Skip to content

Commit 379a73a

Browse files
deads2kdeads2k
committed
make the system:authenticated group adder smarter
1 parent 815b340 commit 379a73a

File tree

6 files changed

+135
-6
lines changed

6 files changed

+135
-6
lines changed

‎pkg/kubeapiserver/authenticator/BUILD

-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ go_library(
2323
"//vendor:k8s.io/apiserver/pkg/authentication/request/union",
2424
"//vendor:k8s.io/apiserver/pkg/authentication/request/x509",
2525
"//vendor:k8s.io/apiserver/pkg/authentication/token/tokenfile",
26-
"//vendor:k8s.io/apiserver/pkg/authentication/user",
2726
"//vendor:k8s.io/apiserver/plugin/pkg/authenticator/password/keystone",
2827
"//vendor:k8s.io/apiserver/plugin/pkg/authenticator/password/passwordfile",
2928
"//vendor:k8s.io/apiserver/plugin/pkg/authenticator/request/basicauth",

‎pkg/kubeapiserver/authenticator/config.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030
"k8s.io/apiserver/pkg/authentication/request/union"
3131
"k8s.io/apiserver/pkg/authentication/request/x509"
3232
"k8s.io/apiserver/pkg/authentication/token/tokenfile"
33-
"k8s.io/apiserver/pkg/authentication/user"
3433
"k8s.io/apiserver/plugin/pkg/authenticator/password/keystone"
3534
"k8s.io/apiserver/plugin/pkg/authenticator/password/passwordfile"
3635
"k8s.io/apiserver/plugin/pkg/authenticator/request/basicauth"
@@ -207,7 +206,7 @@ func (config AuthenticatorConfig) New() (authenticator.Request, *spec.SecurityDe
207206

208207
authenticator := union.New(authenticators...)
209208

210-
authenticator = group.NewGroupAdder(authenticator, []string{user.AllAuthenticated})
209+
authenticator = group.NewAuthenticatedGroupAdder(authenticator)
211210

212211
if config.Anonymous {
213212
// If the authenticator chain returns an error, return an error (don't consider a bad bearer token anonymous).

‎staging/src/k8s.io/apiserver/pkg/authentication/authenticatorfactory/delegating.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030
"k8s.io/apiserver/pkg/authentication/request/headerrequest"
3131
unionauth "k8s.io/apiserver/pkg/authentication/request/union"
3232
"k8s.io/apiserver/pkg/authentication/request/x509"
33-
"k8s.io/apiserver/pkg/authentication/user"
3433
webhooktoken "k8s.io/apiserver/plugin/pkg/authenticator/token/webhook"
3534
authenticationclient "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
3635
"k8s.io/client-go/util/cert"
@@ -107,7 +106,7 @@ func (c DelegatingAuthenticatorConfig) New() (authenticator.Request, *spec.Secur
107106
return nil, nil, errors.New("No authentication method configured")
108107
}
109108

110-
authenticator := group.NewGroupAdder(unionauth.New(authenticators...), []string{user.AllAuthenticated})
109+
authenticator := group.NewAuthenticatedGroupAdder(unionauth.New(authenticators...))
111110
if c.Anonymous {
112111
authenticator = unionauth.NewFailOnError(authenticator, anonymous.NewAuthenticator())
113112
}

‎staging/src/k8s.io/apiserver/pkg/authentication/group/authenticated_group_adder.go

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
Copyright 2017 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package group
18+
19+
import (
20+
"net/http"
21+
22+
"k8s.io/apiserver/pkg/authentication/authenticator"
23+
"k8s.io/apiserver/pkg/authentication/user"
24+
)
25+
26+
// AuthenticatedGroupAdder adds system:authenticated group when appropriate
27+
type AuthenticatedGroupAdder struct {
28+
// Authenticator is delegated to make the authentication decision
29+
Authenticator authenticator.Request
30+
}
31+
32+
// NewAuthenticatedGroupAdder wraps a request authenticator, and adds the system:authenticated group when appropriate.
33+
// Authentication must succeed, the user must not be system:anonymous, the groups system:authenticated or system:unauthenticated must
34+
// not be present
35+
func NewAuthenticatedGroupAdder(auth authenticator.Request) authenticator.Request {
36+
return &AuthenticatedGroupAdder{auth}
37+
}
38+
39+
func (g *AuthenticatedGroupAdder) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {
40+
u, ok, err := g.Authenticator.AuthenticateRequest(req)
41+
if err != nil || !ok {
42+
return nil, ok, err
43+
}
44+
45+
if u.GetName() == user.Anonymous {
46+
return u, true, nil
47+
}
48+
for _, group := range u.GetGroups() {
49+
if group == user.AllAuthenticated || group == user.AllUnauthenticated {
50+
return u, true, nil
51+
}
52+
}
53+
54+
return &user.DefaultInfo{
55+
Name: u.GetName(),
56+
UID: u.GetUID(),
57+
Groups: append(u.GetGroups(), user.AllAuthenticated),
58+
Extra: u.GetExtra(),
59+
}, true, nil
60+
}

‎staging/src/k8s.io/apiserver/pkg/authentication/group/group_adder_test.go

+69
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,72 @@ func TestGroupAdder(t *testing.T) {
4040
t.Errorf("Expected original,added groups, got %#v", user.GetGroups())
4141
}
4242
}
43+
44+
func TestAuthenticatedGroupAdder(t *testing.T) {
45+
tests := []struct {
46+
name string
47+
inputUser user.Info
48+
expectedUser user.Info
49+
}{
50+
{
51+
name: "add",
52+
inputUser: &user.DefaultInfo{
53+
Name: "user",
54+
Groups: []string{"some-group"},
55+
},
56+
expectedUser: &user.DefaultInfo{
57+
Name: "user",
58+
Groups: []string{"some-group", user.AllAuthenticated},
59+
},
60+
},
61+
{
62+
name: "don't double add",
63+
inputUser: &user.DefaultInfo{
64+
Name: "user",
65+
Groups: []string{user.AllAuthenticated, "some-group"},
66+
},
67+
expectedUser: &user.DefaultInfo{
68+
Name: "user",
69+
Groups: []string{user.AllAuthenticated, "some-group"},
70+
},
71+
},
72+
{
73+
name: "don't add for anon",
74+
inputUser: &user.DefaultInfo{
75+
Name: user.Anonymous,
76+
Groups: []string{"some-group"},
77+
},
78+
expectedUser: &user.DefaultInfo{
79+
Name: user.Anonymous,
80+
Groups: []string{"some-group"},
81+
},
82+
},
83+
{
84+
name: "don't add for unauthenticated group",
85+
inputUser: &user.DefaultInfo{
86+
Name: "user",
87+
Groups: []string{user.AllUnauthenticated, "some-group"},
88+
},
89+
expectedUser: &user.DefaultInfo{
90+
Name: "user",
91+
Groups: []string{user.AllUnauthenticated, "some-group"},
92+
},
93+
},
94+
}
95+
96+
for _, test := range tests {
97+
adder := authenticator.Request(
98+
NewAuthenticatedGroupAdder(
99+
authenticator.RequestFunc(func(req *http.Request) (user.Info, bool, error) {
100+
return test.inputUser, true, nil
101+
}),
102+
),
103+
)
104+
105+
user, _, _ := adder.AuthenticateRequest(nil)
106+
if !reflect.DeepEqual(user, test.expectedUser) {
107+
t.Errorf("got %#v", user)
108+
}
109+
}
110+
111+
}

‎vendor/BUILD

+4-1
Original file line numberDiff line numberDiff line change
@@ -9637,7 +9637,10 @@ go_test(
96379637

96389638
go_library(
96399639
name = "k8s.io/apiserver/pkg/authentication/group",
9640-
srcs = ["k8s.io/apiserver/pkg/authentication/group/group_adder.go"],
9640+
srcs = [
9641+
"k8s.io/apiserver/pkg/authentication/group/authenticated_group_adder.go",
9642+
"k8s.io/apiserver/pkg/authentication/group/group_adder.go",
9643+
],
96419644
tags = ["automanaged"],
96429645
deps = [
96439646
"//vendor:k8s.io/apiserver/pkg/authentication/authenticator",

0 commit comments

Comments
 (0)