User Gateway Portal
Relevant source files
The following files were used as context for generating this wiki page:
The User Gateway Portal is the primary interface for Warpgate users to manage their access, credentials, and connection settings. Warpgate acts as a smart bastion host for SSH, HTTPS, MySQL, and PostgreSQL, and the portal provides the web-based gateway necessary for users to authenticate and receive connection instructions for their assigned targets.
Sources: README.md:1-25, warpgate-web/src/gateway/index.html:1-15
Authentication and Access Control
The portal manages a complex authentication flow supporting multiple credential types and out-of-band authorization. Users interact with the gateway to fulfill credential policies defined by administrators, which can include traditional passwords, public keys, and multi-factor authentication.
Out-of-Band (OOB) Authorization
For certain protocols or security configurations, the portal handles out-of-band authorization requests. This allows users to approve or reject a session request from another device or interface by verifying a security identification string.
This diagram illustrates the flow of an out-of-band authorization request where a user must manually verify and approve a session based on a displayed identification string.
Sources: warpgate-web/src/gateway/OutOfBandAuth.svelte:20-55
Credential Management
Users can self-manage several types of credentials within the gateway. The portal enforces the credentialPolicy assigned to the user, warning them if mandatory credentials (like a password or TOTP device) are missing.
| Credential Type | Description | Actions |
|---|---|---|
| Password | Standard login password | Set, Change, Reset |
| One-time Password (OTP) | TOTP-based secondary factor | Add device, Delete |
| Public Keys | OpenSSH format public keys | Add key, Delete, View usage state |
| Single Sign-On (SSO) | External provider identities (OIDC) | View linked email/provider |
Sources: warpgate-web/src/gateway/CredentialManager.svelte:40-160
Target Access and Connection
When a user connects through the gateway, Warpgate presents available targets. The portal provides detailed connection instructions tailored to the specific protocol of the target (SSH, HTTP, MySQL, or PostgreSQL).
Connection Protocols
The gateway generates specific connection strings and example commands to assist users in connecting through the bastion.
- SSH: Provides the specifically formatted SSH username and an example
sshcommand. - HTTP: Provides an access URL and, if applicable, an
Authorizationheader for ticket-based access. - Databases (MySQL/Postgres): Provides database-specific usernames, example CLI commands, and URI-formatted connection strings.
This sequence shows how the gateway transforms target metadata into actionable connection instructions for the user.
Sources: warpgate-web/src/common/ConnectionInstructions.svelte:35-100, warpgate-web/src/admin/Target.svelte:90-110
Programmatic Access (API Tokens)
The User Gateway Portal includes an API Token Manager that allows users to generate secrets for programmatically interacting with Warpgate. These tokens are shown only once upon creation and can be assigned an expiry date.
Token Lifecycle
- Creation: User provides a label and expiry; the API returns a cleartext secret and a token object.
- Usage: The secret is used to authenticate requests to the Warpgate User or Admin APIs.
- Monitoring: The portal displays the status (Active/Expired) of all existing tokens.
- Revocation: Users can delete tokens at any time to immediately invalidate the secret.
Sources: warpgate-web/src/gateway/ApiTokenManager.svelte:15-50
Embedded Gateway UI
Warpgate provides an "Embedded UI" component that can appear over proxied HTTPS targets. This component allows users to quickly navigate back to the gateway home or logout without leaving the target application's context. It features a draggable "floating" toggle button that persists its position in localStorage.
Sources: warpgate-web/src/embed/EmbeddedUI.svelte:10-60
Summary
The User Gateway Portal serves as the bridge between the user and the protected network infrastructure. By centralizing credential management, providing protocol-specific connection guidance, and facilitating secure out-of-band approvals, it ensures that access through the Warpgate bastion is both secure and user-friendly.