public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apiserver: Refactor authenticator and authorizers (#101449)

Browse Source 
* Clean up authenticator

* Cleanup authorizers and replace org_id and stack_id with namespace authorizer

* Remove dependency on org service

* Extract orgID from /apis/ urls and validate stack id
This commit is contained in:
Karl Persson
2025-03-06 16:01:12 +01:00
committed by GitHub
parent 0a24a7cd4c
commit 43f56c5ca1
16 changed files with 372 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/apiserver/auth/authorizer/provider.go → pkg/services/apiserver/auth/authorizer/authorizer.go
+14 -11
View File
@@ -3,7 +3,6 @@ package authorizer
import (
"context"
orgsvc "github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/setting"
"k8s.io/apimachinery/pkg/runtime/schema"
k8suser "k8s.io/apiserver/pkg/authentication/user"
@@ -19,17 +18,21 @@ type GrafanaAuthorizer struct {
auth authorizer.Authorizer
}
func NewGrafanaAuthorizer(cfg *setting.Cfg, orgService orgsvc.Service) *GrafanaAuthorizer {
// NewGrafanaAuthorizer returns an authorizer configured for a grafana instance.
// This authorizer is a chain of smaller authorizers that together form the decision if
// access should be granted.
// 1. We deny all impersonate request.
// 2. We allow all identities that belongs to `system:masters` group, regular grafana identities cannot
// be part of this group
// 3. We check that identity is allowed to make a request for namespace.
// 4. We check authorizer that is configured speficially for an api.
// 5. As a last fallback we check Role, this will only happen if an api have not configured
// an authorizer or return authorizer.DecisionNoOpinion
func NewGrafanaAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
authorizers := []authorizer.Authorizer{
&impersonationAuthorizer{},
newImpersonationAuthorizer(),
authorizerfactory.NewPrivilegedGroups(k8suser.SystemPrivilegedGroup),
}
// In Hosted grafana, the StackID replaces the orgID as a valid namespace
if cfg.StackID != "" {
authorizers = append(authorizers, newStackIDAuthorizer(cfg))
} else {
authorizers = append(authorizers, newOrgIDAuthorizer(orgService))
newNamespaceAuthorizer(),
}
// Individual services may have explicit implementations
@@ -38,7 +41,7 @@ func NewGrafanaAuthorizer(cfg *setting.Cfg, orgService orgsvc.Service) *GrafanaA
// org role is last -- and will return allow for verbs that match expectations
// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
authorizers = append(authorizers, newOrgRoleAuthorizer(orgService))
authorizers = append(authorizers, newRoleAuthorizer())
return &GrafanaAuthorizer{
apis: apis,
auth: union.New(authorizers...),
pkg/services/apiserver/auth/authorizer/impersonation.go
+4
View File
@@ -8,6 +8,10 @@ import (
var _ authorizer.Authorizer = (*impersonationAuthorizer)(nil)
func newImpersonationAuthorizer() *impersonationAuthorizer {
return &impersonationAuthorizer{}
}
// ImpersonationAuthorizer denies all impersonation requests.
type impersonationAuthorizer struct{}
pkg/services/apiserver/auth/authorizer/namespace.go
+52
View File
@@ -0,0 +1,52 @@
package authorizer
import (
"context"
"fmt"
"github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
type namespaceAuthorizer struct {
}
func newNamespaceAuthorizer() *namespaceAuthorizer {
return &namespaceAuthorizer{}
}
func (auth namespaceAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
ident, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, "missing auth info", fmt.Errorf("missing auth info: %w", err)
}
if ident.GetIsGrafanaAdmin() {
return authorizer.DecisionNoOpinion, "", nil
}
if !a.IsResourceRequest() {
return authorizer.DecisionNoOpinion, "", nil
}
// If we have an anonymous user, let the next authorizers decide.
if types.IsIdentityType(ident.GetIdentityType(), types.TypeAnonymous) {
return authorizer.DecisionNoOpinion, "", nil
}
ns, err := types.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, "invalid namespace", err
}
if ns.OrgID != ident.GetOrgID() {
return authorizer.DecisionDeny, "invalid org", nil
}
if !types.NamespaceMatches(ident.GetNamespace(), a.GetNamespace()) {
return authorizer.DecisionDeny, "invalid namespace", nil
}
return authorizer.DecisionNoOpinion, "", nil
}
pkg/services/apiserver/auth/authorizer/org_id.go
-87
View File
@@ -1,87 +0,0 @@
package authorizer
import (
"context"
"fmt"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
)
var _ authorizer.Authorizer = &orgIDAuthorizer{}
type orgIDAuthorizer struct {
log log.Logger
org org.Service
}
func newOrgIDAuthorizer(orgService org.Service) *orgIDAuthorizer {
return &orgIDAuthorizer{
log: log.New("grafana-apiserver.authorizer.orgid"),
org: orgService,
}
}
func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
info, err := claims.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
}
// No opinion when the namespace is empty
if info.Value == "" {
return authorizer.DecisionNoOpinion, "", nil
}
// Grafana super admins can see things in every org
if signedInUser.GetIsGrafanaAdmin() {
return authorizer.DecisionNoOpinion, "", nil
}
if info.OrgID == -1 {
return authorizer.DecisionDeny, "org id is required", nil
}
if info.StackID != 0 {
return authorizer.DecisionDeny, "using a stack namespace requires deployment with a fixed stack id", nil
}
// Quick check that the same org is used
if signedInUser.GetOrgID() == info.OrgID {
return authorizer.DecisionNoOpinion, "", nil
}
// If we have an anonymous user, let the next authorizers decide.
if signedInUser.GetIdentityType() == claims.TypeAnonymous {
return authorizer.DecisionNoOpinion, "", nil
}
// Check if the user has access to the specified org
// nolint:staticcheck
userId, err := signedInUser.GetInternalID()
if err != nil {
return authorizer.DecisionDeny, "unable to get userId", err
}
query := org.GetUserOrgListQuery{UserID: userId}
result, err := auth.org.GetUserOrgList(ctx, &query)
if err != nil {
return authorizer.DecisionDeny, "error getting user org list", err
}
for _, org := range result {
if org.OrgID == info.OrgID {
return authorizer.DecisionNoOpinion, "", nil
}
}
return authorizer.DecisionDeny, fmt.Sprintf("user %d is not a member of org %d", userId, info.OrgID), nil
}
pkg/services/apiserver/auth/authorizer/org_role.go → pkg/services/apiserver/auth/authorizer/role.go
+6 -9
View File
@@ -5,22 +5,19 @@ import (
"fmt"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
var _ authorizer.Authorizer = &orgRoleAuthorizer{}
var _ authorizer.Authorizer = &roleAuthorizer{}
type orgRoleAuthorizer struct {
log log.Logger
type roleAuthorizer struct{}
func newRoleAuthorizer() *roleAuthorizer {
return &roleAuthorizer{}
}
func newOrgRoleAuthorizer(orgService org.Service) *orgRoleAuthorizer {
return &orgRoleAuthorizer{log: log.New("grafana-apiserver.authorizer.orgrole")}
}
func (auth orgRoleAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
func (auth roleAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
pkg/services/apiserver/auth/authorizer/stack_id.go
-66
View File
@@ -1,66 +0,0 @@
package authorizer
import (
"context"
"fmt"
"strconv"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/setting"
)
var _ authorizer.Authorizer = &stackIDAuthorizer{}
type stackIDAuthorizer struct {
log log.Logger
stackID int64
}
func newStackIDAuthorizer(cfg *setting.Cfg) *stackIDAuthorizer {
stackID, err := strconv.ParseInt(cfg.StackID, 10, 64)
if err != nil {
return nil
}
return &stackIDAuthorizer{
log: log.New("grafana-apiserver.authorizer.stackid"),
stackID: stackID, // this lets a single tenant grafana validate stack id (rather than orgs)
}
}
func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
// If we have an anonymous user, let the next authorizers decide.
if signedInUser.GetIdentityType() == claims.TypeAnonymous {
return authorizer.DecisionNoOpinion, "", nil
}
info, err := claims.ParseNamespace(a.GetNamespace())
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
}
// No opinion when the namespace is empty
if info.Value == "" {
return authorizer.DecisionNoOpinion, "", nil
}
if info.StackID != auth.stackID {
msg := fmt.Sprintf("wrong stack id is selected (expected: %d, found %d)", auth.stackID, info.StackID)
return authorizer.DecisionDeny, msg, nil
}
if info.OrgID != 1 {
return authorizer.DecisionDeny, "cloud instance requires org 1", nil
}
if signedInUser.GetOrgID() != 1 {
return authorizer.DecisionDeny, "user must be in org 1", nil
}
return authorizer.DecisionNoOpinion, "", nil
}