2019-08-09 00:10:04 +02:00
|
|
|
/*
|
|
|
|
* MinIO Cloud Storage, (C) 2019 MinIO, Inc.
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package cmd
|
|
|
|
|
|
|
|
import (
|
2019-11-01 23:53:16 +01:00
|
|
|
"bytes"
|
2019-08-09 00:10:04 +02:00
|
|
|
"context"
|
|
|
|
"encoding/json"
|
|
|
|
"errors"
|
|
|
|
"path"
|
|
|
|
"strings"
|
|
|
|
"sync"
|
|
|
|
"time"
|
2020-07-18 02:41:29 +02:00
|
|
|
"unicode/utf8"
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2020-03-17 18:36:13 +01:00
|
|
|
jwtgo "github.com/dgrijalva/jwt-go"
|
2020-07-14 18:38:05 +02:00
|
|
|
"github.com/minio/minio-go/v7/pkg/set"
|
2019-08-09 00:10:04 +02:00
|
|
|
"github.com/minio/minio/cmd/logger"
|
|
|
|
"github.com/minio/minio/pkg/auth"
|
|
|
|
iampolicy "github.com/minio/minio/pkg/iam/policy"
|
2019-11-01 23:53:16 +01:00
|
|
|
"github.com/minio/minio/pkg/madmin"
|
2020-12-03 20:35:18 +01:00
|
|
|
etcd "go.etcd.io/etcd/clientv3"
|
|
|
|
"go.etcd.io/etcd/mvcc/mvccpb"
|
2019-08-09 00:10:04 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
var defaultContextTimeout = 30 * time.Second
|
|
|
|
|
|
|
|
func etcdKvsToSet(prefix string, kvs []*mvccpb.KeyValue) set.StringSet {
|
|
|
|
users := set.NewStringSet()
|
|
|
|
for _, kv := range kvs {
|
2021-03-05 17:36:16 +01:00
|
|
|
user := extractPathPrefixAndSuffix(string(kv.Key), prefix, path.Base(string(kv.Key)))
|
2019-08-09 00:10:04 +02:00
|
|
|
users.Add(user)
|
|
|
|
}
|
|
|
|
return users
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
// Extract path string by stripping off the `prefix` value and the suffix,
|
|
|
|
// value, usually in the following form.
|
|
|
|
// s := "config/iam/users/foo/config.json"
|
|
|
|
// prefix := "config/iam/users/"
|
|
|
|
// suffix := "config.json"
|
|
|
|
// result is foo
|
|
|
|
func extractPathPrefixAndSuffix(s string, prefix string, suffix string) string {
|
|
|
|
return path.Clean(strings.TrimSuffix(strings.TrimPrefix(string(s), prefix), suffix))
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// IAMEtcdStore implements IAMStorageAPI
|
|
|
|
type IAMEtcdStore struct {
|
|
|
|
sync.RWMutex
|
2020-04-07 23:26:39 +02:00
|
|
|
|
2019-08-09 00:10:04 +02:00
|
|
|
client *etcd.Client
|
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func newIAMEtcdStore() *IAMEtcdStore {
|
|
|
|
return &IAMEtcdStore{client: globalEtcdClient}
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) lock() {
|
2019-08-09 00:10:04 +02:00
|
|
|
ies.Lock()
|
2020-04-07 23:26:39 +02:00
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) unlock() {
|
|
|
|
ies.Unlock()
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) rlock() {
|
|
|
|
ies.RLock()
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) runlock() {
|
|
|
|
ies.RUnlock()
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-11-04 22:06:05 +01:00
|
|
|
func (ies *IAMEtcdStore) saveIAMConfig(ctx context.Context, item interface{}, path string, opts ...options) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
data, err := json.Marshal(item)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-11-01 23:53:16 +01:00
|
|
|
if globalConfigEncrypted {
|
|
|
|
data, err = madmin.EncryptData(globalActiveCred.String(), data)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2020-11-04 22:06:05 +01:00
|
|
|
return saveKeyEtcd(ctx, ies.client, path, data, opts...)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func getIAMConfig(item interface{}, value []byte) error {
|
|
|
|
conf := value
|
|
|
|
var err error
|
|
|
|
if globalConfigEncrypted && !utf8.Valid(value) {
|
|
|
|
conf, err = madmin.DecryptData(globalActiveCred.String(), bytes.NewReader(conf))
|
2019-11-01 23:53:16 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2021-03-05 17:36:16 +01:00
|
|
|
return json.Unmarshal(conf, item)
|
|
|
|
}
|
2019-11-01 23:53:16 +01:00
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func (ies *IAMEtcdStore) loadIAMConfig(ctx context.Context, item interface{}, path string) error {
|
|
|
|
pdata, err := readKeyEtcd(ctx, ies.client, path)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return getIAMConfig(item, pdata)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) deleteIAMConfig(ctx context.Context, path string) error {
|
|
|
|
return deleteKeyEtcd(ctx, ies.client, path)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) migrateUsersConfigToV1(ctx context.Context, isSTS bool) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
basePrefix := iamConfigUsersPrefix
|
|
|
|
if isSTS {
|
|
|
|
basePrefix = iamConfigSTSPrefix
|
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
ctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
|
2019-08-09 00:10:04 +02:00
|
|
|
defer cancel()
|
|
|
|
r, err := ies.client.Get(ctx, basePrefix, etcd.WithPrefix(), etcd.WithKeysOnly())
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
users := etcdKvsToSet(basePrefix, r.Kvs)
|
|
|
|
for _, user := range users.ToSlice() {
|
|
|
|
{
|
|
|
|
// 1. check if there is a policy file in the old loc.
|
|
|
|
oldPolicyPath := pathJoin(basePrefix, user, iamPolicyFile)
|
|
|
|
var policyName string
|
2020-10-19 18:54:40 +02:00
|
|
|
err := ies.loadIAMConfig(ctx, &policyName, oldPolicyPath)
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
|
|
|
switch err {
|
|
|
|
case errConfigNotFound:
|
|
|
|
// No mapped policy or already migrated.
|
|
|
|
default:
|
|
|
|
// corrupt data/read error, etc
|
|
|
|
}
|
|
|
|
goto next
|
|
|
|
}
|
|
|
|
|
|
|
|
// 2. copy policy to new loc.
|
|
|
|
mp := newMappedPolicy(policyName)
|
2020-03-17 18:36:13 +01:00
|
|
|
userType := regularUser
|
|
|
|
if isSTS {
|
|
|
|
userType = stsUser
|
|
|
|
}
|
|
|
|
path := getMappedPolicyPath(user, userType, false)
|
2020-10-19 18:54:40 +02:00
|
|
|
if err := ies.saveIAMConfig(ctx, mp, path); err != nil {
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// 3. delete policy file in old loc.
|
|
|
|
deleteKeyEtcd(ctx, ies.client, oldPolicyPath)
|
|
|
|
}
|
|
|
|
|
|
|
|
next:
|
|
|
|
// 4. check if user identity has old format.
|
|
|
|
identityPath := pathJoin(basePrefix, user, iamIdentityFile)
|
|
|
|
var cred auth.Credentials
|
2020-10-19 18:54:40 +02:00
|
|
|
if err := ies.loadIAMConfig(ctx, &cred, identityPath); err != nil {
|
2019-08-09 00:10:04 +02:00
|
|
|
switch err {
|
|
|
|
case errConfigNotFound:
|
|
|
|
// This case should not happen.
|
|
|
|
default:
|
|
|
|
// corrupt file or read error
|
|
|
|
}
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// If the file is already in the new format,
|
|
|
|
// then the parsed auth.Credentials will have
|
|
|
|
// the zero value for the struct.
|
|
|
|
var zeroCred auth.Credentials
|
2020-05-20 20:33:35 +02:00
|
|
|
if cred.Equal(zeroCred) {
|
2019-08-09 00:10:04 +02:00
|
|
|
// nothing to do
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Found a id file in old format. Copy value
|
|
|
|
// into new format and save it.
|
|
|
|
cred.AccessKey = user
|
|
|
|
u := newUserIdentity(cred)
|
2020-10-19 18:54:40 +02:00
|
|
|
if err := ies.saveIAMConfig(ctx, u, identityPath); err != nil {
|
2020-04-07 23:26:39 +02:00
|
|
|
logger.LogIf(ctx, err)
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Nothing to delete as identity file location
|
|
|
|
// has not changed.
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) migrateToV1(ctx context.Context) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
var iamFmt iamFormat
|
|
|
|
path := getIAMFormatFilePath()
|
2020-10-19 18:54:40 +02:00
|
|
|
if err := ies.loadIAMConfig(ctx, &iamFmt, path); err != nil {
|
2019-08-09 00:10:04 +02:00
|
|
|
switch err {
|
|
|
|
case errConfigNotFound:
|
|
|
|
// Need to migrate to V1.
|
|
|
|
default:
|
2019-08-30 19:41:02 +02:00
|
|
|
return err
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
if iamFmt.Version >= iamFormatVersion1 {
|
|
|
|
// Already migrated to V1 of higher!
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
// This case should not happen
|
|
|
|
// (i.e. Version is 0 or negative.)
|
|
|
|
return errors.New("got an invalid IAM format version")
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
// Migrate long-term users
|
2020-04-07 23:26:39 +02:00
|
|
|
if err := ies.migrateUsersConfigToV1(ctx, false); err != nil {
|
|
|
|
logger.LogIf(ctx, err)
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
// Migrate STS users
|
2020-04-07 23:26:39 +02:00
|
|
|
if err := ies.migrateUsersConfigToV1(ctx, true); err != nil {
|
|
|
|
logger.LogIf(ctx, err)
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
// Save iam version file.
|
2020-10-19 18:54:40 +02:00
|
|
|
if err := ies.saveIAMConfig(ctx, newIAMFormatVersion1(), path); err != nil {
|
2020-04-07 23:26:39 +02:00
|
|
|
logger.LogIf(ctx, err)
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Should be called under config migration lock
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) migrateBackendFormat(ctx context.Context) error {
|
|
|
|
return ies.migrateToV1(ctx)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) loadPolicyDoc(ctx context.Context, policy string, m map[string]iampolicy.Policy) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
var p iampolicy.Policy
|
2020-10-19 18:54:40 +02:00
|
|
|
err := ies.loadIAMConfig(ctx, &p, getPolicyDocPath(policy))
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
2021-01-26 05:01:49 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchPolicy
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
m[policy] = p
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func (ies *IAMEtcdStore) getPolicyDoc(ctx context.Context, kvs *mvccpb.KeyValue, m map[string]iampolicy.Policy) error {
|
|
|
|
var p iampolicy.Policy
|
|
|
|
err := getIAMConfig(&p, kvs.Value)
|
|
|
|
if err != nil {
|
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchPolicy
|
|
|
|
}
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
policy := extractPathPrefixAndSuffix(string(kvs.Key), iamConfigPoliciesPrefix, path.Base(string(kvs.Key)))
|
|
|
|
m[policy] = p
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) loadPolicyDocs(ctx context.Context, m map[string]iampolicy.Policy) error {
|
|
|
|
ctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
|
2019-08-09 00:10:04 +02:00
|
|
|
defer cancel()
|
2021-03-05 17:36:16 +01:00
|
|
|
// Retrieve all keys and values to avoid too many calls to etcd in case of
|
|
|
|
// a large number of policies
|
|
|
|
r, err := ies.client.Get(ctx, iamConfigPoliciesPrefix, etcd.WithPrefix())
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
// Parse all values to construct the policies data model.
|
|
|
|
for _, kvs := range r.Kvs {
|
|
|
|
if err = ies.getPolicyDoc(ctx, kvs, m); err != nil && err != errNoSuchPolicy {
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func (ies *IAMEtcdStore) getUser(ctx context.Context, userkv *mvccpb.KeyValue, userType IAMUserType, m map[string]auth.Credentials, basePrefix string) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
var u UserIdentity
|
2021-03-05 17:36:16 +01:00
|
|
|
err := getIAMConfig(&u, userkv.Value)
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchUser
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
2021-03-05 17:36:16 +01:00
|
|
|
user := extractPathPrefixAndSuffix(string(userkv.Key), basePrefix, path.Base(string(userkv.Key)))
|
|
|
|
return ies.addUser(ctx, user, userType, u, m)
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func (ies *IAMEtcdStore) addUser(ctx context.Context, user string, userType IAMUserType, u UserIdentity, m map[string]auth.Credentials) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
if u.Credentials.IsExpired() {
|
|
|
|
// Delete expired identity.
|
2020-10-19 18:54:40 +02:00
|
|
|
deleteKeyEtcd(ctx, ies.client, getUserIdentityPath(user, userType))
|
|
|
|
deleteKeyEtcd(ctx, ies.client, getMappedPolicyPath(user, userType, false))
|
2019-08-09 00:10:04 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-03-17 18:36:13 +01:00
|
|
|
// If this is a service account, rotate the session key if we are changing the server creds
|
|
|
|
if globalOldCred.IsValid() && u.Credentials.IsServiceAccount() {
|
|
|
|
if !globalOldCred.Equal(globalActiveCred) {
|
|
|
|
m := jwtgo.MapClaims{}
|
|
|
|
stsTokenCallback := func(t *jwtgo.Token) (interface{}, error) {
|
|
|
|
return []byte(globalOldCred.SecretKey), nil
|
|
|
|
}
|
|
|
|
if _, err := jwtgo.ParseWithClaims(u.Credentials.SessionToken, m, stsTokenCallback); err == nil {
|
|
|
|
jwt := jwtgo.NewWithClaims(jwtgo.SigningMethodHS512, jwtgo.MapClaims(m))
|
|
|
|
if token, err := jwt.SignedString([]byte(globalActiveCred.SecretKey)); err == nil {
|
|
|
|
u.Credentials.SessionToken = token
|
2020-10-19 18:54:40 +02:00
|
|
|
err := ies.saveIAMConfig(ctx, &u, getUserIdentityPath(user, userType))
|
2020-03-17 18:36:13 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-08-09 00:10:04 +02:00
|
|
|
if u.Credentials.AccessKey == "" {
|
|
|
|
u.Credentials.AccessKey = user
|
|
|
|
}
|
|
|
|
m[user] = u.Credentials
|
|
|
|
return nil
|
2021-03-05 17:36:16 +01:00
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func (ies *IAMEtcdStore) loadUser(ctx context.Context, user string, userType IAMUserType, m map[string]auth.Credentials) error {
|
|
|
|
var u UserIdentity
|
|
|
|
err := ies.loadIAMConfig(ctx, &u, getUserIdentityPath(user, userType))
|
|
|
|
if err != nil {
|
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchUser
|
|
|
|
}
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return ies.addUser(ctx, user, userType, u, m)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) loadUsers(ctx context.Context, userType IAMUserType, m map[string]auth.Credentials) error {
|
2020-03-17 18:36:13 +01:00
|
|
|
var basePrefix string
|
|
|
|
switch userType {
|
|
|
|
case srvAccUser:
|
|
|
|
basePrefix = iamConfigServiceAccountsPrefix
|
|
|
|
case stsUser:
|
2019-08-09 00:10:04 +02:00
|
|
|
basePrefix = iamConfigSTSPrefix
|
2020-03-17 18:36:13 +01:00
|
|
|
default:
|
|
|
|
basePrefix = iamConfigUsersPrefix
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
cctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
|
2019-08-09 00:10:04 +02:00
|
|
|
defer cancel()
|
2020-10-19 18:54:40 +02:00
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
// Retrieve all keys and values to avoid too many calls to etcd in case of
|
|
|
|
// a large number of users
|
|
|
|
r, err := ies.client.Get(cctx, basePrefix, etcd.WithPrefix())
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
// Parse all users values to create the proper data model
|
|
|
|
for _, userKv := range r.Kvs {
|
|
|
|
if err = ies.getUser(ctx, userKv, userType, m, basePrefix); err != nil && err != errNoSuchUser {
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) loadGroup(ctx context.Context, group string, m map[string]GroupInfo) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
var gi GroupInfo
|
2020-10-19 18:54:40 +02:00
|
|
|
err := ies.loadIAMConfig(ctx, &gi, getGroupInfoPath(group))
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchGroup
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
m[group] = gi
|
|
|
|
return nil
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) loadGroups(ctx context.Context, m map[string]GroupInfo) error {
|
2020-10-19 18:54:40 +02:00
|
|
|
cctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
|
2019-08-09 00:10:04 +02:00
|
|
|
defer cancel()
|
2020-10-19 18:54:40 +02:00
|
|
|
|
|
|
|
r, err := ies.client.Get(cctx, iamConfigGroupsPrefix, etcd.WithPrefix(), etcd.WithKeysOnly())
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
groups := etcdKvsToSet(iamConfigGroupsPrefix, r.Kvs)
|
|
|
|
|
|
|
|
// Reload config for all groups.
|
|
|
|
for _, group := range groups.ToSlice() {
|
2021-01-26 05:01:49 +01:00
|
|
|
if err = ies.loadGroup(ctx, group, m); err != nil && err != errNoSuchGroup {
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) loadMappedPolicy(ctx context.Context, name string, userType IAMUserType, isGroup bool, m map[string]MappedPolicy) error {
|
2019-08-09 00:10:04 +02:00
|
|
|
var p MappedPolicy
|
2020-10-19 18:54:40 +02:00
|
|
|
err := ies.loadIAMConfig(ctx, &p, getMappedPolicyPath(name, userType, isGroup))
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchPolicy
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
m[name] = p
|
|
|
|
return nil
|
2021-03-05 17:36:16 +01:00
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
func getMappedPolicy(ctx context.Context, kv *mvccpb.KeyValue, userType IAMUserType, isGroup bool, m map[string]MappedPolicy, basePrefix string) error {
|
|
|
|
var p MappedPolicy
|
|
|
|
err := getIAMConfig(&p, kv.Value)
|
|
|
|
if err != nil {
|
|
|
|
if err == errConfigNotFound {
|
|
|
|
return errNoSuchPolicy
|
|
|
|
}
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
name := extractPathPrefixAndSuffix(string(kv.Key), basePrefix, ".json")
|
|
|
|
m[name] = p
|
|
|
|
return nil
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) loadMappedPolicies(ctx context.Context, userType IAMUserType, isGroup bool, m map[string]MappedPolicy) error {
|
2020-10-19 18:54:40 +02:00
|
|
|
cctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
|
2019-08-09 00:10:04 +02:00
|
|
|
defer cancel()
|
|
|
|
var basePrefix string
|
2020-03-17 18:36:13 +01:00
|
|
|
if isGroup {
|
2019-08-09 00:10:04 +02:00
|
|
|
basePrefix = iamConfigPolicyDBGroupsPrefix
|
2020-03-17 18:36:13 +01:00
|
|
|
} else {
|
|
|
|
switch userType {
|
|
|
|
case srvAccUser:
|
|
|
|
basePrefix = iamConfigPolicyDBServiceAccountsPrefix
|
|
|
|
case stsUser:
|
|
|
|
basePrefix = iamConfigPolicyDBSTSUsersPrefix
|
|
|
|
default:
|
|
|
|
basePrefix = iamConfigPolicyDBUsersPrefix
|
|
|
|
}
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
2021-03-05 17:36:16 +01:00
|
|
|
// Retrieve all keys and values to avoid too many calls to etcd in case of
|
|
|
|
// a large number of policy mappings
|
|
|
|
r, err := ies.client.Get(cctx, basePrefix, etcd.WithPrefix())
|
2019-08-09 00:10:04 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-03-05 17:36:16 +01:00
|
|
|
// Parse all policies mapping to create the proper data model
|
|
|
|
for _, kv := range r.Kvs {
|
|
|
|
if err = getMappedPolicy(ctx, kv, userType, isGroup, m, basePrefix); err != nil && err != errNoSuchPolicy {
|
2019-08-09 00:10:04 +02:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) loadAll(ctx context.Context, sys *IAMSys) error {
|
2021-01-26 05:01:49 +01:00
|
|
|
return sys.Load(ctx, ies)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) savePolicyDoc(ctx context.Context, policyName string, p iampolicy.Policy) error {
|
|
|
|
return ies.saveIAMConfig(ctx, &p, getPolicyDocPath(policyName))
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-11-04 22:06:05 +01:00
|
|
|
func (ies *IAMEtcdStore) saveMappedPolicy(ctx context.Context, name string, userType IAMUserType, isGroup bool, mp MappedPolicy, opts ...options) error {
|
|
|
|
return ies.saveIAMConfig(ctx, mp, getMappedPolicyPath(name, userType, isGroup), opts...)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-11-04 22:06:05 +01:00
|
|
|
func (ies *IAMEtcdStore) saveUserIdentity(ctx context.Context, name string, userType IAMUserType, u UserIdentity, opts ...options) error {
|
|
|
|
return ies.saveIAMConfig(ctx, u, getUserIdentityPath(name, userType), opts...)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) saveGroupInfo(ctx context.Context, name string, gi GroupInfo) error {
|
|
|
|
return ies.saveIAMConfig(ctx, gi, getGroupInfoPath(name))
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) deletePolicyDoc(ctx context.Context, name string) error {
|
|
|
|
err := ies.deleteIAMConfig(ctx, getPolicyDocPath(name))
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
err = errNoSuchPolicy
|
|
|
|
}
|
|
|
|
return err
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) deleteMappedPolicy(ctx context.Context, name string, userType IAMUserType, isGroup bool) error {
|
|
|
|
err := ies.deleteIAMConfig(ctx, getMappedPolicyPath(name, userType, isGroup))
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
err = errNoSuchPolicy
|
|
|
|
}
|
|
|
|
return err
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) deleteUserIdentity(ctx context.Context, name string, userType IAMUserType) error {
|
|
|
|
err := ies.deleteIAMConfig(ctx, getUserIdentityPath(name, userType))
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
err = errNoSuchUser
|
|
|
|
}
|
|
|
|
return err
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
func (ies *IAMEtcdStore) deleteGroupInfo(ctx context.Context, name string) error {
|
|
|
|
err := ies.deleteIAMConfig(ctx, getGroupInfoPath(name))
|
2019-10-30 03:50:26 +01:00
|
|
|
if err == errConfigNotFound {
|
|
|
|
err = errNoSuchGroup
|
|
|
|
}
|
|
|
|
return err
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
|
2020-04-07 23:26:39 +02:00
|
|
|
func (ies *IAMEtcdStore) watch(ctx context.Context, sys *IAMSys) {
|
2020-04-09 04:00:39 +02:00
|
|
|
for {
|
|
|
|
outerLoop:
|
|
|
|
// Refresh IAMSys with etcd watch.
|
|
|
|
watchCh := ies.client.Watch(ctx,
|
|
|
|
iamConfigPrefix, etcd.WithPrefix(), etcd.WithKeysOnly())
|
|
|
|
|
2019-08-09 00:10:04 +02:00
|
|
|
for {
|
2020-04-09 04:00:39 +02:00
|
|
|
select {
|
|
|
|
case <-ctx.Done():
|
|
|
|
return
|
|
|
|
case watchResp, ok := <-watchCh:
|
|
|
|
if !ok {
|
|
|
|
time.Sleep(1 * time.Second)
|
|
|
|
// Upon an error on watch channel
|
|
|
|
// re-init the watch channel.
|
|
|
|
goto outerLoop
|
|
|
|
}
|
|
|
|
if err := watchResp.Err(); err != nil {
|
|
|
|
logger.LogIf(ctx, err)
|
|
|
|
// log and retry.
|
|
|
|
time.Sleep(1 * time.Second)
|
|
|
|
// Upon an error on watch channel
|
|
|
|
// re-init the watch channel.
|
|
|
|
goto outerLoop
|
|
|
|
}
|
|
|
|
for _, event := range watchResp.Events {
|
|
|
|
ies.lock()
|
|
|
|
ies.reloadFromEvent(sys, event)
|
|
|
|
ies.unlock()
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// sys.RLock is held by caller.
|
|
|
|
func (ies *IAMEtcdStore) reloadFromEvent(sys *IAMSys, event *etcd.Event) {
|
|
|
|
eventCreate := event.IsModify() || event.IsCreate()
|
|
|
|
eventDelete := event.Type == etcd.EventTypeDelete
|
|
|
|
usersPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigUsersPrefix)
|
|
|
|
groupsPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigGroupsPrefix)
|
|
|
|
stsPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigSTSPrefix)
|
2021-01-26 05:01:49 +01:00
|
|
|
svcPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigServiceAccountsPrefix)
|
2019-08-09 00:10:04 +02:00
|
|
|
policyPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigPoliciesPrefix)
|
|
|
|
policyDBUsersPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigPolicyDBUsersPrefix)
|
|
|
|
policyDBSTSUsersPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigPolicyDBSTSUsersPrefix)
|
2019-08-13 22:41:06 +02:00
|
|
|
policyDBGroupsPrefix := strings.HasPrefix(string(event.Kv.Key), iamConfigPolicyDBGroupsPrefix)
|
2019-08-09 00:10:04 +02:00
|
|
|
|
2020-10-19 18:54:40 +02:00
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), defaultContextTimeout)
|
|
|
|
defer cancel()
|
|
|
|
|
2019-08-09 00:10:04 +02:00
|
|
|
switch {
|
|
|
|
case eventCreate:
|
|
|
|
switch {
|
|
|
|
case usersPrefix:
|
|
|
|
accessKey := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigUsersPrefix))
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadUser(ctx, accessKey, regularUser, sys.iamUsersMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
case stsPrefix:
|
|
|
|
accessKey := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigSTSPrefix))
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadUser(ctx, accessKey, stsUser, sys.iamUsersMap)
|
2021-01-26 05:01:49 +01:00
|
|
|
case svcPrefix:
|
|
|
|
accessKey := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigServiceAccountsPrefix))
|
|
|
|
ies.loadUser(ctx, accessKey, srvAccUser, sys.iamUsersMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
case groupsPrefix:
|
|
|
|
group := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigGroupsPrefix))
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadGroup(ctx, group, sys.iamGroupsMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
gi := sys.iamGroupsMap[group]
|
|
|
|
sys.removeGroupFromMembershipsMap(group)
|
|
|
|
sys.updateGroupMembershipsMap(group, &gi)
|
|
|
|
case policyPrefix:
|
|
|
|
policyName := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPoliciesPrefix))
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadPolicyDoc(ctx, policyName, sys.iamPolicyDocsMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
case policyDBUsersPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBUsersPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadMappedPolicy(ctx, user, regularUser, false, sys.iamUserPolicyMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
case policyDBSTSUsersPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBSTSUsersPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadMappedPolicy(ctx, user, stsUser, false, sys.iamUserPolicyMap)
|
2019-08-13 22:41:06 +02:00
|
|
|
case policyDBGroupsPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBGroupsPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
2020-10-19 18:54:40 +02:00
|
|
|
ies.loadMappedPolicy(ctx, user, regularUser, true, sys.iamGroupPolicyMap)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
case eventDelete:
|
|
|
|
switch {
|
|
|
|
case usersPrefix:
|
|
|
|
accessKey := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigUsersPrefix))
|
|
|
|
delete(sys.iamUsersMap, accessKey)
|
|
|
|
case stsPrefix:
|
|
|
|
accessKey := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigSTSPrefix))
|
|
|
|
delete(sys.iamUsersMap, accessKey)
|
|
|
|
case groupsPrefix:
|
|
|
|
group := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigGroupsPrefix))
|
|
|
|
sys.removeGroupFromMembershipsMap(group)
|
|
|
|
delete(sys.iamGroupsMap, group)
|
|
|
|
delete(sys.iamGroupPolicyMap, group)
|
|
|
|
case policyPrefix:
|
|
|
|
policyName := path.Dir(strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPoliciesPrefix))
|
|
|
|
delete(sys.iamPolicyDocsMap, policyName)
|
|
|
|
case policyDBUsersPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBUsersPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
|
|
|
delete(sys.iamUserPolicyMap, user)
|
|
|
|
case policyDBSTSUsersPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBSTSUsersPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
|
|
|
delete(sys.iamUserPolicyMap, user)
|
2019-08-13 22:41:06 +02:00
|
|
|
case policyDBGroupsPrefix:
|
|
|
|
policyMapFile := strings.TrimPrefix(string(event.Kv.Key),
|
|
|
|
iamConfigPolicyDBGroupsPrefix)
|
|
|
|
user := strings.TrimSuffix(policyMapFile, ".json")
|
|
|
|
delete(sys.iamGroupPolicyMap, user)
|
2019-08-09 00:10:04 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|