Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v14] Access list user requirements check before member expiry check. #35057

Merged
merged 1 commit into from Nov 28, 2023
Merged

[v14] Access list user requirements check before member expiry check. #35057

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 3 additions & 7 deletions lib/services/access_list.go
View file
Open in desktop
Expand Up @@ -255,18 +255,14 @@ func (a AccessListMembershipChecker) IsAccessListMember(ctx context.Context, ide
return trace.Wrap(err)
}

expires := member.Spec.Expires
if expires.IsZero() {
return nil
if !UserMeetsRequirements(identity, accessList.Spec.MembershipRequires) {
return trace.AccessDenied("user %s is a member, but does not have the roles or traits required to be a member of this list", username)
}

if !a.clock.Now().Before(expires) {
if !member.Spec.Expires.IsZero() && !a.clock.Now().Before(member.Spec.Expires) {
return trace.AccessDenied("user %s's membership has expired in the access list", username)
}

if !UserMeetsRequirements(identity, accessList.Spec.MembershipRequires) {
return trace.AccessDenied("user %s is a member, but does not have the roles or traits required to be a member of this list", username)
}
return nil
}

Expand Down
30 changes: 30 additions & 0 deletions lib/services/access_list_test.go
View file
Open in desktop
Expand Up @@ -416,6 +416,21 @@ func TestIsAccessListMemberChecker(t *testing.T) {
require.True(t, trace.IsAccessDenied(err))
},
},
{
name: "is member with no expiration and missing roles",
identity: tlsca.Identity{
Username: member3,
Groups: []string{"mrole1"},
Traits: map[string][]string{
"mtrait1": {"mvalue1", "mvalue2"},
"mtrait2": {"mvalue3", "mvalue4"},
},
},
currentTime: time.Date(2023, 2, 1, 0, 0, 0, 0, time.UTC),
errAssertionFunc: func(t require.TestingT, err error, i ...interface{}) {
require.True(t, trace.IsAccessDenied(err))
},
},
{
name: "is member with missing traits",
identity: tlsca.Identity{
Expand All @@ -431,6 +446,21 @@ func TestIsAccessListMemberChecker(t *testing.T) {
require.True(t, trace.IsAccessDenied(err))
},
},
{
name: "is member with no expiration and missing traits",
identity: tlsca.Identity{
Username: member3,
Groups: []string{"mrole1", "mrole2"},
Traits: map[string][]string{
"mtrait1": {"mvalue1"},
"mtrait2": {"mvalue3"},
},
},
currentTime: time.Date(2023, 2, 1, 0, 0, 0, 0, time.UTC),
errAssertionFunc: func(t require.TestingT, err error, i ...interface{}) {
require.True(t, trace.IsAccessDenied(err))
},
},
}

for _, test := range tests {
Expand Down