unistack-org/micro
3
0
Fork 3
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases 239 Wiki Activity

Auth - Add debugging to loading rules (#1420)

Browse Source 
* Fix auth multi-rule edgecase

* Add logging to auth rules

Co-authored-by: Ben Toogood <ben@micro.mu>
This commit is contained in:
ben-toogood 2020-03-26 16:30:31 +00:00 committed by GitHub
parent 42b6bf5bbf
commit 00e7804f96
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
auth/service/service.go
View File

@ -125,11 +125,10 @@ func (s *svc) Revoke(role string, res *auth.Resource) error {
// Verify an account has access to a resource // Verify an account has access to a resource
func (s *svc) Verify(acc *auth.Account, res *auth.Resource) error { func (s *svc) Verify(acc *auth.Account, res *auth.Resource) error {
queries := [][]string{ queries := [][]string{
{res.Type, res.Name, res.Endpoint}, // check for specific role, e.g. service.foo.ListFoo:admin (role is checked in accessForRule) {res.Type, res.Name, res.Endpoint}, // check for specific role, e.g. service.foo.ListFoo:admin (role is checked in accessForRule)
{res.Type, res.Name, res.Endpoint, "*"}, // check for wildcard role, e.g. service.foo.ListFoo:* {res.Type, res.Name, "*"}, // check for wildcard endpoint, e.g. service.foo*
{res.Type, res.Name, "*"}, // check for wildcard endpoint, e.g. service.foo* {res.Type, "*"}, // check for wildcard name, e.g. service.*
{res.Type, "*"}, // check for wildcard name, e.g. service.* {"*"}, // check for wildcard type, e.g. *
{"*"}, // check for wildcard type, e.g. *
} }
// endpoint is a url which can have wildcard excludes, e.g. // endpoint is a url which can have wildcard excludes, e.g.
@ -242,6 +241,7 @@ func (s *svc) listRules(filters ...string) []*rulePb.Rule {
// loadRules retrieves the rules from the auth service // loadRules retrieves the rules from the auth service
func (s *svc) loadRules() { func (s *svc) loadRules() {
log.Infof("Loading rules from auth service\n")
rsp, err := s.rule.List(context.TODO(), &rulePb.ListRequest{}) rsp, err := s.rule.List(context.TODO(), &rulePb.ListRequest{})
s.Lock() s.Lock()
defer s.Unlock() defer s.Unlock()
@ -251,6 +251,7 @@ func (s *svc) loadRules() {
return return
} }
log.Infof("Loaded %v rules from the auth service\n", len(rsp.Rules))
s.rules = rsp.Rules s.rules = rsp.Rules
} }