func cacheKey(ctx kapi.Context, a authorizer.Action) (string, error) { if a.GetRequestAttributes() != nil { // TODO: see if we can serialize this? return "", errors.New("cannot cache request attributes") } keyData := map[string]interface{}{ "verb": a.GetVerb(), "apiVersion": a.GetAPIVersion(), "apiGroup": a.GetAPIGroup(), "resource": a.GetResource(), "resourceName": a.GetResourceName(), "nonResourceURL": a.IsNonResourceURL(), "url": a.GetURL(), } if namespace, ok := kapi.NamespaceFrom(ctx); ok { keyData["namespace"] = namespace } if user, ok := kapi.UserFrom(ctx); ok { keyData["user"] = user.GetName() keyData["groups"] = user.GetGroups() keyData["scopes"] = user.GetExtra()[authorizationapi.ScopesKey] } key, err := json.Marshal(keyData) return string(key), err }
func getAction(namespace string, attributes authorizer.Action) authzapi.Action { return authzapi.Action{ Namespace: namespace, Verb: attributes.GetVerb(), Group: attributes.GetAPIGroup(), Version: attributes.GetAPIVersion(), Resource: attributes.GetResource(), ResourceName: attributes.GetResourceName(), // TODO: missing from authorizer.Action: // Content // TODO: missing from authzapi.Action // RequestAttributes (unserializable?) // IsNonResourceURL // URL (doesn't make sense for remote authz?) } }
// forbidden renders a simple forbidden error func forbidden(reason string, attributes authorizer.Action, w http.ResponseWriter, req *http.Request) { kind := "" resource := "" group := "" name := "" // the attributes can be empty for two basic reasons: // 1. malformed API request // 2. not an API request at all // In these cases, just assume default that will work better than nothing if attributes != nil { group = attributes.GetAPIGroup() resource = attributes.GetResource() kind = attributes.GetResource() if len(attributes.GetAPIGroup()) > 0 { kind = attributes.GetAPIGroup() + "." + kind } name = attributes.GetResourceName() } // Reason is an opaque string that describes why access is allowed or forbidden (forbidden by the time we reach here). // We don't have direct access to kind or name (not that those apply either in the general case) // We create a NewForbidden to stay close the API, but then we override the message to get a serialization // that makes sense when a human reads it. forbiddenError := kapierrors.NewForbidden(unversioned.GroupResource{Group: group, Resource: resource}, name, errors.New("") /*discarded*/) forbiddenError.ErrStatus.Message = reason formatted := &bytes.Buffer{} output, err := runtime.Encode(kapi.Codecs.LegacyCodec(kapi.SchemeGroupVersion), &forbiddenError.ErrStatus) if err != nil { fmt.Fprintf(formatted, "%s", forbiddenError.Error()) } else { json.Indent(formatted, output, "", " ") } w.Header().Set("Content-Type", restful.MIME_JSON) w.WriteHeader(http.StatusForbidden) w.Write(formatted.Bytes()) }