public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zanzana: add flag for running zanzana server insecurely (#107130)

Browse Source 
* add flag for running zanzana server insecurely

* Only allow insecure connections in dev environment

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
This commit is contained in:
Cory Forseth
2025-06-25 22:47:53 +00:00
committed by GitHub
co-authored by Alexander Zobnin
parent 79fe8a9902
commit 41a4841e57
2 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/zanzana.go
+30 -9
View File
@@ -177,19 +177,32 @@ func (z *Zanzana) start(ctx context.Context) error {
return fmt.Errorf("failed to start zanzana: %w", err)
}
authenticator := authnlib.NewAccessTokenAuthenticator(
authnlib.NewAccessTokenVerifier(
authnlib.VerifierConfig{AllowedAudiences: []string{AuthzServiceAudience}},
authnlib.NewKeyRetriever(authnlib.KeyRetrieverConfig{
SigningKeysURL: z.cfg.ZanzanaServer.SigningKeysURL,
}),
),
)
var authenticatorInterceptor interceptors.Authenticator
if z.cfg.ZanzanaServer.AllowInsecure && z.cfg.Env == setting.Dev {
z.logger.Info("Allowing insecure connections to OpenFGA HTTP server")
authenticatorInterceptor = noopAuthenticator{}
} else {
z.logger.Info("Requiring secure connections to OpenFGA HTTP server")
authenticator := authnlib.NewAccessTokenAuthenticator(
authnlib.NewAccessTokenVerifier(
authnlib.VerifierConfig{AllowedAudiences: []string{AuthzServiceAudience}},
authnlib.NewKeyRetriever(authnlib.KeyRetrieverConfig{
SigningKeysURL: z.cfg.ZanzanaServer.SigningKeysURL,
}),
),
)
authenticatorInterceptor = interceptors.AuthenticatorFunc(
grpcutils.NewAuthenticatorInterceptor(
authenticator,
tracer,
),
)
}
z.handle, err = grpcserver.ProvideService(
z.cfg,
z.features,
interceptors.AuthenticatorFunc(grpcutils.NewAuthenticatorInterceptor(authenticator, tracer)),
authenticatorInterceptor,
tracer,
prometheus.DefaultRegisterer,
)
@@ -238,3 +251,11 @@ func (z *Zanzana) stopping(err error) error {
}
return nil
}
// TODO this impl might be more broadly useful in authlib
type noopAuthenticator struct {
}
func (n noopAuthenticator) Authenticate(ctx context.Context) (context.Context, error) {
return ctx, nil
}