DEV Community: ☁ Green Panda

Redis Lua

☁ Green Panda — Mon, 25 Jul 2022 23:42:00 +0000

Context

Do you know that you can run a script in Redis? If you don't know maybe it is time to try it out. This scripting ability is intended to optimize performance for Redis operation. However, you probably can achieve the same performance using Redis Pipeline feature. Depending on the use cases, this scripting ability is available if you have very compelling use case.

This article will show you various Redis Lua scripts use case that will make your life easier and its potential use cases where it might fit in daily life.

1. HGet Members

Description

If you have a hash and a set, where a set defines specific hash keys.

Example

Let's say you have vehicles, 3 Honda cars, 1 Mercedes car, and 2 Scooters. We can this script to pull the counts of the Cars.

> hset cars honda 3
(integer) 1
> hset cars mercedes 1
(integer) 1
> hset motorbikes scooters 1
(integer) 1
> sadd cars honda mercedes
(integer) 2
> evalsha 700c06c5ce9835bf9eef2198c8bc4d268b3b5095 2 cars produce
1) 1) "honda"
   2) "3"
2) 1) "mercedes"
   2) "1"

Lua source:

local fields = redis.call("SMEMBERS", KEYS[2])
local values = redis.call("HMGET", KEYS[1], unpack(fields))
local result = {}
for i,k in ipairs(fields) do result[i] = {k, values[i]} end
return result

2. HINCR IF-EXISTS

Description

If you need to increment existing value in Hash map with additional check on the key existance.

Example

> evalsha 3cb0d65c399fda8a1d4eb93b2fe85311671bc969 1 top_scorer budi 1
(nil)
> hset top_scorer budi 80
(integer) 1
> evalsha 3cb0d65c399fda8a1d4eb93b2fe85311671bc969 1 top_scorer budi 1
(integer) 91
> evalsha 3cb0d65c399fda8a1d4eb93b2fe85311671bc969 1 top_scorer budi 1
(integer) 92

Lua source:

if redis.call("HEXISTS", KEYS[1], ARGV[1]) == 1 then
  return redis.call("HINCRBY", KEYS[1], ARGV[1], ARGV[2])
else
  return nil
end

3. HMSET-Extended

Description

In hash set, you usually need to set value one by one. You can leverage Lua to set multiple key from the args.

Example

> evalsha 8c4bbf1b37784149128a5b96e55073538a7401d9 1 mykey foo 1 bar 2
(integer) 1
> hgetall mykey
1) "foo"
2) "1"
3) "bar"
4) "2"
> evalsha 8c4bbf1b37784149128a5b96e55073538a7401d9 1 mykey foo 1 bar 3 baz 4
(integer) 0
> hgetall mykey
1) "foo"
2) "1"
3) "bar"
4) "2"

Lua source:

if redis.call('exists', KEYS[1]) == 0 then
    redis.call('hmset', KEYS[1], unpack(ARGV))
    return 1
end
return 0

4. Simple Rate Limit

Description

If you use Redis for rate limiting, Lua can help you putting together logic your rate limit logic.

Example

> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 0
> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 0
> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 0
> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 0
> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 0
> evalsha 089ccf077629d371793d5e928a3f06e9e483eb08 1 ratelimit:127.0.0.1 5 10000
(integer) 1

Lua source:

local cnt = redis.call('INCR', KEYS[1])
if cnt > tonumber(ARGV[1])
then
  return 1
end
if cnt == 1
then
  redis.call('PEXPIRE', KEYS[1], ARGV[2])
end
return 0

5. Value in Multiple Sets

Description

If you have use case, where you need to check value in multiple sets. This Lua script is definitely helpful for the implementation and avoid networking call.

Example

> sadd users alice bob
(integer) 2
> sadd admin jenny
(integer) 1
> evalsha d7550c872f553141096d5134c027af5eeed283db 2 users admin alice
(integer) 1
> evalsha d7550c872f553141096d5134c027af5eeed283db 3 users admin guests jenny
(integer) 1
> evalsha d7550c872f553141096d5134c027af5eeed283db 2 users admin abner
(integer) 0

Lua source:


-- Is an item in any of several sets? Call with:
-- EVALSHA  n set1 set2 ... setn key
for i=1,#KEYS do
  if redis.call('sismember', KEYS[i], ARGV[1]) == 1 then
    return 1
  end
end
return 0

Source: https://www.redisgreen.com/library/

JumpCloud SSO with Rust Backend and SPA Frontend

☁ Green Panda — Sun, 03 Jul 2022 13:53:07 +0000

For the past week, I have been working on JumpCloud integration for SPA frontend. I decided to write my own tutorial for my own future reference.
If you read this, I am not affiliated with JumpCloud. If you just look for the Rust part, you can skip introduction and jump to the #Integration section.

What is JumpCloud?

If you don't know JumpCloud, JumpCloud is identity management platform. They provide a lot of integrations to 3rd party apps.
Usually if you are enterprise company and looking to integrate your identity into one identity, you can integrate with JumpCloud.
For reference you can go to https://jumpcloud.com to get more detail.

JumpCloud SSO with SAML

This article will not go deeper with SSO and SAML. If you want to know the detail you can go to https://support.google.com/a/answer/6262987?hl=en. It is a great reference to read.

To start with, you need to signed up in JumpCloud and logged in as administrator. Before we create new SSO app, you can create certificate and private key from your local.

# To create cert file
$ openssl req -new -x509 -sha256 -key private.pem -out cert.pem -days 1095
# To create private key
$ openssl genrsa -out private.pem 2048

Now, you can create SSO app in JumpCloud and upload the generated certificate and private key. Then, fill ACS field to http://localhost:8000/saml/acs. It will be your endpoint handler for SAML Response assertion.

Handling SAML Response with Rust

Here is the step by step:

Create new rust project. $ mkdir jumcloud-rust && cargo init.
Add cargo dependencies
Copy JumpCloud metadata
Copy JumpCloud SP entity ID
Replace below code with your JumpCloud metadata and JumpCloud SP entity ID

cargo.toml

[package]
name = "jumpcloudrust"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
openssl = "0.10"
openssl-sys = "0.9"
openssl-probe = "0.1.2"
samael="0.0.9"
tokio = { version = "1", features = ["full"] }
warp="0.3"
reqwest = { version = "0.11", features = ["json"] }

[profile.release]
lto = "fat"
codegen-units = 1

src/main.rs

use samael::metadata::{EntityDescriptor};
use samael::service_provider::ServiceProviderBuilder;
use std::collections::HashMap;
use std::fs;
use warp::{Filter};
use warp::http::{StatusCode};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    openssl_probe::init_ssl_cert_env_vars();

    let jc_metadata_str = "--- replace with your JC SSO App Metadata ---";
    println!("{}",jc_metadata_str);
    let idp_metadata: EntityDescriptor = samael::metadata::de::from_str(&jc_metadata_str)?;

    let pub_key = openssl::x509::X509::from_pem(&fs::read("./cert.pem")?)?;
    let private_key = openssl::rsa::Rsa::private_key_from_pem(&fs::read("./private.pem")?)?;

    let sp = ServiceProviderBuilder::default()
        .entity_id("--- replace with your entity id ---".to_string())
        .key(private_key)
        .certificate(pub_key)
        .allow_idp_initiated(true)
        .idp_metadata(idp_metadata)
        .acs_url("http://localhost:8000/saml/acs".to_string())
        .slo_url("http://localhost:8000/saml/slo".to_string())
        .build()?;

    let metadata = sp.metadata()?.to_xml()?;

    let metadata_route = warp::get()
        .and(warp::path("metadata"))
        .map(move || metadata.clone());

    let acs_route = warp::post()
        .and(warp::path("acs"))
        .and(warp::body::form())
        .map(move |s: HashMap<String, String>| {
            if let Some(encoded_resp) = s.get("SAMLResponse") {
                println!("{:?}", encoded_resp);

                let sp_res = sp.parse_response(encoded_resp, &["a_possible_request_id".to_string()]);
                return match sp_res {
                    Ok(resp) => {
                        println!("{:?}", resp);

                        let cookie_val = format!("token={}; Path=/; Max-Age=1209600", "abc");

                        warp::http::Response::builder()
                            .header("set-cookie", string_to_static_str(cookie_val))
                            .header("Location", "http://localhost:3000/")
                            .status(StatusCode::FOUND)
                            .body("".to_string())
                    },
                    Err(e) => warp::http::Response::builder()
                        .status(StatusCode::BAD_REQUEST)
                        .body(e.to_string())
                }
            }

            return warp::http::Response::builder()
                .status(StatusCode::FORBIDDEN)
                .body("Error FORBIDDEN".to_string())
        });

    let saml_routes = warp::path("saml").and(acs_route.or(metadata_route));
    warp::serve(saml_routes).run(([127, 0, 0, 1], 8000)).await;

    Ok(())
}

fn string_to_static_str(s: String) -> &'static str {
    Box::leak(s.into_boxed_str())
}

Now, run the app. Go to terminal and type cargo run --release. That's the BE part. See my (github)[github.com/rhzs/rust-saml-jumpcloud-sso] for full Rust implementation.

Preparing JumpCloud for SPA Frontend

The frontend part is a straight forward implementation. Go to your terminal and clone my github repo.

This will contain the following implementation and logic:

A login page with JumpCloud login redirection button
A home page and its welcome message after you logged in
A redirection to login page, when you try to click home page when not logged in.
A logout button to clear credentials

Putting it together

To run it together, do the following:

Open 2 different terminals, one for backend and one for frontend.
Try to open frontend and click login with JumpCloud
You will be redirected to JumpCloud login page.
After logged in, you should be redirected to your application.
JumpCloud will response to your Backend by calling API from the input ACS handler field. So, if you put http://localhost:8000/saml/acs
JumpCloud will perform POST with encoded form operation to the designated API endpoint. In backend, backend will accept this request, perform SAML assertion, and then instruct redirection to frontend.

Violaa!! It's a success! Congratulations! You are able to integrate JumpCloud SSO with SPA frontend and your own Rust backend.

This tutorial is confirmed 100% working as of 3 July 2022.
Please forgive me, if the tutorial is somehow lacking information. This is not intended to be detailed tutorial, but rather author own documentation.