Skip to content

Commit d5b954d

Browse files
ijonblinkov
ijon
authored and
blinkov
committed
security: unify and extend admin checks (#14489)
- add `IsTokenAllowed()` to universally check token membership in any `*_allowed_sids` lists - add `IsDatabaseAdministrator()`
1 parent a101229 commit d5b954d

File tree

5 files changed

+220
-22
lines changed

5 files changed

+220
-22
lines changed

‎ydb/core/base/auth.cpp

Lines changed: 56 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,83 @@
1+
#include <ydb/library/aclib/aclib.h>
2+
13
#include "auth.h"
24

35
namespace NKikimr {
46

57
namespace {
68

7-
bool HasToken(const TAppData* appData, const NACLib::TUserToken& userToken) {
8-
for (const auto& sid : appData->AdministrationAllowedSIDs) {
9-
if (userToken.IsExist(sid)) {
9+
template <class Iterable>
10+
bool IsTokenAllowedImpl(const NACLib::TUserToken* userToken, const Iterable& allowedSIDs) {
11+
// empty set contains any element
12+
if (allowedSIDs.empty()) {
13+
return true;
14+
}
15+
16+
// empty element does not belong to any non-empty set
17+
if (!userToken || userToken->GetUserSID().empty()) {
18+
return false;
19+
}
20+
21+
// its enough to a single sid (user or group) from the token to be in the set
22+
for (const auto& sid : allowedSIDs) {
23+
if (userToken->IsExist(sid)) {
1024
return true;
1125
}
1226
}
1327

1428
return false;
1529
}
1630

31+
NACLib::TUserToken ParseUserToken(const TString& userTokenSerialized) {
32+
NACLibProto::TUserToken tokenPb;
33+
if (!tokenPb.ParseFromString(userTokenSerialized)) {
34+
// we want to treat invalid token as empty,
35+
// so then result object must be recreated (or cleared)
36+
// because failed parsing makes result object dirty
37+
tokenPb = NACLibProto::TUserToken();
38+
}
39+
return NACLib::TUserToken(tokenPb);
1740
}
1841

19-
bool IsAdministrator(const TAppData* appData, const TString& userToken) {
20-
if (appData->AdministrationAllowedSIDs.empty()) {
21-
return true;
22-
}
42+
}
2343

24-
if (!userToken) {
25-
return false;
26-
}
44+
bool IsTokenAllowed(const NACLib::TUserToken* userToken, const TVector<TString>& allowedSIDs) {
45+
return IsTokenAllowedImpl(userToken, allowedSIDs);
46+
}
2747

28-
NACLibProto::TUserToken tokenPb;
29-
if (!tokenPb.ParseFromString(userToken)) {
30-
return false;
31-
}
48+
bool IsTokenAllowed(const NACLib::TUserToken* userToken, const NProtoBuf::RepeatedPtrField<TString>& allowedSIDs) {
49+
return IsTokenAllowedImpl(userToken, allowedSIDs);
50+
}
51+
52+
bool IsTokenAllowed(const TString& userTokenSerialized, const TVector<TString>& allowedSIDs) {
53+
NACLib::TUserToken userToken = ParseUserToken(userTokenSerialized);
54+
return IsTokenAllowed(&userToken, allowedSIDs);
55+
}
56+
57+
bool IsTokenAllowed(const TString& userTokenSerialized, const NProtoBuf::RepeatedPtrField<TString>& allowedSIDs) {
58+
NACLib::TUserToken userToken = ParseUserToken(userTokenSerialized);
59+
return IsTokenAllowed(&userToken, allowedSIDs);
60+
}
3261

33-
return HasToken(appData, NACLib::TUserToken(std::move(tokenPb)));
62+
bool IsAdministrator(const TAppData* appData, const TString& userTokenSerialized) {
63+
return IsTokenAllowed(userTokenSerialized, appData->AdministrationAllowedSIDs);
3464
}
3565

3666
bool IsAdministrator(const TAppData* appData, const NACLib::TUserToken* userToken) {
37-
if (appData->AdministrationAllowedSIDs.empty()) {
38-
return true;
39-
}
67+
return IsTokenAllowed(userToken, appData->AdministrationAllowedSIDs);
68+
}
69+
4070

41-
if (!userToken || userToken->GetSerializedToken().empty()) {
71+
bool IsDatabaseAdministrator(const NACLib::TUserToken* userToken, const NACLib::TSID& databaseOwner) {
72+
// no database, no access
73+
if (databaseOwner.empty()) {
4274
return false;
4375
}
44-
45-
return HasToken(appData, *userToken);
76+
// empty token can't have raised access level
77+
if (!userToken || userToken->GetUserSID().empty()) {
78+
return false;
79+
}
80+
return userToken->IsExist(databaseOwner);
4681
}
4782

4883
}

‎ydb/core/base/auth.h

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,17 @@
55

66
namespace NKikimr {
77

8-
bool IsAdministrator(const TAppData* appData, const TString& userToken);
8+
// Check token against given list of allowed sids
9+
bool IsTokenAllowed(const NACLib::TUserToken* userToken, const TVector<TString>& allowedSIDs);
10+
bool IsTokenAllowed(const NACLib::TUserToken* userToken, const NProtoBuf::RepeatedPtrField<TString>& allowedSIDs);
11+
bool IsTokenAllowed(const TString& userTokenSerialized, const TVector<TString>& allowedSIDs);
12+
bool IsTokenAllowed(const TString& userTokenSerialized, const NProtoBuf::RepeatedPtrField<TString>& allowedSIDs);
913

14+
// Check token against AdministrationAllowedSIDs
15+
bool IsAdministrator(const TAppData* appData, const TString& userTokenSerialized);
1016
bool IsAdministrator(const TAppData* appData, const NACLib::TUserToken* userToken);
1117

18+
// Check token against database owner
19+
bool IsDatabaseAdministrator(const NACLib::TUserToken* userToken, const NACLib::TSID& databaseOwner);
20+
1221
}

‎ydb/core/base/auth_ut.cpp

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
#include <library/cpp/testing/unittest/registar.h>
2+
3+
#include "auth.h"
4+
5+
using namespace NKikimr;
6+
7+
Y_UNIT_TEST_SUITE(AuthTokenAllowed) {
8+
9+
const TVector<TString> EmptyList;
10+
11+
// Empty list allows empty token (regardless of its kind)
12+
Y_UNIT_TEST(PassOnEmptyListAndEmptyToken) {
13+
NACLib::TUserToken token(NACLib::TUserToken::TUserTokenInitFields{});
14+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, EmptyList), true);
15+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), EmptyList), true);
16+
}
17+
Y_UNIT_TEST(PassOnEmptyListAndTokenWithEmptyUserSid) {
18+
NACLib::TUserToken token({ .UserSID = "" });
19+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, EmptyList), true);
20+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), EmptyList), true);
21+
}
22+
Y_UNIT_TEST(PassOnEmptyListAndTokenWithEmptyUserSidAndGroups) {
23+
NACLib::TUserToken token({ .UserSID = "", .GroupSIDs = {"group1"} });
24+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, EmptyList), true);
25+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), EmptyList), true);
26+
}
27+
Y_UNIT_TEST(PassOnEmptyListAndNoToken) {
28+
UNIT_ASSERT_EQUAL(IsTokenAllowed(nullptr, EmptyList), true);
29+
}
30+
Y_UNIT_TEST(PassOnEmptyListAndToken) {
31+
NACLib::TUserToken token({ .UserSID = "user1" });
32+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, EmptyList), true);
33+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), EmptyList), true);
34+
}
35+
Y_UNIT_TEST(PassOnEmptyListAndInvalidTokenSerialized) {
36+
UNIT_ASSERT_EQUAL(IsTokenAllowed("invalid-serialized-protobuf", EmptyList), true);
37+
}
38+
39+
// Non empty list forbids empty token (regardless of its kind)
40+
Y_UNIT_TEST(FailOnListAndEmptyToken) {
41+
NACLib::TUserToken token(NACLib::TUserToken::TUserTokenInitFields{});
42+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"entry"}), false);
43+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"entry"}), false);
44+
}
45+
Y_UNIT_TEST(FailOnListAndTokenWithEmptyUserSid) {
46+
NACLib::TUserToken token({ .UserSID = "" });
47+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"entry"}), false);
48+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"entry"}), false);
49+
}
50+
Y_UNIT_TEST(FailOnListAndTokenWithEmptyUserSidAndGroups) {
51+
NACLib::TUserToken token({ .UserSID = "", .GroupSIDs = {"group1"} });
52+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"entry"}), false);
53+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"entry"}), false);
54+
}
55+
Y_UNIT_TEST(FailOnListAndNoToken) {
56+
UNIT_ASSERT_EQUAL(IsTokenAllowed(nullptr, {"entry"}), false);
57+
}
58+
59+
// List matches token
60+
Y_UNIT_TEST(PassOnListMatchUserSid) {
61+
NACLib::TUserToken token({ .UserSID = "user1" });
62+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"group1", "group2", "user1", "user2"}), true);
63+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"group1", "group2", "user1", "user2"}), true);
64+
}
65+
Y_UNIT_TEST(PassOnListMatchUserSidWithGroup) {
66+
NACLib::TUserToken token({ .UserSID = "user1", .GroupSIDs = {"no-match-group"} });
67+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"group1", "group2", "user1", "user2"}), true);
68+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"group1", "group2", "user1", "user2"}), true);
69+
}
70+
Y_UNIT_TEST(PassOnListMatchGroupSid) {
71+
NACLib::TUserToken token({ .UserSID = "no-match-user", .GroupSIDs = {"group2"} });
72+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"group1", "group2", "user1", "user2"}), true);
73+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"group1", "group2", "user1", "user2"}), true);
74+
}
75+
76+
// List does not matchs token
77+
Y_UNIT_TEST(FailOnListMatchGroupSid) {
78+
NACLib::TUserToken token({ .UserSID = "no-match-user", .GroupSIDs = {"no-match-group"} });
79+
UNIT_ASSERT_EQUAL(IsTokenAllowed(&token, {"group1", "group2", "user1", "user2"}), false);
80+
UNIT_ASSERT_EQUAL(IsTokenAllowed(token.SerializeAsString(), {"group1", "group2", "user1", "user2"}), false);
81+
}
82+
83+
}
84+
85+
Y_UNIT_TEST_SUITE(AuthDatabaseAdmin) {
86+
87+
// Empty owner forbids empty token (regardless of its kind)
88+
Y_UNIT_TEST(FailOnEmptyOwnerAndEmptyToken) {
89+
NACLib::TUserToken token(NACLib::TUserToken::TUserTokenInitFields{});
90+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, ""), false);
91+
}
92+
Y_UNIT_TEST(FailOnEmptyOwnerAndTokenWithEmptyUserSid) {
93+
NACLib::TUserToken token({ .UserSID = "" });
94+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, ""), false);
95+
}
96+
Y_UNIT_TEST(FailOnEmptyOwnerAndTokenWithEmptyUserSidAndGroups) {
97+
NACLib::TUserToken token({ .UserSID = "", .GroupSIDs = {"group1"} });
98+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, ""), false);
99+
}
100+
Y_UNIT_TEST(FailOnEmptyOwnerAndNoToken) {
101+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(nullptr, ""), false);
102+
}
103+
104+
// Non empty owner forbids empty token (regardless of its kind)
105+
Y_UNIT_TEST(FailOnOwnerAndEmptyToken) {
106+
NACLib::TUserToken token(NACLib::TUserToken::TUserTokenInitFields{});
107+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "owner"), false);
108+
}
109+
Y_UNIT_TEST(FailOnOwnerAndTokenWithEmptyUserSid) {
110+
NACLib::TUserToken token({ .UserSID = "" });
111+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "owner"), false);
112+
}
113+
Y_UNIT_TEST(FailOnOwnerAndTokenWithEmptyUserSidAndGroups) {
114+
NACLib::TUserToken token({ .UserSID = "", .GroupSIDs = {"group1"} });
115+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "owner"), false);
116+
}
117+
Y_UNIT_TEST(FailOnOwnerAndNoToken) {
118+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(nullptr, "owner"), false);
119+
}
120+
121+
// Owner matches token
122+
Y_UNIT_TEST(PassOnOwnerMatchUserSid) {
123+
NACLib::TUserToken token({ .UserSID = "user1" });
124+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "user1"), true);
125+
}
126+
Y_UNIT_TEST(PassOnOwnerMatchUserSidWithGroup) {
127+
NACLib::TUserToken token({ .UserSID = "user1", .GroupSIDs = {"group1"} });
128+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "user1"), true);
129+
}
130+
Y_UNIT_TEST(PassOnOwnerMatchGroupSid) {
131+
NACLib::TUserToken token({ .UserSID = "user1", .GroupSIDs = {"group1"} });
132+
UNIT_ASSERT_EQUAL(IsDatabaseAdministrator(&token, "group1"), true);
133+
}
134+
135+
}

‎ydb/core/base/ut_auth/ya.make

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
UNITTEST_FOR(ydb/core/base)
2+
3+
FORK_SUBTESTS()
4+
5+
SIZE(MEDIUM)
6+
7+
PEERDIR(
8+
library/cpp/testing/unittest
9+
ydb/library/aclib
10+
)
11+
12+
YQL_LAST_ABI_VERSION()
13+
14+
SRCS(
15+
auth_ut.cpp
16+
)
17+
18+
END()

‎ydb/core/base/ya.make

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,5 +125,6 @@ RECURSE(
125125

126126
RECURSE_FOR_TESTS(
127127
ut
128+
ut_auth
128129
ut_board_subscriber
129130
)

0 commit comments

Comments
 (0)