mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-17 20:57:27 +00:00
Chris LuandGitHub
9d6a699b94
* feat(iam): claim-based policy mode for AssumeRoleWithWebIdentity When the caller passes the sentinel RoleArn arn:aws:iam:::role/sts-claim-based (or omits it entirely) and the matched OIDC provider has policyClaim set, mint a session whose effective policies come from that JWT claim instead of from a server-side role mapping. Accepts string, comma-separated string, or array shapes — MinIO-compatible behaviour for IDPs that already attach policies to the user. Trust-policy validation is skipped in claim-mode: the IDP is the sole authority for both authentication and authorization, mirroring the contract MinIO documents for its DummyRoleARN flow. Concrete-role mode is unchanged and still requires the role definition + trust policy. * fix(iam): trim policy-claim array elements + clean up stale comments Three medium-priority cleanups gemini flagged on the claim-based path: - extractClaimPolicies's array branch was leaving whitespace on each element while the string/comma-separated branch trimmed via splitPolicyClaimString. An IDP that emits ["readonly", " billing "] would create a "billing" policy lookup that didn't match the stored name. Trim every array element, drop empties. - The "synthetic ARN keyed on the session name" comment was wrong — effectiveRoleArn here is the literal sentinel; it's the assumed-role ARN generated downstream that's session-keyed. Reword. - The empty if/else block at the start of validateAssumeRoleWithWebIdentityRequest existed only to host a comment about deferred validation; the comment now lives in the function godoc and the empty branch is gone. Addresses three gemini medium reviews on PR #9322. * feat(iam): account-scoped OIDC providers Add OIDCProviderRecord.AccountID enforcement: when a role lives in account A, the OIDC provider validating the assume-role token must be either global (AccountID="") or also live in account A. Cross-account use is rejected at the IAM-manager layer before reaching the trust policy validator. OIDCProviderStore gains GetProviderByIssuerAndAccount; both the in- memory and filer-backed stores implement it. Static-config-only deployments are unaffected since they don't populate the store. * fix(iam): account-scoped lookup for cross-account check enforceProviderAccountScope was calling GetProviderByIssuer, which returns the first match arbitrarily when multiple providers share an issuer (one global + one per tenant is the canonical setup). On a two-record collision the wrong record could come back first and falsely reject a valid same-account or global-provider request. Use GetProviderByIssuerAndAccount as the primary lookup so the filter happens in the store. On miss, fall back to GetProviderByIssuer purely to distinguish "issuer entirely unknown" (let the STS layer reject) from "issuer registered in a different account" (surface a precise cross-account error). Addresses gemini high-priority review on PR #9323. * feat(iam): opt-in session revocation via JTI blocklist Add SessionRevocationStore (memory + filer implementations) and wire it into the IAMManager.IsActionAllowed path so a revoked session is rejected on the next signed request. Session JWTs now embed the session id as the JTI claim, giving the blocklist a stable key without requiring a second secret. Operators who don't configure a store keep the existing fully-stateless behaviour: every session stays valid until natural expiry. Operators who do configure one accept one filer lookup per signed request in exchange for being able to invalidate compromised tokens before expiry. Revocation entries carry the original session expiry so the blocklist self-trims via PurgeRevokedSessions. * fix(iam): hash JTI filenames + paginate Purge with proper EOF handling Three reviewer-flagged issues on the filer-backed revocation store: 1. Path traversal (security-medium): RevokeSession is exported and takes an arbitrary string. Using the JTI verbatim as a filename meant a caller could pass "../../etc/passwd" to write outside the basePath. SHA-1 hash the JTI to a fixed-width hex name; lookups still find the entry because Revoke and IsRevoked share the same hash function. 2. Purge swallowed errors. The inner `err` from stream.Recv() shadowed the outer err and the loop just broke on any failure, so a mid-stream gRPC error returned (count, nil) and the caller had no idea the purge was incomplete. Switch to errors.Is(io.EOF) for end-of-stream and propagate everything else. 3. Purge had a hardcoded 10000-entry cap. Stream-paginate via StartFromFileName so the operator-cron can clean a backlog larger than that without losing rows.
95 lines
2.8 KiB
Go
95 lines
2.8 KiB
Go
package integration
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestMemoryRevocationStoreCRUD(t *testing.T) {
|
|
ctx := context.Background()
|
|
store := NewMemorySessionRevocationStore()
|
|
|
|
if revoked, _ := store.IsRevoked(ctx, "", "abc"); revoked {
|
|
t.Fatal("empty store should report not revoked")
|
|
}
|
|
|
|
if err := store.Revoke(ctx, "", &RevocationEntry{JTI: "abc", ExpiresAt: time.Now().Add(time.Hour)}); err != nil {
|
|
t.Fatalf("revoke: %v", err)
|
|
}
|
|
if revoked, _ := store.IsRevoked(ctx, "", "abc"); !revoked {
|
|
t.Fatal("expected revoked")
|
|
}
|
|
// Different JTIs are independent.
|
|
if revoked, _ := store.IsRevoked(ctx, "", "xyz"); revoked {
|
|
t.Fatal("xyz should not be revoked")
|
|
}
|
|
}
|
|
|
|
func TestMemoryRevocationStoreRejectsBadInput(t *testing.T) {
|
|
store := NewMemorySessionRevocationStore()
|
|
if err := store.Revoke(context.Background(), "", nil); err == nil {
|
|
t.Fatal("expected error for nil entry")
|
|
}
|
|
if err := store.Revoke(context.Background(), "", &RevocationEntry{}); err == nil {
|
|
t.Fatal("expected error for empty JTI")
|
|
}
|
|
}
|
|
|
|
func TestMemoryRevocationStorePurge(t *testing.T) {
|
|
ctx := context.Background()
|
|
store := NewMemorySessionRevocationStore()
|
|
now := time.Now()
|
|
|
|
must := func(jti string, expiresAt time.Time) {
|
|
if err := store.Revoke(ctx, "", &RevocationEntry{JTI: jti, ExpiresAt: expiresAt}); err != nil {
|
|
t.Fatalf("revoke %s: %v", jti, err)
|
|
}
|
|
}
|
|
must("expired-1", now.Add(-2*time.Hour))
|
|
must("expired-2", now.Add(-time.Minute))
|
|
must("future-1", now.Add(time.Hour))
|
|
|
|
count, err := store.Purge(ctx, "", now)
|
|
if err != nil {
|
|
t.Fatalf("purge: %v", err)
|
|
}
|
|
if count != 2 {
|
|
t.Fatalf("expected 2 purged, got %d", count)
|
|
}
|
|
if revoked, _ := store.IsRevoked(ctx, "", "expired-1"); revoked {
|
|
t.Fatal("expired-1 should be gone")
|
|
}
|
|
if revoked, _ := store.IsRevoked(ctx, "", "future-1"); !revoked {
|
|
t.Fatal("future-1 should still be revoked")
|
|
}
|
|
}
|
|
|
|
func TestIAMManagerRevocationDefaultIsNoop(t *testing.T) {
|
|
mgr := NewIAMManager()
|
|
// Without SetSessionRevocationStore, revocation is a no-op.
|
|
if got, err := mgr.IsSessionRevoked(context.Background(), "anything"); err != nil || got {
|
|
t.Fatalf("expected (false, nil); got (%v, %v)", got, err)
|
|
}
|
|
if err := mgr.RevokeSession(context.Background(), "abc", time.Now().Add(time.Hour), "test"); err == nil {
|
|
t.Fatal("expected error when no store configured")
|
|
}
|
|
}
|
|
|
|
func TestIAMManagerRevocationFlow(t *testing.T) {
|
|
mgr := NewIAMManager()
|
|
mgr.SetSessionRevocationStore(NewMemorySessionRevocationStore())
|
|
|
|
jti := "session-1"
|
|
if err := mgr.RevokeSession(context.Background(), jti, time.Now().Add(time.Hour), "logout"); err != nil {
|
|
t.Fatalf("RevokeSession: %v", err)
|
|
}
|
|
revoked, err := mgr.IsSessionRevoked(context.Background(), jti)
|
|
if err != nil {
|
|
t.Fatalf("IsSessionRevoked: %v", err)
|
|
}
|
|
if !revoked {
|
|
t.Fatal("expected revoked")
|
|
}
|
|
}
|