public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Identity: extend k8s user.Info (#90937)

Browse Source
This commit is contained in:
Ryan McKinley
2024-07-30 08:27:23 +03:00
committed by GitHub
parent efda5a3ef2
commit 728150bdbd
26 changed files with 214 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/apiserver/auth/authenticator/signedinuser.go
+3 -27
View File
@@ -2,13 +2,10 @@ package authenticator
import (
"net/http"
"strconv"
"k8s.io/apiserver/pkg/authentication/authenticator"
k8suser "k8s.io/apiserver/pkg/authentication/user"
"k8s.io/klog/v2"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/klog/v2"
)
var _ authenticator.RequestFunc = signedInUserAuthenticator
@@ -21,28 +18,7 @@ func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool
return nil, false, nil
}
userInfo := &k8suser.DefaultInfo{
Name: signedInUser.GetLogin(),
UID: signedInUser.GetUID().ID(),
Groups: []string{},
// In order to faithfully round-trip through an impersonation flow, Extra keys MUST be lowercase.
// see: https://pkg.go.dev/k8s.io/apiserver@v0.27.1/pkg/authentication/user#Info
Extra: map[string][]string{},
}
for _, v := range signedInUser.GetTeams() {
userInfo.Groups = append(userInfo.Groups, strconv.FormatInt(v, 10))
}
//
if signedInUser.GetIDToken() != "" {
userInfo.Extra["id-token"] = []string{signedInUser.GetIDToken()}
}
if signedInUser.GetOrgRole().IsValid() {
userInfo.Extra["user-instance-role"] = []string{string(signedInUser.GetOrgRole())}
}
return &authenticator.Response{
User: userInfo,
User: signedInUser,
}, true, nil
}
pkg/services/apiserver/auth/authenticator/signedinuser_test.go
+7 -7
View File
@@ -28,9 +28,9 @@ func TestSignedInUser(t *testing.T) {
t.Run("should set user and group", func(t *testing.T) {
u := &user.SignedInUser{
Login: "admin",
Name: "admin",
UserID: 1,
UserUID: uuid.New().String(),
UserUID: "xyz",
Teams: []int64{1, 2},
}
ctx := identity.WithRequester(context.Background(), u)
@@ -44,15 +44,15 @@ func TestSignedInUser(t *testing.T) {
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.Login, res.User.GetName())
require.Equal(t, u.UserUID, res.User.GetUID())
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["id-token"])
})
t.Run("should set ID token when available", func(t *testing.T) {
u := &user.SignedInUser{
Login: "admin",
Name: "admin",
UserID: 1,
UserUID: uuid.New().String(),
Teams: []int64{1, 2},
@@ -69,8 +69,8 @@ func TestSignedInUser(t *testing.T) {
require.True(t, ok)
require.False(t, mockAuthenticator.called)
require.Equal(t, u.Login, res.User.GetName())
require.Equal(t, u.UserUID, res.User.GetUID())
require.Equal(t, u.GetName(), res.User.GetName())
require.Equal(t, u.GetUID(), res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Equal(t, "test-id-token", res.User.GetExtra()["id-token"][0])
})