From 9dd38de5c12ec95481cb789d3a9937f6a34c9005 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Tue, 10 Oct 2023 16:29:31 +0200 Subject: [PATCH] RBAC: Make fixed role UIDs deterministic (#76239) * Add fixed role UID Co-authored-by: Karl Persson * Use base64 url encoding --------- Co-authored-by: Karl Persson --- pkg/services/accesscontrol/models.go | 1 + pkg/services/accesscontrol/roles.go | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go index 87a95f89a89..f09ef0b4fec 100644 --- a/pkg/services/accesscontrol/models.go +++ b/pkg/services/accesscontrol/models.go @@ -321,6 +321,7 @@ func (cmd *SaveExternalServiceRoleCommand) Validate() error { const ( GlobalOrgID = 0 FixedRolePrefix = "fixed:" + FixedRoleUIDPrefix = "fixed_" ManagedRolePrefix = "managed:" BasicRolePrefix = "basic:" PluginRolePrefix = "plugins:" diff --git a/pkg/services/accesscontrol/roles.go b/pkg/services/accesscontrol/roles.go index 198b4583790..6f6a8822dde 100644 --- a/pkg/services/accesscontrol/roles.go +++ b/pkg/services/accesscontrol/roles.go @@ -1,6 +1,9 @@ package accesscontrol import ( + // #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes + "crypto/sha1" + "encoding/base64" "fmt" "strings" "sync" @@ -253,6 +256,15 @@ func ConcatPermissions(permissions ...[]Permission) []Permission { return perms } +// FixedRoleUID generates a UID of 34 bytes: "fixed_" + base64(sha1(roleName)) +func FixedRoleUID(roleName string) string { + // #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes + hasher := sha1.New() + hasher.Write([]byte(roleName)) + + return fmt.Sprintf("%s%s", FixedRoleUIDPrefix, base64.RawURLEncoding.EncodeToString(hasher.Sum(nil))) +} + // ValidateFixedRole errors when a fixed role does not match expected pattern func ValidateFixedRole(role RoleDTO) error { if !strings.HasPrefix(role.Name, FixedRolePrefix) {