From 786325d0912ba22739a1c2113a541e371cc7b8d2 Mon Sep 17 00:00:00 2001 From: Mariell Hoversholm Date: Mon, 20 Jan 2025 10:03:19 +0100 Subject: [PATCH] security: disable auth when provisioning is enabled --- pkg/services/authz/client.go | 7 +++++++ pkg/storage/unified/resource/go.sum | 1 + 2 files changed, 8 insertions(+) diff --git a/pkg/services/authz/client.go b/pkg/services/authz/client.go index c3399811a00..50b78ab7c13 100644 --- a/pkg/services/authz/client.go +++ b/pkg/services/authz/client.go @@ -3,6 +3,7 @@ package authz import ( "context" "errors" + "log/slog" "github.com/fullstorydev/grpchan" "github.com/fullstorydev/grpchan/inprocgrpc" @@ -33,6 +34,12 @@ func ProvideAuthZClient( cfg *setting.Cfg, features featuremgmt.FeatureToggles, grpcServer grpcserver.Provider, tracer tracing.Tracer, db db.DB, ) (authzlib.AccessClient, error) { + // FIXME: SECURITY: Enable authorization. DO NOT MERGE until fixed. + if features.IsEnabledGlobally(featuremgmt.FlagProvisioning) && !setting.IsEnterprise { + slog.Warn("Authorization is disabled for provisioning. To enable, use Enterprise, or wait for OSS fix.") + return nil, nil + } + authCfg, err := ReadCfg(cfg) if err != nil { return nil, err diff --git a/pkg/storage/unified/resource/go.sum b/pkg/storage/unified/resource/go.sum index d1d67af2a44..f2a4fc640ff 100644 --- a/pkg/storage/unified/resource/go.sum +++ b/pkg/storage/unified/resource/go.sum @@ -75,6 +75,7 @@ github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f h1:HR5nRmUQgX github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f/go.mod h1:f3HiCrHjHBdcm6E83vGaXh1KomZMA2P6aeo3hKx/wg0= github.com/Yiling-J/theine-go v0.6.0 h1:jv7V/tcD6ijL0T4kfbJDKP81TCZBkoriNTPSqwivWuY= github.com/Yiling-J/theine-go v0.6.0/go.mod h1:mdch1vjgGWd7s3rWKvY+MF5InRLfRv/CWVI9RVNQ8wY= +github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=