github.com/zitadel/zitadel/cmd/tls"
|
|
"github.com/zitadel/zitadel/internal/actions"
|
|
admin_es "github.com/zitadel/zitadel/internal/admin/repository/eventsourcing"
|
|
"github.com/zitadel/zitadel/internal/api"
|
|
"github.com/zitadel/zitadel/internal/api/assets"
|
|
internal_authz "github.com/zitadel/zitadel/internal/api/authz"
|
|
action_v2 "github.com/zitadel/zitadel/internal/api/grpc/action/v2"
|
|
action_v2_beta "github.com/zitadel/zitadel/internal/api/grpc/action/v2beta"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/admin"
|
|
app_v2beta "github.com/zitadel/zitadel/internal/api/grpc/app/v2beta"
|
|
application "github.com/zitadel/zitadel/internal/api/grpc/application/v2"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/auth"
|
|
authorization_v2 "github.com/zitadel/zitadel/internal/api/grpc/authorization/v2"
|
|
authorization_v2beta "github.com/zitadel/zitadel/internal/api/grpc/authorization/v2beta"
|
|
feature_v2 "github.com/zitadel/zitadel/internal/api/grpc/feature/v2"
|
|
feature_v2beta "github.com/zitadel/zitadel/internal/api/grpc/feature/v2beta"
|
|
group_v2 "github.com/zitadel/zitadel/internal/api/grpc/group/v2"
|
|
idp_v2 "github.com/zitadel/zitadel/internal/api/grpc/idp/v2"
|
|
instance_v2 "github.com/zitadel/zitadel/internal/api/grpc/instance/v2"
|
|
instance_v2beta "github.com/zitadel/zitadel/internal/api/grpc/instance/v2beta"
|
|
internal_permission_v2 "github.com/zitadel/zitadel/internal/api/grpc/internal_permission/v2"
|
|
internal_permission_v2beta "github.com/zitadel/zitadel/internal/api/grpc/internal_permission/v2beta"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/management"
|
|
oidc_v2 "github.com/zitadel/zitadel/internal/api/grpc/oidc/v2"
|
|
oidc_v2beta "github.com/zitadel/zitadel/internal/api/grpc/oidc/v2beta"
|
|
org_v2 "github.com/zitadel/zitadel/internal/api/grpc/org/v2"
|
|
org_v2beta "github.com/zitadel/zitadel/internal/api/grpc/org/v2beta"
|
|
project_v2 "github.com/zitadel/zitadel/internal/api/grpc/project/v2"
|
|
project_v2beta "github.com/zitadel/zitadel/internal/api/grpc/project/v2beta"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/resources/debug_events/debug_events"
|
|
user_v3_alpha "github.com/zitadel/zitadel/internal/api/grpc/resources/user/v3alpha"
|
|
userschema_v3_alpha "github.com/zitadel/zitadel/internal/api/grpc/resources/userschema/v3alpha"
|
|
saml_v2 "github.com/zitadel/zitadel/internal/api/grpc/saml/v2"
|
|
session_v2 "github.com/zitadel/zitadel/internal/api/grpc/session/v2"
|
|
session_v2beta "github.com/zitadel/zitadel/internal/api/grpc/session/v2beta"
|
|
settings_v2 "github.com/zitadel/zitadel/internal/api/grpc/settings/v2"
|
|
settings_v2beta "github.com/zitadel/zitadel/internal/api/grpc/settings/v2beta"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/system"
|
|
user_v2 "github.com/zitadel/zitadel/internal/api/grpc/user/v2"
|
|
user_v2beta "github.com/zitadel/zitadel/internal/api/grpc/user/v2beta"
|
|
webkey_v2 "github.com/zitadel/zitadel/internal/api/grpc/webkey/v2"
|
|
webkey_v2beta "github.com/zitadel/zitadel/internal/api/grpc/webkey/v2beta"
|
|
http_util "github.com/zitadel/zitadel/internal/api/http"
|
|
"github.com/zitadel/zitadel/internal/api/http/middleware"
|
|
"github.com/zitadel/zitadel/internal/api/idp"
|
|
"github.com/zitadel/zitadel/internal/api/oidc"
|
|
"github.com/zitadel/zitadel/internal/api/robots_txt"
|
|
"github.com/zitadel/zitadel/internal/api/saml"
|
|
"github.com/zitadel/zitadel/internal/api/scim"
|
|
"github.com/zitadel/zitadel/internal/api/scim/schemas"
|
|
"github.com/zitadel/zitadel/internal/api/ui/console"
|
|
"github.com/zitadel/zitadel/internal/api/ui/console/path"
|
|
"github.com/zitadel/zitadel/internal/api/ui/login"
|
|
auth_es "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing"
|
|
"github.com/zitadel/zitadel/internal/authz"
|
|
authz_repo "github.com/zitadel/zitadel/internal/authz/repository"
|
|
authz_es "github.com/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore"
|
|
"github.com/zitadel/zitadel/internal/cache"
|
|
"github.com/zitadel/zitadel/internal/cache/connector"
|
|
"github.com/zitadel/zitadel/internal/command"
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
cryptoDB "github.com/zitadel/zitadel/internal/crypto/database"
|
|
"github.com/zitadel/zitadel/internal/database"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/domain/federatedlogout"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
old_es "github.com/zitadel/zitadel/internal/eventstore/repository/sql"
|
|
new_es "github.com/zitadel/zitadel/internal/eventstore/v3"
|
|
"github.com/zitadel/zitadel/internal/execution"
|
|
"github.com/zitadel/zitadel/internal/i18n"
|
|
"github.com/zitadel/zitadel/internal/id"
|
|
"github.com/zitadel/zitadel/internal/integration/sink"
|
|
"github.com/zitadel/zitadel/internal/logstore"
|
|
"github.com/zitadel/zitadel/internal/logstore/emitters/access"
|
|
emit_execution "github.com/zitadel/zitadel/internal/logstore/emitters/execution"
|
|
emit_stdout "github.com/zitadel/zitadel/internal/logstore/emitters/stdout"
|
|
"github.com/zitadel/zitadel/internal/logstore/record"
|
|
"github.com/zitadel/zitadel/internal/net"
|
|
"github.com/zitadel/zitadel/internal/notification"
|
|
"github.com/zitadel/zitadel/internal/query"
|
|
"github.com/zitadel/zitadel/internal/queue"
|
|
"github.com/zitadel/zitadel/internal/serviceping"
|
|
"github.com/zitadel/zitadel/internal/static"
|
|
es_v4 "github.com/zitadel/zitadel/internal/v2/eventstore"
|
|
es_v4_pg "github.com/zitadel/zitadel/internal/v2/eventstore/postgres"
|
|
"github.com/zitadel/zitadel/internal/webauthn"
|
|
"github.com/zitadel/zitadel/openapi"
|
|
)
|
|
|
|
func New(server chan<- *Server) *cobra.Command {
|
|
start := &cobra.Command{
|
|
Use: "start",
|
|
Short: "starts ZITADEL instance",
|
|
Long: `starts ZITADEL.
|
|
Requirements:
|
|
- postgreSQL`,
|
|
RunE: func(cmd *cobra.Command, args []string) (err error) {
|
|
defer func() {
|
|
logging.OnError(cmd.Context(), err).Error("zitadel start command failed")
|
|
}()
|
|
|
|
err = cmd_tls.ModeFromFlag(cmd)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
config, shutdown, err := NewConfig(cmd, viper.GetViper())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer func() {
|
|
err = errors.Join(err, shutdown(cmd.Context()))
|
|
}()
|
|
|
|
masterKey, err := key.MasterKey(cmd)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return startZitadel(cmd.Context(), config, masterKey, server)
|
|
},
|
|
}
|
|
|
|
startFlags(start)
|
|
|
|
return start
|
|
}
|
|
|
|
type Server struct {
|
|
Config *Config
|
|
DB *database.DB
|
|
KeyStorage crypto.KeyStorage
|
|
Keys *encryption.EncryptionKeys
|
|
Eventstore *eventstore.Eventstore
|
|
Queries *query.Queries
|
|
AuthzRepo authz_repo.Repository
|
|
Storage static.Storage
|
|
Commands *command.Commands
|
|
Router *mux.Router
|
|
TLSConfig *tls.Config
|
|
Shutdown chan<- os.Signal
|
|
}
|
|
|
|
func startZitadel(ctx context.Context, config *Config, masterKey string, server chan<- *Server) error {
|
|
showBasicInformation(config)
|
|
|
|
i18n.MustLoadSupportedLanguagesFromDir()
|
|
|
|
dbClient, err := database.Connect(config.Database, false)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot start DB client for queries: %w", err)
|
|
}
|
|
new_domain.SetPool(v3_postgres.PGxPool(dbClient.Pool))
|
|
|
|
keyStorage, err := cryptoDB.NewKeyStorage(dbClient, masterKey)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot start key storage: %w", err)
|
|
}
|
|
keys, err := encryption.EnsureEncryptionKeys(ctx, config.EncryptionKeys, keyStorage)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
q, err := queue.NewQueue(&queue.Config{
|
|
Client: dbClient,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
config.Eventstore.Pusher = new_es.NewEventstore(dbClient, new_es.WithExecutionQueueOption(q))
|
|
config.Eventstore.Searcher = new_es.NewEventstore(dbClient, new_es.WithExecutionQueueOption(q))
|
|
config.Eventstore.Querier = old_es.NewPostgres(dbClient)
|
|
eventstoreClient := eventstore.NewEventstore(config.Eventstore)
|
|
eventstoreV4 := es_v4.NewEventstoreFromOne(es_v4_pg.New(dbClient, &es_v4_pg.Config{
|
|
MaxRetries: config.Eventstore.MaxRetries,
|
|
}))
|
|
|
|
new_domain.SetLegacyEventstore(eventstoreClient)
|
|
new_domain.SetSystemConfig(config.SystemDefaults)
|
|
new_domain.SetIDPEncryptionAlgorithm(keys.IDPConfig)
|
|
new_domain.SetMFAEncryptionAlgorithm(keys.OTP)
|
|
new_domain.SetOTPSMSSecretGeneratorConfig(config.DefaultInstance.SecretGenerators.OTPSMS)
|
|
new_domain.SetOTPEmailSecretGeneratorConfig(config.DefaultInstance.SecretGenerators.OTPEmail)
|
|
|
|
sessionTokenVerifier := internal_authz.SessionTokenVerifier(keys.OIDC)
|
|
sessionTokenDecryptor := internal_authz.SessionTokenDecryptor(keys.OIDC)
|
|
new_domain.SetSessionTokenDecryptor(sessionTokenDecryptor)
|
|
cacheConnectors, err := connector.StartConnectors(config.Caches, dbClient)
|
|
if err != nil {
|
|
return fmt.Errorf("unable to start caches: %w", err)
|
|
}
|
|
|
|
queries, err := query.StartQueries(
|
|
ctx,
|
|
eventstoreClient,
|
|
eventstoreV4.Querier,
|
|
dbClient,
|
|
dbClient,
|
|
cacheConnectors,
|
|
config.Projections,
|
|
config.SystemDefaults,
|
|
keys.IDPConfig,
|
|
keys.OTP,
|
|
keys.OIDC,
|
|
keys.SAML,
|
|
keys.Target,
|
|
keys.SMS,
|
|
keys.SMTP,
|
|
config.InternalAuthZ.RolePermissionMappings,
|
|
sessionTokenVerifier,
|
|
func(q *query.Queries) domain.PermissionCheck {
|
|
return func(ctx context.Context, permission, orgID, resourceID string) (err error) {
|
|
return internal_authz.CheckPermission(ctx, &authz_es.UserMembershipRepo{Queries: q}, config.SystemAuthZ.RolePermissionMappings, config.InternalAuthZ.RolePermissionMappings, permission, orgID, resourceID)
|
|
}
|
|
},
|
|
config.AuditLogRetention,
|
|
config.SystemAPIUsers,
|
|
true,
|
|
config.DefaultInstance.SecretGenerators.ToMap(),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot start queries: %w", err)
|
|
}
|
|
|
|
authZRepo, err := authz.Start(queries, eventstoreClient, dbClient, keys.OIDC, config.ExternalSecure)
|
|
if err != nil {
|
|
return fmt.Errorf("error starting authz repo: %w", err)
|
|
}
|
|
permissionCheck := func(ctx context.Context, permission, orgID, resourceID string) (err error) {
|
|
return internal_authz.CheckPermission(ctx, authZRepo, config.SystemAuthZ.RolePermissionMappings, config.InternalAuthZ.RolePermissionMappings, permission, orgID, resourceID)
|
|
}
|
|
|
|
storage, err := config.AssetStorage.NewStorage(dbClient.DB)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot start asset storage client: %w", err)
|
|
}
|
|
webAuthNConfig := &webauthn.Config{
|
|
DisplayName: config.WebAuthNName,
|
|
ExternalSecure: config.ExternalSecure,
|
|
}
|
|
|
|
new_domain.SetWebAuthNConfig(webAuthNConfig)
|
|
|
|
httpClient := config.HTTPClient.NewClient()
|
|
|
|
commands, err := command.StartCommands(ctx,
|
|
eventstoreClient,
|
|
cacheConnectors,
|
|
config.SystemDefaults,
|
|
config.InternalAuthZ.RolePermissionMappings,
|
|
storage,
|
|
webAuthNConfig,
|
|
config.ExternalDomain,
|
|
config.ExternalSecure,
|
|
config.ExternalPort,
|
|
keys.IDPConfig,
|
|
keys.OTP,
|
|
keys.SMTP,
|
|
keys.SMS,
|
|
keys.User,
|
|
keys.DomainVerification,
|
|
keys.SAML,
|
|
keys.Target,
|
|
keys.OIDC,
|
|
httpClient,
|
|
permissionCheck,
|
|
sessionTokenVerifier,
|
|
config.OIDC.DefaultAccessTokenLifetime,
|
|
config.OIDC.DefaultRefreshTokenExpiration,
|
|
config.OIDC.DefaultRefreshTokenIdleExpiration,
|
|
config.DefaultInstance.SecretGenerators,
|
|
config.Login.DefaultPaths,
|
|
config.HTTPClient.DenyList,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot start commands: %w", err)
|
|
}
|
|
defer commands.Close(ctx) // wait for background jobs
|
|
|
|
// sink Server is stubbed out in production builds, see function's godoc.
|
|
closeSink := sink.StartServer(commands)
|
|
defer closeSink()
|
|
|
|
clock := clockpkg.New()
|
|
actionsExecutionStdoutEmitter, err := logstore.NewEmitter(ctx, clock, &logstore.EmitterConfig{Enabled: config.LogStore.Execution.Stdout.Enabled}, emit_stdout.NewStdoutEmitter[*record.ExecutionLog]())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
actionsExecutionDBEmitter, err := logstore.NewEmitter(ctx, clock, config.Quotas.Execution, emit_execution.NewDatabaseLogStorage(dbClient, commands, queries))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
actionsLogstoreSvc := logstore.New(queries, actionsExecutionDBEmitter, actionsExecutionStdoutEmitter)
|
|
actions.SetLogstoreService(actionsLogstoreSvc)
|
|
|
|
notification.Register(
|
|
ctx,
|
|
config.Projections.Customizations["notifications"],
|
|
config.Projections.Customizations["notificationsquotas"],
|
|
config.Projections.Customizations["backchannel"],
|
|
config.Projections.Customizations["telemetry"],
|
|
config.Notifications,
|
|
config.OIDC.BackChannelLogoutConfig(),
|
|
*config.Telemetry,
|
|
config.ExternalDomain,
|
|
config.ExternalPort,
|
|
config.ExternalSecure,
|
|
commands,
|
|
queries,
|
|
eventstoreClient,
|
|
config.Login.DefaultPaths.DefaultOTPEmailURLTemplate,
|
|
config.SystemDefaults.Notifications.FileSystemPath,
|
|
keys.User,
|
|
keys.SMTP,
|
|
keys.SMS,
|
|
q,
|
|
httpClient,
|
|
)
|
|
notification.Start(ctx)
|
|
|
|
execution.Register(
|
|
ctx,
|
|
config.Executions,
|
|
httpClient,
|
|
q,
|
|
keys.Target,
|
|
queries.GetActiveSigningWebKey,
|
|
)
|
|
execution.Start(ctx)
|
|
|
|
// the service ping and it's workers need to be registered before starting the queue
|
|
if err := serviceping.Register(ctx, q, queries, eventstoreClient, config.ServicePing); err != nil {
|
|
return err
|
|
}
|
|
|
|
if err = q.Start(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
// the scheduler / periodic jobs need to be started after the queue already runs
|
|
if err = serviceping.Start(ctx, config.ServicePing, q); err != nil {
|
|
return err
|
|
}
|
|
|
|
router := mux.NewRouter()
|
|
tlsConfig, err := config.TLS.Config()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
api, err := startAPIs(
|
|
ctx,
|
|
clock,
|
|
router,
|
|
commands,
|
|
queries,
|
|
eventstoreClient,
|
|
dbClient,
|
|
config,
|
|
storage,
|
|
authZRepo,
|
|
keys,
|
|
permissionCheck,
|
|
cacheConnectors,
|
|
httpClient,
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
commands.GrpcMethodExisting = checkExisting(api.ListGrpcMethods())
|
|
commands.GrpcServiceExisting = checkExisting(api.ListGrpcServices())
|
|
|
|
shutdown := make(chan os.Signal, 1)
|
|
signal.Notify(shutdown, os.Interrupt, syscall.SIGTERM)
|
|
|
|
if server != nil {
|
|
server <- &Server{
|
|
Config: config,
|
|
DB: dbClient,
|
|
KeyStorage: keyStorage,
|
|
Keys: keys,
|
|
Eventstore: eventstoreClient,
|
|
Queries: queries,
|
|
AuthzRepo: authZRepo,
|
|
Storage: storage,
|
|
Commands: commands,
|
|
Router: router,
|
|
TLSConfig: tlsConfig,
|
|
Shutdown: shutdown,
|
|
}
|
|
close(server)
|
|
}
|
|
|
|
return listen(ctx, router, config.Port, tlsConfig, shutdown)
|
|
}
|
|
|
|
func startAPIs(
|
|
ctx context.Context,
|
|
clock clockpkg.Clock,
|
|
router *mux.Router,
|
|
commands *command.Commands,
|
|
queries *query.Queries,
|
|
eventstore *eventstore.Eventstore,
|
|
dbClient *database.DB,
|
|
config *Config,
|
|
store static.Storage,
|
|
authZRepo authz_repo.Repository,
|
|
keys *encryption.EncryptionKeys,
|
|
permissionCheck domain.PermissionCheck,
|
|
cacheConnectors connector.Connectors,
|
|
httpClient *http.Client,
|
|
) (*api.API, error) {
|
|
repo := struct {
|
|
authz_repo.Repository
|
|
*query.Queries
|
|
}{
|
|
authZRepo,
|
|
queries,
|
|
}
|
|
oidcPrefixes := []string{"/.well-known/openid-configuration", "/oidc/v1", "/oauth/v2"}
|
|
router.Use(
|
|
middleware.FallbackRecoverHandler(),
|
|
// always set the origin in the context if available in the http headers, no matter for what protocol
|
|
middleware.WithOrigin(config.ExternalSecure, config.HTTP1HostHeader, config.HTTP2HostHeader, config.InstanceHostHeaders, config.PublicHostHeaders),
|
|
)
|
|
systemTokenVerifier, err := internal_authz.StartSystemTokenVerifierFromConfig(http_util.BuildHTTP(config.ExternalDomain, config.ExternalPort, config.ExternalSecure), config.SystemAPIUsers)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
accessTokenVerifer := internal_authz.StartAccessTokenVerifierFromRepo(repo)
|
|
verifier := internal_authz.StartAPITokenVerifier(repo, accessTokenVerifer, systemTokenVerifier)
|
|
tlsConfig, err := config.TLS.Config()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
accessStdoutEmitter, err := logstore.NewEmitter(ctx, clock, &logstore.EmitterConfig{Enabled: config.LogStore.Access.Stdout.Enabled}, emit_stdout.NewStdoutEmitter[*record.AccessLog]())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
accessDBEmitter, err := logstore.NewEmitter(ctx, clock, &config.Quotas.Access.EmitterConfig, access.NewDatabaseLogStorage(dbClient, commands, queries))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
accessSvc := logstore.New(queries, accessDBEmitter, accessStdoutEmitter)
|
|
exhaustedCookieHandler := http_util.NewCookieHandler(
|
|
http_util.WithUnsecure(),
|
|
http_util.WithNonHttpOnly(),
|
|
http_util.WithMaxAge(int(math.Floor(config.Quotas.Access.ExhaustedCookieMaxAge.Seconds()))),
|
|
)
|
|
limitingAccessInterceptor := middleware.NewAccessInterceptor(accessSvc, exhaustedCookieHandler, &config.Quotas.Access.AccessConfig)
|
|
translator := i18n.NewZitadelTranslator(language.English)
|
|
apis, err := api.New(
|
|
ctx,
|
|
config.Port,
|
|
router,
|
|
queries,
|
|
verifier,
|
|
config.SystemAuthZ,
|
|
config.InternalAuthZ,
|
|
tlsConfig,
|
|
config.ExternalDomain,
|
|
append(config.InstanceHostHeaders, config.PublicHostHeaders...),
|
|
limitingAccessInterceptor,
|
|
keys.Target,
|
|
translator,
|
|
config.Instrumentation.Trace.TrustRemoteSpans,
|
|
httpClient,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error creating api %w", err)
|
|
}
|
|
|
|
config.Auth.Spooler.Client = dbClient
|
|
config.Auth.Spooler.Eventstore = eventstore
|
|
config.Auth.Spooler.ActiveInstancer = queries
|
|
authRepo, err := auth_es.Start(ctx, config.Auth, config.SystemDefaults, commands, queries, dbClient, eventstore, keys.OIDC, keys.User)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error starting auth repo: %w", err)
|
|
}
|
|
|
|
config.Admin.Spooler.Client = dbClient
|
|
config.Admin.Spooler.Eventstore = eventstore
|
|
config.Admin.Spooler.ActiveInstancer = queries
|
|
err = admin_es.Start(ctx, config.Admin, store, dbClient, queries)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error starting admin repo: %w", err)
|
|
}
|
|
|
|
if err := apis.RegisterServer(ctx, system.CreateServer(commands, queries, config.Database.DatabaseName(), config.DefaultInstance, config.ExternalDomain), tlsConfig); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, instance_v2beta.CreateServer(commands, queries, config.Database.DatabaseName(), config.DefaultInstance, config.ExternalDomain)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, instance_v2.CreateServer(commands, queries, config.DefaultInstance, config.ExternalDomain, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterServer(ctx, admin.CreateServer(config.Database.DatabaseName(), commands, queries, keys.User, config.AuditLogRetention), tlsConfig); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterServer(ctx, management.CreateServer(commands, queries, config.SystemDefaults, keys.User), tlsConfig); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterServer(ctx, auth.CreateServer(commands, queries, authRepo, config.SystemDefaults, keys.User), tlsConfig); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, user_v2beta.CreateServer(commands, queries, keys.User, keys.IDPConfig, idp.CallbackURL(), idp.SAMLRootURL(), assets.AssetAPI(), permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, user_v2.CreateServer(commands, queries, config.SystemDefaults, keys.User, keys.IDPConfig, idp.CallbackURL(), idp.SAMLRootURL(), assets.AssetAPI(), permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, session_v2beta.CreateServer(commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, settings_v2beta.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, org_v2beta.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, feature_v2beta.CreateServer(commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, session_v2.CreateServer(commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, settings_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, org_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, feature_v2.CreateServer(commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, idp_v2.CreateServer(commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, action_v2_beta.CreateServer(config.SystemDefaults, commands, queries, domain.AllActionFunctions, apis.ListGrpcMethods, apis.ListGrpcServices)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, action_v2.CreateServer(config.SystemDefaults, commands, queries, domain.AllActionFunctions, apis.ListGrpcMethods, apis.ListGrpcServices)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, project_v2beta.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, project_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, internal_permission_v2beta.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, internal_permission_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, userschema_v3_alpha.CreateServer(config.SystemDefaults, commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, user_v3_alpha.CreateServer(commands)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, webkey_v2beta.CreateServer(commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, webkey_v2.CreateServer(commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, debug_events.CreateServer(commands, queries)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, authorization_v2beta.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, authorization_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, app_v2beta.CreateServer(commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, application.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, group_v2.CreateServer(config.SystemDefaults, commands, queries, permissionCheck)); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
instanceInterceptor := middleware.InstanceInterceptor(queries, config.ExternalDomain, translator, login.IgnoreInstanceEndpoints...)
|
|
assetsCache := middleware.AssetsCacheInterceptor(config.AssetStorage.Cache.MaxAge, config.AssetStorage.Cache.SharedMaxAge)
|
|
apis.RegisterHandlerOnPrefix(assets.HandlerPrefix, assets.NewHandler(
|
|
commands,
|
|
verifier,
|
|
config.SystemAuthZ,
|
|
config.InternalAuthZ,
|
|
id.SonyFlakeGenerator(),
|
|
store,
|
|
queries,
|
|
middleware.CallDurationHandler,
|
|
instanceInterceptor.Handler,
|
|
assetsCache.Handler,
|
|
limitingAccessInterceptor.Handle,
|
|
translator,
|
|
))
|
|
|
|
federatedLogoutsCache, err := connector.StartCache[federatedlogout.Index, string, *federatedlogout.FederatedLogout](ctx, []federatedlogout.Index{federatedlogout.IndexRequestID}, cache.PurposeFederatedLogout, cacheConnectors.Config.FederatedLogouts, cacheConnectors)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
apis.RegisterHandlerOnPrefix(idp.HandlerPrefix, idp.NewHandler(commands, queries, keys.IDPConfig, instanceInterceptor.Handler, federatedLogoutsCache))
|
|
|
|
userAgentInterceptor, err := middleware.NewUserAgentHandler(config.UserAgentCookie, keys.UserAgentCookieKey, id.SonyFlakeGenerator(), config.ExternalSecure, login.EndpointResources, login.EndpointExternalLoginCallbackFormPost, login.EndpointSAMLACS)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// robots.txt handler
|
|
robotsTxtHandler, err := robots_txt.Start()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start robots txt handler: %w", err)
|
|
}
|
|
apis.RegisterHandlerOnPrefix(robots_txt.HandlerPrefix, robotsTxtHandler)
|
|
|
|
// TODO: Record openapi access logs?
|
|
openAPIHandler, err := openapi.Start()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start openapi handler: %w", err)
|
|
}
|
|
apis.RegisterHandlerOnPrefix(openapi.HandlerPrefix, openAPIHandler)
|
|
|
|
oidcServer, err := oidc.NewServer(
|
|
ctx,
|
|
config.OIDC,
|
|
login.DefaultLoggedOutPath,
|
|
config.ExternalSecure,
|
|
commands,
|
|
queries,
|
|
authRepo,
|
|
keys.OIDC,
|
|
keys.Target,
|
|
keys.OIDCKey,
|
|
eventstore,
|
|
userAgentInterceptor,
|
|
instanceInterceptor.Handler,
|
|
limitingAccessInterceptor,
|
|
config.Log.Slog(),
|
|
config.SystemDefaults.SecretHasher,
|
|
federatedLogoutsCache,
|
|
httpClient,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start oidc provider: %w", err)
|
|
}
|
|
apis.RegisterHandlerPrefixes(oidcServer, oidcPrefixes...)
|
|
|
|
samlProvider, err := saml.NewProvider(
|
|
config.SAML,
|
|
config.ExternalSecure,
|
|
commands,
|
|
queries,
|
|
authRepo,
|
|
keys.OIDC,
|
|
keys.SAML,
|
|
keys.Target,
|
|
eventstore,
|
|
dbClient,
|
|
instanceInterceptor.Handler,
|
|
userAgentInterceptor,
|
|
limitingAccessInterceptor,
|
|
httpClient,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start saml provider: %w", err)
|
|
}
|
|
apis.RegisterHandlerOnPrefix(saml.HandlerPrefix, samlProvider.HttpHandler())
|
|
|
|
apis.RegisterHandlerOnPrefix(
|
|
schemas.HandlerPrefix,
|
|
scim.NewServer(
|
|
commands,
|
|
queries,
|
|
verifier,
|
|
keys.User,
|
|
&config.SCIM,
|
|
translator,
|
|
instanceInterceptor.HandlerFuncWithError,
|
|
middleware.AuthorizationInterceptor(verifier, config.SystemAuthZ, config.InternalAuthZ).HandlerFuncWithError(schemas.HandlerPrefix)))
|
|
|
|
c, err := console.Start(config.Console, config.ExternalSecure, oidcServer.IssuerFromRequest, middleware.CallDurationHandler, instanceInterceptor.Handler, limitingAccessInterceptor, config.CustomerPortal)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start management console: %w", err)
|
|
}
|
|
apis.RegisterHandlerOnPrefix(path.HandlerPrefix, c)
|
|
managementConsolePath := path.HandlerPrefix + "/"
|
|
l, err := login.CreateLogin(
|
|
config.Login,
|
|
commands,
|
|
queries,
|
|
authRepo,
|
|
store,
|
|
managementConsolePath,
|
|
oidcServer.AuthCallbackURL(),
|
|
samlProvider.AuthCallbackURL(),
|
|
config.ExternalSecure,
|
|
userAgentInterceptor,
|
|
op.NewIssuerInterceptor(oidcServer.IssuerFromRequest).Handler,
|
|
provider.NewIssuerInterceptor(samlProvider.IssuerFromRequest).Handler,
|
|
instanceInterceptor.Handler,
|
|
assetsCache.Handler,
|
|
limitingAccessInterceptor.WithRedirect(managementConsolePath).Handle,
|
|
keys.User,
|
|
keys.IDPConfig,
|
|
keys.CSRFCookieKey,
|
|
cacheConnectors,
|
|
federatedLogoutsCache,
|
|
httpClient,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to start login: %w", err)
|
|
}
|
|
apis.RegisterHandlerOnPrefix(login.HandlerPrefix, l.Handler())
|
|
apis.HandleFunc(login.EndpointDeviceAuth, login.RedirectDeviceAuthToPrefix)
|
|
|
|
// After OIDC provider so that the callback endpoint can be used
|
|
if err := apis.RegisterService(ctx, oidc_v2beta.CreateServer(commands, queries, oidcServer, config.ExternalSecure)); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := apis.RegisterService(ctx, oidc_v2.CreateServer(commands, queries, oidcServer, config.ExternalSecure, keys.OIDC)); err != nil {
|
|
return nil, err
|
|
}
|
|
// After SAML provider so that the callback endpoint can be used
|
|
if err := apis.RegisterService(ctx, saml_v2.CreateServer(commands, queries, samlProvider, config.ExternalSecure)); err != nil {
|
|
return nil, err
|
|
}
|
|
// handle grpc at last to be able to handle the root, because grpc and gateway require a lot of different prefixes
|
|
apis.RouteGRPC()
|
|
return apis, nil
|
|
}
|
|
|
|
func listen(ctx context.Context, router *mux.Router, port uint16, tlsConfig *tls.Config, shutdown <-chan os.Signal) error {
|
|
http2Server := &http2.Server{}
|
|
http1Server := &http.Server{Handler: h2c.NewHandler(router, http2Server), TLSConfig: tlsConfig}
|
|
|
|
lc := net.ListenConfig()
|
|
lis, err := lc.Listen(ctx, "tcp", fmt.Sprintf(":%d", port))
|
|
if err != nil {
|
|
return fmt.Errorf("tcp listener on %d failed: %w", port, err)
|
|
}
|
|
|
|
errCh := make(chan error)
|
|
|
|
go func() {
|
|
logging.Info(ctx, "server is listening", "address", lis.Addr().String())
|
|
if tlsConfig != nil {
|
|
// we don't need to pass the files here, because we already initialized the TLS config on the server
|
|
errCh <- http1Server.ServeTLS(lis, "", "")
|
|
} else {
|
|
errCh <- http1Server.Serve(lis)
|
|
}
|
|
}()
|
|
|
|
select {
|
|
case err := <-errCh:
|
|
return fmt.Errorf("error starting server: %w", err)
|
|
case <-shutdown:
|
|
ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
|
|
defer cancel()
|
|
return shutdownServer(ctx, http1Server)
|
|
case <-ctx.Done():
|
|
return shutdownServer(ctx, http1Server)
|
|
}
|
|
}
|
|
|
|
func shutdownServer(ctx context.Context, server *http.Server) error {
|
|
err := server.Shutdown(ctx)
|
|
if err != nil {
|
|
return fmt.Errorf("could not shutdown gracefully: %w", err)
|
|
}
|
|
logging.Info(ctx, "server shutdown gracefully")
|
|
return nil
|
|
}
|
|
|
|
func showBasicInformation(startConfig *Config) {
|
|
fmt.Println(color.MagentaString(figure.NewFigure("ZITADEL", "", true).String()))
|
|
http := "http"
|
|
if startConfig.TLS.Enabled || startConfig.ExternalSecure {
|
|
http = "https"
|
|
}
|
|
|
|
managementConsoleURL := fmt.Sprintf("%s://%s:%v/ui/console\n", http, startConfig.ExternalDomain, startConfig.ExternalPort)
|
|
healthCheckURL := fmt.Sprintf("%s://%s:%v/debug/healthz\n", http, startConfig.ExternalDomain, startConfig.ExternalPort)
|
|
machineIdMethod := id.MachineIdentificationMethod()
|
|
|
|
insecure := !startConfig.TLS.Enabled && !startConfig.ExternalSecure
|
|
|
|
fmt.Printf(" ===============================================================\n\n")
|
|
fmt.Printf(" Version : %s\n", build.Version())
|
|
fmt.Printf(" TLS enabled : %v\n", startConfig.TLS.Enabled)
|
|
fmt.Printf(" External Secure : %v\n", startConfig.ExternalSecure)
|
|
fmt.Printf(" Machine Id Method : %v\n", machineIdMethod)
|
|
fmt.Printf(" Management Console URL : %s", color.BlueString(managementConsoleURL))
|
|
fmt.Printf(" Health Check URL : %s", color.BlueString(healthCheckURL))
|
|
if insecure {
|
|
fmt.Printf("\n %s: you're using plain http without TLS. Be aware this is \n", color.RedString("Warning"))
|
|
fmt.Printf(" not a secure setup and should only be used for test systems. \n")
|
|
fmt.Printf(" Visit: %s \n", color.CyanString("https://zitadel.com/docs/self-hosting/manage/tls_modes"))
|
|
}
|
|
fmt.Printf("\n ===============================================================\n\n")
|
|
}
|
|
|
|
func checkExisting(values []string) func(string) bool {
|
|
return func(value string) bool {
|
|
return slices.Contains(values, value)
|
|
}
|
|
}
|