AUT-605 - Splitting service-level config from signer and auth config

Dockerfile

@@ -69,7 +69,8 @@ EXPOSE 2112
 
 # Copy compiled appliation from the builder.
 ADD . /app/src/autograph
-ADD autograph.yaml /app
+ADD autograph-service.yaml /app
+ADD autograph-signer.yaml /app
 ADD version.json /app
 COPY --from=builder /go/bin /go/bin/
 
@@ -81,4 +82,3 @@ RUN useradd --uid 10001 --home-dir /app --shell /sbin/nologin app
 USER app
 WORKDIR /app
 CMD ["/go/bin/autograph"]
-

README.md

@@ -77,7 +77,7 @@ $ go get github.com/mozilla-services/autograph
 The resulting binary will be placed in `$GOPATH/bin/autograph`. To run autograph with the example conf, do:
 ```bash
 $ cd $GOPATH/src/github.com/mozilla-services/autograph
-$ $GOPATH/bin/autograph -c autograph.yaml
+$ $GOPATH/bin/autograph -c autograph-service.yaml -s autograph-signer.yaml
 ```
 
 Example clients are in the `tools` directory. You can install the Go one like this:

authorize_test.go

@@ -17,7 +17,7 @@ import (
 )
 
 func TestMissingAuthorization(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	body := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
 	bodyrdr := bytes.NewReader(body)
@@ -35,7 +35,7 @@ func TestMissingAuthorization(t *testing.T) {
 }
 
 func TestBogusAuthorization(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	body := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
 	bodyrdr := bytes.NewReader(body)
@@ -54,15 +54,15 @@ func TestBogusAuthorization(t *testing.T) {
 }
 
 func TestBadPayload(t *testing.T) {
-	ag, conf := newTestAutographer(t)
+	ag, _, signerConf := newTestAutographer(t)
 
 	body := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
 	bodyrdr := bytes.NewReader(body)
 	req, err := http.NewRequest("POST", "http://foo.bar/sign/data", bodyrdr)
 	if err != nil {
 		t.Fatal(err)
 	}
-	auth, err := ag.getAuthByID(conf.Authorizations[0].ID)
+	auth, err := ag.getAuthByID(signerConf.Authorizations[0].ID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -78,7 +78,7 @@ func TestBadPayload(t *testing.T) {
 }
 
 func TestExpiredAuth(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	body := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
 	bodyrdr := bytes.NewReader(body)
@@ -98,7 +98,7 @@ func TestExpiredAuth(t *testing.T) {
 }
 
 func TestDuplicateNonce(t *testing.T) {
-	ag, conf := newTestAutographer(t)
+	ag, _, signerConf := newTestAutographer(t)
 
 	body := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
 	bodyrdr := bytes.NewReader(body)
@@ -107,7 +107,7 @@ func TestDuplicateNonce(t *testing.T) {
 		t.Fatal(err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	auth, err := ag.getAuthByID(conf.Authorizations[0].ID)
+	auth, err := ag.getAuthByID(signerConf.Authorizations[0].ID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -127,14 +127,14 @@ func TestDuplicateNonce(t *testing.T) {
 }
 
 func TestNonceFromLRU(t *testing.T) {
-	ag, conf := newTestAutographer(t)
+	ag, _, signerConf := newTestAutographer(t)
 
 	req, err := http.NewRequest("POST", "http://foo.bar/sign/data", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	authCreds, err := ag.getAuthByID(conf.Authorizations[0].ID)
+	authCreds, err := ag.getAuthByID(signerConf.Authorizations[0].ID)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -174,7 +174,7 @@ func TestNonceFromLRU(t *testing.T) {
 }
 
 func TestSignerNotFound(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	_, err := ag.authBackend.getSignerForUser(`unknown018qoegdxc`, `unkown093ytid`)
 	if err == nil {
@@ -183,7 +183,7 @@ func TestSignerNotFound(t *testing.T) {
 }
 
 func TestDefaultSignerNotFound(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	_, err := ag.authBackend.getSignerForUser(`unknown018qoegdxc`, ``)
 	if err == nil {
@@ -192,7 +192,7 @@ func TestDefaultSignerNotFound(t *testing.T) {
 }
 
 func TestAutographerAddAuthorizationsFails(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	testcases := []struct {
 		name   string
@@ -292,7 +292,7 @@ func TestAutographerAddAuthorizationsFails(t *testing.T) {
 // set an authorization with a ts validity of 2 seconds, then sleep 5 seconds
 // to trigger the hawk skew error
 func TestHawkTimestampSkewFail(t *testing.T) {
-	ag, _ := newTestAutographer(t)
+	ag, _, _ := newTestAutographer(t)
 
 	var err error
 	ag.hawkMaxTimestampSkew, err = time.ParseDuration("2s")

autograph-service.yaml

@@ -0,0 +1,46 @@
+server:
+    listen: "0.0.0.0:8000"
+    # cache 500k nonces to protect from authorization replay attacks
+    noncecachesize: 524288
+    idletimeout: 60s
+    readtimeout: 60s
+    writetimeout: 60s
+
+debugserver:
+    listen: "0.0.0.0:2112"
+
+# When using an HSM, place the path to the pkcs11 client library,
+# token label and pin of the crypto user in the configuration below
+# hsm:
+#     # sample config for cloudhsm
+#     path:       /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
+#     tokenlabel: cavium
+#     pin:        ulfr:e2deea623796eecd
+
+# When using a postgres database, set the config below:
+# database:
+#    name: autograph
+#    user: myautographdbuser
+#    password: myautographdbpassword
+#    host: db:5432
+#    sslmode: verify-full
+#    sslrootcert: /etc/ssl/certs/db-root.crt
+#    maxopenconns: 100
+#    maxidleconns: 10
+#    monitorpollinterval: 10s
+
+# When the DB or HSM is enabled use these timeouts for the
+# /__heartbeat__ handler
+heartbeat:
+    hsmchecktimeout: 100ms
+    dbchecktimeout: 150ms
+
+# allow hawk authorization headers to be valid for up to 10 minutes
+# to account for diverging clocks between client and server
+hawktimestampvalidity: 10m
+
+# optional refresh rate for cached monitor data
+monitorinterval: 5m
+
+monitoring:
+    key: 19zd4w3xirb5syjgdx8atq6g91m03bdsmzjifs2oddivswlu9qs

autograph.yaml → autograph-signer.yaml

@@ -1,47 +1,3 @@
-server:
-    listen: "0.0.0.0:8000"
-    # cache 500k nonces to protect from authorization replay attacks
-    noncecachesize: 524288
-    idletimeout: 60s
-    readtimeout: 60s
-    writetimeout: 60s
-
-debugserver:
-    listen: "0.0.0.0:2112"
-
-# When using an HSM, place the path to the pkcs11 client library,
-# token label and pin of the crypto user in the configuration below
-# hsm:
-#     # sample config for cloudhsm
-#     path:       /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
-#     tokenlabel: cavium
-#     pin:        ulfr:e2deea623796eecd
-
-# When using a postgres database, set the config below:
-# database:
-#    name: autograph
-#    user: myautographdbuser
-#    password: myautographdbpassword
-#    host: db:5432
-#    sslmode: verify-full
-#    sslrootcert: /etc/ssl/certs/db-root.crt
-#    maxopenconns: 100
-#    maxidleconns: 10
-#    monitorpollinterval: 10s
-
-# When the DB or HSM is enabled use these timeouts for the
-# /__heartbeat__ handler
-heartbeat:
-    hsmchecktimeout: 100ms
-    dbchecktimeout: 150ms
-
-# allow hawk authorization headers to be valid for up to 10 minutes
-# to account for diverging clocks between client and server
-hawktimestampvalidity: 10m
-
-# optional refresh rate for cached monitor data
-monitorinterval: 5m
-
 # The keys below are testing keys that do not grant any power
 signers:
     # a p384 key, the standard
@@ -1793,6 +1749,3 @@ authorizations:
       key: 3isey64n25fim18chqgewirm6z2gwva1mas0eu71e9jtisdwv6bd
       signers:
           - remote-settings
-
-monitoring:
-    key: 19zd4w3xirb5syjgdx8atq6g91m03bdsmzjifs2oddivswlu9qs