mirrors/etcd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

auth, etcdserver: allow users to know their roles and permissions

Browse Source 
Current UserGet() and RoleGet() RPCs require admin permission. It
means that users cannot know which roles they belong to and what
permissions the roles have. This commit change the semantics and now
users can know their roles and permissions.
This commit is contained in:
Hitoshi Mitake
2017-06-23 14:40:37 +09:00
committed by Hitoshi Mitake
parent 47a8156851
commit e0c33ef881
2 changed files with 45 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
etcdserver/apply_auth.go
View File

@ -189,6 +189,28 @@ func (aa *authApplierV3) checkLeasePuts(leaseID lease.LeaseID) error {
return nil
}
func (aa *authApplierV3) UserGet(r *pb.AuthUserGetRequest) (*pb.AuthUserGetResponse, error) {
err := aa.as.IsAdminPermitted(&aa.authInfo)
if err != nil && r.Name != aa.authInfo.Username {
aa.authInfo.Username = ""
aa.authInfo.Revision = 0
return &pb.AuthUserGetResponse{}, err
}
return aa.applierV3.UserGet(r)
}
func (aa *authApplierV3) RoleGet(r *pb.AuthRoleGetRequest) (*pb.AuthRoleGetResponse, error) {
err := aa.as.IsAdminPermitted(&aa.authInfo)
if err != nil && !aa.as.HasRole(aa.authInfo.Username, r.Role) {
aa.authInfo.Username = ""
aa.authInfo.Revision = 0
return &pb.AuthRoleGetResponse{}, err
}
return aa.applierV3.RoleGet(r)
}
func needAdminPermission(r *pb.InternalRaftRequest) bool {
switch {
case r.AuthEnable != nil:
@ -203,16 +225,12 @@ func needAdminPermission(r *pb.InternalRaftRequest) bool {
return true
case r.AuthUserGrantRole != nil:
return true
case r.AuthUserGet != nil:
return true
case r.AuthUserRevokeRole != nil:
return true
case r.AuthRoleAdd != nil:
return true
case r.AuthRoleGrantPermission != nil:
return true
case r.AuthRoleGet != nil:
return true
case r.AuthRoleRevokePermission != nil:
return true
case r.AuthRoleDelete != nil: