mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-13 17:48:29 +02:00
Chris Lu
c47eab1a5d
* admin: attach admin-signed Bearer token on filer IAM gRPC calls PR #9442 added Bearer-JWT enforcement on the filer's IAM gRPC service but didn't update its only production client, IamGrpcStore. The admin UI Users/Groups pages went through that client and started failing in 4.24 with either Unimplemented (filer refuses to register the service when jwt.filer_signing.key is empty) or Unauthenticated (the client sent no token). Issues #9495 and #9496 both trace to this gap. Plumb jwt.filer_signing.key into IamGrpcStore via a new SetAdminSigning hook called from the admin server, and append a freshly minted Bearer token to outgoing metadata on every call. The mint helper security.GenJwtForFilerAdmin existed since #9442 but had no production caller; this wires it up. Add an integration test alongside grpc_store.go that runs a real IamGrpcServer over a real grpc.Server listener and exercises the store end-to-end: matching key succeeds, wrong key returns Unauthenticated, no key returns Unauthenticated. Without the client-side token attach the success path fails, so the regression cannot land again. * address review: include adminSigningExpiresAfterSec in mu comment
79 lines
2.5 KiB
Go
79 lines
2.5 KiB
Go
package grpc
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
|
|
)
|
|
|
|
func (store *IamGrpcStore) CreateServiceAccount(ctx context.Context, sa *iam_pb.ServiceAccount) error {
|
|
return store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
_, err := client.CreateServiceAccount(ctx, &iam_pb.CreateServiceAccountRequest{
|
|
ServiceAccount: sa,
|
|
})
|
|
return err
|
|
})
|
|
}
|
|
|
|
func (store *IamGrpcStore) UpdateServiceAccount(ctx context.Context, id string, sa *iam_pb.ServiceAccount) error {
|
|
return store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
_, err := client.UpdateServiceAccount(ctx, &iam_pb.UpdateServiceAccountRequest{
|
|
Id: id,
|
|
ServiceAccount: sa,
|
|
})
|
|
return err
|
|
})
|
|
}
|
|
|
|
func (store *IamGrpcStore) DeleteServiceAccount(ctx context.Context, id string) error {
|
|
return store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
_, err := client.DeleteServiceAccount(ctx, &iam_pb.DeleteServiceAccountRequest{
|
|
Id: id,
|
|
})
|
|
return err
|
|
})
|
|
}
|
|
|
|
func (store *IamGrpcStore) GetServiceAccount(ctx context.Context, id string) (*iam_pb.ServiceAccount, error) {
|
|
var sa *iam_pb.ServiceAccount
|
|
err := store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
resp, err := client.GetServiceAccount(ctx, &iam_pb.GetServiceAccountRequest{
|
|
Id: id,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sa = resp.ServiceAccount
|
|
return nil
|
|
})
|
|
return sa, err
|
|
}
|
|
|
|
func (store *IamGrpcStore) ListServiceAccounts(ctx context.Context) ([]*iam_pb.ServiceAccount, error) {
|
|
var accounts []*iam_pb.ServiceAccount
|
|
err := store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
resp, err := client.ListServiceAccounts(ctx, &iam_pb.ListServiceAccountsRequest{})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
accounts = resp.ServiceAccounts
|
|
return nil
|
|
})
|
|
return accounts, err
|
|
}
|
|
|
|
func (store *IamGrpcStore) GetServiceAccountByAccessKey(ctx context.Context, accessKey string) (*iam_pb.ServiceAccount, error) {
|
|
var sa *iam_pb.ServiceAccount
|
|
err := store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
|
|
resp, err := client.GetServiceAccountByAccessKey(ctx, &iam_pb.GetServiceAccountByAccessKeyRequest{
|
|
AccessKey: accessKey,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sa = resp.ServiceAccount
|
|
return nil
|
|
})
|
|
return sa, err
|
|
}
|