From c3505f08646f51f7db3ee58ce1e78439d4417a58 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Wed, 26 Feb 2025 17:29:32 +0100 Subject: [PATCH] AuthZ: Make `NewGrpcTokenAuth` public (#101352) * AuthZ: Expose NewGrpcTokenAuth * Lint --- pkg/services/authz/rbac.go | 6 +++--- pkg/services/authz/token_auth.go | 3 ++- pkg/services/authz/zanzana.go | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/pkg/services/authz/rbac.go b/pkg/services/authz/rbac.go index fcb398667ab..215bd3dbad6 100644 --- a/pkg/services/authz/rbac.go +++ b/pkg/services/authz/rbac.go @@ -33,8 +33,8 @@ import ( "github.com/grafana/grafana/pkg/storage/legacysql" ) -// `authzService` is hardcoded in authz-service -const authzServiceAudience = "authzService" +// AuthzServiceAudience is the audience for the authz service. +const AuthzServiceAudience = "authzService" // ProvideAuthZClient provides an AuthZ client and creates the AuthZ service. func ProvideAuthZClient( @@ -123,7 +123,7 @@ func newRemoteRBACClient(clientCfg *authzClientSettings, tracer tracing.Tracer) clientCfg.remoteAddress, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithPerRPCCredentials( - newGRPCTokenAuth(authzServiceAudience, clientCfg.tokenNamespace, tokenClient), + NewGRPCTokenAuth(AuthzServiceAudience, clientCfg.tokenNamespace, tokenClient), ), ) if err != nil { diff --git a/pkg/services/authz/token_auth.go b/pkg/services/authz/token_auth.go index 1546379741e..6014d445df3 100644 --- a/pkg/services/authz/token_auth.go +++ b/pkg/services/authz/token_auth.go @@ -6,7 +6,8 @@ import ( "github.com/grafana/authlib/authn" ) -func newGRPCTokenAuth(audience, namespace string, tc authn.TokenExchanger) *tokenAuth { +// TODO: move this to authlib +func NewGRPCTokenAuth(audience, namespace string, tc authn.TokenExchanger) *tokenAuth { return &tokenAuth{audience, namespace, tc} } diff --git a/pkg/services/authz/zanzana.go b/pkg/services/authz/zanzana.go index 8d644167528..6067a232082 100644 --- a/pkg/services/authz/zanzana.go +++ b/pkg/services/authz/zanzana.go @@ -57,7 +57,7 @@ func ProvideZanzana(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, features // TODO: add TLS support grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithPerRPCCredentials( - newGRPCTokenAuth(authzServiceAudience, fmt.Sprintf("stacks-%s", cfg.StackID), tokenClient), + NewGRPCTokenAuth(AuthzServiceAudience, fmt.Sprintf("stacks-%s", cfg.StackID), tokenClient), ), } @@ -172,7 +172,7 @@ func (z *Zanzana) start(ctx context.Context) error { authenticator := authnlib.NewAccessTokenAuthenticator( authnlib.NewAccessTokenVerifier( - authnlib.VerifierConfig{AllowedAudiences: []string{authzServiceAudience}}, + authnlib.VerifierConfig{AllowedAudiences: []string{AuthzServiceAudience}}, authnlib.NewKeyRetriever(authnlib.KeyRetrieverConfig{ SigningKeysURL: z.cfg.ZanzanaServer.SigningKeysURL, }),