Authn: Sync authlib and update how we construct authn client interceptor (#101124)

* Sync authlib and update how we construct authn client interceptor

* Remove namespace from checker

pkg/services/accesscontrol/authorizer.go

@@ -158,7 +158,7 @@ func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, re
 	}
 
 	check := Checker(ident, action)
-	return func(_, name, _ string) bool {
+	return func(name, _ string) bool {
 		return check(fmt.Sprintf("%s:%s:%s", opts.Resource, opts.Attr, name))
 	}, nil
 }

pkg/services/apiserver/options/storage.go

@@ -11,7 +11,6 @@ import (
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	"k8s.io/apiserver/pkg/server/options"
 
-	"github.com/grafana/authlib/authn"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/setting"
@@ -123,17 +122,15 @@ func (o *StorageOptions) ApplyTo(serverConfig *genericapiserver.RecommendedConfi
 	if err != nil {
 		return err
 	}
-	authCfg := authn.GrpcClientConfig{
-		TokenClientConfig: &authn.TokenExchangeConfig{
-			Token:            o.GrpcClientAuthenticationToken,
-			TokenExchangeURL: o.GrpcClientAuthenticationTokenExchangeURL,
-		},
-		TokenRequest: &authn.TokenExchangeRequest{
-			Audiences: []string{"resourceStore"},
-			Namespace: o.GrpcClientAuthenticationTokenNamespace,
-		},
-	}
-	unified, err := resource.NewRemoteResourceClient(tracer, conn, authCfg, o.GrpcClientAuthenticationAllowInsecure)
+
+	const resourceStoreAudience = "resourceStore"
+
+	unified, err := resource.NewRemoteResourceClient(tracer, conn, resource.RemoteResourceClientConfig{
+		Token:            o.GrpcClientAuthenticationToken,
+		TokenExchangeURL: o.GrpcClientAuthenticationTokenExchangeURL,
+		Namespace:        o.GrpcClientAuthenticationTokenNamespace,
+		Audiences:        []string{resourceStoreAudience},
+	})
 	if err != nil {
 		return err
 	}

pkg/services/authn/grpcutils/inproc_exchanger.go

@@ -1,10 +1,8 @@
 package grpcutils
 
 import (
-	"context"
 	"encoding/base64"
 	"encoding/json"
-	"fmt"
 
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/grafana/authlib/authn"
@@ -12,29 +10,21 @@ import (
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 )
 
-type inProcExchanger struct {
-	tokenResponse *authn.TokenExchangeResponse
-}
-
-func ProvideInProcExchanger() *inProcExchanger {
-	tokenResponse, err := createInProcToken()
+func ProvideInProcExchanger() authn.StaticTokenExchanger {
+	token, err := createInProcToken()
 	if err != nil {
 		panic(err)
 	}
 
-	return &inProcExchanger{tokenResponse}
+	return authn.NewStaticTokenExchanger(token)
 }
 
-func (e *inProcExchanger) Exchange(ctx context.Context, r authn.TokenExchangeRequest) (*authn.TokenExchangeResponse, error) {
-	return e.tokenResponse, nil
-}
-
-func createInProcToken() (*authn.TokenExchangeResponse, error) {
+func createInProcToken() (string, error) {
 	claims := authn.Claims[authn.AccessTokenClaims]{
 		Claims: jwt.Claims{
-			Audience: []string{"resourceStore"},
 			Issuer:   "grafana",
 			Subject:  types.NewTypeID(types.TypeAccessPolicy, "grafana"),
+			Audience: []string{"resourceStore"},
 		},
 		Rest: authn.AccessTokenClaims{
 			Namespace:            "*",
@@ -48,15 +38,13 @@ func createInProcToken() (*authn.TokenExchangeResponse, error) {
 		"typ": authn.TokenTypeAccess,
 	})
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	payload, err := json.Marshal(claims)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
-	return &authn.TokenExchangeResponse{
-		Token: fmt.Sprintf("%s.%s.", base64.RawURLEncoding.EncodeToString(header), base64.RawURLEncoding.EncodeToString(payload)),
-	}, nil
+	return base64.RawURLEncoding.EncodeToString(header) + "." + base64.RawURLEncoding.EncodeToString(payload) + ".", nil
 }

pkg/services/authz/token_auth.go

@@ -25,7 +25,9 @@ func (t *tokenAuth) GetRequestMetadata(ctx context.Context, _ ...string) (map[st
 		return nil, err
 	}
 
-	return map[string]string{authn.DefaultAccessTokenMetadataKey: token.Token}, nil
+	const metadataKey = "X-Access-Token"
+
+	return map[string]string{metadataKey: token.Token}, nil
 }
 
 func (t *tokenAuth) RequireTransportSecurity() bool { return false }

pkg/services/authz/zanzana/client/client.go

@@ -79,7 +79,7 @@ func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.L
 func newItemChecker(res *authzv1.ListResponse) authlib.ItemChecker {
 	// if we can see all resource of this type we can just return a function that always return true
 	if res.GetAll() {
-		return func(_, _, _ string) bool { return true }
+		return func(_, _ string) bool { return true }
 	}
 
 	folders := make(map[string]struct{}, len(res.Folders))
@@ -92,7 +92,7 @@ func newItemChecker(res *authzv1.ListResponse) authlib.ItemChecker {
 		items[i] = struct{}{}
 	}
 
-	return func(_, name, folder string) bool {
+	return func(name, folder string) bool {
 		if _, ok := items[name]; ok {
 			return true
 		}