dkirillov/frostfs-s3-gw
1
0
Fork 0
forked from TrueCloudLab/frostfs-s3-gw
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#387] authmate: fix parsing session rules

Browse source 
Signed-off-by: Denis Kirillov <denis@nspcc.ru>
This commit is contained in:
Denis Kirillov 2022-03-30 15:23:00 +03:00 committed by Alex Vanin
parent 83bb6fc020
commit 4322da90d8
2 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
authmate/authmate.go
View file

@ -98,6 +98,7 @@ type (
GatesPublicKeys []*keys.PublicKey GatesPublicKeys []*keys.PublicKey
EACLRules []byte EACLRules []byte
SessionTokenRules []byte SessionTokenRules []byte
SkipSessionRules bool
Lifetime time.Duration Lifetime time.Duration
AwsCliCredentialsFile string AwsCliCredentialsFile string
ContainerPolicies ContainerPolicies ContainerPolicies ContainerPolicies
@ -439,7 +440,7 @@ func createTokens(options *IssueSecretOptions, lifetime lifetimeOptions) ([]*acc
gates[i] = accessbox.NewGateData(gateKey, bearerTokens[i]) gates[i] = accessbox.NewGateData(gateKey, bearerTokens[i])
} }
if options.SessionTokenRules != nil { if !options.SkipSessionRules {
sessionRules, err := buildContext(options.SessionTokenRules) sessionRules, err := buildContext(options.SessionTokenRules)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to build context for session token: %w", err) return nil, fmt.Errorf("failed to build context for session token: %w", err)

13
cmd/authmate/main.go
View file

@ -276,7 +276,7 @@ It will be ceil rounded to the nearest amount of epoch.`,
return cli.Exit(fmt.Sprintf("couldn't parse 'bearer-rules' flag: %s", err.Error()), 7) return cli.Exit(fmt.Sprintf("couldn't parse 'bearer-rules' flag: %s", err.Error()), 7)
} }
sessionRules, err := getSessionRules(sessionTokenFlag) sessionRules, skipSessionRules, err := getSessionRules(sessionTokenFlag)
if err != nil { if err != nil {
return cli.Exit(fmt.Sprintf("couldn't parse 'session-token' flag: %s", err.Error()), 8) return cli.Exit(fmt.Sprintf("couldn't parse 'session-token' flag: %s", err.Error()), 8)
} }
@ -291,6 +291,7 @@ It will be ceil rounded to the nearest amount of epoch.`,
GatesPublicKeys: gatesPublicKeys, GatesPublicKeys: gatesPublicKeys,
EACLRules: bearerRules, EACLRules: bearerRules,
SessionTokenRules: sessionRules, SessionTokenRules: sessionRules,
SkipSessionRules: skipSessionRules,
ContainerPolicies: policies, ContainerPolicies: policies,
Lifetime: lifetimeFlag, Lifetime: lifetimeFlag,
AwsCliCredentialsFile: awcCliCredFile, AwsCliCredentialsFile: awcCliCredFile,
@ -343,11 +344,15 @@ func getJSONRules(val string) ([]byte, error) {
return nil, fmt.Errorf("coudln't read json file or its content is invalid") return nil, fmt.Errorf("coudln't read json file or its content is invalid")
} }
func getSessionRules(r string) ([]byte, error) { // getSessionRules reads json session rules.
// Returns true if rules must be skipped.
func getSessionRules(r string) ([]byte, bool, error) {
if r == "none" { if r == "none" {
return nil, nil return nil, true, nil
} }
return getJSONRules(r)
data, err := getJSONRules(r)
return data, false, err
} }
func obtainSecret() *cli.Command { func obtainSecret() *cli.Command {