mirror of https://github.com/grafana/grafana
Apiserver: Refactor authenticator and authorizers (#101449)
* Clean up authenticator * Cleanup authorizers and replace org_id and stack_id with namespace authorizer * Remove dependency on org service * Extract orgID from /apis/ urls and validate stack idpull/101667/head^2
Karl Persson
5 months ago
committed by
GitHub
parent
0a24a7cd4c
commit
43f56c5ca1
@ -0,0 +1,30 @@ |
||||
package authenticator |
||||
|
||||
import ( |
||||
"net/http" |
||||
|
||||
"k8s.io/apiserver/pkg/authentication/authenticator" |
||||
"k8s.io/apiserver/pkg/authentication/request/union" |
||||
"k8s.io/klog/v2" |
||||
|
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
) |
||||
|
||||
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request { |
||||
handlers := append([]authenticator.Request{authenticator.RequestFunc(identityAuthenticator)}, authRequestHandlers...) |
||||
return union.New(handlers...) |
||||
} |
||||
|
||||
var _ authenticator.RequestFunc = identityAuthenticator |
||||
|
||||
// identityAuthenticator check if we have any identity set in context.
|
||||
// If not we delegate authentication to next authenticator in the chain.
|
||||
func identityAuthenticator(req *http.Request) (*authenticator.Response, bool, error) { |
||||
ident, err := identity.GetRequester(req.Context()) |
||||
if err != nil { |
||||
klog.V(5).Info("no idenitty in context", "err", err) |
||||
return nil, false, nil |
||||
} |
||||
|
||||
return &authenticator.Response{User: ident}, true, nil |
||||
} |
||||
@ -0,0 +1,63 @@ |
||||
package authenticator |
||||
|
||||
import ( |
||||
"context" |
||||
"net/http" |
||||
"testing" |
||||
|
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"github.com/grafana/grafana/pkg/services/user" |
||||
"github.com/stretchr/testify/require" |
||||
"k8s.io/apiserver/pkg/authentication/authenticator" |
||||
) |
||||
|
||||
func TestAuthenticator(t *testing.T) { |
||||
t.Run("should call next authenticator if identity is not set in context", func(t *testing.T) { |
||||
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil) |
||||
require.NoError(t, err) |
||||
mockAuthenticator := &mockAuthenticator{} |
||||
|
||||
auth := NewAuthenticator(mockAuthenticator) |
||||
res, ok, err := auth.AuthenticateRequest(req) |
||||
require.NoError(t, err) |
||||
require.False(t, ok) |
||||
require.Nil(t, res) |
||||
require.True(t, mockAuthenticator.called) |
||||
}) |
||||
|
||||
t.Run("should authenticate when identity is set in context", func(t *testing.T) { |
||||
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil) |
||||
require.NoError(t, err) |
||||
|
||||
ident := &user.SignedInUser{ |
||||
Name: "admin", |
||||
UserID: 1, |
||||
UserUID: "xyz", |
||||
Teams: []int64{1, 2}, |
||||
} |
||||
|
||||
req = req.WithContext(identity.WithRequester(context.Background(), ident)) |
||||
mockAuthenticator := &mockAuthenticator{} |
||||
auth := NewAuthenticator(mockAuthenticator) |
||||
res, ok, err := auth.AuthenticateRequest(req) |
||||
require.NoError(t, err) |
||||
require.True(t, ok) |
||||
require.False(t, mockAuthenticator.called) |
||||
|
||||
require.Equal(t, ident.GetName(), res.User.GetName()) |
||||
require.Equal(t, ident.GetUID(), res.User.GetUID()) |
||||
require.Equal(t, []string{"1", "2"}, res.User.GetGroups()) |
||||
require.Empty(t, res.User.GetExtra()["id-token"]) |
||||
}) |
||||
} |
||||
|
||||
var _ authenticator.Request = (*mockAuthenticator)(nil) |
||||
|
||||
type mockAuthenticator struct { |
||||
called bool |
||||
} |
||||
|
||||
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) { |
||||
a.called = true |
||||
return nil, false, nil |
||||
} |
||||
@ -1,11 +0,0 @@ |
||||
package authenticator |
||||
|
||||
import ( |
||||
"k8s.io/apiserver/pkg/authentication/authenticator" |
||||
"k8s.io/apiserver/pkg/authentication/request/union" |
||||
) |
||||
|
||||
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request { |
||||
handlers := append([]authenticator.Request{authenticator.RequestFunc(signedInUserAuthenticator)}, authRequestHandlers...) |
||||
return union.New(handlers...) |
||||
} |
||||
@ -1,24 +0,0 @@ |
||||
package authenticator |
||||
|
||||
import ( |
||||
"net/http" |
||||
|
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"k8s.io/apiserver/pkg/authentication/authenticator" |
||||
"k8s.io/klog/v2" |
||||
) |
||||
|
||||
var _ authenticator.RequestFunc = signedInUserAuthenticator |
||||
|
||||
func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool, error) { |
||||
ctx := req.Context() |
||||
signedInUser, err := identity.GetRequester(ctx) |
||||
if err != nil { |
||||
klog.V(5).Info("failed to get signed in user", "err", err) |
||||
return nil, false, nil |
||||
} |
||||
|
||||
return &authenticator.Response{ |
||||
User: signedInUser, |
||||
}, true, nil |
||||
} |
||||
@ -1,88 +0,0 @@ |
||||
package authenticator |
||||
|
||||
import ( |
||||
"context" |
||||
"net/http" |
||||
"testing" |
||||
|
||||
"github.com/google/uuid" |
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"github.com/grafana/grafana/pkg/services/user" |
||||
"github.com/stretchr/testify/require" |
||||
"k8s.io/apiserver/pkg/authentication/authenticator" |
||||
"k8s.io/apiserver/pkg/authentication/request/union" |
||||
) |
||||
|
||||
func TestSignedInUser(t *testing.T) { |
||||
t.Run("should call next authenticator if SignedInUser is not set", func(t *testing.T) { |
||||
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil) |
||||
require.NoError(t, err) |
||||
mockAuthenticator := &mockAuthenticator{} |
||||
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator) |
||||
res, ok, err := all.AuthenticateRequest(req) |
||||
require.NoError(t, err) |
||||
require.False(t, ok) |
||||
require.Nil(t, res) |
||||
require.True(t, mockAuthenticator.called) |
||||
}) |
||||
|
||||
t.Run("should set user and group", func(t *testing.T) { |
||||
u := &user.SignedInUser{ |
||||
Name: "admin", |
||||
UserID: 1, |
||||
UserUID: "xyz", |
||||
Teams: []int64{1, 2}, |
||||
} |
||||
ctx := identity.WithRequester(context.Background(), u) |
||||
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil) |
||||
require.NoError(t, err) |
||||
req = req.WithContext(ctx) |
||||
mockAuthenticator := &mockAuthenticator{} |
||||
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator) |
||||
res, ok, err := all.AuthenticateRequest(req) |
||||
require.NoError(t, err) |
||||
require.True(t, ok) |
||||
require.False(t, mockAuthenticator.called) |
||||
|
||||
require.Equal(t, u.GetName(), res.User.GetName()) |
||||
require.Equal(t, u.GetUID(), res.User.GetUID()) |
||||
require.Equal(t, []string{"1", "2"}, res.User.GetGroups()) |
||||
require.Empty(t, res.User.GetExtra()["id-token"]) |
||||
}) |
||||
|
||||
t.Run("should set ID token when available", func(t *testing.T) { |
||||
u := &user.SignedInUser{ |
||||
Name: "admin", |
||||
UserID: 1, |
||||
UserUID: uuid.New().String(), |
||||
Teams: []int64{1, 2}, |
||||
IDToken: "test-id-token", |
||||
} |
||||
ctx := identity.WithRequester(context.Background(), u) |
||||
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil) |
||||
require.NoError(t, err) |
||||
req = req.WithContext(ctx) |
||||
mockAuthenticator := &mockAuthenticator{} |
||||
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator) |
||||
res, ok, err := all.AuthenticateRequest(req) |
||||
require.NoError(t, err) |
||||
require.True(t, ok) |
||||
|
||||
require.False(t, mockAuthenticator.called) |
||||
require.Equal(t, u.GetName(), res.User.GetName()) |
||||
require.Equal(t, u.GetUID(), res.User.GetUID()) |
||||
require.Equal(t, []string{"1", "2"}, res.User.GetGroups()) |
||||
require.Equal(t, "test-id-token", res.User.GetExtra()["id-token"][0]) |
||||
}) |
||||
} |
||||
|
||||
var _ authenticator.Request = (*mockAuthenticator)(nil) |
||||
|
||||
type mockAuthenticator struct { |
||||
called bool |
||||
} |
||||
|
||||
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) { |
||||
a.called = true |
||||
return nil, false, nil |
||||
} |
||||
@ -0,0 +1,52 @@ |
||||
package authorizer |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
|
||||
"github.com/grafana/authlib/types" |
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"k8s.io/apiserver/pkg/authorization/authorizer" |
||||
) |
||||
|
||||
type namespaceAuthorizer struct { |
||||
} |
||||
|
||||
func newNamespaceAuthorizer() *namespaceAuthorizer { |
||||
return &namespaceAuthorizer{} |
||||
} |
||||
|
||||
func (auth namespaceAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) { |
||||
ident, err := identity.GetRequester(ctx) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, "missing auth info", fmt.Errorf("missing auth info: %w", err) |
||||
} |
||||
|
||||
if ident.GetIsGrafanaAdmin() { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
if !a.IsResourceRequest() { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
// If we have an anonymous user, let the next authorizers decide.
|
||||
if types.IsIdentityType(ident.GetIdentityType(), types.TypeAnonymous) { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
ns, err := types.ParseNamespace(a.GetNamespace()) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, "invalid namespace", err |
||||
} |
||||
|
||||
if ns.OrgID != ident.GetOrgID() { |
||||
return authorizer.DecisionDeny, "invalid org", nil |
||||
} |
||||
|
||||
if !types.NamespaceMatches(ident.GetNamespace(), a.GetNamespace()) { |
||||
return authorizer.DecisionDeny, "invalid namespace", nil |
||||
} |
||||
|
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
@ -1,87 +0,0 @@ |
||||
package authorizer |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
|
||||
"k8s.io/apiserver/pkg/authorization/authorizer" |
||||
|
||||
claims "github.com/grafana/authlib/types" |
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
"github.com/grafana/grafana/pkg/services/org" |
||||
) |
||||
|
||||
var _ authorizer.Authorizer = &orgIDAuthorizer{} |
||||
|
||||
type orgIDAuthorizer struct { |
||||
log log.Logger |
||||
org org.Service |
||||
} |
||||
|
||||
func newOrgIDAuthorizer(orgService org.Service) *orgIDAuthorizer { |
||||
return &orgIDAuthorizer{ |
||||
log: log.New("grafana-apiserver.authorizer.orgid"), |
||||
org: orgService, |
||||
} |
||||
} |
||||
|
||||
func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) { |
||||
signedInUser, err := identity.GetRequester(ctx) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil |
||||
} |
||||
|
||||
info, err := claims.ParseNamespace(a.GetNamespace()) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil |
||||
} |
||||
|
||||
// No opinion when the namespace is empty
|
||||
if info.Value == "" { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
// Grafana super admins can see things in every org
|
||||
if signedInUser.GetIsGrafanaAdmin() { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
if info.OrgID == -1 { |
||||
return authorizer.DecisionDeny, "org id is required", nil |
||||
} |
||||
|
||||
if info.StackID != 0 { |
||||
return authorizer.DecisionDeny, "using a stack namespace requires deployment with a fixed stack id", nil |
||||
} |
||||
|
||||
// Quick check that the same org is used
|
||||
if signedInUser.GetOrgID() == info.OrgID { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
// If we have an anonymous user, let the next authorizers decide.
|
||||
if signedInUser.GetIdentityType() == claims.TypeAnonymous { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
// Check if the user has access to the specified org
|
||||
// nolint:staticcheck
|
||||
userId, err := signedInUser.GetInternalID() |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, "unable to get userId", err |
||||
} |
||||
query := org.GetUserOrgListQuery{UserID: userId} |
||||
result, err := auth.org.GetUserOrgList(ctx, &query) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, "error getting user org list", err |
||||
} |
||||
|
||||
for _, org := range result { |
||||
if org.OrgID == info.OrgID { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
} |
||||
|
||||
return authorizer.DecisionDeny, fmt.Sprintf("user %d is not a member of org %d", userId, info.OrgID), nil |
||||
} |
||||
@ -1,66 +0,0 @@ |
||||
package authorizer |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
"strconv" |
||||
|
||||
"k8s.io/apiserver/pkg/authorization/authorizer" |
||||
|
||||
claims "github.com/grafana/authlib/types" |
||||
"github.com/grafana/grafana/pkg/apimachinery/identity" |
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
"github.com/grafana/grafana/pkg/setting" |
||||
) |
||||
|
||||
var _ authorizer.Authorizer = &stackIDAuthorizer{} |
||||
|
||||
type stackIDAuthorizer struct { |
||||
log log.Logger |
||||
stackID int64 |
||||
} |
||||
|
||||
func newStackIDAuthorizer(cfg *setting.Cfg) *stackIDAuthorizer { |
||||
stackID, err := strconv.ParseInt(cfg.StackID, 10, 64) |
||||
if err != nil { |
||||
return nil |
||||
} |
||||
return &stackIDAuthorizer{ |
||||
log: log.New("grafana-apiserver.authorizer.stackid"), |
||||
stackID: stackID, // this lets a single tenant grafana validate stack id (rather than orgs)
|
||||
} |
||||
} |
||||
|
||||
func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) { |
||||
signedInUser, err := identity.GetRequester(ctx) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil |
||||
} |
||||
|
||||
// If we have an anonymous user, let the next authorizers decide.
|
||||
if signedInUser.GetIdentityType() == claims.TypeAnonymous { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
|
||||
info, err := claims.ParseNamespace(a.GetNamespace()) |
||||
if err != nil { |
||||
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil |
||||
} |
||||
|
||||
// No opinion when the namespace is empty
|
||||
if info.Value == "" { |
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
if info.StackID != auth.stackID { |
||||
msg := fmt.Sprintf("wrong stack id is selected (expected: %d, found %d)", auth.stackID, info.StackID) |
||||
return authorizer.DecisionDeny, msg, nil |
||||
} |
||||
if info.OrgID != 1 { |
||||
return authorizer.DecisionDeny, "cloud instance requires org 1", nil |
||||
} |
||||
if signedInUser.GetOrgID() != 1 { |
||||
return authorizer.DecisionDeny, "user must be in org 1", nil |
||||
} |
||||
|
||||
return authorizer.DecisionNoOpinion, "", nil |
||||
} |
||||
Loading…
Reference in new issue