Add encrypted basic credentials to mgt ui

consolidate cookies mgt to the server and

Author: MarcialRosales

.gitignore

@@ -123,6 +123,9 @@ rabbitmq-server-*.tar.xz
 rabbitmq-server-*.zip
 secondary_dist/
 
+# RabbitMQ javascript files generated from EJS templates 
+deps/*/priv/www/js/*-ejs.js 
+
 # Trace tools output.
 *-ttb
 *.ti

deps/rabbitmq_management/priv/schema/rabbitmq_management.schema

@@ -490,6 +490,13 @@ end}.
 {mapping, "management.disable_basic_auth", "rabbitmq_management.disable_basic_auth",
     [{datatype, boolean}]}.
 
+%% When set, the management UI stores an AES-256-GCM encrypted bearer token
+%% (prefixed "rmqe.") instead of a plaintext base64(username:password).
+%% The value must be identical on every node in the cluster.
+{mapping, "management.credentials_encryption_secret",
+          "rabbitmq_management.credentials_encryption_secret",
+    [{datatype, [tagged_binary, binary]}]}.
+
 %% Management only
 
 {mapping, "management.disable_stats", "rabbitmq_management.disable_management_stats", [

deps/rabbitmq_management/priv/www/js/main.js

@@ -86,8 +86,7 @@ function start_app_login () {
     this.get('#/', function () {})
     if (!oauth.enabled || !oauth.oauth_disable_basic_auth) {
       this.put('#/login', function() {
-        set_basic_auth(this.params['username'], this.params['password'])
-        check_login()
+        login(this.params['username'], this.params['password']);
       });
     }
   })
@@ -117,34 +116,69 @@ function check_login () {
     }
     return false;
   }
-  check_version()
-  hide_popup_warn()
-  replace_content('outer', format('layout', {}))
-  var user_login_session_timeout = parseInt(user.login_session_timeout)
-  if (!isNaN(user_login_session_timeout)) {
-    update_login_session_timeout(user_login_session_timeout)
+  load_ui();
+  return true;
+}
+
+function do_login(username, password) {
+    var result = null;
+    $.ajax({
+        async: false,
+        type: 'POST',
+        url: 'api/login',
+        data: {username: username, password: password},
+        success: function(resp) { result = resp; },
+        error: function(xhr) {
+            try { result = JSON.parse(xhr.responseText); } catch(e) {}
+            if (!result) result = {error: 'login_failed', reason: 'Login failed'};
+        }
+    });
+    return result;
+}
+
+function login(username, password) {
+  var result = do_login(username, password);
+  if (!result || result.error) {
+    replace_content('login-status', '<p>Login failed</p>');
+    if (result && result.reason && typeof result.reason === 'string') {
+      show_popup('warn', fmt_escape_html(result.reason));
+    }
+    return false;
+  }
+  var scheme = result.token.type === 'bearer' ? 'Bearer' : 'Basic';
+  set_auth(scheme, result.token.value, default_hard_session_timeout());
+  user = result.user;
+  var sessionTimeout = parseInt(user.login_session_timeout);
+  if (!isNaN(sessionTimeout)) {
+    update_login_session_timeout(sessionTimeout);
   }
+  load_ui();
+  return true;
+}
+
+function load_ui() {
+  check_version();
+  hide_popup_warn();
+  replace_content('outer', format('layout', {}));
 
   ui_data_model.vhosts = JSON.parse(sync_get('/vhosts'));
-  ac.update(user, ui_data_model)
+  ac.update(user, ui_data_model);
   if (ac.isMonitoringUser()) {
-    ui_data_model.nodes = JSON.parse(sync_get('/nodes'))
+    ui_data_model.nodes = JSON.parse(sync_get('/nodes'));
   }
-  var overview = JSON.parse(sync_get('/overview'))
+  var overview = JSON.parse(sync_get('/overview'));
 
-  display.update(overview, ui_data_model)
+  display.update(overview, ui_data_model);
 
-  setup_global_vars(overview)
+  setup_global_vars(overview);
 
-  setup_constant_events()
-  update_vhosts()
-  update_interval()
+  setup_constant_events();
+  update_vhosts();
+  update_interval();
   setup_extensions(function onCompleted() {
     console.info("All extensions have been loaded. Starting application ..");
     start_app();
   });
-
-  return true
 }
 
 

deps/rabbitmq_management/priv/www/js/prefs.js

@@ -1,17 +1,8 @@
-function local_storage_available() {
-    try {
-        return 'localStorage' in window && window['localStorage'] !== null;
-    } catch (e) {
-        return false;
-    }
-}
-
 /// Credential management
 
 const CREDENTIALS = 'credentials'
 const AUTH_SCHEME = "auth-scheme"
-const LOGGED_IN = 'loggedIn'
-const LOGIN_SESSION_TIMEOUT = "login_session_timeout"
+const SESSION_EXPIRY = 'session_expiry'
 const AUTH_RESOURCE = 'auth_resource'
 
 const BASIC_AUTH_SCHEME = "Basic"
@@ -30,9 +21,12 @@ function get_auth_resource() {
 
 // When auth_scheme is undefined, matches any scheme for backwards compatibility.
 function has_auth_credentials(auth_scheme) {
-    let authenticated =get_local_pref(CREDENTIALS) != undefined && get_local_pref(AUTH_SCHEME) != undefined &&
-      get_cookie_value(LOGGED_IN) != undefined;
-    return authenticated && (auth_scheme == undefined 
+    let expiry = get_local_pref(SESSION_EXPIRY);
+    let authenticated = get_local_pref(CREDENTIALS) != undefined &&
+                        get_local_pref(AUTH_SCHEME) != undefined &&
+                        expiry != undefined &&
+                        Date.now() < parseInt(expiry, 10);
+    return authenticated && (auth_scheme == undefined
         || auth_scheme == get_auth_scheme());
 }
 function get_auth_credentials() {
@@ -44,13 +38,11 @@ function get_auth_scheme() {
 function clear_auth() {
     clear_local_pref(CREDENTIALS)
     clear_local_pref(AUTH_SCHEME)
-    clear_local_pref(LOGIN_SESSION_TIMEOUT)
-    clear_cookie_value(LOGGED_IN)
+    clear_local_pref(SESSION_EXPIRY)
     clear_local_pref(AUTH_RESOURCE)
+    $.ajax({ async: false, type: 'DELETE', url: 'api/login' })
 }
 function set_basic_auth(username, password) {
-    // Clear the stored timeout so a fresh login re-applies the configured value.
-    clear_local_pref(LOGIN_SESSION_TIMEOUT)
     set_auth("Basic", b64_encode_utf8(username + ":" + password), default_hard_session_timeout())
 }
 function set_token_auth(token) {
@@ -59,9 +51,10 @@ function set_token_auth(token) {
 function set_auth(auth_scheme, credentials, validUntil) {
     clear_local_pref(CREDENTIALS)
     clear_local_pref(AUTH_SCHEME)
+    clear_local_pref(SESSION_EXPIRY)
     store_local_pref(CREDENTIALS, credentials)
     store_local_pref(AUTH_SCHEME, auth_scheme)
-    store_cookie_value_with_expiration(LOGGED_IN, "true", validUntil) // session marker
+    store_local_pref(SESSION_EXPIRY, validUntil.getTime())
 }
 
 function authorization_header() {
@@ -78,15 +71,22 @@ function default_hard_session_timeout() {
 }
 
 function update_login_session_timeout(login_session_timeout) {
-    if (get_local_pref(LOGIN_SESSION_TIMEOUT) != undefined || !has_auth_credentials()) {
-      return;
-    }
+    if (!has_auth_credentials()) return;
     var date = new Date();
     date.setMinutes(date.getMinutes() + login_session_timeout);
-    store_local_pref(LOGIN_SESSION_TIMEOUT, login_session_timeout);
-    store_cookie_value_with_expiration(LOGGED_IN, "true", date)
+    store_local_pref(SESSION_EXPIRY, date.getTime())
+}
+
+function print_logging_session_info (user_login_session_timeout) {
+  let authenticated = has_auth_credentials()
+  let session_expiry = get_local_pref(SESSION_EXPIRY)
+  console.log('user_login_session_timeout: ' + user_login_session_timeout)
+  console.log('has_auth_credentials: ' + authenticated)
+  console.log('session_expiry: ' + session_expiry)
+  console.log('isNaN(user_login_session_timeout): ' + isNaN(user_login_session_timeout))
 }
 
+
 /// End Credential Management
 
 // Our base64 library takes a string that is really a byte sequence,
@@ -102,83 +102,33 @@ function encode_utf8(str) {
   return unescape(encodeURIComponent(str));
 }
 
-function store_cookie_value(k, v) {
-    var d = parse_cookie();
-    d[short_key(k)] = v;
-    store_cookie(d);
-}
+// All preferences and credentials are stored in localStorage.
+// The management UI requires localStorage; without it no part of the UI functions.
 
-function store_cookie_value_with_expiration(k, v, expiration_date) {
-    var d = parse_cookie();
-    d[short_key(k)] = v;
-    store_cookie_with_expiration(d, expiration_date);
+function store_local_pref(k, v) {
+    window.localStorage.setItem('rabbitmq.' + k, v);
 }
 
-function clear_cookie_value(k) {
-    var d = parse_cookie();
-    delete d[short_key(k)];
-    store_cookie(d);
+function clear_local_pref(k) {
+    window.localStorage.removeItem('rabbitmq.' + k);
 }
 
-function get_cookie_value(k) {
-    var r;
-    r = parse_cookie()[short_key(k)];
-    return r == undefined ? default_pref(k) : r;
-}
-function store_local_pref(k, v) {
-    if (local_storage_available()) {
-        window.localStorage.setItem('rabbitmq.' + k, v);
-    }else {
-      throw "Local Storage not available. RabbitMQ requires localStorage"
-    }
-}
-function clear_local_pref(k) {
-    if (local_storage_available()) {
-        window.localStorage.removeItem('rabbitmq.' + k);
-    }
+function get_local_pref(k) {
+    return window.localStorage.getItem('rabbitmq.' + k);
 }
 
 function store_pref(k, v) {
-    if (local_storage_available()) {
-        window.localStorage['rabbitmq.' + k] = v;
-    }
-    else {
-        var d = parse_cookie();
-        d[short_key(k)] = v;
-        store_cookie(d);
-    }
+    store_local_pref(k, v);
 }
 
 function clear_pref(k) {
-    if (local_storage_available()) {
-        window.localStorage.removeItem('rabbitmq.' + k);
-    }
-    else {
-        var d = parse_cookie();
-        delete d[short_key(k)];
-        store_cookie(d);
-    }
-}
-function get_local_pref(k) {
-  if (local_storage_available()) {
-      return window.localStorage.getItem('rabbitmq.' + k)
-  }else {
-    throw "Local Storage not available. RabbitMQ requires localStorage"
-  }
+    clear_local_pref(k);
 }
 
 function get_pref(k, defaultValue = undefined) {
-    var val;
-    if (local_storage_available()) {
-        val = window.localStorage['rabbitmq.' + k];
-    }
-    else {
-        val = parse_cookie()[short_key(k)];
-
-    }
-    var res = (val == undefined) ? 
+    var val = get_local_pref(k);
+    return (val == undefined) ?
         (defaultValue != undefined ? defaultValue : default_pref(k)) : val;
-    return res;
 }
 
 function section_pref(template, name) {
@@ -218,57 +168,3 @@ function default_column_pref(key0) {
     return 'false';
 }
 
-// ---------------------------------------------------------------------------
-
-function parse_cookie() {
-    var c = get_cookie('m');
-    var items = c.length == 0 ? [] : c.split('|');
-
-    var start = 0;
-    var dict = {};
-    for (var i in items) {
-        var kv = items[i].split(':');
-        dict[kv[0]] = unescape(kv[1]);
-    }
-    return dict;
-}
-
-function store_cookie(dict) {
-    store_cookie_with_expiration(dict, default_hard_session_timeout());
-}
-
-function store_cookie_with_expiration(dict, expiration_date) {
-    var enc = [];
-    for (var k in dict) {
-        enc.push(k + ':' + escape(dict[k]));
-    }
-    document.cookie = 'm=' + enc.join('|') + '; expires=' + expiration_date.toUTCString() + "; path=/";
-//    console.log("Cookie m expires at " + expiration_date);
-}
-
-function get_cookie(key) {
-    var cookies = document.cookie.split(';');
-    for (var i in cookies) {
-        var kv = cookies[i].trim().split('=');
-        if (kv[0] == key) return kv[1];
-    }
-    return '';
-}
-
-// Try to economise on space since cookies have limited length.
-function short_key(k) {
-    var res = Math.abs(k.hashCode() << 16 >> 16);
-    res = res.toString(16);
-    return res;
-}
-
-String.prototype.hashCode = function() {
-    var hash = 0;
-    if (this.length == 0) return code;
-    for (i = 0; i < this.length; i++) {
-        char = this.charCodeAt(i);
-        hash = 31*hash+char;
-        hash = hash & hash; // Convert to 32bit integer
-    }
-    return hash;
-}