opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-24 16:17:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Apply traits to Windows Desktop labels (#13991)

Browse Source 
It was noticed that this functionality has been missing.

Updates #5973
This commit is contained in:
Zac Bergquist
2022-06-30 17:55:20 +00:00
committed by GitHub
parent fa7d59adf0
commit 69fd10e9a5
2 changed files with 47 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/services/role.go
+6
View File
@@ -353,6 +353,12 @@ func ApplyTraits(r types.Role, traits map[string][]string) types.Role {
r.SetDatabaseLabels(condition, applyLabelsTraits(inLabels, traits))
}
// apply templates to windows desktop labels
inLabels = r.GetWindowsDesktopLabels(condition)
if inLabels != nil {
r.SetWindowsDesktopLabels(condition, applyLabelsTraits(inLabels, traits))
}
r.SetHostGroups(condition,
applyValueTraitsSlice(r.GetHostGroups(condition), traits, "host_groups"))
lib/services/role_test.go
+41 -26
View File
@@ -1828,32 +1828,34 @@ func TestCheckRuleSorting(t *testing.T) {
func TestApplyTraits(t *testing.T) {
type rule struct {
inLogins []string
outLogins []string
inWindowsLogins []string
outWindowsLogins []string
inRoleARNs []string
outRoleARNs []string
inLabels types.Labels
outLabels types.Labels
inKubeLabels types.Labels
outKubeLabels types.Labels
inKubeGroups []string
outKubeGroups []string
inKubeUsers []string
outKubeUsers []string
inAppLabels types.Labels
outAppLabels types.Labels
inDBLabels types.Labels
outDBLabels types.Labels
inDBNames []string
outDBNames []string
inDBUsers []string
outDBUsers []string
inImpersonate types.ImpersonateConditions
outImpersonate types.ImpersonateConditions
inSudoers []string
outSudoers []string
inLogins []string
outLogins []string
inWindowsLogins []string
outWindowsLogins []string
inRoleARNs []string
outRoleARNs []string
inLabels types.Labels
outLabels types.Labels
inKubeLabels types.Labels
outKubeLabels types.Labels
inKubeGroups []string
outKubeGroups []string
inKubeUsers []string
outKubeUsers []string
inAppLabels types.Labels
outAppLabels types.Labels
inDBLabels types.Labels
outDBLabels types.Labels
inWindowsDesktopLabels types.Labels
outWindowsDesktopLabels types.Labels
inDBNames []string
outDBNames []string
inDBUsers []string
outDBUsers []string
inImpersonate types.ImpersonateConditions
outImpersonate types.ImpersonateConditions
inSudoers []string
outSudoers []string
}
var tests = []struct {
comment string
@@ -2239,6 +2241,16 @@ func TestApplyTraits(t *testing.T) {
outDBLabels: types.Labels{`key`: []string{"bar", "baz"}},
},
},
{
comment: "values are expanded in windows desktop labels",
inTraits: map[string][]string{
"foo": {"bar", "baz"},
},
allow: rule{
inWindowsDesktopLabels: types.Labels{`key`: []string{`{{external.foo}}`}},
outWindowsDesktopLabels: types.Labels{`key`: []string{"bar", "baz"}},
},
},
{
comment: "impersonate roles",
inTraits: map[string][]string{
@@ -2323,6 +2335,7 @@ func TestApplyTraits(t *testing.T) {
DatabaseLabels: tt.allow.inDBLabels,
DatabaseNames: tt.allow.inDBNames,
DatabaseUsers: tt.allow.inDBUsers,
WindowsDesktopLabels: tt.allow.inWindowsDesktopLabels,
Impersonate: &tt.allow.inImpersonate,
HostSudoers: tt.allow.inSudoers,
},
@@ -2338,6 +2351,7 @@ func TestApplyTraits(t *testing.T) {
DatabaseLabels: tt.deny.inDBLabels,
DatabaseNames: tt.deny.inDBNames,
DatabaseUsers: tt.deny.inDBUsers,
WindowsDesktopLabels: tt.deny.inWindowsDesktopLabels,
Impersonate: &tt.deny.inImpersonate,
HostSudoers: tt.deny.outSudoers,
},
@@ -2364,6 +2378,7 @@ func TestApplyTraits(t *testing.T) {
require.Equal(t, rule.spec.outDBLabels, outRole.GetDatabaseLabels(rule.condition))
require.Equal(t, rule.spec.outDBNames, outRole.GetDatabaseNames(rule.condition))
require.Equal(t, rule.spec.outDBUsers, outRole.GetDatabaseUsers(rule.condition))
require.Equal(t, rule.spec.outWindowsDesktopLabels, outRole.GetWindowsDesktopLabels(rule.condition))
require.Equal(t, rule.spec.outImpersonate, outRole.GetImpersonateConditions(rule.condition))
require.Equal(t, rule.spec.outSudoers, outRole.GetHostSudoers(rule.condition))
}