func hasGuestAccess(sec *auth.Store, r *http.Request, key string) bool {
	writeAccess := r.Method != "GET" && r.Method != "HEAD"
	role, err := sec.GetRole(auth.GuestRoleName)
	if err != nil {
		return false
	}
	if role.HasKeyAccess(key, writeAccess) {
		return true
	}
	plog.Warningf("auth: invalid access for unauthenticated user on resource %s.", key)
	return false
}
Example #2
0
func hasKeyPrefixAccess(sec auth.Store, r *http.Request, key string, recursive bool) bool {
	if sec == nil {
		// No store means no auth available, eg, tests.
		return true
	}
	if !sec.AuthEnabled() {
		return true
	}
	if r.Header.Get("Authorization") == "" {
		plog.Warningf("auth: no authorization provided, checking guest access")
		return hasGuestAccess(sec, r, key)
	}
	username, password, ok := netutil.BasicAuth(r)
	if !ok {
		plog.Warningf("auth: malformed basic auth encoding")
		return false
	}
	user, err := sec.GetUser(username)
	if err != nil {
		plog.Warningf("auth: no such user: %s.", username)
		return false
	}
	authAsUser := user.CheckPassword(password)
	if !authAsUser {
		plog.Warningf("auth: incorrect password for user: %s.", username)
		return false
	}
	writeAccess := r.Method != "GET" && r.Method != "HEAD"
	for _, roleName := range user.Roles {
		role, err := sec.GetRole(roleName)
		if err != nil {
			continue
		}
		if recursive {
			if role.HasRecursiveAccess(key, writeAccess) {
				return true
			}
		} else if role.HasKeyAccess(key, writeAccess) {
			return true
		}
	}
	plog.Warningf("auth: invalid access for user %s on key %s.", username, key)
	return false
}
Example #3
0
func hasKeyPrefixAccess(sec auth.Store, r *http.Request, key string, recursive, clientCertAuthEnabled bool) bool {
	if sec == nil {
		// No store means no auth available, eg, tests.
		return true
	}
	if !sec.AuthEnabled() {
		return true
	}

	var user *auth.User
	if r.Header.Get("Authorization") == "" {
		if clientCertAuthEnabled {
			user = userFromClientCertificate(sec, r)
		}
		if user == nil {
			return hasGuestAccess(sec, r, key)
		}
	} else {
		user = userFromBasicAuth(sec, r)
		if user == nil {
			return false
		}
	}

	writeAccess := r.Method != "GET" && r.Method != "HEAD"
	for _, roleName := range user.Roles {
		role, err := sec.GetRole(roleName)
		if err != nil {
			continue
		}
		if recursive {
			if role.HasRecursiveAccess(key, writeAccess) {
				return true
			}
		} else if role.HasKeyAccess(key, writeAccess) {
			return true
		}
	}
	plog.Warningf("auth: invalid access for user %s on key %s.", user.User, key)
	return false
}