public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Ext JWT support actions (#92486)

Browse Source
This commit is contained in:
Gabriel MABILLE
2024-09-19 14:25:43 +02:00
committed by GitHub
parent 1e3816a6f8
commit 7ef13497a8
8 changed files with 270 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/clients/ext_jwt.go
+18 -6
View File
@@ -147,7 +147,7 @@ func (s *ExtendedJWT) authenticateAsUser(
ClientParams: authn.ClientParams{
SyncPermissions: true,
FetchPermissionsParams: authn.FetchPermissionsParams{
ActionsLookup: accessTokenClaims.Rest.DelegatedPermissions,
RestrictedActions: accessTokenClaims.Rest.DelegatedPermissions,
},
FetchSyncedUser: true,
}}, nil
@@ -168,6 +168,20 @@ func (s *ExtendedJWT) authenticateAsService(accessTokenClaims authlib.Claims[aut
return nil, errExtJWTInvalidSubject.Errorf("unexpected identity: %s", accessTokenClaims.Subject)
}
permissions := accessTokenClaims.Rest.Permissions
fetchPermissionsParams := authn.FetchPermissionsParams{}
if len(permissions) > 0 {
fetchPermissionsParams.Roles = make([]string, 0, len(permissions))
fetchPermissionsParams.AllowedActions = make([]string, 0, len(permissions))
for i := range permissions {
if strings.HasPrefix(permissions[i], "fixed:") {
fetchPermissionsParams.Roles = append(fetchPermissionsParams.Roles, permissions[i])
} else {
fetchPermissionsParams.AllowedActions = append(fetchPermissionsParams.AllowedActions, permissions[i])
}
}
}
return &authn.Identity{
ID: id,
UID: id,
@@ -179,11 +193,9 @@ func (s *ExtendedJWT) authenticateAsService(accessTokenClaims authlib.Claims[aut
AuthID: accessTokenClaims.Subject,
AllowedKubernetesNamespace: accessTokenClaims.Rest.Namespace,
ClientParams: authn.ClientParams{
SyncPermissions: true,
FetchPermissionsParams: authn.FetchPermissionsParams{
Roles: accessTokenClaims.Rest.Permissions,
},
FetchSyncedUser: false,
SyncPermissions: true,
FetchPermissionsParams: fetchPermissionsParams,
FetchSyncedUser: false,
},
}, nil
}
pkg/services/authn/clients/ext_jwt_test.go
+3 -3
View File
@@ -35,7 +35,7 @@ var (
Rest: authnlib.AccessTokenClaims{
Scopes: []string{"profile", "groups"},
DelegatedPermissions: []string{"dashboards:create", "folders:read", "datasources:explore", "datasources.insights:read"},
Permissions: []string{"fixed:folders:reader"},
Permissions: []string{"fixed:folders:reader", "folders:read"},
Namespace: "default", // org ID of 1 is special and translates to default
},
}
@@ -236,7 +236,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) {
AuthID: "access-policy:this-uid",
ClientParams: authn.ClientParams{
SyncPermissions: true,
FetchPermissionsParams: authn.FetchPermissionsParams{Roles: []string{"fixed:folders:reader"}}},
FetchPermissionsParams: authn.FetchPermissionsParams{Roles: []string{"fixed:folders:reader"}, AllowedActions: []string{"folders:read"}}},
},
},
{
@@ -275,7 +275,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) {
FetchSyncedUser: true,
SyncPermissions: true,
FetchPermissionsParams: authn.FetchPermissionsParams{
ActionsLookup: []string{"dashboards:create", "folders:read", "datasources:explore", "datasources.insights:read"},
RestrictedActions: []string{"dashboards:create", "folders:read", "datasources:explore", "datasources.insights:read"},
},
},
},