Skip to content

Commit e72c279

Browse files
bosorawisbosorawis
authored
fix(authmethods): set parent scope ID for auth methods resource (#5448)
* handlers/authmethods: fix children permission * documentation * formatting
1 parent 9a68808 commit e72c279

File tree

2 files changed

+267
-0
lines changed

2 files changed

+267
-0
lines changed

‎internal/daemon/controller/handlers/authmethods/authmethod_service.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1577,6 +1577,7 @@ func newOutputOpts(ctx context.Context, item auth.AuthMethod, scopeInfoMap map[s
15771577
}
15781578
res.Id = item.GetPublicId()
15791579
res.ScopeId = item.GetScopeId()
1580+
res.ParentScopeId = scopeInfoMap[item.GetScopeId()].GetParentScopeId()
15801581
authorizedActions := authResults.FetchActionSetForId(ctx, item.GetPublicId(), IdActions[globals.ResourceInfoFromPrefix(item.GetPublicId()).Subtype], requestauth.WithResource(&res)).Strings()
15811582
if len(authorizedActions) == 0 {
15821583
return nil, false, nil

‎internal/daemon/controller/handlers/authmethods/grants_test.go

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
// Copyright (c) HashiCorp, Inc.
2+
// SPDX-License-Identifier: BUSL-1.1
3+
4+
package authmethods_test
5+
6+
import (
7+
"context"
8+
"slices"
9+
"testing"
10+
11+
"github.com/hashicorp/boundary/globals"
12+
"github.com/hashicorp/boundary/internal/auth"
13+
"github.com/hashicorp/boundary/internal/auth/ldap"
14+
"github.com/hashicorp/boundary/internal/auth/oidc"
15+
"github.com/hashicorp/boundary/internal/auth/password"
16+
"github.com/hashicorp/boundary/internal/authtoken"
17+
controllerauth "github.com/hashicorp/boundary/internal/daemon/controller/auth"
18+
"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
19+
20+
"github.com/hashicorp/boundary/internal/daemon/controller/handlers/authmethods"
21+
"github.com/hashicorp/boundary/internal/db"
22+
pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
23+
"github.com/hashicorp/boundary/internal/iam"
24+
"github.com/hashicorp/boundary/internal/kms"
25+
"github.com/stretchr/testify/require"
26+
)
27+
28+
// TestGrants_ReadActions tests read actions to assert that grants are being applied properly
29+
func TestGrants_ReadActions(t *testing.T) {
30+
ctx := context.Background()
31+
conn, _ := db.TestSetup(t, "postgres")
32+
wrap := db.TestWrapper(t)
33+
iamRepo := iam.TestRepo(t, conn, wrap)
34+
rw := db.New(conn)
35+
kmsCache := kms.TestKms(t, conn, wrap)
36+
iamRepoFn := func() (*iam.Repository, error) {
37+
return iamRepo, nil
38+
}
39+
oidcRepoFn := func() (*oidc.Repository, error) {
40+
return oidc.NewRepository(ctx, rw, rw, kmsCache)
41+
}
42+
ldapRepoFn := func() (*ldap.Repository, error) {
43+
return ldap.NewRepository(ctx, rw, rw, kmsCache)
44+
}
45+
pwRepoFn := func() (*password.Repository, error) {
46+
return password.NewRepository(ctx, rw, rw, kmsCache)
47+
}
48+
atRepoFn := func() (*authtoken.Repository, error) {
49+
return authtoken.NewRepository(ctx, rw, rw, kmsCache)
50+
}
51+
authMethodRepoFn := func() (*auth.AuthMethodRepository, error) {
52+
return auth.NewAuthMethodRepository(ctx, rw, rw, kmsCache)
53+
}
54+
55+
s, err := authmethods.NewService(ctx,
56+
kmsCache,
57+
pwRepoFn,
58+
oidcRepoFn,
59+
iamRepoFn,
60+
atRepoFn,
61+
ldapRepoFn,
62+
authMethodRepoFn,
63+
1000)
64+
require.NoError(t, err)
65+
org1, _ := iam.TestScopes(t, iamRepo)
66+
org2, _ := iam.TestScopes(t, iamRepo)
67+
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), globals.GlobalPrefix, kms.KeyPurposeDatabase)
68+
require.NoError(t, err)
69+
oidcGlobal := oidc.TestAuthMethod(t, conn, databaseWrapper, globals.GlobalPrefix, oidc.InactiveState, "client-id", "secret")
70+
oidcOrg1 := oidc.TestAuthMethod(t, conn, databaseWrapper, org1.GetPublicId(), oidc.InactiveState, "client-id", "secret")
71+
oidcOrg2 := oidc.TestAuthMethod(t, conn, databaseWrapper, org2.GetPublicId(), oidc.InactiveState, "client-id", "secret")
72+
73+
ldapGlobal := ldap.TestAuthMethod(t, conn, wrap, globals.GlobalPrefix, []string{"ldaps://alice.com"})
74+
ldapOrg1 := ldap.TestAuthMethod(t, conn, wrap, org1.GetPublicId(), []string{"ldaps://alice.com"})
75+
ldapOrg2 := ldap.TestAuthMethod(t, conn, wrap, org2.GetPublicId(), []string{"ldaps://alice.com"})
76+
77+
pwGlobal := password.TestAuthMethod(t, conn, globals.GlobalPrefix)
78+
pwOrg1 := password.TestAuthMethod(t, conn, org1.GetPublicId())
79+
pwOrg2 := password.TestAuthMethod(t, conn, org2.GetPublicId())
80+
81+
// ignoreList consists of auth method IDs to omit from the result set
82+
// this is to handle auth methods that are created during the auth token
83+
// creation
84+
ignoreList := []string{}
85+
86+
t.Run("List", func(t *testing.T) {
87+
testcases := []struct {
88+
name string
89+
input *pbs.ListAuthMethodsRequest
90+
includeGlobalAuthMethods bool
91+
rolesToCreate []authtoken.TestRoleGrantsForToken
92+
wantErr error
93+
wantIDs []string
94+
}{
95+
{
96+
name: "global role grant this and children returns all auth methods",
97+
input: &pbs.ListAuthMethodsRequest{
98+
ScopeId: globals.GlobalPrefix,
99+
Recursive: true,
100+
},
101+
rolesToCreate: []authtoken.TestRoleGrantsForToken{
102+
{
103+
RoleScopeID: globals.GlobalPrefix,
104+
GrantStrings: []string{"ids=*;type=auth-method;actions=list,read"},
105+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
106+
},
107+
},
108+
wantErr: nil,
109+
wantIDs: []string{
110+
oidcGlobal.PublicId,
111+
oidcOrg1.PublicId,
112+
oidcOrg2.PublicId,
113+
ldapGlobal.PublicId,
114+
ldapOrg1.PublicId,
115+
ldapOrg2.PublicId,
116+
pwGlobal.PublicId,
117+
pwOrg1.PublicId,
118+
pwOrg2.PublicId,
119+
},
120+
},
121+
{
122+
name: "no grants return children org",
123+
input: &pbs.ListAuthMethodsRequest{
124+
ScopeId: globals.GlobalPrefix,
125+
Recursive: true,
126+
},
127+
rolesToCreate: []authtoken.TestRoleGrantsForToken{},
128+
wantErr: nil,
129+
// auth methods in `global` are filtered out because the user does not have grants to read
130+
// them in the global scope. Auth methods in org 1 and org 2 show up - my guess is because
131+
// the u_anon grants allow auth methods to be read on any org.
132+
wantIDs: []string{
133+
// oidcGlobal.PublicId,
134+
oidcOrg1.PublicId,
135+
oidcOrg2.PublicId,
136+
// ldapGlobal.PublicId,
137+
ldapOrg1.PublicId,
138+
ldapOrg2.PublicId,
139+
// pwGlobal.PublicId,
140+
pwOrg1.PublicId,
141+
pwOrg2.PublicId,
142+
},
143+
},
144+
{
145+
name: "org role grant this and children returns auth methods in org1",
146+
input: &pbs.ListAuthMethodsRequest{
147+
ScopeId: org1.PublicId,
148+
Recursive: true,
149+
},
150+
rolesToCreate: []authtoken.TestRoleGrantsForToken{
151+
{
152+
RoleScopeID: org1.PublicId,
153+
GrantStrings: []string{"ids=*;type=auth-method;actions=list,read"},
154+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
155+
},
156+
},
157+
wantErr: nil,
158+
wantIDs: []string{oidcOrg1.PublicId, ldapOrg1.PublicId, pwOrg1.PublicId},
159+
},
160+
}
161+
162+
for _, tc := range testcases {
163+
t.Run(tc.name, func(t *testing.T) {
164+
tok := authtoken.TestAuthTokenWithRoles(t, conn, kmsCache, globals.GlobalPrefix, tc.rolesToCreate)
165+
// auth method created during token generation will not be taken into considerations during this test
166+
// adding to the ignoreList so it can be ignored later
167+
ignoreList = append(ignoreList, tok.GetAuthMethodId())
168+
fullGrantAuthCtx := controllerauth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
169+
got, finalErr := s.ListAuthMethods(fullGrantAuthCtx, tc.input)
170+
if tc.wantErr != nil {
171+
require.ErrorIs(t, finalErr, tc.wantErr)
172+
return
173+
}
174+
// authtoken.TestAuthTokenWithRoles creates an auth method at `global` scope so
175+
// include AuthMethodID of the user used to generate AuthToken in the "wantIDs" set
176+
// when listing auth methods at global scope
177+
require.NoError(t, finalErr)
178+
var gotIDs []string
179+
for _, g := range got.Items {
180+
// do not include IDs in the ignore list in the
181+
// result sets
182+
if slices.Contains(ignoreList, g.Id) {
183+
continue
184+
}
185+
gotIDs = append(gotIDs, g.GetId())
186+
}
187+
require.ElementsMatch(t, tc.wantIDs, gotIDs)
188+
})
189+
}
190+
})
191+
192+
t.Run("Get", func(t *testing.T) {
193+
testcases := []struct {
194+
name string
195+
input *pbs.ListAuthMethodsRequest
196+
amIDExpectErrMap map[string]error
197+
rolesToCreate []authtoken.TestRoleGrantsForToken
198+
}{
199+
{
200+
name: "global role grant this and children returns all auth methods",
201+
amIDExpectErrMap: map[string]error{
202+
pwGlobal.GetPublicId(): nil,
203+
pwOrg1.GetPublicId(): nil,
204+
pwOrg2.GetPublicId(): nil,
205+
},
206+
rolesToCreate: []authtoken.TestRoleGrantsForToken{
207+
{
208+
RoleScopeID: globals.GlobalPrefix,
209+
GrantStrings: []string{"ids=*;type=auth-method;actions=list,read"},
210+
GrantScopes: []string{globals.GrantScopeThis, globals.GrantScopeChildren},
211+
},
212+
},
213+
},
214+
{
215+
name: "org role grant this and children returns auth methods in org1",
216+
input: &pbs.ListAuthMethodsRequest{
217+
ScopeId: org1.PublicId,
218+
Recursive: true,
219+
},
220+
rolesToCreate: []authtoken.TestRoleGrantsForToken{
221+
{
222+
RoleScopeID: globals.GlobalPrefix,
223+
GrantStrings: []string{"ids=*;type=auth-method;actions=list,read"},
224+
GrantScopes: []string{globals.GrantScopeChildren},
225+
},
226+
},
227+
amIDExpectErrMap: map[string]error{
228+
pwGlobal.GetPublicId(): handlers.ForbiddenError(),
229+
pwOrg1.GetPublicId(): nil,
230+
pwOrg2.GetPublicId(): nil,
231+
},
232+
},
233+
{
234+
name: "no grants return all auth methods",
235+
input: &pbs.ListAuthMethodsRequest{
236+
ScopeId: globals.GlobalPrefix,
237+
Recursive: true,
238+
PageSize: 500,
239+
},
240+
rolesToCreate: []authtoken.TestRoleGrantsForToken{},
241+
amIDExpectErrMap: map[string]error{
242+
pwGlobal.GetPublicId(): handlers.ForbiddenError(),
243+
pwOrg1.GetPublicId(): handlers.ForbiddenError(),
244+
pwOrg2.GetPublicId(): handlers.ForbiddenError(),
245+
},
246+
},
247+
}
248+
249+
for _, tc := range testcases {
250+
t.Run(tc.name, func(t *testing.T) {
251+
tok := authtoken.TestAuthTokenWithRoles(t, conn, kmsCache, globals.GlobalPrefix, tc.rolesToCreate)
252+
fullGrantAuthCtx := controllerauth.TestAuthContextFromToken(t, conn, wrap, tok, iamRepo)
253+
for amId, wantErr := range tc.amIDExpectErrMap {
254+
_, err := s.GetAuthMethod(fullGrantAuthCtx, &pbs.GetAuthMethodRequest{
255+
Id: amId,
256+
})
257+
if wantErr != nil {
258+
require.ErrorIs(t, err, wantErr)
259+
continue
260+
}
261+
require.NoError(t, err)
262+
}
263+
})
264+
}
265+
})
266+
}

0 commit comments

Comments
 (0)