Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #12111 Make fine-grained API authorization a plugin #1858

Conversation

fanf
Copy link
Member

@fanf fanf commented Feb 16, 2018

Issue: https://www.rudder-project.org/redmine/issues/12111

The main changes are:

  • the ApiAccounKind now holds authorization for PublicApi type, other types don't have specific authz (they are induced by account kind),
  • we have 5 ApiAuthorizationKind: None, RO, RW, ACL
  • ACL is interpreted only when the plugin is enable. When that kind is used without the plugin, authorization are interpreted as RO (but actual ACL are kept, so that re-enableling the plugin make find back ACLs)
  • when migrating from 4.2, authorization are set to RW
  • also corrected the logs so that we can have relevant information in debug mode:
[2018-02-16 12:17:24] DEBUG api-processing - Processing request: POST /rudder-web/api/latest/settings/node_onaccept_default_policyMode [JSON request with valid JSON body]
[2018-02-16 12:17:24] DEBUG api-processing - Found a valid endpoint handler: 'modifySetting' on [POST settings/{key}] with version '10'
[2018-02-16 12:17:24] DEBUG api-processing - User 'REST Account: "Test 1" (00000001-379a-4e96-b2e8-b1ac6f7fd4a5)' has RW authorizations.
[2018-02-16 12:17:24] DEBUG api-processing - Handler for 'POST api/latest/settings/node_onaccept_default_policyMode' executed in 27 ms

[2018-02-16 12:17:39] DEBUG api-processing - Processing request: POST /rudder-web/api/latest/settings/node_onaccept_default_policyMode [JSON request with valid JSON body]
[2018-02-16 12:17:39] DEBUG api-processing - Found a valid endpoint handler: 'modifySetting' on [POST settings/{key}] with version '10'
[2018-02-16 12:17:39] DEBUG api-processing - User 'REST Account: "Test" (a92b486d-379a-4e96-b2e8-b1ac6f7fd4a5)' has ACL authorization and a plugin allows to interpret them.
[2018-02-16 12:17:39] DEBUG api-processing - Handler for 'POST api/latest/settings/node_onaccept_default_policyMode' executed in 4 ms

[2018-02-16 12:17:53] DEBUG api-processing - Processing request: POST /rudder-web/api/latest/settings/node_onaccept_default_policyMode [JSON request with valid JSON body]
[2018-02-16 12:17:53] DEBUG api-processing - Found a valid endpoint handler: 'modifySetting' on [POST settings/{key}] with version '10'
[2018-02-16 12:17:53] DEBUG api-processing - User 'REST Account: "ServiceNow" (d5f76fda-a578-47d5-be60-f2174ad56aa7)' has RO authorization.
[2018-02-16 12:17:53] ERROR api-processing - Authorization error for 'POST api/latest/settings/node_onaccept_default_policyMode': User 'REST Account: "ServiceNow" (d5f76fda-a578-47d5-be60-f2174ad56aa7)' is not allowed to access POST api/latest/settings/{key}
[2018-02-16 12:17:53] ERROR com.normation.rudder.rest.RestUtils - "Authorization error: User 'REST Account: \"ServiceNow\" (d5f76fda-a578-47d5-be60-f2174ad56aa7)' is not allowed to access POST api/latest/settings/{key}"

@Normation-Quality-Assistant
Copy link
Contributor

This PR is not mergeable to upper versions.
Since it is "Ready for merge" you must merge it by yourself using the following command:
rudder-dev merge https://github.com/Normation/rudder/pull/1858
-- Your faithful QA

1 similar comment
@Normation-Quality-Assistant
Copy link
Contributor

This PR is not mergeable to upper versions.
Since it is "Ready for merge" you must merge it by yourself using the following command:
rudder-dev merge https://github.com/Normation/rudder/pull/1858
-- Your faithful QA

@VinceMacBuche
Copy link
Member

OK, merging this PR

@VinceMacBuche VinceMacBuche merged commit 2c87dc7 into Normation:branches/rudder/4.3 Mar 7, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants