Auth: File backend: use new auth config file

 - Use new auth config file in Config.js
 - Define a new env variable to change the path of the authentication config
 file
 - Update backend.js to use the new authentication data API
 - Update tests to remove references to the old, inconsistent auth config file
 format.

Author: David Pineau

lib/Config.js

@@ -2,6 +2,8 @@ import assert from 'assert';
 import fs from 'fs';
 import path from 'path';
 
+import authDataChecker from './auth/in_memory/checker';
+
 /**
  * Reads from a config file and returns the content as a config object
  */
@@ -175,11 +177,15 @@ class Config {
         if (auth === 'file' || auth === 'mem') {
             // Auth only checks for 'mem' since mem === file
             auth = 'mem';
-            let authfile = `${__dirname}/auth/in_memory/vault.json`;
+            let authfile = `${__dirname}/../conf/authdata.json`;
             if (process.env.S3AUTH_CONFIG) {
                 authfile = process.env.S3AUTH_CONFIG;
             }
-            this.authData = require(authfile);
+            const authData = require(authfile);
+            if (authDataChecker(authData)) {
+                throw new Error('bad config: invalid auth config file.');
+            }
+            this.authData = authData;
         }
         if (process.env.S3SPROXYD) {
             data = process.env.S3SPROXYD;

lib/auth/in_memory/backend.js

@@ -2,9 +2,12 @@ import { errors } from 'arsenal';
 import crypto from 'crypto';
 
 import config from '../../Config';
+import Index from './index';
 
 import { calculateSigningKey, hashSignature } from './vaultUtilities';
 
+const authIndex = new Index(config.authData);
+
 const backend = {
     /** verifySignatureV2
     * @param {string} stringToSign - string to sign built per AWS rules
@@ -16,21 +19,22 @@ const backend = {
     */
     verifySignatureV2: (stringToSign, signatureFromRequest,
         accessKey, options, callback) => {
-        const account = config.authData.accountsKeyedbyAccessKey[accessKey];
-        if (!account) {
+        const entity = authIndex.getByKey(accessKey);
+        if (!entity) {
             return callback(errors.InvalidAccessKeyId);
         }
-        const secretKey = account.secretKey;
+        const secretKey = entity.keys
+            .filter(kv => kv.access === accessKey)[0].secret;
         const reconstructedSig =
             hashSignature(stringToSign, secretKey, options.algo);
         if (signatureFromRequest !== reconstructedSig) {
             return callback(errors.SignatureDoesNotMatch);
         }
         const userInfoToSend = {
-            accountDisplayName: account.displayName,
-            canonicalID: account.canonicalID,
-            arn: account.arn,
-            IAMdisplayName: account.IAMdisplayName,
+            accountDisplayName: entity.accountDisplayName,
+            canonicalID: entity.canonicalID,
+            arn: entity.arn,
+            IAMdisplayName: entity.IAMdisplayName,
         };
         const vaultReturnObject = {
             message: {
@@ -54,22 +58,23 @@ const backend = {
      */
     verifySignatureV4: (stringToSign, signatureFromRequest, accessKey,
         region, scopeDate, options, callback) => {
-        const account = config.authData.accountsKeyedbyAccessKey[accessKey];
-        if (!account) {
+        const entity = authIndex.getByKey(accessKey);
+        if (!entity) {
             return callback(errors.InvalidAccessKeyId);
         }
-        const secretKey = account.secretKey;
+        const secretKey = entity.keys
+            .filter(kv => kv.access === accessKey)[0].secret;
         const signingKey = calculateSigningKey(secretKey, region, scopeDate);
         const reconstructedSig = crypto.createHmac('sha256', signingKey)
             .update(stringToSign).digest('hex');
         if (signatureFromRequest !== reconstructedSig) {
             return callback(errors.SignatureDoesNotMatch);
         }
         const userInfoToSend = {
-            accountDisplayName: account.displayName,
-            canonicalID: account.canonicalID,
-            arn: account.arn,
-            IAMdisplayName: account.IAMdisplayName,
+            accountDisplayName: entity.accountDisplayName,
+            canonicalID: entity.canonicalID,
+            arn: entity.arn,
+            IAMdisplayName: entity.IAMdisplayName,
         };
         const vaultReturnObject = {
             message: {
@@ -92,13 +97,10 @@ const backend = {
     getCanonicalIds: (emails, log, cb) => {
         const results = {};
         emails.forEach(email => {
-            const lowercasedEmail = email.toLowerCase();
-            if (!config.authData.accountsKeyedbyEmail[lowercasedEmail]) {
+            if (!authIndex.getByEmail(email)) {
                 results[email] = 'NotFound';
             } else {
-                results[email] =
-                    config.authData.accountsKeyedbyEmail[lowercasedEmail]
-                        .canonicalID;
+                results[email] = authIndex.getByEmail(email).canonicalID;
             }
         });
         const vaultReturnObject = {
@@ -123,8 +125,7 @@ const backend = {
     getEmailAddresses: (canonicalIDs, options, cb) => {
         const results = {};
         canonicalIDs.forEach(canonicalId => {
-            const foundAccount = config.authData
-                .accountsKeyedbyCanID[canonicalId];
+            const foundAccount = authIndex.getByCanId(canonicalId);
             if (!foundAccount || !foundAccount.email) {
                 results[canonicalId] = 'NotFound';
             } else {

lib/auth/in_memory/vault.json

@@ -23,7 +23,8 @@ const aclBucket = 'acluniverse';
 const nonexist = 'nonexist';
 const prefix = 'topLevel';
 const delimiter = '/';
-const ownerCanonicalId = 'accessKey1canonicalID';
+const ownerCanonicalId = '79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d52'
+    + '18e7cd47ef2be';
 const endpoint = `${transport}://${ipAddress}:8000`;
 
 function diff(putFile, receivedFile, done) {

tests/functional/s3curl/tests.js

@@ -47,7 +47,8 @@ describe('bucketDelete API', () => {
                     assert.deepStrictEqual(err, errors.BucketNotEmpty);
                     metadata.getBucket(bucketName, log, (err, md) => {
                         assert.strictEqual(md.getName(), bucketName);
-                        metadata.listObject(usersBucket, canonicalID,
+                        metadata.listObject(usersBucket,
+                            authInfo.getCanonicalID(),
                             null, null, null, log, (err, listResponse) => {
                                 assert.strictEqual(listResponse.Contents.length,
                                                    1);

tests/unit/api/bucketDelete.js

@@ -21,7 +21,9 @@ export function shuffle(array) {
     array.forEach((item, currentIndex, array) => {
         randomIndex = Math.floor(Math.random() * length);
         temporaryValue = array[currentIndex];
+        // eslint-disable-next-line no-param-reassign
         array[currentIndex] = array[randomIndex];
+        // eslint-disable-next-line no-param-reassign
         array[randomIndex] = temporaryValue;
     });
     return array;
@@ -36,10 +38,17 @@ export function timeDiff(startTime) {
 }
 
 export function makeAuthInfo(accessKey) {
-    const canonicalID = accessKey === constants.publicId ?
-        constants.publicId : `${accessKey}canonicalID`;
+    const canIdMap = {
+        accessKey1: '79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7'
+            + 'cd47ef2be',
+        accessKey2: '79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7'
+            + 'cd47ef2bf',
+        default: `${accessKey}canonicalID`,
+    };
+    canIdMap[constants.publicId] = constants.publicId;
+
     return new AuthInfo({
-        canonicalID,
+        canonicalID: canIdMap[accessKey] || canIdMap.default,
         shortid: 'shortid',
         email: `${accessKey}@l.com`,
         accountDisplayName: `${accessKey}displayName`,