authentik.outposts.models

  1"""Outpost models"""
  2
  3from collections.abc import Iterable
  4from dataclasses import asdict, dataclass, field
  5from datetime import datetime
  6from typing import Any
  7from uuid import uuid4
  8
  9from dacite.core import from_dict
 10from django.contrib.auth.models import Permission
 11from django.core.cache import cache
 12from django.db import IntegrityError, models, transaction
 13from django.db.models.base import Model
 14from django.utils.translation import gettext_lazy as _
 15from model_utils.managers import InheritanceManager
 16from packaging.version import Version, parse
 17from rest_framework.serializers import Serializer
 18from structlog.stdlib import get_logger
 19
 20from authentik import authentik_build_hash, authentik_version
 21from authentik.blueprints.models import ManagedModel
 22from authentik.brands.models import Brand
 23from authentik.core.models import (
 24    USER_PATH_SYSTEM_PREFIX,
 25    Provider,
 26    Token,
 27    TokenIntents,
 28    User,
 29    UserTypes,
 30)
 31from authentik.crypto.models import CertificateKeyPair
 32from authentik.events.models import Event, EventAction
 33from authentik.lib.config import CONFIG
 34from authentik.lib.models import InheritanceForeignKey, SerializerModel
 35from authentik.lib.sentry import SentryIgnoredException
 36from authentik.lib.utils.time import fqdn_rand
 37from authentik.outposts.controllers.k8s.utils import get_namespace
 38from authentik.tasks.schedules.common import ScheduleSpec
 39from authentik.tasks.schedules.models import ScheduledModel
 40
 41OUR_VERSION = parse(authentik_version())
 42OUTPOST_HELLO_INTERVAL = 10
 43LOGGER = get_logger()
 44
 45USER_PATH_OUTPOSTS = USER_PATH_SYSTEM_PREFIX + "/outposts"
 46
 47
 48class ServiceConnectionInvalid(SentryIgnoredException):
 49    """Exception raised when a Service Connection has invalid parameters"""
 50
 51
 52@dataclass
 53class OutpostConfig:
 54    """Configuration an outpost uses to configure it self"""
 55
 56    # update website/docs/add-secure-apps/outposts/_config.md
 57
 58    authentik_host: str = ""
 59    authentik_host_insecure: bool = False
 60    authentik_host_browser: str = ""
 61
 62    log_level: str = CONFIG.get("log_level")
 63    object_naming_template: str = field(default="ak-outpost-%(name)s")
 64    refresh_interval: str = "minutes=5"
 65
 66    container_image: str | None = field(default=None)
 67
 68    docker_network: str | None = field(default=None)
 69    docker_map_ports: bool = field(default=True)
 70    docker_labels: dict[str, str] | None = field(default=None)
 71
 72    kubernetes_replicas: int = field(default=1)
 73    kubernetes_namespace: str = field(default_factory=get_namespace)
 74    kubernetes_ingress_annotations: dict[str, str] = field(default_factory=dict)
 75    kubernetes_ingress_secret_name: str = field(default="authentik-outpost-tls")
 76    kubernetes_ingress_class_name: str | None = field(default=None)
 77    kubernetes_ingress_path_type: str | None = field(default=None)
 78    kubernetes_httproute_annotations: dict[str, str] = field(default_factory=dict)
 79    kubernetes_httproute_parent_refs: list[dict[str, str]] = field(default_factory=list)
 80    kubernetes_service_type: str = field(default="ClusterIP")
 81    kubernetes_disabled_components: list[str] = field(default_factory=list)
 82    kubernetes_image_pull_secrets: list[str] = field(default_factory=list)
 83    kubernetes_json_patches: dict[str, list[dict[str, Any]]] | None = field(default=None)
 84
 85
 86class OutpostModel(Model):
 87    """Base model for providers that need more objects than just themselves"""
 88
 89    def get_required_objects(self) -> Iterable[models.Model | str | tuple[str, models.Model]]:
 90        """Return a list of all required objects"""
 91        return [self]
 92
 93    class Meta:
 94        abstract = True
 95
 96
 97class OutpostType(models.TextChoices):
 98    """Outpost types"""
 99
100    PROXY = "proxy"
101    LDAP = "ldap"
102    RADIUS = "radius"
103    RAC = "rac"
104
105
106def default_outpost_config(host: str | None = None):
107    """Get default outpost config"""
108    return asdict(OutpostConfig(authentik_host=host or ""))
109
110
111@dataclass
112class OutpostServiceConnectionState:
113    """State of an Outpost Service Connection"""
114
115    version: str
116    healthy: bool
117
118
119class OutpostServiceConnection(ScheduledModel, models.Model):
120    """Connection details for an Outpost Controller, like Docker or Kubernetes"""
121
122    uuid = models.UUIDField(default=uuid4, editable=False, primary_key=True)
123    name = models.TextField(unique=True)
124
125    local = models.BooleanField(
126        default=False,
127        help_text=_(
128            "If enabled, use the local connection. Required Docker socket/Kubernetes Integration"
129        ),
130    )
131
132    objects = InheritanceManager()
133
134    class Meta:
135        verbose_name = _("Outpost Service-Connection")
136        verbose_name_plural = _("Outpost Service-Connections")
137
138    def __str__(self) -> str:
139        return f"Outpost service connection {self.name}"
140
141    @property
142    def state_key(self) -> str:
143        """Key used to save connection state in cache"""
144        return f"goauthentik.io/outposts/service_connection_state/{self.pk.hex}"
145
146    @property
147    def state(self) -> OutpostServiceConnectionState:
148        """Get state of service connection"""
149        from authentik.outposts.tasks import outpost_service_connection_monitor
150
151        state = cache.get(self.state_key, None)
152        if not state:
153            outpost_service_connection_monitor.send_with_options(args=(self.pk,), rel_obj=self)
154            return OutpostServiceConnectionState("", False)
155        return state
156
157    @property
158    def component(self) -> str:
159        """Return component used to edit this object"""
160        # This is called when creating an outpost with a service connection
161        # since the response doesn't use the correct inheritance
162        return ""
163
164    @property
165    def schedule_specs(self) -> list[ScheduleSpec]:
166        from authentik.outposts.tasks import outpost_service_connection_monitor
167
168        return [
169            ScheduleSpec(
170                actor=outpost_service_connection_monitor,
171                uid=self.name,
172                args=(self.pk,),
173                crontab="3-59/15 * * * *",
174                send_on_save=True,
175            ),
176        ]
177
178
179class DockerServiceConnection(SerializerModel, OutpostServiceConnection):
180    """Service Connection to a Docker endpoint"""
181
182    url = models.TextField(
183        help_text=_(
184            "Can be in the format of 'unix://<path>' when connecting to a local docker daemon, "
185            "or 'https://<hostname>:2376' when connecting to a remote system."
186        )
187    )
188    tls_verification = models.ForeignKey(
189        CertificateKeyPair,
190        null=True,
191        blank=True,
192        default=None,
193        related_name="+",
194        on_delete=models.SET_DEFAULT,
195        help_text=_(
196            "CA which the endpoint's Certificate is verified against. "
197            "Can be left empty for no validation."
198        ),
199    )
200    tls_authentication = models.ForeignKey(
201        CertificateKeyPair,
202        null=True,
203        blank=True,
204        default=None,
205        related_name="+",
206        on_delete=models.SET_DEFAULT,
207        help_text=_(
208            "Certificate/Key used for authentication. Can be left empty for no authentication."
209        ),
210    )
211
212    class Meta:
213        verbose_name = _("Docker Service-Connection")
214        verbose_name_plural = _("Docker Service-Connections")
215
216    def __str__(self) -> str:
217        return f"Docker Service-Connection {self.name}"
218
219    @property
220    def serializer(self) -> Serializer:
221        from authentik.outposts.api.service_connections import DockerServiceConnectionSerializer
222
223        return DockerServiceConnectionSerializer
224
225    @property
226    def component(self) -> str:
227        return "ak-service-connection-docker-form"
228
229
230class KubernetesServiceConnection(SerializerModel, OutpostServiceConnection):
231    """Service Connection to a Kubernetes cluster"""
232
233    kubeconfig = models.JSONField(
234        help_text=_(
235            "Paste your kubeconfig here. authentik will automatically use "
236            "the currently selected context."
237        ),
238        blank=True,
239    )
240    verify_ssl = models.BooleanField(
241        default=True, help_text=_("Verify SSL Certificates of the Kubernetes API endpoint")
242    )
243
244    class Meta:
245        verbose_name = _("Kubernetes Service-Connection")
246        verbose_name_plural = _("Kubernetes Service-Connections")
247
248    def __str__(self) -> str:
249        return f"Kubernetes Service-Connection {self.name}"
250
251    @property
252    def serializer(self) -> Serializer:
253        from authentik.outposts.api.service_connections import KubernetesServiceConnectionSerializer
254
255        return KubernetesServiceConnectionSerializer
256
257    @property
258    def component(self) -> str:
259        return "ak-service-connection-kubernetes-form"
260
261
262class Outpost(ScheduledModel, SerializerModel, ManagedModel):
263    """Outpost instance which manages a service user and token"""
264
265    uuid = models.UUIDField(default=uuid4, editable=False, primary_key=True)
266    name = models.TextField(unique=True)
267
268    type = models.TextField(choices=OutpostType.choices, default=OutpostType.PROXY)
269    service_connection = InheritanceForeignKey(
270        OutpostServiceConnection,
271        default=None,
272        null=True,
273        blank=True,
274        help_text=_(
275            "Select Service-Connection authentik should use to manage this outpost. "
276            "Leave empty if authentik should not handle the deployment."
277        ),
278        on_delete=models.SET_DEFAULT,
279    )
280
281    _config = models.JSONField(default=default_outpost_config)
282
283    providers = models.ManyToManyField(Provider)
284
285    @property
286    def serializer(self) -> Serializer:
287        from authentik.outposts.api.outposts import OutpostSerializer
288
289        return OutpostSerializer
290
291    @property
292    def config(self) -> OutpostConfig:
293        """Load config as OutpostConfig object"""
294        return from_dict(OutpostConfig, self._config)
295
296    @config.setter
297    def config(self, value):
298        """Dump config into json"""
299        self._config = asdict(value)
300
301    @property
302    def state_cache_prefix(self) -> str:
303        """Key by which the outposts status is saved"""
304        return f"goauthentik.io/outposts/state/{self.uuid.hex}"
305
306    @property
307    def state(self) -> list[OutpostState]:
308        """Get outpost's health status"""
309        return OutpostState.for_outpost(self)
310
311    @property
312    def user_identifier(self):
313        """Username for service user"""
314        return f"ak-outpost-{self.uuid.hex}"
315
316    @property
317    def schedule_specs(self) -> list[ScheduleSpec]:
318        from authentik.outposts.tasks import outpost_controller
319
320        return [
321            ScheduleSpec(
322                actor=outpost_controller,
323                uid=self.name,
324                args=(self.pk,),
325                kwargs={"action": "up", "from_cache": False},
326                crontab=f"{fqdn_rand('outpost_controller')} */4 * * *",
327                send_on_save=True,
328            ),
329        ]
330
331    def build_user_permissions(self, user: User):
332        """Create per-object and global permissions for outpost service-account"""
333        # To ensure the user only has the correct permissions, we delete all of them and re-add
334        # the ones the user needs
335        try:
336            with transaction.atomic():
337                user.remove_all_perms_from_managed_role()
338                for model_or_perm in self.get_required_objects():
339                    if isinstance(model_or_perm, models.Model):
340                        code_name = (
341                            f"{model_or_perm._meta.app_label}.view_{model_or_perm._meta.model_name}"
342                        )
343                        user.assign_perms_to_managed_role(code_name, model_or_perm)
344                    elif isinstance(model_or_perm, tuple):
345                        perm, obj = model_or_perm
346                        user.assign_perms_to_managed_role(perm, obj)
347                    else:
348                        user.assign_perms_to_managed_role(model_or_perm)
349        except (Permission.DoesNotExist, AttributeError) as exc:
350            LOGGER.warning(
351                "permission doesn't exist",
352                code_name=code_name,
353                user=user,
354                model=model_or_perm,
355            )
356            Event.new(
357                action=EventAction.SYSTEM_EXCEPTION,
358                message=(
359                    "While setting the permissions for the service-account, a "
360                    "permission was not found: Check "
361                    "https://docs.goauthentik.io/troubleshooting/missing_permission"
362                ),
363            ).with_exception(exc).set_user(user).save()
364        LOGGER.debug(
365            "Updated service account's permissions",
366            obj_perms=user.get_all_obj_perms_on_managed_role(),
367            perms=user.get_all_model_perms_on_managed_role(),
368        )
369
370    @property
371    def user(self) -> User:
372        """Get/create user with access to all required objects"""
373        user = User.objects.filter(username=self.user_identifier).first()
374        user_created = False
375        if not user:
376            user: User = User.objects.create(username=self.user_identifier)
377            user_created = True
378        attrs = {
379            "type": UserTypes.INTERNAL_SERVICE_ACCOUNT,
380            "name": f"Outpost {self.name} Service-Account",
381            "path": USER_PATH_OUTPOSTS,
382        }
383        dirty = False
384        for key, value in attrs.items():
385            if getattr(user, key) != value:
386                dirty = True
387                setattr(user, key, value)
388        if user.has_usable_password():
389            user.set_unusable_password()
390            dirty = True
391        if dirty:
392            user.save()
393        if user_created:
394            self.build_user_permissions(user)
395        return user
396
397    @property
398    def token_identifier(self) -> str:
399        """Get Token identifier"""
400        return f"ak-outpost-{self.pk}-api"
401
402    @property
403    def token(self) -> Token:
404        """Get/create token for auto-generated user"""
405        managed = f"goauthentik.io/outpost/{self.token_identifier}"
406        tokens = Token.objects.filter(
407            identifier=self.token_identifier,
408            intent=TokenIntents.INTENT_API,
409            managed=managed,
410        )
411        if tokens.exists():
412            return tokens.first()
413        try:
414            return Token.objects.create(
415                user=self.user,
416                identifier=self.token_identifier,
417                intent=TokenIntents.INTENT_API,
418                description=f"Autogenerated by authentik for Outpost {self.name}",
419                expiring=False,
420                managed=managed,
421            )
422        except IntegrityError:
423            # Integrity error happens mostly when managed is reused
424            Token.objects.filter(managed=managed).delete()
425            Token.objects.filter(identifier=self.token_identifier).delete()
426            return self.token
427
428    def get_required_objects(self) -> Iterable[models.Model | str | tuple[str, models.Model]]:
429        """Get an iterator of all objects the user needs read access to"""
430        objects: list[models.Model | str] = [
431            self,
432            "authentik_events.add_event",
433        ]
434        for provider in Provider.objects.filter(outpost=self).select_related().select_subclasses():
435            if isinstance(provider, OutpostModel):
436                objects.extend(provider.get_required_objects())
437            else:
438                objects.append(provider)
439        if self.managed:
440            for brand in Brand.objects.filter(web_certificate__isnull=False):
441                objects.append(brand)
442                objects.append(("authentik_crypto.view_certificatekeypair", brand.web_certificate))
443                objects.append(
444                    ("authentik_crypto.view_certificatekeypair_certificate", brand.web_certificate)
445                )
446                objects.append(
447                    ("authentik_crypto.view_certificatekeypair_key", brand.web_certificate)
448                )
449        return objects
450
451    def __str__(self) -> str:
452        return f"Outpost {self.name}"
453
454    class Meta:
455        verbose_name = _("Outpost")
456        verbose_name_plural = _("Outposts")
457
458
459@dataclass
460class OutpostState:
461    """Outpost instance state, last_seen and version"""
462
463    uid: str
464    last_seen: datetime | None = field(default=None)
465    version: str | None = field(default=None)
466    version_should: Version = field(default=OUR_VERSION)
467    build_hash: str = field(default="")
468    golang_version: str = field(default="")
469    openssl_enabled: bool = field(default=False)
470    openssl_version: str = field(default="")
471    fips_enabled: bool = field(default=False)
472    hostname: str = field(default="")
473    args: dict = field(default_factory=dict)
474
475    _outpost: Outpost | None = field(default=None)
476
477    @property
478    def version_outdated(self) -> bool:
479        """Check if outpost version matches our version"""
480        if not self.version:
481            return False
482        if self.build_hash != authentik_build_hash():
483            return False
484        return parse(self.version) != OUR_VERSION
485
486    @staticmethod
487    def for_outpost(outpost: Outpost) -> list[OutpostState]:
488        """Get all states for an outpost"""
489        keys = cache.keys(f"{outpost.state_cache_prefix}/*")
490        if not keys:
491            return []
492        states = []
493        for key in keys:
494            instance_uid = key.replace(f"{outpost.state_cache_prefix}/", "")
495            states.append(OutpostState.for_instance_uid(outpost, instance_uid))
496        return states
497
498    @staticmethod
499    def for_instance_uid(outpost: Outpost, uid: str) -> OutpostState:
500        """Get state for a single instance"""
501        key = f"{outpost.state_cache_prefix}/{uid}"
502        default_data = {"uid": uid}
503        data = cache.get(key, default_data)
504        if isinstance(data, str):
505            cache.delete(key)
506            data = default_data
507        state = from_dict(OutpostState, data)
508
509        state._outpost = outpost
510        return state
511
512    def save(self, timeout=OUTPOST_HELLO_INTERVAL):
513        """Save current state to cache"""
514        full_key = f"{self._outpost.state_cache_prefix}/{self.uid}"
515        return cache.set(full_key, asdict(self), timeout=timeout)
516
517    def delete(self):
518        """Manually delete from cache, used on channel disconnect"""
519        full_key = f"{self._outpost.state_cache_prefix}/{self.uid}"
520        cache.delete(full_key)