feat(authentication): add a --no-auth flag to disable authentication (#553)

api/http/auth_handler.go

@@ -16,6 +16,7 @@ import (
 type AuthHandler struct {
 	*mux.Router
 	Logger        *log.Logger
+	authDisabled  bool
 	UserService   portainer.UserService
 	CryptoService portainer.CryptoService
 	JWTService    portainer.JWTService
@@ -26,6 +27,9 @@ const (
 	ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
 	// ErrInvalidCredentials is an error raised when credentials for a user are invalid
 	ErrInvalidCredentials = portainer.Error("Invalid credentials")
+	// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
+	// when the server has been started with the --no-auth flag
+	ErrAuthDisabled = portainer.Error("Authentication is disabled")
 )
 
 // NewAuthHandler returns a new instance of AuthHandler.
@@ -44,6 +48,11 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	if handler.authDisabled {
+		Error(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
 	var req postAuthRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)

api/http/middleware.go

@@ -9,7 +9,8 @@ import (
 
 // Service represents a service to manage HTTP middlewares
 type middleWareService struct {
-	jwtService portainer.JWTService
+	jwtService   portainer.JWTService
+	authDisabled bool
 }
 
 func addMiddleware(h http.Handler, middleware ...func(http.Handler) http.Handler) http.Handler {
@@ -37,24 +38,26 @@ func (*middleWareService) middleWareSecureHeaders(next http.Handler) http.Handle
 // middleWareAuthenticate provides Authentication middleware for handlers
 func (service *middleWareService) middleWareAuthenticate(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var token string
+		if !service.authDisabled {
+			var token string
 
-		// Get token from the Authorization header
-		tokens, ok := r.Header["Authorization"]
-		if ok && len(tokens) >= 1 {
-			token = tokens[0]
-			token = strings.TrimPrefix(token, "Bearer ")
-		}
+			// Get token from the Authorization header
+			tokens, ok := r.Header["Authorization"]
+			if ok && len(tokens) >= 1 {
+				token = tokens[0]
+				token = strings.TrimPrefix(token, "Bearer ")
+			}
 
-		if token == "" {
-			Error(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
-			return
-		}
+			if token == "" {
+				Error(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
+				return
+			}
 
-		err := service.jwtService.VerifyToken(token)
-		if err != nil {
-			Error(w, err, http.StatusUnauthorized, nil)
-			return
+			err := service.jwtService.VerifyToken(token)
+			if err != nil {
+				Error(w, err, http.StatusUnauthorized, nil)
+				return
+			}
 		}
 
 		next.ServeHTTP(w, r)

api/http/server.go

@@ -10,6 +10,7 @@ import (
 type Server struct {
 	BindAddress     string
 	AssetsPath      string
+	AuthDisabled    bool
 	UserService     portainer.UserService
 	EndpointService portainer.EndpointService
 	CryptoService   portainer.CryptoService
@@ -40,13 +41,15 @@ func (server *Server) updateActiveEndpoint(endpoint *portainer.Endpoint) error {
 // Start starts the HTTP server
 func (server *Server) Start() error {
 	middleWareService := &middleWareService{
-		jwtService: server.JWTService,
+		jwtService:   server.JWTService,
+		authDisabled: server.AuthDisabled,
 	}
 
 	var authHandler = NewAuthHandler()
 	authHandler.UserService = server.UserService
 	authHandler.CryptoService = server.CryptoService
 	authHandler.JWTService = server.JWTService
+	authHandler.authDisabled = server.AuthDisabled
 	var userHandler = NewUserHandler(middleWareService)
 	userHandler.UserService = server.UserService
 	userHandler.CryptoService = server.CryptoService