Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #24394: Autoprovisioned users don't have access to any nodes #682

Merged
merged 1 commit into from
Mar 12, 2024
Merged

Fixes #24394: Autoprovisioned users don't have access to any nodes #682

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 12 additions & 4 deletions auth-backends/src/main/scala/bootstrap/rudder/plugin/AuthBackendsConf.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ import com.normation.rudder.api.ApiAuthorization
import com.normation.rudder.domain.eventlog.RudderEventActor
import com.normation.rudder.domain.logger.ApplicationLoggerPure
import com.normation.rudder.domain.logger.PluginLogger
import com.normation.rudder.facts.nodes.NodeSecurityContext
import com.normation.rudder.rest.RoleApiMapping
import com.normation.rudder.users._
import com.normation.zio._
Expand Down Expand Up @@ -527,8 +528,15 @@ trait RudderUserServerMapping[R <: OAuth2UserRequest, U <: OAuth2User, T <: Rudd
rudderUserDetailsService.loadUserByUsername(user.getName)
}
}
// for now, tenants are not configurable by OIDC
val tenants = rudderUserDetailsService.authConfigProvider.getUserByName(user.getName) match {
// when the user is not defined in rudder-users.xml, we give it the whole perm on nodes for compatibility
case Left(_) => NodeSecurityContext.All
// if the user is defined in rudder-users.xml, we get whatever is defined there.
case Right(u) => u.nodePerms
}

buildUser(optReg, userRequest, user, roleApiMapping, rudderUser, newUserDetails)
buildUser(optReg, userRequest, user, roleApiMapping, rudderUser, newUserDetails, tenants)
}

def buildUser(
Expand All @@ -537,7 +545,8 @@ trait RudderUserServerMapping[R <: OAuth2UserRequest, U <: OAuth2User, T <: Rudd
user: U,
roleApiMapping: RoleApiMapping,
rudder: RudderUserDetail,
userBuilder: (U, RudderUserDetail) => T
userBuilder: (U, RudderUserDetail) => T,
tenants: NodeSecurityContext
): T = {
val roles = {
optReg match {
Expand Down Expand Up @@ -644,8 +653,7 @@ trait RudderUserServerMapping[R <: OAuth2UserRequest, U <: OAuth2User, T <: Rudd
.toList

val apiAuthz = ApiAuthorization.ACL(acls)
val userDetails = rudder
.copy(roles = roles, apiAuthz = apiAuthz)
val userDetails = rudder.copy(roles = roles, apiAuthz = apiAuthz, nodePerms = tenants)
AuthBackendsLogger.debug(
s"Principal '${rudder.getUsername}' final roles: [${roles.map(_.name).mkString(", ")}], and API authz: ${apiAuthz.debugString}"
)
Expand Down