auth: Make luci-go services trust signatures produced by the token server.

appengine/gaeauth/server/db.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package server
 
 import (
         "errors"
         "net"
 
         "golang.org/x/net/context"
 
         "github.com/luci/gae/service/info"
         "github.com/luci/luci-go/appengine/gaeauth/server/internal/authdbimpl"
         "github.com/luci/luci-go/common/clock"
         "github.com/luci/luci-go/common/logging"
         "github.com/luci/luci-go/server/auth/authdb"
         "github.com/luci/luci-go/server/auth/identity"
+        "github.com/luci/luci-go/server/auth/signing"
         "github.com/luci/luci-go/server/secrets"
 )
 
 // errNotConfigured is returned on real GAE if auth service URL is not set.
 var errNotConfigured = errors.New(
         "Auth Service URL is not configured, you MUST configure it for apps used " +
                 "in production, visit /admin/settings/auth_service to do so.")
 
 // GetAuthDB fetches AuthDB snapshot from the datastore and returns authdb.DB
 // interface wrapping it.
@@ skipping 58 matching lines @@
         return true, nil
 }
 
 func (devServerDB) IsMember(c context.Context, id identity.Identity, group string) (bool, error) {
         if !info.IsDevAppServer(c) {
                 return false, errNotConfigured
         }
         return id.Kind() != identity.Anonymous, nil
 }
 
 func (devServerDB) SharedSecrets(c context.Context) (secrets.Store, error) {

[Vadim Sh., 2016/10/03 20:47:12]

This is used on local devserver and only on devserver. It make 'IsMember' calls
return True for any group. Allows to not bother to configure groups on local dev
server.

         return nil, errNotConfigured
 }
 
+func (devServerDB) GetCertificates(c context.Context, id identity.Identity) (*signing.PublicCertificates, error) {
+        return nil, errNotConfigured
+}
+
 func (devServerDB) GetWhitelistForIdentity(c context.Context, ident identity.Identity) (string, error) {
         return "", nil
 }
 
 func (devServerDB) IsInWhitelist(c context.Context, ip net.IP, whitelist string) (bool, error) {
         return false, nil
 }
 
 func (devServerDB) GetAuthServiceURL(c context.Context) (string, error) {
         return "", errNotConfigured
 }
 
 func (devServerDB) GetTokenServiceURL(c context.Context) (string, error) {
         return "", errNotConfigured
 }