From cef08a1c2d65fb5fcea08cd91169f1b2a538b768 Mon Sep 17 00:00:00 2001 From: Caleb Doxsey Date: Thu, 15 Jul 2021 09:31:45 -0600 Subject: [PATCH] authorize: remove service account impersonate user id, email and groups (#2365) --- authorize/evaluator/evaluator_test.go | 2 +- authorize/log.go | 9 --- pkg/grpc/audit/audit.pb.go | 2 +- pkg/grpc/config/config.pb.go | 2 +- pkg/grpc/crypt/crypt.pb.go | 2 +- pkg/grpc/databroker/databroker.pb.go | 2 +- pkg/grpc/directory/directory.pb.go | 2 +- pkg/grpc/events/xds.pb.go | 2 +- pkg/grpc/registry/registry.pb.go | 2 +- pkg/grpc/session/session.pb.go | 2 +- pkg/grpc/user/user.pb.go | 87 ++++++++++----------------- pkg/grpc/user/user.proto | 5 +- 12 files changed, 41 insertions(+), 78 deletions(-) diff --git a/authorize/evaluator/evaluator_test.go b/authorize/evaluator/evaluator_test.go index 2751987c6..55cbde617 100644 --- a/authorize/evaluator/evaluator_test.go +++ b/authorize/evaluator/evaluator_test.go @@ -244,7 +244,7 @@ func TestEvaluator(t *testing.T) { t.Run("impersonate email", func(t *testing.T) { t.Run("allowed", func(t *testing.T) { res, err := eval(t, options, []proto.Message{ - &user.ServiceAccount{ + &session.Session{ Id: "session1", UserId: "user1", ImpersonateEmail: proto.String("a@example.com"), diff --git a/authorize/log.go b/authorize/log.go index 49ad4ca6f..4db30df51 100644 --- a/authorize/log.go +++ b/authorize/log.go @@ -50,15 +50,6 @@ func (a *Authorize) logAuthorizeCheck( } if sa, ok := s.(*user.ServiceAccount); ok { evt = evt.Str("service-account-id", sa.GetId()) - if sa.GetImpersonateEmail() != "" { - evt = evt.Str("impersonate-email", sa.GetImpersonateEmail()) - } - if len(sa.GetImpersonateGroups()) > 0 { - evt = evt.Strs("impersonate-groups", sa.GetImpersonateGroups()) - } - if sa.GetImpersonateUserId() != "" { - evt = evt.Str("impersonate-user-id", sa.GetImpersonateUserId()) - } } // result diff --git a/pkg/grpc/audit/audit.pb.go b/pkg/grpc/audit/audit.pb.go index 74c068c55..ea6b93fe5 100644 --- a/pkg/grpc/audit/audit.pb.go +++ b/pkg/grpc/audit/audit.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: audit.proto diff --git a/pkg/grpc/config/config.pb.go b/pkg/grpc/config/config.pb.go index bd06db96a..931caa424 100644 --- a/pkg/grpc/config/config.pb.go +++ b/pkg/grpc/config/config.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: config.proto diff --git a/pkg/grpc/crypt/crypt.pb.go b/pkg/grpc/crypt/crypt.pb.go index d9640585d..47d0774b6 100644 --- a/pkg/grpc/crypt/crypt.pb.go +++ b/pkg/grpc/crypt/crypt.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: crypt.proto diff --git a/pkg/grpc/databroker/databroker.pb.go b/pkg/grpc/databroker/databroker.pb.go index 4cb143d4e..4689f6276 100644 --- a/pkg/grpc/databroker/databroker.pb.go +++ b/pkg/grpc/databroker/databroker.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: databroker.proto diff --git a/pkg/grpc/directory/directory.pb.go b/pkg/grpc/directory/directory.pb.go index ab0e265ee..50c99fd76 100644 --- a/pkg/grpc/directory/directory.pb.go +++ b/pkg/grpc/directory/directory.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: directory.proto diff --git a/pkg/grpc/events/xds.pb.go b/pkg/grpc/events/xds.pb.go index c48bb049b..3e83f26c9 100644 --- a/pkg/grpc/events/xds.pb.go +++ b/pkg/grpc/events/xds.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: xds.proto diff --git a/pkg/grpc/registry/registry.pb.go b/pkg/grpc/registry/registry.pb.go index a11eba546..0625d2104 100644 --- a/pkg/grpc/registry/registry.pb.go +++ b/pkg/grpc/registry/registry.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: registry.proto diff --git a/pkg/grpc/session/session.pb.go b/pkg/grpc/session/session.pb.go index 122424634..0be3b5e23 100644 --- a/pkg/grpc/session/session.pb.go +++ b/pkg/grpc/session/session.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: session.proto diff --git a/pkg/grpc/user/user.pb.go b/pkg/grpc/user/user.pb.go index 300d45f17..ebddd64c2 100644 --- a/pkg/grpc/user/user.pb.go +++ b/pkg/grpc/user/user.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.27.0 +// protoc-gen-go v1.27.1 // protoc v3.14.0 // source: user.proto @@ -161,13 +161,11 @@ type ServiceAccount struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"` - ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"` - IssuedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"` - ImpersonateUserId *string `protobuf:"bytes,5,opt,name=impersonate_user_id,json=impersonateUserId,proto3,oneof" json:"impersonate_user_id,omitempty"` - ImpersonateEmail *string `protobuf:"bytes,6,opt,name=impersonate_email,json=impersonateEmail,proto3,oneof" json:"impersonate_email,omitempty"` - ImpersonateGroups []string `protobuf:"bytes,7,rep,name=impersonate_groups,json=impersonateGroups,proto3" json:"impersonate_groups,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + NamespaceId *string `protobuf:"bytes,8,opt,name=namespace_id,json=namespaceId,proto3,oneof" json:"namespace_id,omitempty"` + UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"` + ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"` + IssuedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"` } func (x *ServiceAccount) Reset() { @@ -209,6 +207,13 @@ func (x *ServiceAccount) GetId() string { return "" } +func (x *ServiceAccount) GetNamespaceId() string { + if x != nil && x.NamespaceId != nil { + return *x.NamespaceId + } + return "" +} + func (x *ServiceAccount) GetUserId() string { if x != nil { return x.UserId @@ -230,27 +235,6 @@ func (x *ServiceAccount) GetIssuedAt() *timestamppb.Timestamp { return nil } -func (x *ServiceAccount) GetImpersonateUserId() string { - if x != nil && x.ImpersonateUserId != nil { - return *x.ImpersonateUserId - } - return "" -} - -func (x *ServiceAccount) GetImpersonateEmail() string { - if x != nil && x.ImpersonateEmail != nil { - return *x.ImpersonateEmail - } - return "" -} - -func (x *ServiceAccount) GetImpersonateGroups() []string { - if x != nil { - return x.ImpersonateGroups - } - return nil -} - var File_user_proto protoreflect.FileDescriptor var file_user_proto_rawDesc = []byte{ @@ -276,34 +260,25 @@ var file_user_proto_rawDesc = []byte{ 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, - 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf1, 0x02, 0x0a, 0x0e, 0x53, 0x65, 0x72, + 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xe6, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, - 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, - 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, - 0x65, 0x72, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, - 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, - 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, - 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x12, - 0x37, 0x0a, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01, - 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, - 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, - 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x41, 0x74, 0x12, 0x33, 0x0a, 0x13, 0x69, 0x6d, 0x70, 0x65, - 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, - 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x11, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, - 0x6e, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x30, 0x0a, - 0x11, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6d, 0x61, - 0x69, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x10, 0x69, 0x6d, 0x70, 0x65, - 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x88, 0x01, 0x01, 0x12, - 0x2d, 0x0a, 0x12, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x5f, 0x67, - 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x69, 0x6d, 0x70, - 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x42, 0x16, - 0x0a, 0x14, 0x5f, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x5f, 0x75, - 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x42, 0x14, 0x0a, 0x12, 0x5f, 0x69, 0x6d, 0x70, 0x65, 0x72, - 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x42, 0x2c, 0x5a, 0x2a, - 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, - 0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6b, 0x67, - 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, - 0x6f, 0x33, + 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x26, 0x0a, 0x0c, 0x6e, + 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, + 0x09, 0x48, 0x00, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, + 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, + 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x0a, + 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, + 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, + 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, + 0x70, 0x69, 0x72, 0x65, 0x73, 0x41, 0x74, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, + 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, + 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, + 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x41, 0x74, + 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, + 0x64, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, + 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, + 0x6d, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x62, + 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/pkg/grpc/user/user.proto b/pkg/grpc/user/user.proto index c3e8f9a7b..c297c8015 100644 --- a/pkg/grpc/user/user.proto +++ b/pkg/grpc/user/user.proto @@ -21,11 +21,8 @@ message User { message ServiceAccount { string id = 1; + optional string namespace_id = 8; string user_id = 2; google.protobuf.Timestamp expires_at = 3; google.protobuf.Timestamp issued_at = 4; - - optional string impersonate_user_id = 5; - optional string impersonate_email = 6; - repeated string impersonate_groups = 7; }