mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-16 07:44:31 +08:00
Alexander Klizhentas
73ecb48232
This commit fixes #3369, refs #3374 It adds support for kuberenetes_users section in roles, allowing Teleport proxy to impersonate user identities. It also extends variable interpolation syntax by adding suffix and prefix to variables and function `email.local`: Example: ```yaml kind: role version: v3 metadata: name: admin spec: allow: # extract email local part from the email claim logins: ['{{email.local(external.email)}}'] # impersonate a kubernetes user with IAM prefix kubernetes_users: ['IAM#{{external.email}}'] # the deny section uses the identical format as the 'allow' section. # the deny rules always override allow rules. deny: {} ``` Some notes on email.local behavior: * This is the only function supported in the template variables for now * In case if the email.local will encounter invalid email address, it will interpolate to empty value, will be removed from resulting output. Changes in impersonation behavior: * By default, if no kubernetes_users is set, which is a majority of cases, user will impersonate themselves, which is the backwards-compatible behavior. * As long as at least one `kubernetes_users` is set, the forwarder will start limiting the list of users allowed by the client to impersonate. * If the users' role set does not include actual user name, it will be rejected, otherwise there will be no way to exclude the user from the list). * If the `kuberentes_users` role set includes only one user (quite frequently that's the real intent), teleport will default to it, otherwise it will refuse to select. This will enable the use case when `kubernetes_users` has just one field to link the user identity with the IAM role, for example `IAM#{{external.email}}` * Previous versions of the forwarding proxy were denying all external impersonation headers, this commit allows 'Impesrsonate-User' and 'Impersonate-Group' header values that are allowed by role set. * Previous versions of the forwarding proxy ignored 'Deny' section of the roles when applied to impersonation, this commit fixes that - roles with deny kubernetes_users and kubernetes_groups section will not allow impersonation of those users and groups.
108 lines
3.0 KiB
Go
108 lines
3.0 KiB
Go
/*
|
|
Copyright 2017 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package modules
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/gravitational/teleport"
|
|
|
|
"github.com/gravitational/trace"
|
|
check "gopkg.in/check.v1"
|
|
)
|
|
|
|
func TestModules(t *testing.T) { check.TestingT(t) }
|
|
|
|
type ModulesSuite struct{}
|
|
|
|
var _ = check.Suite(&ModulesSuite{})
|
|
|
|
func (s *ModulesSuite) TestDefaultModules(c *check.C) {
|
|
err := GetModules().EmptyRolesHandler()
|
|
c.Assert(err, check.IsNil)
|
|
|
|
logins := GetModules().DefaultAllowedLogins()
|
|
c.Assert(logins, check.DeepEquals, []string{teleport.TraitInternalLoginsVariable})
|
|
|
|
kubeGroups := GetModules().DefaultKubeGroups()
|
|
c.Assert(kubeGroups, check.DeepEquals, []string{teleport.TraitInternalKubeGroupsVariable})
|
|
|
|
roles := GetModules().RolesFromLogins([]string{"root"})
|
|
c.Assert(roles, check.DeepEquals, []string{teleport.AdminRoleName})
|
|
|
|
traits := GetModules().TraitsFromLogins([]string{"root"}, []string{"system:masters"}, []string{"alice@example.com"})
|
|
c.Assert(traits, check.DeepEquals, map[string][]string{
|
|
teleport.TraitLogins: []string{"root"},
|
|
teleport.TraitKubeGroups: []string{"system:masters"},
|
|
teleport.TraitKubeUsers: []string{"alice@example.com"},
|
|
})
|
|
|
|
isBoring := GetModules().IsBoringBinary()
|
|
c.Assert(isBoring, check.Equals, false)
|
|
}
|
|
|
|
func (s *ModulesSuite) TestTestModules(c *check.C) {
|
|
SetModules(&testModules{})
|
|
|
|
err := GetModules().EmptyRolesHandler()
|
|
c.Assert(trace.IsNotFound(err), check.Equals, true)
|
|
|
|
logins := GetModules().DefaultAllowedLogins()
|
|
c.Assert(logins, check.DeepEquals, []string{"a", "b"})
|
|
|
|
roles := GetModules().RolesFromLogins([]string{"root"})
|
|
c.Assert(roles, check.DeepEquals, []string{"root"})
|
|
|
|
traits := GetModules().TraitsFromLogins([]string{"root"}, []string{"system:masters"}, []string{"alice@example.com"})
|
|
c.Assert(traits, check.IsNil)
|
|
|
|
isBoring := GetModules().IsBoringBinary()
|
|
c.Assert(isBoring, check.Equals, true)
|
|
}
|
|
|
|
type testModules struct{}
|
|
|
|
func (p *testModules) EmptyRolesHandler() error {
|
|
return trace.NotFound("no roles specified")
|
|
}
|
|
|
|
func (p *testModules) DefaultAllowedLogins() []string {
|
|
return []string{"a", "b"}
|
|
}
|
|
|
|
func (p *testModules) DefaultKubeGroups() []string {
|
|
return []string{"kube:test"}
|
|
}
|
|
|
|
func (p *testModules) SupportsKubernetes() bool {
|
|
return true
|
|
}
|
|
|
|
func (p *testModules) PrintVersion() {}
|
|
|
|
func (p *testModules) RolesFromLogins(logins []string) []string {
|
|
return logins
|
|
}
|
|
|
|
func (p *testModules) TraitsFromLogins(logins []string, kubeGroups []string, kubeUsers []string) map[string][]string {
|
|
return nil
|
|
}
|
|
|
|
func (p *testModules) IsBoringBinary() bool {
|
|
return true
|
|
}
|