Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
194cf1e
Add local user authentication (ADR-001)
ViToRiO92 Apr 3, 2026
c56f4e0
go mod tidy
ViToRiO92 Apr 3, 2026
6146ee9
Fix import cycle between handler and middleware packages
ViToRiO92 Apr 3, 2026
bcb0b81
Add authentication test plan
ViToRiO92 Apr 3, 2026
6d5bc25
Add ADR-003: User management UI
ViToRiO92 Apr 3, 2026
77c5cb1
tests successfully for adr-001 done
ViToRiO92 Apr 3, 2026
dc36a2b
Add user management UI page (ADR-003)
ViToRiO92 Apr 3, 2026
12e7905
Implement SAML 2.0 authentication (ADR-002)
ViToRiO92 Apr 3, 2026
36f3b09
Fix SAML assertion validation by tracking AuthnRequest ID in cookie
ViToRiO92 Apr 4, 2026
876028d
crewjam logging
ViToRiO92 Apr 4, 2026
ca8bbfd
Fix login button extending beyond form field width
ViToRiO92 Apr 4, 2026
bda6f41
Make SAML user profile read-only in user management UI
ViToRiO92 Apr 4, 2026
c7447ec
Document SAML user read-only UI behavior in ADR-002
ViToRiO92 Apr 4, 2026
feaf170
Log config file parse errors instead of silently ignoring
ViToRiO92 Apr 4, 2026
ad1ff8e
Remove CLAUDE.md from repository
ViToRiO92 Apr 4, 2026
9af77ca
Update ADR documents, CONFIGURATION.md, and add screenshots
ViToRiO92 Apr 4, 2026
b0958cc
Update ADRs with is_admin authorization model
ViToRiO92 Apr 4, 2026
2bf6585
add reader and admin role
ViToRiO92 Apr 4, 2026
7513e00
save button visible for admin user
ViToRiO92 Apr 4, 2026
c38cbd4
SAML Cookie Missing Secure Flag
ViToRiO92 Apr 4, 2026
f58d750
implement adr-004
ViToRiO92 Apr 4, 2026
774b664
add security review
ViToRiO92 Apr 4, 2026
cfe0c10
add new test result
ViToRiO92 Apr 4, 2026
f60e841
updated ADR
ViToRiO92 Apr 4, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 100 additions & 0 deletions CONFIGURATION.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ but you can pass the -config parameter to define the location of the config file
| views | | | array | predefined views (see view table) |
| trusted_proxies | TRUSTED_PROXIES | | array | List of trusted proxies (env var is space seperated) |
| strip_path_prefix | STRIP_PATH_PREFIX | | string | Strip base paths from Puppet code locations |
| cors_origin | OPENVOXVIEW_CORS_ORIGIN | | string | Allowed CORS origin (empty = no CORS headers) |
| puppetca.host | PUPPETCA_HOST | | string | Address of Puppet CA server (optional) |
| puppetca.port | PUPPETCA_PORT | 8140 | int | Port of Puppet CA server |
| puppetca.tls | PUPPETCA_TLS | true | bool | Use TLS for Puppet CA communications |
Expand All @@ -32,6 +33,90 @@ but you can pass the -config parameter to define the location of the config file
| puppetca.deactivate_nodes | PUPPETCA_DEACTIVATE_NODES | false | bool | Also deactivate node in PuppetDB with revoke / clean |


### Authentication

| Option | Environment Variable | Default | Type | Description |
|------------------------------|----------------------------------------------|-----------------------|--------|--------------------------------------------------|
| auth.enabled | OPENVOXVIEW_AUTH_ENABLED | false | bool | Enable local user authentication |
| auth.jwt_secret | OPENVOXVIEW_AUTH_JWT_SECRET | | string | Secret for signing JWT tokens (min 32 chars) |
| auth.access_token_ttl_minutes| OPENVOXVIEW_AUTH_ACCESS_TOKEN_TTL_MINUTES | 15 | int | Access token lifetime in minutes |
| auth.refresh_token_ttl_days | OPENVOXVIEW_AUTH_REFRESH_TOKEN_TTL_DAYS | 30 | int | Refresh token lifetime in days |
| auth.db_path | OPENVOXVIEW_AUTH_DB_PATH | data/openvoxview.db | string | Path to SQLite database file |

When `auth.enabled` is `true`, all API endpoints (except `/api/v1/auth/login`, `/api/v1/auth/refresh`, `/api/v1/version`, and `/api/v1/meta`) require a valid JWT bearer token. If no `jwt_secret` is configured, a random one is generated at startup (tokens will not survive restarts).

To create the first admin user, run:

```
openvoxview --create-admin
```

Users can also be managed via the API endpoints when authenticated:

| Method | Endpoint | Description |
|--------|-----------------------------|------------------------|
| POST | /api/v1/auth/login | Login (returns tokens) |
| POST | /api/v1/auth/refresh | Refresh access token |
| POST | /api/v1/auth/logout | Revoke refresh token |
| GET | /api/v1/auth/me | Current user profile |
| GET | /api/v1/auth/users | List all users |
| POST | /api/v1/auth/users | Create user |
| PUT | /api/v1/auth/users/:id | Update user |
| DELETE | /api/v1/auth/users/:id | Delete user |

### SAML Authentication (EntraID / ADFS)

| Option | Environment Variable | Default | Type | Description |
|---------------------------------|----------------------------------------------|----------------------------------------------------------------------------|--------|-------------------------------------------------|
| auth.saml.enabled | OPENVOXVIEW_AUTH_SAML_ENABLED | false | bool | Enable SAML 2.0 SSO authentication |
| auth.saml.idp_metadata_url | OPENVOXVIEW_AUTH_SAML_IDP_METADATA_URL | | string | URL to IdP federation metadata XML |
| auth.saml.idp_metadata_file | OPENVOXVIEW_AUTH_SAML_IDP_METADATA_FILE | | string | Path to local IdP metadata XML file (fallback) |
| auth.saml.sp_entity_id | OPENVOXVIEW_AUTH_SAML_SP_ENTITY_ID | | string | SP Entity ID (e.g. https://openvoxview.example.com) |
| auth.saml.sp_acs_url | OPENVOXVIEW_AUTH_SAML_SP_ACS_URL | | string | Assertion Consumer Service URL |
| auth.saml.sp_cert_file | OPENVOXVIEW_AUTH_SAML_SP_CERT_FILE | | string | Path to SP X.509 certificate (PEM) |
| auth.saml.sp_key_file | OPENVOXVIEW_AUTH_SAML_SP_KEY_FILE | | string | Path to SP private key (PEM) |
| auth.saml.attr_email | | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | string | SAML attribute URI for email |
| auth.saml.attr_given_name | | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | string | SAML attribute URI for given name |
| auth.saml.attr_surname | | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | string | SAML attribute URI for surname |
| auth.saml.attr_display_name | | http://schemas.microsoft.com/identity/claims/displayname | string | SAML attribute URI for display name |

SAML requires `auth.enabled: true` as a prerequisite. Both local login and SAML SSO can be active simultaneously (recommended for break-glass admin access).

To generate a self-signed SP certificate for SAML:

```
openvoxview --generate-saml-cert
```

This creates `saml-sp.crt` and `saml-sp.key` in the current directory. Point `sp_cert_file` and `sp_key_file` to these files.

SAML API endpoints (public, no auth required):

| Method | Endpoint | Description |
|--------|----------------------------------|------------------------------------|
| GET | /api/v1/auth/saml/metadata | SP metadata XML (for IdP setup) |
| GET | /api/v1/auth/saml/login | Initiates SAML SSO redirect to IdP |
| POST | /api/v1/auth/saml/acs | Assertion Consumer Service callback|

After the IdP returns a valid assertion, the user is auto-provisioned in the local database (with `auth_source = 'saml'`) and redirected to the frontend with JWT tokens.

#### EntraID Setup

1. Azure Portal > Enterprise Applications > New Application > Create your own (non-gallery)
2. Single Sign-On > SAML
3. Basic SAML Configuration:
- Identifier (Entity ID): value of `sp_entity_id`
- Reply URL (ACS): value of `sp_acs_url`
- Sign on URL: `https://<host>/api/v1/auth/saml/login`
4. Copy the **App Federation Metadata Url** (must include `?appid=`) from Section 3 (SAML Certificates) and use it as `idp_metadata_url`. Do NOT use the generic tenant metadata URL — it contains the wrong signing certificate.
5. Assign users/groups

#### ADFS Setup

1. ADFS Management > Relying Party Trusts > Add
2. Import from URL: `https://<host>/api/v1/auth/saml/metadata`
3. Add claim rules for email, given name, surname, and display name

### predefined Queries
| Option | Type | Description |
|-------------|--------|---------------------------|
Expand Down Expand Up @@ -79,6 +164,21 @@ port: 5000
trusted_proxies:
- 127.0.0.1

auth:
enabled: true
jwt_secret: "change-me-to-a-long-random-string-min-32-chars"
access_token_ttl_minutes: 15
refresh_token_ttl_days: 30
db_path: "data/openvoxview.db"

saml:
enabled: true
idp_metadata_url: "https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml?appid=<app-id>"
sp_entity_id: "https://openvoxview.example.com"
sp_acs_url: "https://openvoxview.example.com/api/v1/auth/saml/acs"
sp_cert_file: "/etc/openvoxview/saml-sp.crt"
sp_key_file: "/etc/openvoxview/saml-sp.key"

puppetdb:
host: localhost
port: 8081
Expand Down
66 changes: 65 additions & 1 deletion config/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ import (

var configPath = flag.String("config", "", "path to the config file")
var printVersion = flag.Bool("version", false, "prints version")
var createAdmin = flag.Bool("create-admin", false, "create an admin user interactively")
var generateSamlCert = flag.Bool("generate-saml-cert", false, "generate a self-signed SAML SP certificate and key")

func init() {
flag.Parse()
Expand All @@ -22,6 +24,29 @@ type ConfigPqlQuery struct {
Query string `mapstructure:"query"`
}

type SamlConfig struct {
Enabled bool `mapstructure:"enabled"`
IdpMetadataURL string `mapstructure:"idp_metadata_url"`
IdpMetadataFile string `mapstructure:"idp_metadata_file"`
SpEntityID string `mapstructure:"sp_entity_id"`
SpAcsURL string `mapstructure:"sp_acs_url"`
SpCertFile string `mapstructure:"sp_cert_file"`
SpKeyFile string `mapstructure:"sp_key_file"`
AttrEmail string `mapstructure:"attr_email"`
AttrGivenName string `mapstructure:"attr_given_name"`
AttrSurname string `mapstructure:"attr_surname"`
AttrDisplayName string `mapstructure:"attr_display_name"`
}

type AuthConfig struct {
Enabled bool `mapstructure:"enabled"`
JwtSecret string `mapstructure:"jwt_secret"`
AccessTokenTTL int `mapstructure:"access_token_ttl_minutes"`
RefreshTokenTTL int `mapstructure:"refresh_token_ttl_days"`
DbPath string `mapstructure:"db_path"`
Saml SamlConfig `mapstructure:"saml"`
}

type Config struct {
Listen string `mapstructure:"listen"`
Port uint64 `mapstructure:"port"`
Expand All @@ -39,6 +64,8 @@ type Config struct {
Views []model.View `mapstructure:"views"`
UnreportedHours uint64 `mapstructure:"unreported_hours"`
StripPathPrefix string `mapstructure:"strip_path_prefix"`
CorsOrigin string `mapstructure:"cors_origin"`
Auth AuthConfig `mapstructure:"auth"`
PuppetCA struct {
Host string `mapstructure:"host"`
Port uint64 `mapstructure:"port"`
Expand All @@ -60,6 +87,14 @@ func PrintVersion(version string) bool {
return false
}

func CreateAdmin() bool {
return *createAdmin
}

func GenerateSamlCert() bool {
return *generateSamlCert
}

var (
cachedConfig *Config
cachedErr error
Expand All @@ -83,6 +118,17 @@ func GetConfig() (*Config, error) {
viper.SetDefault("puppetdb.tls_ignore", false)
viper.SetDefault("unreported_hours", 3)
viper.SetDefault("strip_path_prefix", `/etc/puppetlabs/code/environments(/.*?/modules)?`)
viper.SetDefault("cors_origin", "")
viper.SetDefault("auth.enabled", false)
viper.SetDefault("auth.access_token_ttl_minutes", 15)
viper.SetDefault("auth.refresh_token_ttl_days", 30)
viper.SetDefault("auth.db_path", "data/openvoxview.db")
viper.SetDefault("auth.saml.enabled", false)
viper.SetDefault("auth.saml.attr_email", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress")
viper.SetDefault("auth.saml.attr_given_name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname")
viper.SetDefault("auth.saml.attr_surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname")
viper.SetDefault("auth.saml.attr_display_name", "http://schemas.microsoft.com/identity/claims/displayname")

viper.SetDefault("puppetca.port", 8140)
viper.SetDefault("puppetca.tls", true)
viper.SetDefault("puppetca.tls_ignore", false)
Expand All @@ -103,6 +149,20 @@ func GetConfig() (*Config, error) {
viper.BindEnv("puppetdb.tls_cert", "PUPPETDB_TLS_CERT")
viper.BindEnv("unreported_hours", "UNREPORTED_HOURS")
viper.BindEnv("strip_path_prefix", "STRIP_PATH_PREFIX")
viper.BindEnv("cors_origin", "OPENVOXVIEW_CORS_ORIGIN")
viper.BindEnv("auth.enabled", "OPENVOXVIEW_AUTH_ENABLED")
viper.BindEnv("auth.jwt_secret", "OPENVOXVIEW_AUTH_JWT_SECRET")
viper.BindEnv("auth.access_token_ttl_minutes", "OPENVOXVIEW_AUTH_ACCESS_TOKEN_TTL_MINUTES")
viper.BindEnv("auth.refresh_token_ttl_days", "OPENVOXVIEW_AUTH_REFRESH_TOKEN_TTL_DAYS")
viper.BindEnv("auth.db_path", "OPENVOXVIEW_AUTH_DB_PATH")
viper.BindEnv("auth.saml.enabled", "OPENVOXVIEW_AUTH_SAML_ENABLED")
viper.BindEnv("auth.saml.idp_metadata_url", "OPENVOXVIEW_AUTH_SAML_IDP_METADATA_URL")
viper.BindEnv("auth.saml.idp_metadata_file", "OPENVOXVIEW_AUTH_SAML_IDP_METADATA_FILE")
viper.BindEnv("auth.saml.sp_entity_id", "OPENVOXVIEW_AUTH_SAML_SP_ENTITY_ID")
viper.BindEnv("auth.saml.sp_acs_url", "OPENVOXVIEW_AUTH_SAML_SP_ACS_URL")
viper.BindEnv("auth.saml.sp_cert_file", "OPENVOXVIEW_AUTH_SAML_SP_CERT_FILE")
viper.BindEnv("auth.saml.sp_key_file", "OPENVOXVIEW_AUTH_SAML_SP_KEY_FILE")

viper.BindEnv("puppetca.host", "PUPPETCA_HOST")
viper.BindEnv("puppetca.port", "PUPPETCA_PORT")
viper.BindEnv("puppetca.tls", "PUPPETCA_TLS")
Expand All @@ -113,7 +173,11 @@ func GetConfig() (*Config, error) {
viper.BindEnv("puppetca.readonly", "PUPPETCA_READONLY")
viper.BindEnv("puppetca.deactivate_nodes", "PUPPETCA_DEACTIVATE_NODES")

viper.ReadInConfig()
if err := viper.ReadInConfig(); err != nil {
if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
log.Printf("WARNING: Failed to read config file: %v", err)
}
}

var cfg Config
cachedErr = viper.Unmarshal(&cfg)
Expand Down
85 changes: 85 additions & 0 deletions db/db.go

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think if we add this, we should use an ORM to enable other dbms also.

Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
package db

import (
"database/sql"
"fmt"
"log"
"os"
"path/filepath"

_ "modernc.org/sqlite"
)

type Database struct {
db *sql.DB
}

func Open(dbPath string) (*Database, error) {
dir := filepath.Dir(dbPath)
if err := os.MkdirAll(dir, 0700); err != nil {
return nil, fmt.Errorf("failed to create database directory: %w", err)
}

sqlDB, err := sql.Open("sqlite", dbPath)
if err != nil {
return nil, fmt.Errorf("failed to open database: %w", err)
}

if _, err := sqlDB.Exec("PRAGMA journal_mode=WAL"); err != nil {
sqlDB.Close()
return nil, fmt.Errorf("failed to set journal mode: %w", err)
}
if _, err := sqlDB.Exec("PRAGMA foreign_keys=ON"); err != nil {
sqlDB.Close()
return nil, fmt.Errorf("failed to enable foreign keys: %w", err)
}

d := &Database{db: sqlDB}
if err := d.migrate(); err != nil {
sqlDB.Close()
return nil, fmt.Errorf("failed to run migrations: %w", err)
}

log.Printf("Database opened: %s", dbPath)
return d, nil
}

func (d *Database) Close() error {
return d.db.Close()
}

func (d *Database) migrate() error {
migrations := []string{
`CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
email TEXT,
display_name TEXT,
given_name TEXT,
surname TEXT,
password_hash TEXT,
auth_source TEXT NOT NULL DEFAULT 'local',
is_admin BOOLEAN NOT NULL DEFAULT FALSE,
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
)`,
`CREATE TABLE IF NOT EXISTS refresh_tokens (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
token_hash TEXT UNIQUE NOT NULL,
expires_at DATETIME NOT NULL,
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
revoked_at DATETIME
)`,
`CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user_id ON refresh_tokens(user_id)`,
`CREATE INDEX IF NOT EXISTS idx_refresh_tokens_hash ON refresh_tokens(token_hash)`,
}

for _, m := range migrations {
if _, err := d.db.Exec(m); err != nil {
return fmt.Errorf("migration failed: %w\nSQL: %s", err, m)
}
}

return nil
}
Loading