Authorization: panic when specific authorizer returns nil (#114982)

pkg/registry/apis/service/register.go

@@ -12,6 +12,7 @@ import (
 
 	service "github.com/grafana/grafana/pkg/apis/service/v0alpha1"
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
+	roleauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 )
@@ -37,7 +38,7 @@ func RegisterAPIService(features featuremgmt.FeatureToggles, apiregistration bui
 }
 
 func (b *ServiceAPIBuilder) GetAuthorizer() authorizer.Authorizer {
-	return nil // default authorizer is fine
+	return roleauthorizer.NewRoleAuthorizer()
 }
 
 func (b *ServiceAPIBuilder) GetGroupVersion() schema.GroupVersion {

pkg/services/apiserver/appinstaller/installer.go

@@ -108,6 +108,9 @@ func RegisterAuthorizers(
 		if authorizerProvider, ok := installer.(AuthorizerProvider); ok {
 			authorizer := authorizerProvider.GetAuthorizer()
 			for _, gv := range installer.GroupVersions() {
+				if authorizer == nil {
+					panic("authorizer cannot be nil for api group: " + gv.String())
+				}
 				registrar.Register(gv, authorizer)
 				logger.Debug("Registered authorizer", "group", gv.Group, "version", gv.Version, "app")
 			}

pkg/services/apiserver/auth/authorizer/authorizer.go

@@ -42,7 +42,9 @@ func NewGrafanaBuiltInSTAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
 
 	// org role is last -- and will return allow for verbs that match expectations
 	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
-	authorizers = append(authorizers, newRoleAuthorizer())
+	// NOTE: role authorizer is now used by some api groups as their specific authorizer
+	// but there are still some apis not directly registered in the embedded delegate that benefit from including it here
+	authorizers = append(authorizers, NewRoleAuthorizer())
 	return &GrafanaAuthorizer{
 		apis: apis,
 		auth: union.New(authorizers...),

pkg/services/apiserver/auth/authorizer/role.go

@@ -19,7 +19,7 @@ var orgRoleNoneAsViewerAPIGroups = []string{
 
 type roleAuthorizer struct{}
 
-func newRoleAuthorizer() *roleAuthorizer {
+func NewRoleAuthorizer() *roleAuthorizer {
 	return &roleAuthorizer{}
 }