fanhuadesenlinnn/cloudpods
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/yunionio/cloudpods.git synced 2026-09-20 08:03:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: keystone issues: 1. add no_policy_violation_check (#13948)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2022-04-11 06:39:08 +08:00
committed by GitHub
parent d700f89877
commit b77aa834e3
16 changed files with 55 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@@ -155,7 +155,7 @@ require (
yunion.io/x/ovsdb v0.0.0-20200526071744-27bf0940cbc7
yunion.io/x/pkg v0.0.0-20220406030238-39fbc60d5d4e
yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e
yunion.io/x/sqlchemy v0.0.0-20220405074102-7b815a97eb67
yunion.io/x/sqlchemy v0.0.0-20220410134835-8a3d36a64faa
yunion.io/x/structarg v0.0.0-20220312084958-9c6c79c7d1c6
)

4
go.sum
View File

@@ -998,7 +998,7 @@ yunion.io/x/pkg v0.0.0-20220406030238-39fbc60d5d4e h1:ovxSHuAa8hOBiZPU+ezrwqmVuC
yunion.io/x/pkg v0.0.0-20220406030238-39fbc60d5d4e/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e h1:v+EzIadodSwkdZ/7bremd7J8J50Cise/HCylsOJngmo=
yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e/go.mod h1:0iFKpOs1y4lbCxeOmq3Xx/0AcQoewVPwj62eRluioEo=
yunion.io/x/sqlchemy v0.0.0-20220405074102-7b815a97eb67 h1:vZiiB5oc6wqEvr1UNmJPFCX3FmLznZbvoUZ90ONgAcE=
yunion.io/x/sqlchemy v0.0.0-20220405074102-7b815a97eb67/go.mod h1:FTdwPdGhMgh4E+UFXc9klI1Ok34fMuybTT+jLhOaIjI=
yunion.io/x/sqlchemy v0.0.0-20220410134835-8a3d36a64faa h1:ZOjsS0xfXNbTXB4OBPDRNmcpSiQDPA+hIZ3fZafu0g0=
yunion.io/x/sqlchemy v0.0.0-20220410134835-8a3d36a64faa/go.mod h1:FTdwPdGhMgh4E+UFXc9klI1Ok34fMuybTT+jLhOaIjI=
yunion.io/x/structarg v0.0.0-20220312084958-9c6c79c7d1c6 h1:WuWXhY3DvhdRTzWCJ/kwt3Ss6KIq7+KqJwb+esvNGwU=
yunion.io/x/structarg v0.0.0-20220312084958-9c6c79c7d1c6/go.mod h1:EP6NSv2C0zzqBDTKumv8hPWLb3XvgMZDHQRfyuOrQng=

12
pkg/apis/identity/domain.go
View File

@@ -22,12 +22,12 @@ type DomainDetails struct {
SDomain
UserCout int `json:"user_count"`
GroupCount int `json:"group_count"`
ProjectCout int `json:"project_count"`
RoleCount int `json:"role_count"`
PolicyCount int `json:"policy_count"`
IdpCount int `json:"idp_count"`
UserCount int `json:"user_count"`
GroupCount int `json:"group_count"`
ProjectCount int `json:"project_count"`
RoleCount int `json:"role_count"`
PolicyCount int `json:"policy_count"`
IdpCount int `json:"idp_count"`
ExternalResourceInfo
}

2
pkg/apis/identity/user.go
View File

@@ -38,4 +38,6 @@ type UserDetails struct {
IsLocal bool `json:"is_local"`
ExternalResourceInfo
Projects []SFetchDomainObject `json:"projects"`
}

2
pkg/cloudcommon/db/quotas/usageworker.go
View File

@@ -69,7 +69,7 @@ type quotaTask struct {
}
func (t *quotaTask) Run() {
ctx := context.Background()
ctx := context.WithValue(context.Background(), "task", t)
usage := t.manager.newQuota()

3
pkg/keystone/locale/predefined_policies.go
View File

@@ -71,6 +71,9 @@ var (
Scope: rbacutils.ScopeProject,
Extra: map[string]map[string][]string{
"compute": {
"dashboard": {
"get",
},
"capabilities": {
"list",
},

4
pkg/keystone/models/domains.go
View File

@@ -373,9 +373,9 @@ func (manager *SDomainManager) FetchCustomizeColumns(
}
domain := objs[i].(*SDomain)
idList[i] = domain.Id
rows[i].UserCout, _ = domain.GetUserCount()
rows[i].UserCount, _ = domain.GetUserCount()
rows[i].GroupCount, _ = domain.GetGroupCount()
rows[i].ProjectCout, _ = domain.GetProjectCount()
rows[i].ProjectCount, _ = domain.GetProjectCount()
rows[i].RoleCount, _ = domain.GetRoleCount()
rows[i].PolicyCount, _ = domain.GetPolicyCount()
rows[i].IdpCount, _ = domain.GetIdpCount()

4
pkg/keystone/models/policies.go
View File

@@ -36,6 +36,7 @@ import (
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/keystone/locale"
"yunion.io/x/onecloud/pkg/keystone/options"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/rbacutils"
"yunion.io/x/onecloud/pkg/util/stringutils2"
@@ -240,6 +241,9 @@ func (manager *SPolicyManager) FetchEnabledPolicies() ([]SPolicy, error) {
}
func validatePolicyVioldatePrivilege(userCred mcclient.TokenCredential, policyScope rbacutils.TRbacScope, policy *rbacutils.SPolicy) error {
if options.Options.NoPolicyViolationCheck {
return nil
}
if userCred.GetUserName() == api.SystemAdminUser && userCred.GetDomainId() == api.DEFAULT_DOMAIN_ID {
return nil
}

3
pkg/keystone/models/projects.go
View File

@@ -478,6 +478,9 @@ func (self *SProject) PostCreate(
}
func validateJoinProject(userCred mcclient.TokenCredential, project *SProject, roleIds []string) error {
if options.Options.NoPolicyViolationCheck {
return nil
}
_, opsPolicies, _ := RolePolicyManager.GetMatchPolicyGroup(userCred, time.Time{}, false)
_, assignPolicies, _ := RolePolicyManager.GetMatchPolicyGroup2(false, roleIds, project.Id, "", time.Time{}, false)
opsScope := opsPolicies.HighestScope()

17
pkg/keystone/models/rolepolicies.go
View File

@@ -431,11 +431,17 @@ func (manager *SRolePolicyManager) GetMatchPolicyGroupByCred(userCred mcclient.T
if err != nil {
return nil, nil, errors.Wrap(err, "GetMatchPolicyGroup")
}
usr, err := UserManager.fetchUserById(userCred.GetUserId())
if err != nil {
return nil, nil, errors.Wrapf(err, "user id %s of userCred not found", userCred.GetUserId())
userId := userCred.GetUserId()
if len(userId) == 0 {
// anonymous access
return names, policies, nil
}
if usr.AllowWebConsole.IsTrue() {
usr, err := UserManager.fetchUserById(userId)
if err != nil {
return nil, nil, errors.Wrapf(err, "user id %s of userCred not found", userId)
}
// append dashboard policy only when there are matched policies
if len(names) > 0 && usr.AllowWebConsole.IsTrue() {
// add web console policy
for scope := range names {
consolePolicyName := ""
@@ -500,7 +506,8 @@ func (manager *SRolePolicyManager) GetPolicyGroupByIds(policyIds []string, nameO
}
func (rp *SRolePolicy) MatchIP(ipstr string) bool {
return rbacutils.MatchIPStrings(rp.Ips, ipstr)
result := rbacutils.MatchIPStrings(rp.Ips, ipstr)
return result
}
func (rp *SRolePolicy) MatchTime(tm time.Time) bool {

9
pkg/keystone/models/users.go
View File

@@ -664,6 +664,15 @@ func userExtra(user *SUser, out api.UserDetails) api.UserDetails {
out.ExtResourcesNextUpdate = nextUpdate
}
projects, _ := ProjectManager.FetchUserProjects(user.Id)
out.Projects = make([]api.SFetchDomainObject, len(projects))
for i, proj := range projects {
out.Projects[i].Id = proj.Id
out.Projects[i].Name = proj.Name
out.Projects[i].Domain = proj.DomainName
out.Projects[i].DomainId = proj.DomainId
}
return out
}

2
pkg/keystone/options/options.go
View File

@@ -63,6 +63,8 @@ type SKeystoneOptions struct {
SystemDashboardPolicy string `help:"dashboard policy name for system view" default:"sys-dashboard"`
DomainDashboardPolicy string `help:"dashboard policy name for domain view" default:"domain-dashboard"`
ProjectDashboardPolicy string `help:"dashboard policy name for project view" default:"project-dashboard"`
NoPolicyViolationCheck bool `help:"do not check policy violation when modify or assign policy" default:"false"`
}
var (

2
pkg/keystone/service/localpolicy.go
View File

@@ -25,7 +25,7 @@ import (
)
func localPolicyFetcher(ctx context.Context, token mcclient.TokenCredential) (*mcclient.SFetchMatchPoliciesOutput, error) {
names, groups, err := models.RolePolicyManager.GetMatchPolicyGroup(token, time.Now(), false)
names, groups, err := models.RolePolicyManager.GetMatchPolicyGroupByCred(token, time.Now(), false)
if err != nil {
return nil, errors.Wrap(err, "GetMatchPolicyGroup")
}

2
vendor/modules.txt vendored
View File

@@ -1265,7 +1265,7 @@ yunion.io/x/pkg/util/workqueue
yunion.io/x/pkg/utils
# yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e
yunion.io/x/s3cli
# yunion.io/x/sqlchemy v0.0.0-20220405074102-7b815a97eb67
# yunion.io/x/sqlchemy v0.0.0-20220410134835-8a3d36a64faa
yunion.io/x/sqlchemy
yunion.io/x/sqlchemy/backends
yunion.io/x/sqlchemy/backends/clickhouse

2
vendor/yunion.io/x/sqlchemy/backends_mock.go generated vendored
View File

@@ -121,7 +121,7 @@ func (mock *sMockBackend) DropIndexSQLTemplate() string {
}
func (mock *sMockBackend) InsertOrUpdateSQLTemplate() string {
return ""
return "INSERT INTO `{{ .Table }}` ({{ .Columns }}) VALUES ({{ .Values }}) ON DUPLICATE KEY UPDATE {{ .SetValues }}"
}
func (mock *sMockBackend) GetTableSQL() string {

5
vendor/yunion.io/x/sqlchemy/insert.go generated vendored
View File

@@ -183,7 +183,12 @@ func (t *STableSpec) InsertSqlPrep(data interface{}, update bool) (*InsertSqlRes
} else {
return nil, errors.Wrapf(ErrEmptyPrimaryKey, "cannot insert for null primary key %q", k)
}
continue
}
// empty without default
if update {
updates = append(updates, fmt.Sprintf("`%s` = NULL", k))
continue
}
}