Squashed 'k8smain/' content from commit 719158d

git-subtree-dir: k8smain
git-subtree-split: 719158d2c8788c30cc9e1c51bbebb53c5801524e

plugin/pkg/auth/authenticator/token/oidc/oidc.go

@@ -0,0 +1,183 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// oidc implements the authenticator.Token interface using the OpenID Connect protocol.
+package oidc
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-oidc/jose"
+	"github.com/coreos/go-oidc/oidc"
+	"github.com/golang/glog"
+	"k8s.io/kubernetes/pkg/auth/user"
+	"k8s.io/kubernetes/pkg/util"
+	"k8s.io/kubernetes/pkg/util/net"
+)
+
+var (
+	maxRetries   = 5
+	retryBackoff = time.Second * 3
+)
+
+type OIDCAuthenticator struct {
+	clientConfig     oidc.ClientConfig
+	client           *oidc.Client
+	usernameClaim    string
+	groupsClaim      string
+	stopSyncProvider chan struct{}
+}
+
+// New creates a new OpenID Connect client with the given issuerURL and clientID.
+// NOTE(yifan): For now we assume the server provides the "jwks_uri" so we don't
+// need to manager the key sets by ourselves.
+func New(issuerURL, clientID, caFile, usernameClaim, groupsClaim string) (*OIDCAuthenticator, error) {
+	var cfg oidc.ProviderConfig
+	var err error
+	var roots *x509.CertPool
+
+	url, err := url.Parse(issuerURL)
+	if err != nil {
+		return nil, err
+	}
+
+	if url.Scheme != "https" {
+		return nil, fmt.Errorf("'oidc-issuer-url' (%q) has invalid scheme (%q), require 'https'", issuerURL, url.Scheme)
+	}
+
+	if caFile != "" {
+		roots, err = util.CertPoolFromFile(caFile)
+		if err != nil {
+			glog.Errorf("Failed to read the CA file: %v", err)
+		}
+	}
+	if roots == nil {
+		glog.Info("No x509 certificates provided, will use host's root CA set")
+	}
+
+	// Copied from http.DefaultTransport.
+	tr := net.SetTransportDefaults(&http.Transport{
+		// According to golang's doc, if RootCAs is nil,
+		// TLS uses the host's root CA set.
+		TLSClientConfig: &tls.Config{RootCAs: roots},
+	})
+
+	hc := &http.Client{}
+	hc.Transport = tr
+
+	for i := 0; i <= maxRetries; i++ {
+		if i == maxRetries {
+			return nil, fmt.Errorf("failed to fetch provider config after %v retries", maxRetries)
+		}
+
+		cfg, err = oidc.FetchProviderConfig(hc, strings.TrimSuffix(issuerURL, "/"))
+		if err == nil {
+			break
+		}
+		glog.Errorf("Failed to fetch provider config, trying again in %v: %v", retryBackoff, err)
+		time.Sleep(retryBackoff)
+	}
+
+	glog.Infof("Fetched provider config from %s: %#v", issuerURL, cfg)
+
+	if cfg.KeysEndpoint == "" {
+		return nil, fmt.Errorf("OIDC provider must provide 'jwks_uri' for public key discovery")
+	}
+
+	ccfg := oidc.ClientConfig{
+		HTTPClient:     hc,
+		Credentials:    oidc.ClientCredentials{ID: clientID},
+		ProviderConfig: cfg,
+	}
+
+	client, err := oidc.NewClient(ccfg)
+	if err != nil {
+		return nil, err
+	}
+
+	// SyncProviderConfig will start a goroutine to periodically synchronize the provider config.
+	// The synchronization interval is set by the expiration length of the config, and has a mininum
+	// and maximum threshold.
+	stop := client.SyncProviderConfig(issuerURL)
+
+	return &OIDCAuthenticator{ccfg, client, usernameClaim, groupsClaim, stop}, nil
+}
+
+// AuthenticateToken decodes and verifies a JWT using the OIDC client, if the verification succeeds,
+// then it will extract the user info from the JWT claims.
+func (a *OIDCAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {
+	jwt, err := jose.ParseJWT(value)
+	if err != nil {
+		return nil, false, err
+	}
+
+	if err := a.client.VerifyJWT(jwt); err != nil {
+		return nil, false, err
+	}
+
+	claims, err := jwt.Claims()
+	if err != nil {
+		return nil, false, err
+	}
+
+	claim, ok, err := claims.StringClaim(a.usernameClaim)
+	if err != nil {
+		return nil, false, err
+	}
+	if !ok {
+		return nil, false, fmt.Errorf("cannot find %q in JWT claims", a.usernameClaim)
+	}
+
+	var username string
+	switch a.usernameClaim {
+	case "email":
+		// TODO(yifan): Check 'email_verified' to make sure the email is valid.
+		username = claim
+	default:
+		// For all other cases, use issuerURL + claim as the user name.
+		username = fmt.Sprintf("%s#%s", a.clientConfig.ProviderConfig.Issuer, claim)
+	}
+
+	// TODO(yifan): Add UID, also populate the issuer to upper layer.
+	info := &user.DefaultInfo{Name: username}
+
+	if a.groupsClaim != "" {
+		groups, found, err := claims.StringsClaim(a.groupsClaim)
+		if err != nil {
+			// Custom claim is present, but isn't an array of strings.
+			return nil, false, fmt.Errorf("custom group claim contains invalid object: %v", err)
+		}
+		if found {
+			info.Groups = groups
+		}
+	}
+	return info, true, nil
+}
+
+// Close closes the OIDC authenticator, this will close the provider sync goroutine.
+func (a *OIDCAuthenticator) Close() {
+	// This assumes the s.stopSyncProvider is an unbuffered channel.
+	// So instead of closing the channel, we send am empty struct here.
+	// This guarantees that when this function returns, there is no flying requests,
+	// because a send to an unbuffered channel happens after the receive from the channel.
+	a.stopSyncProvider <- struct{}{}
+}

plugin/pkg/auth/authenticator/token/oidc/oidc_test.go

@@ -0,0 +1,428 @@
+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oidc
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"io/ioutil"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/jose"
+	"github.com/coreos/go-oidc/key"
+	"github.com/coreos/go-oidc/oidc"
+	"k8s.io/kubernetes/pkg/auth/user"
+)
+
+type oidcProvider struct {
+	mux     *http.ServeMux
+	pcfg    oidc.ProviderConfig
+	privKey *key.PrivateKey
+}
+
+func newOIDCProvider(t *testing.T) *oidcProvider {
+	privKey, err := key.GeneratePrivateKey()
+	if err != nil {
+		t.Fatalf("Cannot create OIDC Provider: %v", err)
+		return nil
+	}
+
+	op := &oidcProvider{
+		mux:     http.NewServeMux(),
+		privKey: privKey,
+	}
+
+	op.mux.HandleFunc("/.well-known/openid-configuration", op.handleConfig)
+	op.mux.HandleFunc("/keys", op.handleKeys)
+
+	return op
+
+}
+
+func (op *oidcProvider) handleConfig(w http.ResponseWriter, req *http.Request) {
+	b, err := json.Marshal(op.pcfg)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(b)
+}
+
+func (op *oidcProvider) handleKeys(w http.ResponseWriter, req *http.Request) {
+	keys := struct {
+		Keys []jose.JWK `json:"keys"`
+	}{
+		Keys: []jose.JWK{op.privKey.JWK()},
+	}
+
+	b, err := json.Marshal(keys)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%d", int(time.Hour.Seconds())))
+	w.Header().Set("Expires", time.Now().Add(time.Hour).Format(time.RFC1123))
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(b)
+}
+
+func (op *oidcProvider) generateToken(t *testing.T, iss, sub, aud string, usernameClaim, value, groupsClaim string, groups []string, iat, exp time.Time) string {
+	signer := op.privKey.Signer()
+	claims := oidc.NewClaims(iss, sub, aud, iat, exp)
+	claims.Add(usernameClaim, value)
+	if groups != nil && groupsClaim != "" {
+		claims.Add(groupsClaim, groups)
+	}
+
+	jwt, err := jose.NewSignedJWT(claims, signer)
+	if err != nil {
+		t.Fatalf("Cannot generate token: %v", err)
+		return ""
+	}
+	return jwt.Encode()
+}
+
+func (op *oidcProvider) generateGoodToken(t *testing.T, iss, sub, aud string, usernameClaim, value, groupsClaim string, groups []string) string {
+	return op.generateToken(t, iss, sub, aud, usernameClaim, value, groupsClaim, groups, time.Now(), time.Now().Add(time.Hour))
+}
+
+func (op *oidcProvider) generateMalformedToken(t *testing.T, iss, sub, aud string, usernameClaim, value, groupsClaim string, groups []string) string {
+	return op.generateToken(t, iss, sub, aud, usernameClaim, value, groupsClaim, groups, time.Now(), time.Now().Add(time.Hour)) + "randombits"
+}
+
+func (op *oidcProvider) generateExpiredToken(t *testing.T, iss, sub, aud string, usernameClaim, value, groupsClaim string, groups []string) string {
+	return op.generateToken(t, iss, sub, aud, usernameClaim, value, groupsClaim, groups, time.Now().Add(-2*time.Hour), time.Now().Add(-1*time.Hour))
+}
+
+// generateSelfSignedCert generates a self-signed cert/key pairs and writes to the certPath/keyPath.
+// This method is mostly identical to util.GenerateSelfSignedCert except for the 'IsCA' and 'KeyUsage'
+// in the certificate template. (Maybe we can merge these two methods).
+func generateSelfSignedCert(t *testing.T, host, certPath, keyPath string) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: fmt.Sprintf("%s@%d", host, time.Now().Unix()),
+		},
+		NotBefore: time.Now(),
+		NotAfter:  time.Now().Add(time.Hour * 24 * 365),
+
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		IsCA: true,
+	}
+
+	if ip := net.ParseIP(host); ip != nil {
+		template.IPAddresses = append(template.IPAddresses, ip)
+	} else {
+		template.DNSNames = append(template.DNSNames, host)
+	}
+
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Generate cert
+	certBuffer := bytes.Buffer{}
+	if err := pem.Encode(&certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Generate key
+	keyBuffer := bytes.Buffer{}
+	if err := pem.Encode(&keyBuffer, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Write cert
+	if err := os.MkdirAll(filepath.Dir(certPath), os.FileMode(0755)); err != nil {
+		t.Fatal(err)
+	}
+	if err := ioutil.WriteFile(certPath, certBuffer.Bytes(), os.FileMode(0644)); err != nil {
+		t.Fatal(err)
+	}
+
+	// Write key
+	if err := os.MkdirAll(filepath.Dir(keyPath), os.FileMode(0755)); err != nil {
+		t.Fatal(err)
+	}
+	if err := ioutil.WriteFile(keyPath, keyBuffer.Bytes(), os.FileMode(0600)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOIDCDiscoveryTimeout(t *testing.T) {
+	maxRetries = 3
+	retryBackoff = time.Second
+	expectErr := fmt.Errorf("failed to fetch provider config after 3 retries")
+
+	_, err := New("https://foo/bar", "client-foo", "", "sub", "")
+	if !reflect.DeepEqual(err, expectErr) {
+		t.Errorf("Expecting %v, but got %v", expectErr, err)
+	}
+}
+
+func TestOIDCDiscoveryNoKeyEndpoint(t *testing.T) {
+	var err error
+	expectErr := fmt.Errorf("OIDC provider must provide 'jwks_uri' for public key discovery")
+
+	cert := path.Join(os.TempDir(), "oidc-cert")
+	key := path.Join(os.TempDir(), "oidc-key")
+
+	defer os.Remove(cert)
+	defer os.Remove(key)
+
+	generateSelfSignedCert(t, "127.0.0.1", cert, key)
+
+	op := newOIDCProvider(t)
+	srv := httptest.NewUnstartedServer(op.mux)
+	srv.TLS = &tls.Config{Certificates: make([]tls.Certificate, 1)}
+	srv.TLS.Certificates[0], err = tls.LoadX509KeyPair(cert, key)
+	if err != nil {
+		t.Fatalf("Cannot load cert/key pair: %v", err)
+	}
+	srv.StartTLS()
+	// TODO: Uncomment when fix #19254
+	// defer srv.Close()
+
+	op.pcfg = oidc.ProviderConfig{
+		Issuer: srv.URL,
+	}
+
+	_, err = New(srv.URL, "client-foo", cert, "sub", "")
+	if !reflect.DeepEqual(err, expectErr) {
+		t.Errorf("Expecting %v, but got %v", expectErr, err)
+	}
+}
+
+func TestOIDCDiscoverySecureConnection(t *testing.T) {
+	maxRetries = 3
+	retryBackoff = time.Second
+
+	// Verify that plain HTTP issuer URL is forbidden.
+	op := newOIDCProvider(t)
+	srv := httptest.NewServer(op.mux)
+	// TODO: Uncomment when fix #19254
+	// defer srv.Close()
+
+	op.pcfg = oidc.ProviderConfig{
+		Issuer:       srv.URL,
+		KeysEndpoint: srv.URL + "/keys",
+	}
+
+	expectErr := fmt.Errorf("'oidc-issuer-url' (%q) has invalid scheme (%q), require 'https'", srv.URL, "http")
+
+	_, err := New(srv.URL, "client-foo", "", "sub", "")
+	if !reflect.DeepEqual(err, expectErr) {
+		t.Errorf("Expecting %v, but got %v", expectErr, err)
+	}
+
+	// Verify the cert/key pair works.
+	cert1 := path.Join(os.TempDir(), "oidc-cert-1")
+	key1 := path.Join(os.TempDir(), "oidc-key-1")
+	cert2 := path.Join(os.TempDir(), "oidc-cert-2")
+	key2 := path.Join(os.TempDir(), "oidc-key-2")
+
+	defer os.Remove(cert1)
+	defer os.Remove(key1)
+	defer os.Remove(cert2)
+	defer os.Remove(key2)
+
+	generateSelfSignedCert(t, "127.0.0.1", cert1, key1)
+	generateSelfSignedCert(t, "127.0.0.1", cert2, key2)
+
+	// Create a TLS server using cert/key pair 1.
+	tlsSrv := httptest.NewUnstartedServer(op.mux)
+	tlsSrv.TLS = &tls.Config{Certificates: make([]tls.Certificate, 1)}
+	tlsSrv.TLS.Certificates[0], err = tls.LoadX509KeyPair(cert1, key1)
+	if err != nil {
+		t.Fatalf("Cannot load cert/key pair: %v", err)
+	}
+	tlsSrv.StartTLS()
+	// TODO: Uncomment when fix #19254
+	// defer tlsSrv.Close()
+
+	op.pcfg = oidc.ProviderConfig{
+		Issuer:       tlsSrv.URL,
+		KeysEndpoint: tlsSrv.URL + "/keys",
+	}
+
+	// Create a client using cert2, should fail.
+	_, err = New(tlsSrv.URL, "client-foo", cert2, "sub", "")
+	if err == nil {
+		t.Fatalf("Expecting error, but got nothing")
+	}
+
+}
+
+func TestOIDCAuthentication(t *testing.T) {
+	var err error
+
+	cert := path.Join(os.TempDir(), "oidc-cert")
+	key := path.Join(os.TempDir(), "oidc-key")
+
+	defer os.Remove(cert)
+	defer os.Remove(key)
+
+	generateSelfSignedCert(t, "127.0.0.1", cert, key)
+
+	// Create a TLS server and a client.
+	op := newOIDCProvider(t)
+	srv := httptest.NewUnstartedServer(op.mux)
+	srv.TLS = &tls.Config{Certificates: make([]tls.Certificate, 1)}
+	srv.TLS.Certificates[0], err = tls.LoadX509KeyPair(cert, key)
+	if err != nil {
+		t.Fatalf("Cannot load cert/key pair: %v", err)
+	}
+	srv.StartTLS()
+	// TODO: Uncomment when fix #19254
+	// defer srv.Close()
+
+	op.pcfg = oidc.ProviderConfig{
+		Issuer:       srv.URL,
+		KeysEndpoint: srv.URL + "/keys",
+	}
+
+	tests := []struct {
+		userClaim   string
+		groupsClaim string
+		token       string
+		userInfo    user.Info
+		verified    bool
+		err         string
+	}{
+		{
+			"sub",
+			"",
+			op.generateGoodToken(t, srv.URL, "client-foo", "client-foo", "sub", "user-foo", "", nil),
+			&user.DefaultInfo{Name: fmt.Sprintf("%s#%s", srv.URL, "user-foo")},
+			true,
+			"",
+		},
+		{
+			// Use user defined claim (email here).
+			"email",
+			"",
+			op.generateGoodToken(t, srv.URL, "client-foo", "client-foo", "email", "foo@example.com", "", nil),
+			&user.DefaultInfo{Name: "foo@example.com"},
+			true,
+			"",
+		},
+		{
+			// Use user defined claim (email here).
+			"email",
+			"",
+			op.generateGoodToken(t, srv.URL, "client-foo", "client-foo", "email", "foo@example.com", "groups", []string{"group1", "group2"}),
+			&user.DefaultInfo{Name: "foo@example.com"},
+			true,
+			"",
+		},
+		{
+			// Use user defined claim (email here).
+			"email",
+			"groups",
+			op.generateGoodToken(t, srv.URL, "client-foo", "client-foo", "email", "foo@example.com", "groups", []string{"group1", "group2"}),
+			&user.DefaultInfo{Name: "foo@example.com", Groups: []string{"group1", "group2"}},
+			true,
+			"",
+		},
+		{
+			"sub",
+			"",
+			op.generateMalformedToken(t, srv.URL, "client-foo", "client-foo", "sub", "user-foo", "", nil),
+			nil,
+			false,
+			"malformed JWS, unable to decode signature",
+		},
+		{
+			// Invalid 'aud'.
+			"sub",
+			"",
+			op.generateGoodToken(t, srv.URL, "client-foo", "client-bar", "sub", "user-foo", "", nil),
+			nil,
+			false,
+			"oidc: JWT claims invalid: invalid claims, 'aud' claim and 'client_id' do not match",
+		},
+		{
+			// Invalid issuer.
+			"sub",
+			"",
+			op.generateGoodToken(t, "http://foo-bar.com", "client-foo", "client-foo", "sub", "user-foo", "", nil),
+			nil,
+			false,
+			"oidc: JWT claims invalid: invalid claim value: 'iss'.",
+		},
+		{
+			"sub",
+			"",
+			op.generateExpiredToken(t, srv.URL, "client-foo", "client-foo", "sub", "user-foo", "", nil),
+			nil,
+			false,
+			"oidc: JWT claims invalid: token is expired",
+		},
+	}
+
+	for i, tt := range tests {
+		client, err := New(srv.URL, "client-foo", cert, tt.userClaim, tt.groupsClaim)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		user, result, err := client.AuthenticateToken(tt.token)
+		if tt.err != "" {
+			if !strings.HasPrefix(err.Error(), tt.err) {
+				t.Errorf("#%d: Expecting: %v..., but got: %v", i, tt.err, err)
+			}
+		} else {
+			if err != nil {
+				t.Errorf("#%d: Unexpected error: %v", i, err)
+			}
+		}
+		if !reflect.DeepEqual(tt.verified, result) {
+			t.Errorf("#%d: Expecting: %v, but got: %v", i, tt.verified, result)
+		}
+		if !reflect.DeepEqual(tt.userInfo, user) {
+			t.Errorf("#%d: Expecting: %v, but got: %v", i, tt.userInfo, user)
+		}
+		client.Close()
+	}
+}

plugin/pkg/auth/authenticator/token/tokenfile/tokenfile.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tokenfile
+
+import (
+	"encoding/csv"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"k8s.io/kubernetes/pkg/auth/user"
+)
+
+type TokenAuthenticator struct {
+	tokens map[string]*user.DefaultInfo
+}
+
+// NewCSV returns a TokenAuthenticator, populated from a CSV file.
+// The CSV file must contain records in the format "token,username,useruid"
+func NewCSV(path string) (*TokenAuthenticator, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	tokens := make(map[string]*user.DefaultInfo)
+	reader := csv.NewReader(file)
+	reader.FieldsPerRecord = -1
+	for {
+		record, err := reader.Read()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		if len(record) < 3 {
+			return nil, fmt.Errorf("token file '%s' must have at least 3 columns (token, user name, user uid), found %d", path, len(record))
+		}
+		obj := &user.DefaultInfo{
+			Name: record[1],
+			UID:  record[2],
+		}
+		tokens[record[0]] = obj
+
+		if len(record) >= 4 {
+			obj.Groups = strings.Split(record[3], ",")
+		}
+	}
+
+	return &TokenAuthenticator{
+		tokens: tokens,
+	}, nil
+}
+
+func (a *TokenAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {
+	user, ok := a.tokens[value]
+	if !ok {
+		return nil, false, nil
+	}
+	return user, true, nil
+}

plugin/pkg/auth/authenticator/token/tokenfile/tokenfile_test.go

@@ -0,0 +1,141 @@
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tokenfile
+
+import (
+	"io/ioutil"
+	"os"
+	"reflect"
+	"testing"
+
+	"k8s.io/kubernetes/pkg/auth/user"
+)
+
+func TestTokenFile(t *testing.T) {
+	auth, err := newWithContents(t, `
+token1,user1,uid1
+token2,user2,uid2
+token3,user3,uid3,"group1,group2"
+token4,user4,uid4,"group2"
+token5,user5,uid5,group5
+token6,user6,uid6,group5,otherdata
+token7,user7,uid7,"group1,group2",otherdata
+`)
+	if err != nil {
+		t.Fatalf("unable to read tokenfile: %v", err)
+	}
+
+	testCases := []struct {
+		Token string
+		User  *user.DefaultInfo
+		Ok    bool
+		Err   bool
+	}{
+		{
+			Token: "token1",
+			User:  &user.DefaultInfo{Name: "user1", UID: "uid1"},
+			Ok:    true,
+		},
+		{
+			Token: "token2",
+			User:  &user.DefaultInfo{Name: "user2", UID: "uid2"},
+			Ok:    true,
+		},
+		{
+			Token: "token3",
+			User:  &user.DefaultInfo{Name: "user3", UID: "uid3", Groups: []string{"group1", "group2"}},
+			Ok:    true,
+		},
+		{
+			Token: "token4",
+			User:  &user.DefaultInfo{Name: "user4", UID: "uid4", Groups: []string{"group2"}},
+			Ok:    true,
+		},
+		{
+			Token: "token5",
+			User:  &user.DefaultInfo{Name: "user5", UID: "uid5", Groups: []string{"group5"}},
+			Ok:    true,
+		},
+		{
+			Token: "token6",
+			User:  &user.DefaultInfo{Name: "user6", UID: "uid6", Groups: []string{"group5"}},
+			Ok:    true,
+		},
+		{
+			Token: "token7",
+			User:  &user.DefaultInfo{Name: "user7", UID: "uid7", Groups: []string{"group1", "group2"}},
+			Ok:    true,
+		},
+		{
+			Token: "token8",
+		},
+	}
+	for i, testCase := range testCases {
+		user, ok, err := auth.AuthenticateToken(testCase.Token)
+		if testCase.User == nil {
+			if user != nil {
+				t.Errorf("%d: unexpected non-nil user %#v", i, user)
+			}
+		} else if !reflect.DeepEqual(testCase.User, user) {
+			t.Errorf("%d: expected user %#v, got %#v", i, testCase.User, user)
+		}
+
+		if testCase.Ok != ok {
+			t.Errorf("%d: expected auth %v, got %v", i, testCase.Ok, ok)
+		}
+		switch {
+		case err == nil && testCase.Err:
+			t.Errorf("%d: unexpected nil error", i)
+		case err != nil && !testCase.Err:
+			t.Errorf("%d: unexpected error: %v", i, err)
+		}
+	}
+}
+
+func TestBadTokenFile(t *testing.T) {
+	_, err := newWithContents(t, `
+token1,user1,uid1
+token2,user2,uid2
+token3,user3
+token4
+`)
+	if err == nil {
+		t.Fatalf("unexpected non error")
+	}
+}
+
+func TestInsufficientColumnsTokenFile(t *testing.T) {
+	_, err := newWithContents(t, "token4\n")
+	if err == nil {
+		t.Fatalf("unexpected non error")
+	}
+}
+
+func newWithContents(t *testing.T, contents string) (auth *TokenAuthenticator, err error) {
+	f, err := ioutil.TempFile("", "tokenfile_test")
+	if err != nil {
+		t.Fatalf("unexpected error creating tokenfile: %v", err)
+	}
+	f.Close()
+	defer os.Remove(f.Name())
+
+	if err := ioutil.WriteFile(f.Name(), []byte(contents), 0700); err != nil {
+		t.Fatalf("unexpected error writing tokenfile: %v", err)
+	}
+
+	return NewCSV(f.Name())
+}

plugin/pkg/auth/authenticator/token/tokentest/tokentest.go

@@ -0,0 +1,36 @@
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tokentest
+
+import "k8s.io/kubernetes/pkg/auth/user"
+
+type TokenAuthenticator struct {
+	Tokens map[string]*user.DefaultInfo
+}
+
+func New() *TokenAuthenticator {
+	return &TokenAuthenticator{
+		Tokens: make(map[string]*user.DefaultInfo),
+	}
+}
+func (a *TokenAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {
+	user, ok := a.Tokens[value]
+	if !ok {
+		return nil, false, nil
+	}
+	return user, true, nil
+}