IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

K8s: Pass ID token in X-Extra-id-token header (#82893)

Browse Source
This commit is contained in:
Todd Treece 2024-02-16 10:07:37 -05:00 committed by GitHub
parent ffb9a4de4a
commit 8f0431ba46
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/services/apiserver/auth/authenticator/signedinuser.go
View File

@ -25,15 +25,18 @@ func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool
Name: signedInUser.Login, Name: signedInUser.Login,
UID: signedInUser.UserUID, UID: signedInUser.UserUID,
Groups: []string{}, Groups: []string{},
Extra: map[string][]string{}, // In order to faithfully round-trip through an impersonation flow, Extra keys MUST be lowercase.
// see: https://pkg.go.dev/k8s.io/apiserver@v0.27.1/pkg/authentication/user#Info
Extra: map[string][]string{},
} }
for _, v := range signedInUser.Teams { for _, v := range signedInUser.Teams {
userInfo.Groups = append(userInfo.Groups, strconv.FormatInt(v, 10)) userInfo.Groups = append(userInfo.Groups, strconv.FormatInt(v, 10))
} }
//
if signedInUser.IDToken != "" { if signedInUser.IDToken != "" {
userInfo.Extra["ID-Token"] = []string{signedInUser.IDToken} userInfo.Extra["id-token"] = []string{signedInUser.IDToken}
} }
return &authenticator.Response{ return &authenticator.Response{

4
pkg/services/apiserver/auth/authenticator/signedinuser_test.go
View File

@ -47,7 +47,7 @@ func TestSignedInUser(t *testing.T) {
require.Equal(t, u.Login, res.User.GetName()) require.Equal(t, u.Login, res.User.GetName())
require.Equal(t, u.UserUID, res.User.GetUID()) require.Equal(t, u.UserUID, res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups()) require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Empty(t, res.User.GetExtra()["ID-Token"]) require.Empty(t, res.User.GetExtra()["id-token"])
}) })
t.Run("should set ID token when available", func(t *testing.T) { t.Run("should set ID token when available", func(t *testing.T) {
@ -72,7 +72,7 @@ func TestSignedInUser(t *testing.T) {
require.Equal(t, u.Login, res.User.GetName()) require.Equal(t, u.Login, res.User.GetName())
require.Equal(t, u.UserUID, res.User.GetUID()) require.Equal(t, u.UserUID, res.User.GetUID())
require.Equal(t, []string{"1", "2"}, res.User.GetGroups()) require.Equal(t, []string{"1", "2"}, res.User.GetGroups())
require.Equal(t, "test-id-token", res.User.GetExtra()["ID-Token"][0]) require.Equal(t, "test-id-token", res.User.GetExtra()["id-token"][0])
}) })
} }