controller/auth: Implement JWT based authorization for controller. (#2544)

Fixes #2474

cmd/controller-handlers.go

@@ -16,8 +16,31 @@
 
 package cmd
 
+/// Auth operations
+
+// Login - login handler.
+func (c *controllerAPIHandlers) LoginHandler(args *RPCLoginArgs, reply *RPCLoginReply) error {
+	jwt, err := newJWT(defaultTokenExpiry)
+	if err != nil {
+		return err
+	}
+	if err = jwt.Authenticate(args.Username, args.Password); err != nil {
+		return err
+	}
+	token, err := jwt.GenerateToken(args.Username)
+	if err != nil {
+		return err
+	}
+	reply.Token = token
+	reply.ServerVersion = Version
+	return nil
+}
+
 // HealListArgs - argument for ListObjects RPC.
 type HealListArgs struct {
+	// Authentication token generated by Login.
+	GenericArgs
+
 	Bucket    string
 	Prefix    string
 	Marker    string
@@ -25,7 +48,7 @@ type HealListArgs struct {
 	MaxKeys   int
 }
 
-// HealListReply - reply by ListObjects RPC.
+// HealListReply - reply object by ListObjects RPC.
 type HealListReply struct {
 	IsTruncated bool
 	NextMarker  string
@@ -33,12 +56,15 @@ type HealListReply struct {
 }
 
 // ListObjects - list all objects that needs healing.
-func (c *controllerAPIHandlers) ListObjectsHeal(arg *HealListArgs, reply *HealListReply) error {
+func (c *controllerAPIHandlers) ListObjectsHealHandler(args *HealListArgs, reply *HealListReply) error {
 	objAPI := c.ObjectAPI()
 	if objAPI == nil {
-		return errInvalidArgument
+		return errVolumeBusy
 	}
-	info, err := objAPI.ListObjectsHeal(arg.Bucket, arg.Prefix, arg.Marker, arg.Delimiter, arg.MaxKeys)
+	if !isRPCTokenValid(args.Token) {
+		return errInvalidToken
+	}
+	info, err := objAPI.ListObjectsHeal(args.Bucket, args.Prefix, args.Marker, args.Delimiter, args.MaxKeys)
 	if err != nil {
 		return err
 	}
@@ -52,7 +78,13 @@ func (c *controllerAPIHandlers) ListObjectsHeal(arg *HealListArgs, reply *HealLi
 
 // HealObjectArgs - argument for HealObject RPC.
 type HealObjectArgs struct {
+	// Authentication token generated by Login.
+	GenericArgs
+
+	// Name of the bucket.
 	Bucket string
+
+	// Name of the object.
 	Object string
 }
 
@@ -60,26 +92,33 @@ type HealObjectArgs struct {
 type HealObjectReply struct{}
 
 // HealObject - heal the object.
-func (c *controllerAPIHandlers) HealObject(arg *HealObjectArgs, reply *HealObjectReply) error {
+func (c *controllerAPIHandlers) HealObjectHandler(args *HealObjectArgs, reply *GenericReply) error {
 	objAPI := c.ObjectAPI()
 	if objAPI == nil {
-		return errInvalidArgument
+		return errVolumeBusy
 	}
-	return objAPI.HealObject(arg.Bucket, arg.Object)
+	if !isRPCTokenValid(args.Token) {
+		return errInvalidToken
+	}
+	return objAPI.HealObject(args.Bucket, args.Object)
 }
 
 // ShutdownArgs - argument for Shutdown RPC.
 type ShutdownArgs struct {
-	Reboot bool
+	// Authentication token generated by Login.
+	GenericArgs
+
+	// Should the server be restarted, call active connections are served before server
+	// is restarted.
+	Restart bool
 }
 
-// ShutdownReply - reply by Shutdown RPC.
-type ShutdownReply struct{}
-
-// Shutdown - Shutdown the server.
-
-func (c *controllerAPIHandlers) Shutdown(arg *ShutdownArgs, reply *ShutdownReply) error {
-	if arg.Reboot {
+// Shutdown - Shutsdown the server.
+func (c *controllerAPIHandlers) ShutdownHandler(args *ShutdownArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errInvalidToken
+	}
+	if args.Restart {
 		globalShutdownSignalCh <- shutdownRestart
 	} else {
 		globalShutdownSignalCh <- shutdownHalt