public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ: Launch service within IAM app (#96421)

Browse Source
This commit is contained in:
Gabriel MABILLE
2024-11-20 11:13:33 +01:00
committed by GitHub
parent 4800b8a26b
commit aa2b4751a0
10 changed files with 223 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/rbac/service.go
+37
View File
@@ -0,0 +1,37 @@
package rbac
import (
authzv1 "github.com/grafana/authlib/authz/proto/v1"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/authz/rbac/store"
"github.com/grafana/grafana/pkg/storage/legacysql"
)
type Service struct {
authzv1.UnimplementedAuthzServiceServer
authzextv1.UnimplementedAuthzExtentionServiceServer
store *store.Store
logger log.Logger
tracer tracing.Tracer
}
func NewService(sql legacysql.LegacyDatabaseProvider, logger log.Logger, tracer tracing.Tracer) *Service {
return &Service{
store: store.NewStore(sql),
logger: logger,
tracer: tracer,
}
}
// TODO: Implement Check
// func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv1.CheckResponse, error) {
// This needs to be done for the database provider
// ns := req.GetNamespace()
// ctx = request.WithNamespace(ctx, ns)
// return nil, nil
// }
pkg/services/authz/rbac/store/store.go
+15
View File
@@ -0,0 +1,15 @@
package store
import "github.com/grafana/grafana/pkg/storage/legacysql"
// TODO (gamab): Implement GetRoles, GetTeams, GetFolders, GetPermissions
type Store struct {
sql legacysql.LegacyDatabaseProvider
}
func NewStore(sql legacysql.LegacyDatabaseProvider) *Store {
return &Store{
sql: sql,
}
}
pkg/services/authz/server.go
+11
View File
@@ -16,11 +16,22 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authz/mappers"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
"github.com/grafana/grafana/pkg/services/authz/rbac"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/folder"
"github.com/grafana/grafana/pkg/services/grpcserver"
"github.com/grafana/grafana/pkg/storage/legacysql"
)
func RegisterRBACAuthZService(handler grpcserver.Provider, db legacysql.LegacyDatabaseProvider, tracer tracing.Tracer) {
server := rbac.NewService(db, log.New("authz-grpc-server"), tracer)
srv := handler.GetServer()
authzv1.RegisterAuthzServiceServer(srv, server)
authzextv1.RegisterAuthzExtentionServiceServer(srv, server)
}
var _ authzv1.AuthzServiceServer = (*legacyServer)(nil)
var _ grpc_auth.ServiceAuthFuncOverride = (*legacyServer)(nil)
var _ authzlib.ServiceAuthorizeFuncOverride = (*legacyServer)(nil)
pkg/services/grpcserver/interceptors/logging.go
+2 -3
View File
@@ -4,11 +4,10 @@ import (
"context"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/setting"
"google.golang.org/grpc"
)
func LoggingUnaryInterceptor(cfg *setting.Cfg, logger log.Logger) grpc.UnaryServerInterceptor {
func LoggingUnaryInterceptor(logger log.Logger, enabled bool) grpc.UnaryServerInterceptor {
return func(
ctx context.Context,
req any,
@@ -16,7 +15,7 @@ func LoggingUnaryInterceptor(cfg *setting.Cfg, logger log.Logger) grpc.UnaryServ
handler grpc.UnaryHandler,
) (resp any, err error) {
resp, err = handler(ctx, req)
if cfg.GRPCServerEnableLogging {
if enabled {
ctxLogger := logger.FromContext(ctx)
if err != nil {
ctxLogger.Error("gRPC call", "method", info.FullMethod, "req", req, "err", err)
pkg/services/grpcserver/service.go
+12 -12
View File
@@ -34,7 +34,7 @@ type Provider interface {
}
type gPRCServerService struct {
cfg *setting.Cfg
cfg setting.GRPCServerSettings
logger log.Logger
server *grpc.Server
address string
@@ -44,9 +44,9 @@ type gPRCServerService struct {
func ProvideService(cfg *setting.Cfg, features featuremgmt.FeatureToggles, authenticator interceptors.Authenticator, tracer tracing.Tracer, registerer prometheus.Registerer) (Provider, error) {
s := &gPRCServerService{
cfg: cfg,
cfg: cfg.GRPCServer,
logger: log.New("grpc-server"),
enabled: features.IsEnabledGlobally(featuremgmt.FlagGrpcServer),
enabled: features.IsEnabledGlobally(featuremgmt.FlagGrpcServer), // TODO: replace with cfg.GRPCServer.Enabled when we remove feature toggle.
startedChan: make(chan struct{}),
}
@@ -75,7 +75,7 @@ func ProvideService(cfg *setting.Cfg, features featuremgmt.FeatureToggles, authe
grpc.StatsHandler(otelgrpc.NewServerHandler()),
grpc.ChainUnaryInterceptor(
grpcAuth.UnaryServerInterceptor(authenticator.Authenticate),
interceptors.LoggingUnaryInterceptor(s.cfg, s.logger), // needs to be registered after tracing interceptor to get trace id
interceptors.LoggingUnaryInterceptor(s.logger, s.cfg.EnableLogging), // needs to be registered after tracing interceptor to get trace id
middleware.UnaryServerInstrumentInterceptor(grpcRequestDuration),
),
grpc.ChainStreamInterceptor(
@@ -85,16 +85,16 @@ func ProvideService(cfg *setting.Cfg, features featuremgmt.FeatureToggles, authe
),
}
if s.cfg.GRPCServerTLSConfig != nil {
opts = append(opts, grpc.Creds(credentials.NewTLS(cfg.GRPCServerTLSConfig)))
if s.cfg.TLSConfig != nil {
opts = append(opts, grpc.Creds(credentials.NewTLS(s.cfg.TLSConfig)))
}
if s.cfg.GRPCServerMaxRecvMsgSize > 0 {
opts = append(opts, grpc.MaxRecvMsgSize(s.cfg.GRPCServerMaxRecvMsgSize))
if s.cfg.MaxRecvMsgSize > 0 {
opts = append(opts, grpc.MaxRecvMsgSize(s.cfg.MaxRecvMsgSize))
}
if s.cfg.GRPCServerMaxSendMsgSize > 0 {
opts = append(opts, grpc.MaxSendMsgSize(s.cfg.GRPCServerMaxSendMsgSize))
if s.cfg.MaxSendMsgSize > 0 {
opts = append(opts, grpc.MaxSendMsgSize(s.cfg.MaxSendMsgSize))
}
s.server = grpc.NewServer(opts...)
@@ -102,9 +102,9 @@ func ProvideService(cfg *setting.Cfg, features featuremgmt.FeatureToggles, authe
}
func (s *gPRCServerService) Run(ctx context.Context) error {
s.logger.Info("Running GRPC server", "address", s.cfg.GRPCServerAddress, "network", s.cfg.GRPCServerNetwork, "tls", s.cfg.GRPCServerTLSConfig != nil, "max_recv_msg_size", s.cfg.GRPCServerMaxRecvMsgSize, "max_send_msg_size", s.cfg.GRPCServerMaxSendMsgSize)
s.logger.Info("Running GRPC server", "address", s.cfg.Address, "network", s.cfg.Network, "tls", s.cfg.TLSConfig != nil, "max_recv_msg_size", s.cfg.MaxRecvMsgSize, "max_send_msg_size", s.cfg.MaxSendMsgSize)
listener, err := net.Listen(s.cfg.GRPCServerNetwork, s.cfg.GRPCServerAddress)
listener, err := net.Listen(s.cfg.Network, s.cfg.Address)
if err != nil {
return fmt.Errorf("GRPC server: failed to listen: %w", err)
}