try to load providers from /etc/opk/providers.d

Author: markafarrell

main.go

@@ -261,6 +261,31 @@ Arguments:
 				return err
 			}
 
+			// Load all files found in /etc/opk/prividers.d
+			providerPolicyDir := "/etc/opk/providers.d"
+			providerPolicyPaths, err := os.ReadDir(providerPolicyDir)
+
+			if err != nil {
+				log.Println("Failed to list files in /etc/opk/providers.d/:", err)
+				return err
+			}
+
+			for _, providerPolicyPath := range providerPolicyPaths {
+				if !providerPolicyPath.IsDir() {
+
+					thisProviderPolicy, err := policy.NewProviderFileLoader().
+						LoadProviderPolicy(providerPolicyDir + "/" + providerPolicyPath.Name())
+
+					if err != nil {
+						log.Printf("Failed to load providers from %s/%s:\n%s",
+							providerPolicyDir, providerPolicyPath.Name(), err)
+						return err
+					}
+
+					providerPolicy.Append(*thisProviderPolicy)
+				}
+			}
+
 			printConfigProblems()
 			log.Println("Providers loaded: ", providerPolicy.ToString())
 

policy/providerloader.go

@@ -63,6 +63,10 @@ func (p *ProviderPolicy) AddRow(row ProvidersRow) {
 	p.rows = append(p.rows, row)
 }
 
+func (p *ProviderPolicy) Append(n ProviderPolicy) {
+	p.rows = append(p.rows, n.rows...)
+}
+
 func (p *ProviderPolicy) CreateVerifier() (*verifier.Verifier, error) {
 	pvs := []verifier.ProviderVerifier{}
 	var expirationPolicy verifier.ExpirationPolicy

policy/providerloader_test.go

@@ -175,3 +175,35 @@ func TestProvidersFileLoader_ToTable(t *testing.T) {
 		t.Error("second row in table does not match expected values")
 	}
 }
+
+// Test ProvidersFileLoader.Append.
+func TestProvidersFileLoader_Append(t *testing.T) {
+	policy1 := ProviderPolicy{}
+	policy1.AddRow(ProvidersRow{
+		Issuer:           "issuer1",
+		ClientID:         "client1",
+		ExpirationPolicy: "24h",
+	})
+	policy1.AddRow(ProvidersRow{
+		Issuer:           "issuer2",
+		ClientID:         "client2",
+		ExpirationPolicy: "48h",
+	})
+
+	policy2 := ProviderPolicy{}
+	policy1.AddRow(ProvidersRow{
+		Issuer:           "issuer3",
+		ClientID:         "client3",
+		ExpirationPolicy: "24h",
+	})
+	policy1.AddRow(ProvidersRow{
+		Issuer:           "issuer4",
+		ClientID:         "client4",
+		ExpirationPolicy: "48h",
+	})
+
+	policy1.Append(policy2)
+
+	expected := "issuer1 client1 24h\nissuer2 client2 48h\nissuer3 client3 24h\nissuer4 client4 48h\n"
+	require.Equal(t, expected, policy1.ToString())
+}

test/integration/ssh_server/arch_opkssh.Dockerfile

@@ -66,7 +66,13 @@ RUN ls -l /usr/local/bin
 RUN printenv PATH
 
 ARG ISSUER_PORT="9998"
-RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" >> /etc/opk/providers
+
+RUN mkdir -p /etc/opk/providers.d && \
+    chown root:opksshuser /etc/opk/providers.d
+
+RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" > /etc/opk/providers.d/oidc-local && \
+    chown root:opksshuser /etc/opk/providers.d/oidc-local && \
+    chmod 640 /etc/opk/providers.d/oidc-local
 
 # Add integration test user as allowed email in policy (this directly tests
 # policy "add" command)

test/integration/ssh_server/centos_opkssh.Dockerfile

@@ -61,7 +61,13 @@ RUN ls -l /usr/local/bin
 RUN printenv PATH
 
 ARG ISSUER_PORT="9998"
-RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" >> /etc/opk/providers
+
+RUN mkdir -p /etc/opk/providers.d && \
+    chown root:opksshuser /etc/opk/providers.d
+
+RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" > /etc/opk/providers.d/oidc-local && \
+    chown root:opksshuser /etc/opk/providers.d/oidc-local && \
+    chmod 640 /etc/opk/providers.d/oidc-local
 
 # Add integration test user as allowed email in policy (this directly tests
 # policy "add" command)

test/integration/ssh_server/debian_opkssh.Dockerfile

@@ -46,7 +46,12 @@ RUN chmod +x ./scripts/install-linux.sh
 RUN bash ./scripts/install-linux.sh --install-from=opksshbuild --no-sshd-restart
 # RUN chmod 700 /usr/local/bin/opkssh
 
-RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" >> /etc/opk/providers
+RUN mkdir -p /etc/opk/providers.d && \
+    chown root:opksshuser /etc/opk/providers.d
+
+RUN echo "http://oidc.local:${ISSUER_PORT}/ web oidc_refreshed" > /etc/opk/providers.d/oidc-local && \
+    chown root:opksshuser /etc/opk/providers.d/oidc-local && \
+    chmod 640 /etc/opk/providers.d/oidc-local
 
 # Add integration test user as allowed email in policy (this directly tests
 # policy "add" command)