Application passwords implementation #2578

scabrero · 2024-02-23T12:42:45Z

This pull request replaces #2457 and follows the design document #2427.

It is just the server side for now.

Related to #41

Checklist

This pr contains no AI generated code
cargo fmt has been run
cargo clippy has been run
cargo test has been run and passes
book chapter included (if relevant)
design document included (if relevant)

scabrero · 2024-02-23T12:48:44Z

@Firstyear, the last test for:

Since application passwords are related to applications, on delete of an application all entries
that have a bound application password should be removed from user accounts.

fails. Any hint about how to enforce reference integrity on a "complex" attribute?

Firstyear

Regarding referential integrity have a look at https://github.com/kanidm/kanidm/blob/master/server/lib/src/valueset/oauth.rs#L369

It has handling for Refer as a special case, as well as Iutf8 for matching labels. You'll also notice https://github.com/kanidm/kanidm/blob/master/server/lib/src/valueset/oauth.rs#L607 which indexes the uuids of the groups related.

That way if you search an application id with PartialValue::Uuid yuo get the application itself, but PartialValue::Refer gets everything that refers to it.

That's what enables https://github.com/kanidm/kanidm/blob/master/server/lib/src/schema.rs#L771 which indicates that a reference relationship exists, and that automatically triggers https://github.com/kanidm/kanidm/blob/master/server/lib/src/plugins/refint.rs

book/src/access_control/intro.md

server/lib/src/be/dbvalue.rs

server/lib/src/constants/acp.rs

Firstyear · 2024-02-24T01:10:27Z

server/lib/src/constants/acp.rs

+        create_classes: vec![EntryClass::Object, EntryClass::Application],
+        ..Default::default()
+    };
+    pub static ref IDM_ACP_APPLICATION_MANAGE_V1: BuiltinAcp = BuiltinAcp {


What's the thinking behind all these being separate? What's the use case you have in mind?

Creating and managing applications does not fit in any of the existing ACPs, except maybe:

IDM_ACP_SERVICE_ACCOUT_* ?

IDM_ACP_DOMAIN_ADMIN ?

I think we need some more thought here about this. For example what are the administrator use cases? Do we need to delegate rights?

We should look at this as "how will admins and users interact" and use that to create access controls instead.

server/lib/src/constants/schema.rs

server/lib/src/idm/application.rs

server/lib/src/constants/schema.rs

server/lib/src/idm/application.rs

server/lib/src/idm/ldap.rs

server/lib/src/valueset/apppwd.rs

book/src/developers/designs/application_passwords.md

server/lib/src/constants/acp.rs

server/lib/src/credential/apppwd.rs

scabrero · 2024-03-19T08:33:50Z

Hi @Firstyear, PR is not updated yet because I am rebasing on top of master commit by commit while addressing your comments.

Firstyear · 2024-03-20T03:31:43Z

Hi @Firstyear, PR is not updated yet because I am rebasing on top of master commit by commit while addressing your comments.

Ahhh okay. Sorry about that :)

Want me to wait til you are ready for me to look again then?

scabrero · 2024-03-20T08:18:50Z

Hi @Firstyear, PR is not updated yet because I am rebasing on top of master commit by commit while addressing your comments.

Ahhh okay. Sorry about that :)

Want me to wait til you are ready for me to look again then?

Except the refint for the ApplicationPassword struct to make the last test pass, it is now ready for a second review :)

scabrero · 2024-03-21T14:06:39Z

Ready for review.

Firstyear

Haven't finished the full review but here is the first pass.

server/lib/src/constants/acp.rs

Firstyear · 2024-04-12T02:12:28Z

server/lib/src/constants/acp.rs

+//   needs to be able to assign to entry managed by
+lazy_static! {
+    pub static ref IDM_ACP_APPLICATION_CREATE_DL6: BuiltinAcp = BuiltinAcp {
+        classes: vec![


Previous comment was "how do you envisage these access controls working with human roles and tasks", and I think you need to answer that because these access controls otherwise seem confused.

Ok, I can think about two possibilities:

Use case 1, the IDM administrator creates the application, links the group, and sets up the members.
Use case 2, there is a person managing service X, e.g. mail. The IDM administrator creates the app, links a group,
and delegates group permission for the group to the X service manager who sets up the members.

Firstyear · 2024-04-12T02:14:10Z

server/lib/src/constants/schema.rs

+    description: "A reference to the group linked to the entry".to_string(),
+
+    multivalue: false,
+    sync_allowed: true,


Do you know what the sync_allowed attribute affects?

Attribute or class can be imported from external scim?

server/lib/src/credential/apppwd.rs

Firstyear · 2024-04-12T02:19:29Z

server/lib/src/idm/account.rs

+                    return Ok(Some(LdapBoundToken {
+                        spn: self.spn.clone(),
+                        session_id,
+                        effective_session: LdapSession::UnixBind(self.uuid),


Should we consider this being a different type rather than UnixBind since this session Enum is meant to encode "what kind of session this is" and this is an application password session, not a unix session.

Firstyear · 2024-04-12T02:21:16Z

server/lib/src/idm/application.rs

+
+#[derive(Clone)]
+struct LdapApplicationsInner {
+    set: HashMap<String, Application>,


What's the logic of using a string to index into this Map instead of UUID?

Mainly because LdapApplicationAuthEvent carries the application name extracted from the bind DN, so we can do https://github.com/scabrero/kanidm/blob/app-passwords/server/lib/src/idm/application.rs#L178

server/lib/src/idm/application.rs

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

and not used Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

TODO: How to test without client side? Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

This is how the application passwords will be serialized and stored in the backend. It will be a vector of DbValueApplicationPassword, each one having its uuid, application uuid, label and DbPasswordV1. Signed-off-by: Samuel Cabrero <scabrero@suse.de>

This is how the data is serialized/deserialized from replication Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

scabrero mentioned this pull request Feb 23, 2024

Application passwords implementation #2457

Closed

6 tasks

scabrero requested a review from Firstyear February 23, 2024 12:48

Firstyear requested changes Feb 24, 2024

View reviewed changes

Firstyear reviewed Mar 19, 2024

View reviewed changes

book/src/developers/designs/application_passwords.md Outdated Show resolved Hide resolved

server/lib/src/constants/acp.rs Outdated Show resolved Hide resolved

server/lib/src/credential/apppwd.rs Outdated Show resolved Hide resolved

scabrero force-pushed the app-passwords branch from f677344 to 617b188 Compare March 19, 2024 15:47

scabrero force-pushed the app-passwords branch from 617b188 to 0c42d7f Compare March 21, 2024 14:01

scabrero marked this pull request as ready for review March 22, 2024 07:20

Firstyear requested changes Apr 12, 2024

View reviewed changes

scabrero added 17 commits May 20, 2024 08:49

Remove unused type

3e083a7

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

spn attribute not mandatory for service accounts

8527683

and not used Signed-off-by: Samuel Cabrero <scabrero@suse.de>

run insecure script from project root

57e1d24

Update application passwords design doc

7bbbe84

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Add application schema class

40bc39e

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Add LinkedGroup attribute

caaa994

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Tests for application class

58da0e7

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Access control profiles and builtin groups for applications

7517662

TODO: How to test without client side? Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Factor out bind target from bind dn

d772f8a

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

LDAP application bind

495eb57

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

ldap: Application auth event

f4ac3f3

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Build Application struct

1e829f4

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Check user is member of linked group

73389ac

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Add test for LDAP bind to application

38c0769

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

repl: ReplAttrV1::ApplicationPassword

befb9bd

This is how the data is serialized/deserialized from replication Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: Value::ApplicationPassword

0cdac3f

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

scabrero added 20 commits May 20, 2024 13:36

schema: SyntaxType::ApplicationPassword

a4182cc

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: Add ValueSetApplicationPassword

c9353e9

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: ValueSetApplicationPassword from repl

2889df8

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: ValueSetApplicationPassword from Value iterator

84646cb

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: ValueSetApplicationPassword from db value set

9301cec

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

entries: Add ApplicationPassword attribute

9b5ff4a

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

schema: Add ApplicationPassword attribute

fe3c025

account: Fetch ApplicationPassword attribute

3a0f3bf

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

account: Verify application password

b1273c3

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

idm: Generate application password event

e394dc7

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

acp: ApplicationPassword attribute management

5b5d4b6

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

ldap: Add tests for application passwords

e349cd8

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

ldap: Add test for searches under application base dn

8ba7d00

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

ldap: Add tests for application's linked group

4950c35

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

ldap: application binding, check account validity window

8ee9f3a

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

idm: Add applications cache

efb02e9

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

apppwd: Test linked group reference integrity

213bd83

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

apppwds: Enforce reference integrity when an application is removed

110e7a6

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

value: Remove unused application uuid from ApplicationPassword variant

90a5560

valueset: Add tests for ValueSetApplicationPassword

2a6fa18

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

scabrero force-pushed the app-passwords branch from 0c42d7f to 2a6fa18 Compare May 20, 2024 12:54

scabrero added 2 commits May 24, 2024 09:30

Extract building Identity from UnixBind to a function

ed8250a

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

Introduce LdapSession::ApplicationPasswordBind

9a9fd26

Signed-off-by: Samuel Cabrero <scabrero@suse.de>

scabrero force-pushed the app-passwords branch from 244e7e0 to 9a9fd26 Compare May 24, 2024 07:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Application passwords implementation #2578

Application passwords implementation #2578

scabrero commented Feb 23, 2024

scabrero commented Feb 23, 2024

Firstyear left a comment

Firstyear Feb 24, 2024

scabrero Feb 29, 2024

Firstyear Mar 8, 2024

scabrero commented Mar 19, 2024

Firstyear commented Mar 20, 2024

scabrero commented Mar 20, 2024

scabrero commented Mar 21, 2024

Firstyear left a comment

Firstyear Apr 12, 2024

scabrero May 23, 2024

Firstyear Apr 12, 2024

scabrero May 20, 2024

Firstyear Apr 12, 2024

Firstyear Apr 12, 2024

scabrero May 20, 2024

Application passwords implementation #2578

Are you sure you want to change the base?

Application passwords implementation #2578

Conversation

scabrero commented Feb 23, 2024

scabrero commented Feb 23, 2024

Firstyear left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scabrero commented Mar 19, 2024

Firstyear commented Mar 20, 2024

scabrero commented Mar 20, 2024

scabrero commented Mar 21, 2024

Firstyear left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment