IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-01-24 23:37:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

Access Control: Remove built-in role assignment by default (#49058)

Browse Source 
* Remove FF-bultins

* Add a param to test br-simplifying
This commit is contained in:
Gabriel MABILLE 2022-05-19 09:29:36 +02:00 committed by GitHub
parent a3c5834594
commit 5b6d20fbce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 7 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
packages/grafana-data/src/types/featureToggles.gen.ts
View File

@ -32,7 +32,6 @@ export interface FeatureToggles {
tempoBackendSearch?: boolean;
tempoServiceGraph?: boolean;
lokiBackendMode?: boolean;
['accesscontrol-builtins']?: boolean;
prometheus_azure_auth?: boolean;
influxdbBackendMigration?: boolean;
newNavigation?: boolean;

8
pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go
View File

@ -18,7 +18,7 @@ import (
func ProvideService(features featuremgmt.FeatureToggles, cfg *setting.Cfg,
provider accesscontrol.PermissionsProvider, routeRegister routing.RouteRegister) (*OSSAccessControlService, error) {
var errDeclareRoles error
s := ProvideOSSAccessControl(features, cfg, provider)
s := ProvideOSSAccessControl(cfg, provider)
if !s.IsDisabled() {
api := api.AccessControlAPI{
RouteRegister: routeRegister,
@ -32,9 +32,8 @@ func ProvideService(features featuremgmt.FeatureToggles, cfg *setting.Cfg,
return s, errDeclareRoles
}
func ProvideOSSAccessControl(features featuremgmt.FeatureToggles, cfg *setting.Cfg, provider accesscontrol.PermissionsProvider) *OSSAccessControlService {
func ProvideOSSAccessControl(cfg *setting.Cfg, provider accesscontrol.PermissionsProvider) *OSSAccessControlService {
s := &OSSAccessControlService{
features: features,
cfg: cfg,
provider: provider,
log: log.New("accesscontrol"),
@ -48,7 +47,6 @@ func ProvideOSSAccessControl(features featuremgmt.FeatureToggles, cfg *setting.C
// OSSAccessControlService is the service implementing role based access control.
type OSSAccessControlService struct {
log log.Logger
features featuremgmt.FeatureToggles
cfg *setting.Cfg
scopeResolvers accesscontrol.ScopeResolvers
provider accesscontrol.PermissionsProvider
@ -158,7 +156,7 @@ func (ac *OSSAccessControlService) GetUserBuiltInRoles(user *models.SignedInUser
builtInRoles := []string{string(user.OrgRole)}
// With built-in role simplifying, inheritance is performed upon role registration.
if !ac.features.IsEnabled(featuremgmt.FlagAccesscontrolBuiltins) {
if ac.cfg.RBACBuiltInRoleAssignmentEnabled {
for _, br := range user.OrgRole.Children() {
builtInRoles = append(builtInRoles, string(br))
}

1
pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol_test.go
View File

@ -24,7 +24,6 @@ func setupTestEnv(t testing.TB) *OSSAccessControlService {
ac := &OSSAccessControlService{
cfg: cfg,
features: featuremgmt.WithFeatures(),
log: log.New("accesscontrol"),
registrations: accesscontrol.RegistrationList{},
scopeResolvers: accesscontrol.NewScopeResolvers(),

6
pkg/services/featuremgmt/registry.go
View File

@ -94,12 +94,6 @@ var (
State: FeatureStateAlpha,
FrontendOnly: true,
},
{
Name: "accesscontrol-builtins",
Description: "Simplify access control builtin roles",
State: FeatureStateAlpha,
RequiresDevMode: true,
},
{
Name: "prometheus_azure_auth",
Description: "Experimental. Azure authentication for Prometheus datasource",

4
pkg/services/featuremgmt/toggles_gen.go
View File

@ -71,10 +71,6 @@ const (
// Loki datasource works as backend datasource
FlagLokiBackendMode = "lokiBackendMode"
// FlagAccesscontrolBuiltins
// Simplify access control builtin roles
FlagAccesscontrolBuiltins = "accesscontrol-builtins"
// FlagPrometheusAzureAuth
// Experimental. Azure authentication for Prometheus datasource
FlagPrometheusAzureAuth = "prometheus_azure_auth"

1
pkg/services/featuremgmt/toggles_gen_test.go
View File

@ -24,7 +24,6 @@ func TestFeatureToggleFiles(t *testing.T) {
"live-config": true,
"live-pipeline": true,
"live-service-web-worker": true,
"accesscontrol-builtins": true,
"prometheus_azure_auth": true,
"disable_http_request_histogram": true,
}

4
pkg/setting/setting.go
View File

@ -447,6 +447,9 @@ type Cfg struct {
// Access Control
RBACEnabled bool
RBACPermissionCache bool
// Undocumented option as a backup in case removing builtin-role assignment
// fails
RBACBuiltInRoleAssignmentEnabled bool
}
type CommandLineArgs struct {
@ -1360,6 +1363,7 @@ func readAccessControlSettings(iniFile *ini.File, cfg *Cfg) {
rbac := iniFile.Section("rbac")
cfg.RBACEnabled = rbac.Key("enabled").MustBool(true)
cfg.RBACPermissionCache = rbac.Key("permission_cache").MustBool(true)
cfg.RBACBuiltInRoleAssignmentEnabled = rbac.Key("builtin_role_assignment_enabled").MustBool(false)
}
func readUserSettings(iniFile *ini.File, cfg *Cfg) error {