opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-01 15:07:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: keystoen cronman use uninitialized admin token (#14439)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2022-06-13 00:00:24 +08:00
committed by GitHub
parent 6aa32e5bf5
commit f6c4bb7f21
7 changed files with 33 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/cronman/cronman.go
+10 -11
View File
@@ -22,9 +22,8 @@ import (
"sync"
"time"
"github.com/pkg/errors"
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
"yunion.io/x/onecloud/pkg/appctx"
"yunion.io/x/onecloud/pkg/appsrv"
@@ -35,7 +34,7 @@ import (
var (
DefaultAdminSessionGenerator = auth.AdminCredential
ErrCronJobNameConflict = errors.New("Cron job Name Conflict")
ErrCronJobNameConflict = errors.Error("Cron job Name Conflict")
)
type TCronJobFunction func(ctx context.Context, userCred mcclient.TokenCredential, isStart bool)
@@ -164,7 +163,7 @@ func (self *SCronJobManager) AddJobAtIntervals(name string, interval time.Durati
func (self *SCronJobManager) AddJobAtIntervalsWithStartRun(name string, interval time.Duration, jobFunc TCronJobFunction, startRun bool) error {
if interval <= 0 {
return errors.New("AddJobAtIntervals: interval must > 0")
return errors.Error("AddJobAtIntervals: interval must > 0")
}
self.dataLock.Lock()
defer self.dataLock.Unlock()
@@ -193,13 +192,13 @@ func (self *SCronJobManager) AddJobAtIntervalsWithStartRun(name string, interval
func (self *SCronJobManager) AddJobEveryFewDays(name string, day, hour, min, sec int, jobFunc TCronJobFunction, startRun bool) error {
switch {
case day <= 0:
return errors.New("AddJobEveryFewDays: day must > 0")
return errors.Error("AddJobEveryFewDays: day must > 0")
case hour < 0:
return errors.New("AddJobEveryFewDays: hour must > 0")
return errors.Error("AddJobEveryFewDays: hour must > 0")
case min < 0:
return errors.New("AddJobEveryFewDays: min must > 0")
return errors.Error("AddJobEveryFewDays: min must > 0")
case sec < 0:
return errors.New("AddJobEveryFewDays: sec must > 0")
return errors.Error("AddJobEveryFewDays: sec must > 0")
}
self.dataLock.Lock()
@@ -232,11 +231,11 @@ func (self *SCronJobManager) AddJobEveryFewDays(name string, day, hour, min, sec
func (self *SCronJobManager) AddJobEveryFewHour(name string, hour, min, sec int, jobFunc TCronJobFunction, startRun bool) error {
switch {
case hour <= 0:
return errors.New("AddJobEveryFewHour: hour must > 0")
return errors.Error("AddJobEveryFewHour: hour must > 0")
case min < 0:
return errors.New("AddJobEveryFewHour: min must > 0")
return errors.Error("AddJobEveryFewHour: min must > 0")
case sec < 0:
return errors.New("AddJobEveryFewHour: sec must > 0")
return errors.Error("AddJobEveryFewHour: sec must > 0")
}
self.dataLock.Lock()
pkg/keystone/cronjobs/project_resources.go
+1 -1
View File
@@ -95,7 +95,7 @@ func refreshScopeResourceCount(ctx context.Context) error {
url = ep.external
}
url = httputils.JoinPath(url, "scope-resources")
tk, _ := tokens.GetDefaultToken()
tk := tokens.GetDefaultToken()
hdr := http.Header{}
hdr.Add("X-Auth-Token", tk)
_, ret, err := httputils.JSONRequest(
pkg/keystone/models/default_admin.go
-4
View File
@@ -53,10 +53,6 @@ func GetDefaultAdminCred() mcclient.TokenCredential {
return defaultAdminCred
}
func GetDefaultAdminSSimpleToken() *mcclient.SSimpleToken {
return getDefaultAdminCred()
}
func getDefaultAdminCred() *mcclient.SSimpleToken {
token := mcclient.SSimpleToken{}
usr, _ := UserManager.FetchUserExtended("", api.SystemAdminUser, api.DEFAULT_DOMAIN_ID, "")
pkg/keystone/service/service.go
+1 -1
View File
@@ -51,7 +51,7 @@ func StartService() {
db.DefaultProjectsFetcher = keystoneProjectsFetcher
policy.DefaultPolicyFetcher = localPolicyFetcher
logclient.DefaultSessionGenerator = models.GetDefaultClientSession
cronman.DefaultAdminSessionGenerator = models.GetDefaultAdminCred
cronman.DefaultAdminSessionGenerator = tokens.GetDefaultAdminCredToken
notifyclient.AdminSessionGenerator = util.GetDefaulAdminSession
notifyclient.UserLangFetcher = models.GetUserLangForKeyStone
pkg/keystone/tokens/auth.go
+2 -3
View File
@@ -73,9 +73,8 @@ func authUserByIdentity(ctx context.Context, ident mcclient.SAuthenticationIdent
ident.Password.User.Password = "***"
log.Errorf("authenticate fail for %s reason: %s", jsonutils.Marshal(ident), err)
user := logclient.NewSimpleObject(ident.Password.User.Id, ident.Password.User.Name, "user")
token := models.GetDefaultAdminSSimpleToken()
token.Token, _ = GetDefaultToken()
token.Context = authCtx
token := GetDefaultAdminCredToken()
token.(*mcclient.SSimpleToken).Context = authCtx
logclient.AddActionLogWithContext(ctx, user, logclient.ACT_AUTHENTICATE, err, token, false)
}
return usr, err
pkg/keystone/tokens/token.go
+18 -3
View File
@@ -19,6 +19,7 @@ import (
"strings"
"time"
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
"yunion.io/x/pkg/utils"
@@ -31,10 +32,11 @@ import (
)
var (
defaultAuthToken *SAuthToken
defaultAuthToken *SAuthToken
defaultAuthTokenStr string
)
func GetDefaultToken() (string, error) {
func GetDefaultToken() string {
now := time.Now()
if defaultAuthToken == nil || defaultAuthToken.ExpiresAt.Sub(now) < time.Duration(3600) {
simpleToken := models.GetDefaultAdminCred()
@@ -45,8 +47,21 @@ func GetDefaultToken() (string, error) {
ExpiresAt: now.Add(time.Duration(options.Options.TokenExpirationSeconds) * time.Second),
AuditIds: []string{utils.GenRequestId(16)},
}
var err error
defaultAuthTokenStr, err = defaultAuthToken.EncodeFernetToken()
if err != nil {
log.Fatalf("defaultAuthToken.EncodeFernetToken fail: %s", err)
}
if simpleToken.(*mcclient.SSimpleToken).Token != defaultAuthTokenStr {
simpleToken.(*mcclient.SSimpleToken).Token = defaultAuthTokenStr
}
}
return defaultAuthToken.EncodeFernetToken()
return defaultAuthTokenStr
}
func GetDefaultAdminCredToken() mcclient.TokenCredential {
GetDefaultToken()
return models.GetDefaultAdminCred()
}
type SAuthToken struct {
pkg/keystone/util/session.go
+1 -36
View File
@@ -16,47 +16,12 @@ package util
import (
"context"
"time"
"yunion.io/x/pkg/utils"
api "yunion.io/x/onecloud/pkg/apis/identity"
"yunion.io/x/onecloud/pkg/keystone/models"
"yunion.io/x/onecloud/pkg/keystone/tokens"
"yunion.io/x/onecloud/pkg/mcclient"
)
var (
authToken *tokens.SAuthToken
simpleToken *mcclient.SSimpleToken
)
func getDefaultAdminCredWithToken() (mcclient.TokenCredential, error) {
if simpleToken == nil {
simpleToken = models.GetDefaultAdminSSimpleToken()
}
var err error
if now := time.Now(); authToken == nil || authToken.ExpiresAt.Sub(now) < time.Duration(3600) {
authTokenTmp := &tokens.SAuthToken{
UserId: simpleToken.GetUserId(),
Method: api.AUTH_METHOD_TOKEN,
ProjectId: simpleToken.GetProjectId(),
ExpiresAt: now.Add(24 * time.Hour),
AuditIds: []string{utils.GenRequestId(16)},
}
simpleToken.Token, err = authTokenTmp.EncodeFernetToken()
if err != nil {
return nil, err
}
authToken = authTokenTmp
}
return simpleToken, nil
}
func GetDefaulAdminSession(ctx context.Context, region, apiVersion string) (*mcclient.ClientSession, error) {
cred, err := getDefaultAdminCredWithToken()
if err != nil {
return nil, err
}
return models.GetDefaultClientSession(ctx, cred, region, apiVersion), nil
return models.GetDefaultClientSession(ctx, tokens.GetDefaultAdminCredToken(), region, apiVersion), nil
}