Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AuthN: Use sync hook to fetch service account #84078

Merged
merged 2 commits into from Mar 11, 2024
Merged

AuthN: Use sync hook to fetch service account #84078

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eea5624
Use sync hook to fetch service account
kalleep Mar 7, 2024
1726e4b
remove unused field
kalleep Mar 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion pkg/services/authn/authnimpl/service.go
View file
Open in desktop
Expand Up @@ -90,7 +90,7 @@ func ProvideService(
usageStats.RegisterMetricsFunc(s.getUsageStats)

s.RegisterClient(clients.ProvideRender(userService, renderService))
s.RegisterClient(clients.ProvideAPIKey(apikeyService, userService))
s.RegisterClient(clients.ProvideAPIKey(apikeyService))

if cfg.LoginCookieName != "" {
s.RegisterClient(clients.ProvideSession(cfg, sessionService))
Expand Down
2 changes: 1 addition & 1 deletion pkg/services/authn/authnimpl/sync/user_sync.go
View file
Open in desktop
Expand Up @@ -111,7 +111,7 @@ func (s *UserSync) FetchSyncedUserHook(ctx context.Context, identity *authn.Iden
return nil
}
namespace, id := identity.GetNamespacedID()
if namespace != authn.NamespaceUser {
if namespace != authn.NamespaceUser && namespace != authn.NamespaceServiceAccount {
return nil
}

Expand Down
21 changes: 7 additions & 14 deletions pkg/services/authn/clients/api_key.go
View file
Open in desktop
Expand Up @@ -14,7 +14,6 @@ import (
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
"github.com/grafana/grafana/pkg/util/errutil"
)
Expand All @@ -29,17 +28,15 @@ var (
var _ authn.HookClient = new(APIKey)
var _ authn.ContextAwareClient = new(APIKey)

func ProvideAPIKey(apiKeyService apikey.Service, userService user.Service) *APIKey {
func ProvideAPIKey(apiKeyService apikey.Service) *APIKey {
return &APIKey{
log: log.New(authn.ClientAPIKey),
userService: userService,
apiKeyService: apiKeyService,
}
}

type APIKey struct {
log log.Logger
userService user.Service
apiKeyService apikey.Service
}

Expand Down Expand Up @@ -81,16 +78,12 @@ func (s *APIKey) Authenticate(ctx context.Context, r *authn.Request) (*authn.Ide
}, nil
}

usr, err := s.userService.GetSignedInUserWithCacheCtx(ctx, &user.GetSignedInUserQuery{
UserID: *apiKey.ServiceAccountId,
OrgID: apiKey.OrgID,
})

if err != nil {
return nil, err
}

return authn.IdentityFromSignedInUser(authn.NamespacedID(authn.NamespaceServiceAccount, usr.UserID), usr, authn.ClientParams{SyncPermissions: true}, login.APIKeyAuthModule), nil
return &authn.Identity{
ID: authn.NamespacedID(authn.NamespaceServiceAccount, *apiKey.ServiceAccountId),
OrgID: apiKey.OrgID,
AuthenticatedBy: login.APIKeyAuthModule,
ClientParams: authn.ClientParams{FetchSyncedUser: true, SyncPermissions: true},
}, nil
}

func (s *APIKey) getAPIKey(ctx context.Context, token string) (*apikey.APIKey, error) {
Expand Down
34 changes: 5 additions & 29 deletions pkg/services/authn/clients/api_key_test.go
View file
Open in desktop
Expand Up @@ -16,8 +16,6 @@ import (
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/services/user/usertest"
)

var (
Expand All @@ -30,7 +28,6 @@ func TestAPIKey_Authenticate(t *testing.T) {
desc string
req *authn.Request
expectedKey *apikey.APIKey
expectedUser *user.SignedInUser
expectedErr error
expectedIdentity *authn.Identity
}
Expand Down Expand Up @@ -72,20 +69,11 @@ func TestAPIKey_Authenticate(t *testing.T) {
Key: hash,
ServiceAccountId: intPtr(1),
},
expectedUser: &user.SignedInUser{
UserID: 1,
OrgID: 1,
IsServiceAccount: true,
OrgRole: org.RoleViewer,
Name: "test",
},
expectedIdentity: &authn.Identity{
ID: "service-account:1",
OrgID: 1,
Name: "test",
OrgRoles: map[int64]org.RoleType{1: org.RoleViewer},
IsGrafanaAdmin: boolPtr(false),
ID: "service-account:1",
OrgID: 1,
ClientParams: authn.ClientParams{
FetchSyncedUser: true,
SyncPermissions: true,
},
AuthenticatedBy: login.APIKeyAuthModule,
Expand Down Expand Up @@ -124,11 +112,7 @@ func TestAPIKey_Authenticate(t *testing.T) {

for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
c := ProvideAPIKey(&apikeytest.Service{
ExpectedAPIKey: tt.expectedKey,
}, &usertest.FakeUserService{
ExpectedSignedInUser: tt.expectedUser,
})
c := ProvideAPIKey(&apikeytest.Service{ExpectedAPIKey: tt.expectedKey})

identity, err := c.Authenticate(context.Background(), tt.req)
if tt.expectedErr != nil {
Expand Down Expand Up @@ -195,7 +179,7 @@ func TestAPIKey_Test(t *testing.T) {

for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
c := ProvideAPIKey(&apikeytest.Service{}, usertest.NewUserServiceFake())
c := ProvideAPIKey(&apikeytest.Service{})
assert.Equal(t, tt.expected, c.Test(context.Background(), tt.req))
})
}
Expand Down Expand Up @@ -286,19 +270,11 @@ func TestAPIKey_GetAPIKeyIDFromIdentity(t *testing.T) {
},
}}

signedInUser := &user.SignedInUser{
UserID: 1,
OrgID: 1,
Name: "test",
}

for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
c := ProvideAPIKey(&apikeytest.Service{
ExpectedError: tt.expectedError,
ExpectedAPIKey: tt.expectedKey,
}, &usertest.FakeUserService{
ExpectedSignedInUser: signedInUser,
})
id, exists := c.getAPIKeyID(context.Background(), tt.expectedIdentity, req)
assert.Equal(t, tt.expectedExists, exists)
Expand Down