// InitFromMetadataOrJSON must be called before any other login methods.
//
// InitFromMetadataOrJSON will eventually replace all instances of Init, at
// which point it will be renamed back to Init().
//
// The function first tries to load the cookie salt, client id, and client
// secret from GCE project level metadata. If that fails it looks for a
// "client_secret.json" file in the current directory to extract the client id
// and client secret from. If both of those fail then it returns an error.
//
// The authWhiteList is the space separated list of domains and email addresses
// that are allowed to log in. The authWhiteList will be overwritten from
// GCE instance level metadata if present.
func InitFromMetadataOrJSON(redirectURL, scopes string, authWhiteList string) error {
cookieSalt, clientID, clientSecret := tryLoadingFromMetadata()
if clientID == "" {
b, err := ioutil.ReadFile("client_secret.json")
if err != nil {
return fmt.Errorf("Failed to read from metadata and from client_secret.json file: %s", err)
}
config, err := google.ConfigFromJSON(b)
if err != nil {
return fmt.Errorf("Failed to read from metadata and decode client_secret.json file: %s", err)
}
clientID = config.ClientID
clientSecret = config.ClientSecret
}
secureCookie = securecookie.New([]byte(cookieSalt), nil)
oauthConfig.ClientId = clientID
oauthConfig.ClientSecret = clientSecret
oauthConfig.RedirectURL = redirectURL
oauthConfig.Scope = scopes
// We allow for meta data to not be present.
whiteList, err := metadata.Get(metadata.AUTH_WHITE_LIST)
if err != nil {
glog.Infof("Failed to retrieve auth whitelist from instance meta data: %s", err)
} else {
authWhiteList = whiteList
}
activeDomainWhiteList, activeEmailWhiteList = splitAuthWhiteList(authWhiteList)
return nil
}
// Init must be called before any other methods.
//
// The Client ID, Client Secret, and Redirect URL are listed in the Google
// Developers Console. The authWhiteList is the space separated list of domains
// and email addresses that are allowed to log in.
func Init(clientId, clientSecret, redirectURL, cookieSalt, scope string, authWhiteList string, local bool) {
secureCookie = securecookie.New([]byte(cookieSalt), nil)
oauthConfig.ClientId = clientId
oauthConfig.ClientSecret = clientSecret
oauthConfig.RedirectURL = redirectURL
oauthConfig.Scope = scope
// If we are in the cloud and there is a whitelist in meta data then use the
// meta data version.
if !local {
// We allow for meta data to not be present.
whiteList, err := metadata.Get(metadata.AUTH_WHITE_LIST)
if err != nil {
glog.Infof("Unable to retrieve auth whitelist from meta data. Error:", err)
} else {
authWhiteList = whiteList
}
}
activeDomainWhiteList, activeEmailWhiteList = splitAuthWhiteList(authWhiteList)
}