IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

ExtJwtClient: Use user namespace for k8s allowed namespace (#93687)

Browse Source 
* ExtJwtClient: Use user namespace for k8s allowed namespace

* fix test
This commit is contained in:
Gabriel MABILLE 2025-01-15 17:38:46 +01:00 committed by GitHub
parent 5d45af1110
commit b6fc695598
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/services/authn/clients/ext_jwt.go
View File

@ -127,13 +127,6 @@ func (s *ExtendedJWT) authenticateAsUser(
return nil, errExtJWTInvalidSubject.Errorf("unexpected identity: %s", idTokenClaims.Subject)
}
// For use in service layer, allow higher privilege
namespace := accessTokenClaims.Rest.Namespace
if len(s.cfg.StackID) > 0 {
// For single-tenant cloud use, choose the lower of the two (id token will always have the specific namespace)
namespace = idTokenClaims.Rest.Namespace
}
return &authn.Identity{
ID: id,
Type: t,
@ -142,7 +135,7 @@ func (s *ExtendedJWT) authenticateAsUser(
IDTokenClaims: &idTokenClaims,
AuthenticatedBy: login.ExtendedJWTModule,
AuthID: accessTokenClaims.Subject,
Namespace: namespace,
Namespace: idTokenClaims.Rest.Namespace,
ClientParams: authn.ClientParams{
SyncPermissions: true,
FetchPermissionsParams: authn.FetchPermissionsParams{

4
pkg/services/authn/clients/ext_jwt_test.go
View File

@ -283,7 +283,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) {
},
},
{
name: "should authenticate as user using wildcard namespace for access token",
name: "should authenticate as user in the user namespace",
accessToken: &validAccessTokenClaimsWildcard,
idToken: &validIDTokenClaims,
orgID: 1,
@ -293,7 +293,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) {
OrgID: 1,
AccessTokenClaims: &validAccessTokenClaimsWildcard,
IDTokenClaims: &validIDTokenClaims,
Namespace: "*",
Namespace: "default",
AuthenticatedBy: "extendedjwt",
AuthID: "access-policy:this-uid",
ClientParams: authn.ClientParams{