Authz: Setup access claims for service identity (#100986)

* Setup access claims for service identity and add them to identityes without any claims

pkg/services/authn/authnimpl/registration.go

@@ -145,5 +145,7 @@ func ProvideRegistration(
 
 	nsSync := sync.ProvideNamespaceSync(cfg)
 	authnSvc.RegisterPostAuthHook(nsSync.SyncNamespace, 150)
+	authnSvc.RegisterPostAuthHook(sync.AccessClaimsHook, 160)
+
 	return Registration{}
 }

pkg/services/authn/authnimpl/sync/access_claims.go

@@ -0,0 +1,32 @@
+package sync
+
+import (
+	"context"
+
+	authnlib "github.com/grafana/authlib/authn"
+
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/authn"
+)
+
+func NewAccessClaimsSync() AccessClaimsSync {
+	return AccessClaimsSync{}
+}
+
+type AccessClaimsSync struct{}
+
+func AccessClaimsHook(ctx context.Context, id *authn.Identity, _ *authn.Request) error {
+	if id.AccessTokenClaims == nil {
+		// When normal authencation flows are used withint grafana we don't have any access token e.g. using user
+		// session. This makes it impossible to authorize using AccessClient because we don't have any access claims
+		// with deletegated permissions. To get around this we use the hardcoded delegated
+		// permissions.
+		id.AccessTokenClaims = &authnlib.Claims[authnlib.AccessTokenClaims]{
+			Rest: authnlib.AccessTokenClaims{
+				DelegatedPermissions: identity.ServiceIdentityClaims.Rest.DelegatedPermissions,
+			},
+		}
+	}
+
+	return nil
+}

pkg/services/authn/grpcutils/inproc_exchanger.go

@@ -9,6 +9,7 @@ import (
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/grafana/authlib/authn"
 	"github.com/grafana/authlib/types"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 )
 
 type inProcExchanger struct {
@@ -37,8 +38,8 @@ func createInProcToken() (*authn.TokenExchangeResponse, error) {
 		},
 		Rest: authn.AccessTokenClaims{
 			Namespace:            "*",
-			Permissions:          []string{"folder.grafana.app:*", "dashboard.grafana.app:*"},
-			DelegatedPermissions: []string{"folder.grafana.app:*", "dashboard.grafana.app:*"},
+			Permissions:          identity.ServiceIdentityClaims.Rest.Permissions,
+			DelegatedPermissions: identity.ServiceIdentityClaims.Rest.DelegatedPermissions,
 		},
 	}