wmantly
aa3b3ed515
The web management UI was a bespoke minimal theme with LDAP-bind login.
Rebuild it to match the SSO Manager and Proxy — same stack, same look/feel,
same auth model. The SSH bridge, audit, metrics, and access logic are
unchanged; this is purely the web layer.
Frontend (mirrors proxy/sso):
- Express + EJS with the shared top.ejs/bottom.ejs shell, Bootstrap 5,
jQuery, jq-repeat, FontAwesome, Socket.IO, and the shared app-base.js /
val.js client framework (copied verbatim). Vendor libs served from
node_modules via /static-modules; app assets via /static.
- Dashboard / Sessions / Audit pages render in the common look/feel,
loading data through the authenticated /api/* endpoints.
Auth (mirrors proxy):
- OIDC against the SSO (utils/oidc.js + routes/auth.js + models/oidc_state)
plus a local anti-lockout admin (models/user_redis.js, bootstrapped from
auth.adminUsers[0] / auth.localAdminPass). AuthToken sessions carry the
group snapshot; middleware gates the data API on adminGroups or the local
admin. New config: oidc{} + auth.adminUsers/localAdminPass.
- /api/user/me drives the client login state; "Log in with SSO" hidden when
oidc.enabled is false.
Verified end to end: local admin login -> token -> /api/user/me isAdmin,
metrics/sessions/audit 200 with token / 401 without / 401 bad password;
static + page shells serve; 26 tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
95 lines
3.3 KiB
Plaintext
95 lines
3.3 KiB
Plaintext
'use strict';
|
|
//
|
|
// jump-host secrets. Copy to your secrets file and fill in.
|
|
// Bare metal: /etc/jump-host/secrets.js (install.sh seeds this)
|
|
// Docker: mount at /config/jump-secrets.js (the entrypoint points
|
|
// CONF_SECRETS at it); or pass the same values as app_* env.
|
|
//
|
|
// Read by @simpleworkjs/conf via CONF_SECRETS. Precedence (later wins):
|
|
// conf/base.js < conf/<NODE_ENV>.js < this file < app_* env vars.
|
|
//
|
|
module.exports = {
|
|
name: 'My Org',
|
|
|
|
// The directory the users live in (the SSO Manager's OpenLDAP).
|
|
//
|
|
// IMPORTANT: bindDN needs, beyond read on ou=people + ou=groups, WRITE on
|
|
// the sshPublicKey attribute of user entries — the jump host injects its
|
|
// own public key into each user's sshPublicKey on first use so it can
|
|
// connect downstream AS that user. Grant it with an OpenLDAP ACL, e.g.:
|
|
//
|
|
// access to attrs=sshPublicKey
|
|
// by dn.exact="cn=jumphost,ou=people,dc=example,dc=com" write
|
|
// by self write
|
|
// by * read
|
|
//
|
|
// (In the theta-env bundle this ACL is added by the bootstrap for the
|
|
// shared cn=ldapclient service account.)
|
|
ldap: {
|
|
url: 'ldaps://sso.example.com:636',
|
|
bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
|
|
bindPassword: 'CHANGE-ME',
|
|
userBase: 'ou=people,dc=example,dc=com',
|
|
groupBase: 'ou=groups,dc=example,dc=com',
|
|
tlsOptions: { rejectUnauthorized: false },
|
|
},
|
|
|
|
// SSO Manager directory (inventory) API. apiToken is a personal access
|
|
// token (sso_<id>_<secret>) of any user that can read /api/discovery/*.
|
|
sso: {
|
|
url: 'https://sso.example.com',
|
|
apiToken: 'sso_CHANGE_ME',
|
|
},
|
|
|
|
ssh: {
|
|
listenPort: 2222,
|
|
hostKeyPath: '/var/lib/jump-host/keys',
|
|
banner: 'Theta42 Jump Host — authorized use only.\n',
|
|
// 'off' = keys only (recommended for a public host); 'local' = passwords
|
|
// only from loopback/RFC1918 clients, keys-only from the internet;
|
|
// 'all' = passwords from anywhere.
|
|
passwordAuth: 'off',
|
|
allowRawIPs: false,
|
|
connectTimeoutMs: 10000,
|
|
idleTimeoutMs: 0,
|
|
maxSessions: 100,
|
|
// Comment on the injected key; also excludes that key from inbound auth.
|
|
keyComment: 'jump-host@my-org',
|
|
},
|
|
|
|
web: { port: 3002 },
|
|
|
|
// Web UI/API login. Same model as the proxy: OIDC against the SSO for
|
|
// normal users, plus a local anti-lockout admin. Set enabled:true and fill
|
|
// in the endpoints + client creds to turn on "Log in with SSO" (in the
|
|
// theta-env bundle these are provisioned for you).
|
|
oidc: {
|
|
enabled: false,
|
|
issuer: 'https://sso.example.com',
|
|
authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
|
|
tokenEndpoint: 'http://sso-manager:3001/oauth/token',
|
|
userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
|
|
clientId: 'CHANGE_ME',
|
|
clientSecret: 'CHANGE_ME',
|
|
redirectUri: 'https://jump.example.com/api/auth/oidc/callback',
|
|
scopes: ['openid', 'profile', 'email', 'groups'],
|
|
groupsClaim: 'groups',
|
|
usernameClaim: 'preferred_username',
|
|
},
|
|
|
|
auth: {
|
|
// OIDC group memberships that grant web UI/API admin access.
|
|
adminGroups: ['app_sso_admin'],
|
|
// Local anti-lockout admin — the first name is bootstrapped as a
|
|
// redis-backed user on first boot (password from localAdminPass below,
|
|
// or a random one printed to the log once). Works even if OIDC is down.
|
|
adminUsers: ['jumpadmin'],
|
|
localAdminPass: 'CHANGE_ME',
|
|
},
|
|
|
|
redis: {
|
|
prefix: 'jump_host_',
|
|
redisConf: { url: 'redis://127.0.0.1:6379' },
|
|
},
|
|
};
|