public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Ext JWT support actions (#92486)

Browse Source
This commit is contained in:
Gabriel MABILLE
2024-09-19 14:25:43 +02:00
committed by GitHub
parent 1e3816a6f8
commit 7ef13497a8
8 changed files with 270 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/service_test.go
+53 -5
View File
@@ -59,7 +59,7 @@ func TestService_Authenticate(t *testing.T) {
Type: claims.TypeUser,
ClientParams: authn.ClientParams{
FetchPermissionsParams: authn.FetchPermissionsParams{
ActionsLookup: []string{
RestrictedActions: []string{
"datasources:read",
"datasources:query",
},
@@ -76,7 +76,7 @@ func TestService_Authenticate(t *testing.T) {
Type: claims.TypeUser,
ClientParams: authn.ClientParams{
FetchPermissionsParams: authn.FetchPermissionsParams{
ActionsLookup: []string{
RestrictedActions: []string{
"datasources:read",
"datasources:query",
},
@@ -87,6 +87,50 @@ func TestService_Authenticate(t *testing.T) {
},
},
},
{
desc: "should succeed with authentication for client with fetch permissions params made of roles and actions",
clients: []authn.Client{
&authntest.FakeClient{
ExpectedTest: true,
ExpectedIdentity: &authn.Identity{
ID: "2",
Type: claims.TypeUser,
ClientParams: authn.ClientParams{
FetchPermissionsParams: authn.FetchPermissionsParams{
RestrictedActions: []string{
"datasources:read",
"datasources:query",
},
AllowedActions: []string{
"datasources:write",
},
Roles: []string{
"fixed:datasources:writer",
},
},
},
},
},
},
expectedIdentity: &authn.Identity{
ID: "2",
Type: claims.TypeUser,
ClientParams: authn.ClientParams{
FetchPermissionsParams: authn.FetchPermissionsParams{
RestrictedActions: []string{
"datasources:read",
"datasources:query",
},
AllowedActions: []string{
"datasources:write",
},
Roles: []string{
"fixed:datasources:writer",
},
},
},
},
},
{
desc: "should succeed with authentication for second client when first test fail",
clients: []authn.Client{
@@ -187,9 +231,13 @@ func TestService_Authenticate(t *testing.T) {
assert.Equal(t, tt.expectedIdentity.AuthID, attr.Value.AsString())
case "identity.AuthenticatedBy":
assert.Equal(t, tt.expectedIdentity.AuthenticatedBy, attr.Value.AsString())
case "identity.ClientParams.FetchPermissionsParams.ActionsLookup":
if len(tt.expectedIdentity.ClientParams.FetchPermissionsParams.ActionsLookup) > 0 {
assert.Equal(t, tt.expectedIdentity.ClientParams.FetchPermissionsParams.ActionsLookup, attr.Value.AsStringSlice())
case "identity.ClientParams.FetchPermissionsParams.RestrictedActions":
if len(tt.expectedIdentity.ClientParams.FetchPermissionsParams.RestrictedActions) > 0 {
assert.Equal(t, tt.expectedIdentity.ClientParams.FetchPermissionsParams.RestrictedActions, attr.Value.AsStringSlice())
}
case "identity.ClientParams.FetchPermissionsParams.AllowedActions":
if len(tt.expectedIdentity.ClientParams.FetchPermissionsParams.AllowedActions) > 0 {
assert.Equal(t, tt.expectedIdentity.ClientParams.FetchPermissionsParams.AllowedActions, attr.Value.AsStringSlice())
}
case "identity.ClientParams.FetchPermissionsParams.Roles":
if len(tt.expectedIdentity.ClientParams.FetchPermissionsParams.Roles) > 0 {