public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apiserver: Refactor authenticator and authorizers (#101449)

Browse Source 
* Clean up authenticator

* Cleanup authorizers and replace org_id and stack_id with namespace authorizer

* Remove dependency on org service

* Extract orgID from /apis/ urls and validate stack id
This commit is contained in:
Karl Persson
2025-03-06 16:01:12 +01:00
committed by GitHub
parent 0a24a7cd4c
commit 43f56c5ca1
16 changed files with 372 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/apiserver/auth/authenticator/authenticator.go
+30
View File
@@ -0,0 +1,30 @@
package authenticator
import (
"net/http"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
"k8s.io/klog/v2"
"github.com/grafana/grafana/pkg/apimachinery/identity"
)
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request {
handlers := append([]authenticator.Request{authenticator.RequestFunc(identityAuthenticator)}, authRequestHandlers...)
return union.New(handlers...)
}
var _ authenticator.RequestFunc = identityAuthenticator
// identityAuthenticator check if we have any identity set in context.
// If not we delegate authentication to next authenticator in the chain.
func identityAuthenticator(req *http.Request) (*authenticator.Response, bool, error) {
ident, err := identity.GetRequester(req.Context())
if err != nil {
klog.V(5).Info("no idenitty in context", "err", err)
return nil, false, nil
}
return &authenticator.Response{User: ident}, true, nil
}
pkg/services/apiserver/auth/authenticator/authenticator_test.go
+63
View File
@@ -0,0 +1,63 @@
package authenticator
import (
"context"
"net/http"
"testing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/require"
"k8s.io/apiserver/pkg/authentication/authenticator"
)
func TestAuthenticator(t *testing.T) {
t.Run("should call next authenticator if identity is not set in context", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
mockAuthenticator := &mockAuthenticator{}
auth := NewAuthenticator(mockAuthenticator)
res, ok, err := auth.AuthenticateRequest(req)
require.NoError(t, err)
require.False(t, ok)
require.Nil(t, res)
require.True(t, mockAuthenticator.called)
})
t.Run("should authenticate when identity is set in context", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
ident := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: "xyz",
Teams: []int64{1, 2},
}
req = req.WithContext(identity.WithRequester(context.Background(), ident))
mockAuthenticator := &mockAuthenticator{}
auth := NewAuthenticator(mockAuthenticator)
res, ok, err := auth.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, ident.GetName(), res.User.GetName())
require.Equal(t, ident.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["id-token"])
})
}
var _ authenticator.Request = (*mockAuthenticator)(nil)
type mockAuthenticator struct {
called bool
}
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
a.called = true
return nil, false, nil
}
pkg/services/apiserver/auth/authenticator/provider.go
-11
View File
@@ -1,11 +0,0 @@
package authenticator
import (
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
)
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request {
handlers := append([]authenticator.Request{authenticator.RequestFunc(signedInUserAuthenticator)}, authRequestHandlers...)
return union.New(handlers...)
}
pkg/services/apiserver/auth/authenticator/signedinuser.go
-24
View File
@@ -1,24 +0,0 @@
package authenticator
import (
"net/http"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/klog/v2"
)
var _ authenticator.RequestFunc = signedInUserAuthenticator
func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool, error) {
ctx := req.Context()
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
klog.V(5).Info("failed to get signed in user", "err", err)
return nil, false, nil
}
return &authenticator.Response{
User: signedInUser,
}, true, nil
}
pkg/services/apiserver/auth/authenticator/signedinuser_test.go
-88
View File
@@ -1,88 +0,0 @@
package authenticator
import (
"context"
"net/http"
"testing"
"github.com/google/uuid"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/require"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
)
func TestSignedInUser(t *testing.T) {
t.Run("should call next authenticator if SignedInUser is not set", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.False(t, ok)
require.Nil(t, res)
require.True(t, mockAuthenticator.called)
})
t.Run("should set user and group", func(t *testing.T) {
u := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: "xyz",
Teams: []int64{1, 2},
}
ctx := identity.WithRequester(context.Background(), u)
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
req = req.WithContext(ctx)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["id-token"])
})
t.Run("should set ID token when available", func(t *testing.T) {
u := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: uuid.New().String(),
Teams: []int64{1, 2},
IDToken: "test-id-token",
}
ctx := identity.WithRequester(context.Background(), u)
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
req = req.WithContext(ctx)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Equal(t, "test-id-token", res.User.GetExtra()["id-token"][0])
})
}
var _ authenticator.Request = (*mockAuthenticator)(nil)
type mockAuthenticator struct {
called bool
}
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
a.called = true
return nil, false, nil
}
pkg/services/apiserver/auth/authorizer/provider.go → pkg/services/apiserver/auth/authorizer/authorizer.go
+14 -11
View File
@@ -3,7 +3,6 @@ package authorizer
import (
"context"
orgsvc "github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/setting"
"k8s.io/apimachinery/pkg/runtime/schema"
k8suser "k8s.io/apiserver/pkg/authentication/user"
@@ -19,17 +18,21 @@ type GrafanaAuthorizer struct {
auth authorizer.Authorizer
}
func NewGrafanaAuthorizer(cfg *setting.Cfg, orgService orgsvc.Service) *GrafanaAuthorizer {
// NewGrafanaAuthorizer returns an authorizer configured for a grafana instance.
// This authorizer is a chain of smaller authorizers that together form the decision if
// access should be granted.
// 1. We deny all impersonate request.
// 2. We allow all identities that belongs to `system:masters` group, regular grafana identities cannot
// be part of this group
// 3. We check that identity is allowed to make a request for namespace.
// 4. We check authorizer that is configured speficially for an api.
// 5. As a last fallback we check Role, this will only happen if an api have not configured
// an authorizer or return authorizer.DecisionNoOpinion
func NewGrafanaAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
authorizers := []authorizer.Authorizer{
&impersonationAuthorizer{},
newImpersonationAuthorizer(),
authorizerfactory.NewPrivilegedGroups(k8suser.SystemPrivilegedGroup),
}
// In Hosted grafana, the StackID replaces the orgID as a valid namespace
if cfg.StackID != "" {
authorizers = append(authorizers, newStackIDAuthorizer(cfg))
} else {
authorizers = append(authorizers, newOrgIDAuthorizer(orgService))
newNamespaceAuthorizer(),
}
// Individual services may have explicit implementations
@@ -38,7 +41,7 @@ func NewGrafanaAuthorizer(cfg *setting.Cfg, orgService orgsvc.Service) *GrafanaA
// org role is last -- and will return allow for verbs that match expectations
// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
authorizers = append(authorizers, newOrgRoleAuthorizer(orgService))
authorizers = append(authorizers, newRoleAuthorizer())
return &GrafanaAuthorizer{
apis: apis,
auth: union.New(authorizers...),
pkg/services/apiserver/auth/authorizer/impersonation.go
+4
View File
@@ -8,6 +8,10 @@ import (
var _ authorizer.Authorizer = (*impersonationAuthorizer)(nil)
func newImpersonationAuthorizer() *impersonationAuthorizer {
return &impersonationAuthorizer{}
}
// ImpersonationAuthorizer denies all impersonation requests.
type impersonationAuthorizer struct{}
pkg/services/apiserver/auth/authorizer/namespace.go
+52
View File
@@ -0,0 +1,52 @@
package authorizer
import (
"context"
"fmt"
"github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
type namespaceAuthorizer struct {
}
func newNamespaceAuthorizer() *namespaceAuthorizer {
return &namespaceAuthorizer{}
}
func (auth namespaceAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
ident, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, "missing auth info", fmt.Errorf("missing auth info: %w", err)
}
if ident.GetIsGrafanaAdmin() {
return authorizer.DecisionNoOpinion, "", nil
}
if !a.IsResourceRequest() {
return authorizer.DecisionNoOpinion, "", nil
}
// If we have an anonymous user, let the next authorizers decide.
if types.IsIdentityType(ident.GetIdentityType(), types.TypeAnonymous) {
return authorizer.DecisionNoOpinion, "", nil
}
ns, err := types.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, "invalid namespace", err
}
if ns.OrgID != ident.GetOrgID() {
return authorizer.DecisionDeny, "invalid org", nil
}
if !types.NamespaceMatches(ident.GetNamespace(), a.GetNamespace()) {
return authorizer.DecisionDeny, "invalid namespace", nil
}
return authorizer.DecisionNoOpinion, "", nil
}
pkg/services/apiserver/auth/authorizer/org_id.go
-87
View File
@@ -1,87 +0,0 @@
package authorizer
import (
"context"
"fmt"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
)
var _ authorizer.Authorizer = &orgIDAuthorizer{}
type orgIDAuthorizer struct {
log log.Logger
org org.Service
}
func newOrgIDAuthorizer(orgService org.Service) *orgIDAuthorizer {
return &orgIDAuthorizer{
log: log.New("grafana-apiserver.authorizer.orgid"),
org: orgService,
}
}
func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
info, err := claims.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
}
// No opinion when the namespace is empty
if info.Value == "" {
return authorizer.DecisionNoOpinion, "", nil
}
// Grafana super admins can see things in every org
if signedInUser.GetIsGrafanaAdmin() {
return authorizer.DecisionNoOpinion, "", nil
}
if info.OrgID == -1 {
return authorizer.DecisionDeny, "org id is required", nil
}
if info.StackID != 0 {
return authorizer.DecisionDeny, "using a stack namespace requires deployment with a fixed stack id", nil
}
// Quick check that the same org is used
if signedInUser.GetOrgID() == info.OrgID {
return authorizer.DecisionNoOpinion, "", nil
}
// If we have an anonymous user, let the next authorizers decide.
if signedInUser.GetIdentityType() == claims.TypeAnonymous {
return authorizer.DecisionNoOpinion, "", nil
}
// Check if the user has access to the specified org
// nolint:staticcheck
userId, err := signedInUser.GetInternalID()
if err != nil {
return authorizer.DecisionDeny, "unable to get userId", err
}
query := org.GetUserOrgListQuery{UserID: userId}
result, err := auth.org.GetUserOrgList(ctx, &query)
if err != nil {
return authorizer.DecisionDeny, "error getting user org list", err
}
for _, org := range result {
if org.OrgID == info.OrgID {
return authorizer.DecisionNoOpinion, "", nil
}
}
return authorizer.DecisionDeny, fmt.Sprintf("user %d is not a member of org %d", userId, info.OrgID), nil
}
pkg/services/apiserver/auth/authorizer/org_role.go → pkg/services/apiserver/auth/authorizer/role.go
+6 -9
View File
@@ -5,22 +5,19 @@ import (
"fmt"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
var _ authorizer.Authorizer = &orgRoleAuthorizer{}
var _ authorizer.Authorizer = &roleAuthorizer{}
type orgRoleAuthorizer struct {
log log.Logger
type roleAuthorizer struct{}
func newRoleAuthorizer() *roleAuthorizer {
return &roleAuthorizer{}
}
func newOrgRoleAuthorizer(orgService org.Service) *orgRoleAuthorizer {
return &orgRoleAuthorizer{log: log.New("grafana-apiserver.authorizer.orgrole")}
}
func (auth orgRoleAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
func (auth roleAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
pkg/services/apiserver/auth/authorizer/stack_id.go
-66
View File
@@ -1,66 +0,0 @@
package authorizer
import (
"context"
"fmt"
"strconv"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/setting"
)
var _ authorizer.Authorizer = &stackIDAuthorizer{}
type stackIDAuthorizer struct {
log log.Logger
stackID int64
}
func newStackIDAuthorizer(cfg *setting.Cfg) *stackIDAuthorizer {
stackID, err := strconv.ParseInt(cfg.StackID, 10, 64)
if err != nil {
return nil
}
return &stackIDAuthorizer{
log: log.New("grafana-apiserver.authorizer.stackid"),
stackID: stackID, // this lets a single tenant grafana validate stack id (rather than orgs)
}
}
func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
// If we have an anonymous user, let the next authorizers decide.
if signedInUser.GetIdentityType() == claims.TypeAnonymous {
return authorizer.DecisionNoOpinion, "", nil
}
info, err := claims.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
}
// No opinion when the namespace is empty
if info.Value == "" {
return authorizer.DecisionNoOpinion, "", nil
}
if info.StackID != auth.stackID {
msg := fmt.Sprintf("wrong stack id is selected (expected: %d, found %d)", auth.stackID, info.StackID)
return authorizer.DecisionDeny, msg, nil
}
if info.OrgID != 1 {
return authorizer.DecisionDeny, "cloud instance requires org 1", nil
}
if signedInUser.GetOrgID() != 1 {
return authorizer.DecisionDeny, "user must be in org 1", nil
}
return authorizer.DecisionNoOpinion, "", nil
}