// Authorize authorizes user based on identity supplied via context
19880
func (r *contextAuthorizer) Authorize(ctx context.Context) (*AuthContext, error) {
	return &r.authContext, nil
}
781159
func (a *ArgoCDServer) authenticate(ctx context.Context) (context.Context, error) {
	if a.DisableAuth {
		return ctx, nil
	}
	md, ok := metadata.FromIncomingContext(ctx)
	if !ok {
		return ctx, ErrNoSession
	}
	tokenString := getToken(md)
	if tokenString == "" {
		return ctx, ErrNoSession
	}
	claims, err := a.sessionMgr.VerifyToken(tokenString)
	if err != nil {
		return ctx, status.Errorf(codes.Unauthenticated, "invalid session: %v", err)
	}
	// Add claims to the context to inspect for RBAC
	ctx = context.WithValue(ctx, "claims", claims)
	return ctx, nil
}
299839
func (s *OauthService) AuthorizeURL(clientID string, options *AuthorizationOptions) string {
	uri, _ := url.Parse(strings.Replace(s.client.BaseURL, "api.", "", 1))
	uri.Path = "/oauth/authorize"
	query := uri.Query()
	query.Add("client_id", clientID)
	query.Add("response_type", "code")
	uri.RawQuery = query.Encode()

	path, _ := addURLQueryOptions(uri.String(), options)
	return path
}
822810
func (a controllerAdminAuthorizer) Authorize(authInfo httpcontext.AuthInfo) error {
	userTag, ok := authInfo.Entity.Tag().(names.UserTag)
	if !ok {
		return errors.Errorf("%s is not a user", names.ReadableString(authInfo.Entity.Tag()))
	}
	admin, err := a.st.IsControllerAdmin(userTag)
	if err != nil {
		return errors.Trace(err)
	}
	if !admin {
		return errors.Errorf("%s is not a controller admin", names.ReadableString(authInfo.Entity.Tag()))
	}
	return nil
}
1030770
func (a *Authenticator) Serialize(context.Context, oauth2.Principal) (string, error) {
	return a.Serialized, nil
}
807470
func (id *SpiffeIDSigning) Authorize(ixn *structs.Intention) (bool, bool) {
	// Never authorize as a client.
	return false, true
}
662287
func (d *DigestAuth) Authorize(c *Client, method string, path string) {
	d.digestParts["uri"] = path
	d.digestParts["method"] = method
	d.digestParts["username"] = d.user
	d.digestParts["password"] = d.pw
	c.headers.Set("Authorization", getDigestAuthorization(d.digestParts))
}
1110323
func (r *rest) AppAuthorize(c *gin.Context) {
	resp := r.server.NewResponse()
	defer resp.Close()
	if ar := r.server.HandleAuthorizeRequest(resp, c.Request); ar != nil {
		userId, ok := handleLoginPage(r, ar, c)
		if !ok {
			return
		}
		ar.UserData = userId
		ar.Authorized = true
		r.server.FinishAuthorizeRequest(resp, c.Request, ar)
	}
	if resp.IsError && resp.InternalError != nil {
		log.Printf("ERROR: %s\n", resp.InternalError)
	}
	if !resp.IsError {
		//resp.Output["custom_parameter"] = 42
	}
	osin.OutputJSON(resp, c.Writer, c.Request)
}
485781
func (a *authorizer) authorizeBuiltinRole(r BuiltinRole) (*AuthContext, error) {
	config, err := r.GetClusterConfig()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	return contextForBuiltinRole(r.ClusterName, config, r.Role, r.Username)
}
999941
func (a *authorizer) authorizeRemoteUser(u RemoteUser) (*AuthContext, error) {
	ca, err := a.trust.GetCertAuthority(services.CertAuthID{Type: services.UserCA, DomainName: u.ClusterName}, false)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	roleNames, err := ca.CombinedMapping().Map(u.RemoteRoles)
	if err != nil {
		return nil, trace.AccessDenied("failed to map roles for remote user %q from cluster %q", u.Username, u.ClusterName)
	}
	if len(roleNames) == 0 {
		return nil, trace.AccessDenied("no roles mapped for remote user %q from cluster %q", u.Username, u.ClusterName)
	}
	// Set "logins" trait and "kubernetes_groups" for the remote user. This allows Teleport to work by
	// passing exact logins and kubernetes groups to the remote cluster. Note that claims (OIDC/SAML)
	// are not passed, but rather the exact logins, this is done to prevent
	// leaking too much of identity to the remote cluster, and instead of focus
	// on main cluster's interpretation of this identity
	traits := map[string][]string{
		teleport.TraitLogins:     u.Principals,
		teleport.TraitKubeGroups: u.KubernetesGroups,
	}
	log.Debugf("Mapped roles %v of remote user %q to local roles %v and traits %v.", u.RemoteRoles, u.Username, roleNames, traits)
	checker, err := services.FetchRoles(roleNames, a.access, traits)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	// The user is prefixed with "remote-" and suffixed with cluster name with
	// the hope that it does not match a real local user.
	user, err := services.NewUser(fmt.Sprintf("remote-%v-%v", u.Username, u.ClusterName))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	user.SetTraits(traits)

	// Set the list of roles this user has in the remote cluster.
	user.SetRoles(roleNames)

	return &AuthContext{
		User:    user,
		Checker: checker,
	}, nil
}
860938
func (self *OAuth1Mixin) AuthorizeToken(w http.ResponseWriter, r *http.Request) (*oauth1.AccessToken, error) {

	//Get the presisted request token
	cookie, err := r.Cookie("_token")
	if err != nil {
		return nil, nil
	}

	//Parse the persisted request token
	requestToken, err := oauth1.ParseRequestTokenStr(cookie.Value)
	if err != nil {
		return nil, err
	}

	//Delete the request Token ...don't need it anymore
	DeleteUserCookieName(w,r,"_token")

	//Parse the verification code from the Redirect URL
	verifier := r.URL.Query().Get("oauth_verifier")

	//Upgrade to an Authorization Token
	accessToken, err := self.Consumer.AuthorizeToken(requestToken, verifier)
	if err != nil {
		return nil, err
	}

	return accessToken, nil
}
1083665
func (s *storage) LoadAuthorize(code string) (*osin.AuthorizeData, error) {
	authorize, err := s.authorizetoken.Get(code, metav1.GetOptions{})
	if kerrors.IsNotFound(err) {
		klog.V(5).Info("Authorization code not found")
		return nil, nil
	}
	if err != nil {
		return nil, err
	}
	return s.convertFromAuthorizeToken(authorize)
}
881741
func (a *Authenticator) Authorize(ctx context.Context, w http.ResponseWriter, p oauth2.Principal) error {
	cookie := http.Cookie{}

	http.SetCookie(w, &cookie)
	return nil
}
362621
func (context *APIContext) Authentication(request *restful.Request) (interface{}, error) {
	//FIXME: implement this properly

	t := request.QueryParameter("accesstoken")
	if len(t) == 0 {
		t = request.HeaderParameter("authorization")
		if strings.Index(t, " ") > 0 {
			t = strings.TrimSpace(strings.Split(t, " ")[1])
		}
	}

	return nil, nil // context.GetUserByAccessToken(t)
}
567574
func (s *Session) Authorize(provider goth.Provider, params goth.Params) (string, error) {
	s.AccessToken = "access"
	return s.AccessToken, nil
}
946789
func (u Util) AuthorizeSSHKeys(c types.PasswdUser) error {
	if len(c.SSHAuthorizedKeys) == 0 {
		return nil
	}

	return u.LogOp(func() error {
		usr, err := u.userLookup(c.Name)
		if err != nil {
			return fmt.Errorf("unable to lookup user %q", c.Name)
		}

		// TODO(vc): introduce key names to config?
		// TODO(vc): validate c.SSHAuthorizedKeys well-formedness.
		ks := strings.Join(translateV2_1SSHAuthorizedKeySliceToStringSlice(c.SSHAuthorizedKeys), "\n")
		// XXX(vc): for now ensure the addition is always
		// newline-terminated.  A future version of akd will handle this
		// for us in addition to validating the ssh keys for
		// well-formedness.
		if !strings.HasSuffix(ks, "\n") {
			ks = ks + "\n"
		}

		if distro.WriteAuthorizedKeysFragment() {
			writeAuthKeysFile(usr, filepath.Join(usr.HomeDir, ".ssh", "authorized_keys.d", "ignition"), []byte(ks))
		} else {
			writeAuthKeysFile(usr, filepath.Join(usr.HomeDir, ".ssh", "authorized_keys"), []byte(ks))
		}

		return nil
	}, "adding ssh keys to user %q", c.Name)
}
298927
func (a *Authorizer) Apply(next web.HandlerFunc) web.HandlerFunc {
	if a.Checker == nil {
		panic("Authorizer requires an checker function")
	}

	if a.LoginURL == "" {
		a.LoginURL = "/login"
	}
	if a.UnauthorizedMsg == "" {
		a.UnauthorizedMsg = "You are not logged in"
	}
	if a.ForbiddenMsg == "" {
		a.ForbiddenMsg = "You do not have access to this URL"
	}

	return func(ctx web.Context) error {
		auth := ctx.Handler().Authorize()
		if auth == web.AuthAnonymous {
			return next(ctx)
		}

		user := ctx.User()
		if user == nil || user.Anonymous() {
			ct := ctx.ContentType()
			if ct == web.MIMEApplicationJSON {
				//return web.NewError(http.StatusUnauthorized)
				return ctx.Status(http.StatusUnauthorized).JSON(data.Map{
					"url":       ctx.Route(),
					"code":      http.StatusUnauthorized,
					"message":   a.UnauthorizedMsg,
					"login_url": a.LoginURL,
				})
			} else if ctx.IsAJAX() {
				return ctx.Status(http.StatusUnauthorized).HTML(a.UnauthorizedMsg)
			}

			u, err := url.Parse(a.LoginURL)
			if err != nil {
				return err
			}
			q := u.Query()
			q.Set("from", ctx.Request().RequestURI)
			u.RawQuery = q.Encode()
			return ctx.Redirect(u.String())
		}

		if auth == web.AuthExplicit && !a.Checker(user, ctx.Handler()) {
			return web.NewError(http.StatusForbidden, a.ForbiddenMsg)
		}
		return next(ctx)
	}
}