From 66932600ecfe10b77ef9ec998ed191992651003c Mon Sep 17 00:00:00 2001 From: Ryan McKinley Date: Wed, 19 Feb 2025 00:49:54 +0300 Subject: [PATCH] K8s: DecisionNoOpinion for claims.TypeAnonymous (#100880) --- pkg/services/apiserver/auth/authorizer/org_id.go | 5 +++++ pkg/services/apiserver/auth/authorizer/stack_id.go | 9 +++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/pkg/services/apiserver/auth/authorizer/org_id.go b/pkg/services/apiserver/auth/authorizer/org_id.go index 87b38d2f9c2..a76f55e73d7 100644 --- a/pkg/services/apiserver/auth/authorizer/org_id.go +++ b/pkg/services/apiserver/auth/authorizer/org_id.go @@ -60,6 +60,11 @@ func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attribut return authorizer.DecisionNoOpinion, "", nil } + // If we have an anonymous user, let the next authorizers decide. + if signedInUser.GetIdentityType() == claims.TypeAnonymous { + return authorizer.DecisionNoOpinion, "", nil + } + // Check if the user has access to the specified org // nolint:staticcheck userId, err := signedInUser.GetInternalID() diff --git a/pkg/services/apiserver/auth/authorizer/stack_id.go b/pkg/services/apiserver/auth/authorizer/stack_id.go index cbec3b0d09f..2232335984d 100644 --- a/pkg/services/apiserver/auth/authorizer/stack_id.go +++ b/pkg/services/apiserver/auth/authorizer/stack_id.go @@ -37,6 +37,11 @@ func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attrib return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil } + // If we have an anonymous user, let the next authorizers decide. + if signedInUser.GetIdentityType() == claims.TypeAnonymous { + return authorizer.DecisionNoOpinion, "", nil + } + info, err := claims.ParseNamespace(a.GetNamespace()) if err != nil { return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil @@ -46,9 +51,9 @@ func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attrib if info.Value == "" { return authorizer.DecisionNoOpinion, "", nil } - if info.StackID != auth.stackID { - return authorizer.DecisionDeny, "wrong stack id is selected", nil + msg := fmt.Sprintf("wrong stack id is selected (expected: %d, found %d)", auth.stackID, info.StackID) + return authorizer.DecisionDeny, msg, nil } if info.OrgID != 1 { return authorizer.DecisionDeny, "cloud instance requires org 1", nil