Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Auth: Embedded OpenFGA authorization driver #12976

Merged
merged 11 commits into from
Mar 8, 2024
Merged

Auth: Embedded OpenFGA authorization driver #12976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
1746373
lxd/db/cluster: Add a method to get a single entity reference from a …
markylaing Mar 4, 2024
e51f12c
gomod: Add OpenFGA dependencies.
markylaing Mar 8, 2024
57b95ea
lxd/db: Adds the OpenFGA datastore implementation.
markylaing Feb 27, 2024
be6b406
lxd/auth: Add the OpenFGA model.
markylaing Feb 27, 2024
61ad209
lxd/auth: Add identity provider groups to request details.
markylaing Feb 27, 2024
8389cf5
lxd/auth: Update requestDetails method.
markylaing Feb 27, 2024
74aff1a
lxd/auth: Add the embedded OpenFGA authorization driver.
markylaing Feb 27, 2024
1bbd495
lxd: Load the embedded OpenFGA driver by default.
markylaing Feb 27, 2024
0270135
test: Add a util for getting the fingerprint from a certificate.
markylaing Feb 27, 2024
a0fdce4
test/suites: Add tests for fine-grained authorization.
markylaing Feb 27, 2024
28b5fd2
Makefile: Exclude dependency from spec generation.
markylaing Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,9 @@ update-api:
ifeq "$(LXD_OFFLINE)" ""
(cd / ; go install github.com/go-swagger/go-swagger/cmd/swagger@latest)
endif
swagger generate spec -o doc/rest-api.yaml -w ./lxd -m
@# Generate spec and exclude package from dependency which causes a 'classifier: unknown swagger annotation "extendee"' error.
@# For more details see: https://github.com/go-swagger/go-swagger/issues/2917.
swagger generate spec -o doc/rest-api.yaml -w ./lxd -m -x github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options
tomponline marked this conversation as resolved.
Show resolved Hide resolved

.PHONY: update-metadata
update-metadata: build
Expand Down
44 changes: 36 additions & 8 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,11 @@ require (
github.com/miekg/dns v1.1.58
github.com/minio/minio-go/v7 v7.0.68
github.com/mitchellh/mapstructure v1.5.0
github.com/oklog/ulid/v2 v2.1.0
github.com/olekukonko/tablewriter v0.0.5
github.com/openfga/api/proto v0.0.0-20240307175852-df09bc1e8e82
github.com/openfga/language/pkg/go v0.0.0-20240307152633-772cdd8b6a9c
github.com/openfga/openfga v1.5.0
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is pulling in lots of stuff, two surprising items are mysql driver and docker client?

Is it possible for us to consume a more specific package rather than the general openfga package.

Not a blocker ofc.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is possible as the go.mod is in the root of the repo. I could look into which specific dependencies are required by the packages we are using and potentially we can write exclude directives to get rid of mysql and docker etc.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think go mod tidy would have done this for us already if it wasnt needed - i was wondering if we did need to import the main package or whether we can be more specific somehow?

github.com/osrg/gobgp/v3 v3.24.0
github.com/pkg/sftp v1.13.6
github.com/pkg/xattr v0.4.9
Expand All @@ -45,34 +49,45 @@ require (
github.com/vishvananda/netlink v1.2.1-beta.2
github.com/zitadel/oidc/v2 v2.12.0
go.starlark.net v0.0.0-20240123142251-f86470692795
golang.org/x/crypto v0.20.0
go.uber.org/zap v1.27.0
golang.org/x/crypto v0.21.0
golang.org/x/oauth2 v0.17.0
golang.org/x/sync v0.6.0
golang.org/x/sys v0.17.0
golang.org/x/term v0.17.0
golang.org/x/sys v0.18.0
golang.org/x/term v0.18.0
golang.org/x/text v0.14.0
google.golang.org/protobuf v1.32.0
google.golang.org/protobuf v1.33.0
gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637
gopkg.in/yaml.v2 v2.4.0
k8s.io/utils v0.0.0-20240102154912-e7106e64919e
)

require (
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
github.com/digitalocean/go-libvirt v0.0.0-20240226191243-cbbbe227f0a2 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/eapache/channels v1.1.0 // indirect
github.com/eapache/queue v1.1.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/go-jose/go-jose/v3 v3.0.3 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/cel-go v0.20.0 // indirect
github.com/google/renameio v1.0.1 // indirect
github.com/gorilla/schema v1.2.1 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 // indirect
Expand All @@ -84,6 +99,7 @@ require (
github.com/juju/schema v1.2.0 // indirect
github.com/juju/version v0.0.0-20210303051006-2015802527a8 // indirect
github.com/k-sone/critbitgo v1.4.0 // indirect
github.com/karlseguin/ccache/v3 v3.0.5 // indirect
github.com/klauspost/compress v1.17.7 // indirect
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
github.com/kr/fs v0.1.0 // indirect
Expand All @@ -98,9 +114,14 @@ require (
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/muhlemmer/gu v0.3.1 // indirect
github.com/muhlemmer/httpforwarded v0.1.0 // indirect
github.com/natefinch/wrap v0.2.0 // indirect
github.com/pelletier/go-toml/v2 v2.1.1 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.18.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.46.0 // indirect
github.com/prometheus/procfs v0.12.0 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/rs/cors v1.10.1 // indirect
github.com/rs/xid v1.5.0 // indirect
Expand All @@ -112,19 +133,26 @@ require (
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/viper v1.18.2 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/vishvananda/netns v0.0.4 // indirect
go.opentelemetry.io/otel v1.24.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.24.0 // indirect
go.opentelemetry.io/otel/metric v1.24.0 // indirect
go.opentelemetry.io/otel/sdk v1.24.0 // indirect
go.opentelemetry.io/otel/trace v1.24.0 // indirect
go.opentelemetry.io/proto/otlp v1.1.0 // indirect
go.uber.org/mock v0.4.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
golang.org/x/mod v0.15.0 // indirect
golang.org/x/net v0.21.0 // indirect
golang.org/x/net v0.22.0 // indirect
golang.org/x/tools v0.18.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect
google.golang.org/grpc v1.62.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240304212257-790db918fca8 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240304212257-790db918fca8 // indirect
google.golang.org/grpc v1.62.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
Expand Down
Loading
Loading