public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Ext JWT support actions (#92486)

Browse Source
This commit is contained in:
Gabriel MABILLE
2024-09-19 14:25:43 +02:00
committed by GitHub
parent 1e3816a6f8
commit 7ef13497a8
8 changed files with 270 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/sync/rbac_sync.go
+27 -10
View File
@@ -11,6 +11,7 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/permreg"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
@@ -21,18 +22,20 @@ var (
errSyncPermissionsForbidden = errutil.Forbidden("permissions.sync.forbidden")
)
func ProvideRBACSync(acService accesscontrol.Service, tracer tracing.Tracer) *RBACSync {
func ProvideRBACSync(acService accesscontrol.Service, tracer tracing.Tracer, permRegistry permreg.PermissionRegistry) *RBACSync {
return &RBACSync{
ac: acService,
log: log.New("permissions.sync"),
tracer: tracer,
ac: acService,
log: log.New("permissions.sync"),
permRegistry: permRegistry,
tracer: tracer,
}
}
type RBACSync struct {
ac accesscontrol.Service
log log.Logger
tracer tracing.Tracer
ac accesscontrol.Service
permRegistry permreg.PermissionRegistry
log log.Logger
tracer tracing.Tracer
}
func (s *RBACSync) SyncPermissionsHook(ctx context.Context, ident *authn.Identity, _ *authn.Request) error {
@@ -56,7 +59,7 @@ func (s *RBACSync) SyncPermissionsHook(ctx context.Context, ident *authn.Identit
grouped := accesscontrol.GroupScopesByActionContext(ctx, permissions)
// Restrict access to the list of actions
actionsLookup := ident.ClientParams.FetchPermissionsParams.ActionsLookup
actionsLookup := ident.ClientParams.FetchPermissionsParams.RestrictedActions
if len(actionsLookup) > 0 {
filtered := make(map[string][]string, len(actionsLookup))
for _, action := range actionsLookup {
@@ -77,7 +80,8 @@ func (s *RBACSync) fetchPermissions(ctx context.Context, ident *authn.Identity)
permissions := make([]accesscontrol.Permission, 0, 8)
roles := ident.ClientParams.FetchPermissionsParams.Roles
if len(roles) > 0 {
actions := ident.ClientParams.FetchPermissionsParams.AllowedActions
if len(roles) > 0 || len(actions) > 0 {
for _, role := range roles {
roleDTO, err := s.ac.GetRoleByName(ctx, ident.GetOrgID(), role)
if err != nil && !errors.Is(err, accesscontrol.ErrRoleNotFound) {
@@ -88,7 +92,20 @@ func (s *RBACSync) fetchPermissions(ctx context.Context, ident *authn.Identity)
permissions = append(permissions, roleDTO.Permissions...)
}
}
for _, action := range actions {
scopes, ok := s.permRegistry.GetScopePrefixes(action)
if !ok {
s.log.Warn("Unknown action scopes", "action", action)
continue
}
if len(scopes) == 0 {
permissions = append(permissions, accesscontrol.Permission{Action: action})
continue
}
for scope := range scopes {
permissions = append(permissions, accesscontrol.Permission{Action: action, Scope: scope + "*"})
}
}
return permissions, nil
}