public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apiserver: Refactor authenticator and authorizers (#101449)

Browse Source 
* Clean up authenticator

* Cleanup authorizers and replace org_id and stack_id with namespace authorizer

* Remove dependency on org service

* Extract orgID from /apis/ urls and validate stack id
This commit is contained in:
Karl Persson
2025-03-06 16:01:12 +01:00
committed by GitHub
parent 0a24a7cd4c
commit 43f56c5ca1
16 changed files with 372 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/apiserver/auth/authenticator/authenticator.go
+30
View File
@@ -0,0 +1,30 @@
package authenticator
import (
"net/http"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
"k8s.io/klog/v2"
"github.com/grafana/grafana/pkg/apimachinery/identity"
)
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request {
handlers := append([]authenticator.Request{authenticator.RequestFunc(identityAuthenticator)}, authRequestHandlers...)
return union.New(handlers...)
}
var _ authenticator.RequestFunc = identityAuthenticator
// identityAuthenticator check if we have any identity set in context.
// If not we delegate authentication to next authenticator in the chain.
func identityAuthenticator(req *http.Request) (*authenticator.Response, bool, error) {
ident, err := identity.GetRequester(req.Context())
if err != nil {
klog.V(5).Info("no idenitty in context", "err", err)
return nil, false, nil
}
return &authenticator.Response{User: ident}, true, nil
}
pkg/services/apiserver/auth/authenticator/authenticator_test.go
+63
View File
@@ -0,0 +1,63 @@
package authenticator
import (
"context"
"net/http"
"testing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/require"
"k8s.io/apiserver/pkg/authentication/authenticator"
)
func TestAuthenticator(t *testing.T) {
t.Run("should call next authenticator if identity is not set in context", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
mockAuthenticator := &mockAuthenticator{}
auth := NewAuthenticator(mockAuthenticator)
res, ok, err := auth.AuthenticateRequest(req)
require.NoError(t, err)
require.False(t, ok)
require.Nil(t, res)
require.True(t, mockAuthenticator.called)
})
t.Run("should authenticate when identity is set in context", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
ident := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: "xyz",
Teams: []int64{1, 2},
}
req = req.WithContext(identity.WithRequester(context.Background(), ident))
mockAuthenticator := &mockAuthenticator{}
auth := NewAuthenticator(mockAuthenticator)
res, ok, err := auth.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, ident.GetName(), res.User.GetName())
require.Equal(t, ident.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["id-token"])
})
}
var _ authenticator.Request = (*mockAuthenticator)(nil)
type mockAuthenticator struct {
called bool
}
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
a.called = true
return nil, false, nil
}
pkg/services/apiserver/auth/authenticator/provider.go
-11
View File
@@ -1,11 +0,0 @@
package authenticator
import (
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
)
func NewAuthenticator(authRequestHandlers ...authenticator.Request) authenticator.Request {
handlers := append([]authenticator.Request{authenticator.RequestFunc(signedInUserAuthenticator)}, authRequestHandlers...)
return union.New(handlers...)
}
pkg/services/apiserver/auth/authenticator/signedinuser.go
-24
View File
@@ -1,24 +0,0 @@
package authenticator
import (
"net/http"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/klog/v2"
)
var _ authenticator.RequestFunc = signedInUserAuthenticator
func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool, error) {
ctx := req.Context()
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
klog.V(5).Info("failed to get signed in user", "err", err)
return nil, false, nil
}
return &authenticator.Response{
User: signedInUser,
}, true, nil
}
pkg/services/apiserver/auth/authenticator/signedinuser_test.go
-88
View File
@@ -1,88 +0,0 @@
package authenticator
import (
"context"
"net/http"
"testing"
"github.com/google/uuid"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/require"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/union"
)
func TestSignedInUser(t *testing.T) {
t.Run("should call next authenticator if SignedInUser is not set", func(t *testing.T) {
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.False(t, ok)
require.Nil(t, res)
require.True(t, mockAuthenticator.called)
})
t.Run("should set user and group", func(t *testing.T) {
u := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: "xyz",
Teams: []int64{1, 2},
}
ctx := identity.WithRequester(context.Background(), u)
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
req = req.WithContext(ctx)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["id-token"])
})
t.Run("should set ID token when available", func(t *testing.T) {
u := &user.SignedInUser{
Name: "admin",
UserID: 1,
UserUID: uuid.New().String(),
Teams: []int64{1, 2},
IDToken: "test-id-token",
}
ctx := identity.WithRequester(context.Background(), u)
req, err := http.NewRequest("GET", "http://localhost:3000/apis", nil)
require.NoError(t, err)
req = req.WithContext(ctx)
mockAuthenticator := &mockAuthenticator{}
all := union.New(authenticator.RequestFunc(signedInUserAuthenticator), mockAuthenticator)
res, ok, err := all.AuthenticateRequest(req)
require.NoError(t, err)
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Equal(t, "test-id-token", res.User.GetExtra()["id-token"][0])
})
}
var _ authenticator.Request = (*mockAuthenticator)(nil)
type mockAuthenticator struct {
called bool
}
func (a *mockAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
a.called = true
return nil, false, nil
}