fix(backend): allow empty userid header prefix. Fixes #4091 (4098)

kubeflow · Jul 2, 2020 · 9e00c79 · 9e00c79
1 parent f64e105
commit 9e00c79
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/backend/src/apiserver/main.go b/backend/src/apiserver/main.go
@@ -216,6 +216,8 @@ func initConfig() {
 	replacer := strings.NewReplacer(".", "_")
 	viper.SetEnvKeyReplacer(replacer)
 	viper.AutomaticEnv()
+	// We need empty string env var for e.g. KUBEFLOW_USERID_PREFIX.
+	viper.AllowEmptyEnv(true)
 
 	// Set configuration file name. The format is auto detected in this case.
 	viper.SetConfigName("config")

diff --git a/backend/src/apiserver/server/auth_server_test.go b/backend/src/apiserver/server/auth_server_test.go
@@ -96,3 +96,26 @@ func TestAuthorizeRequest_Unauthorized(t *testing.T) {
 	assert.Error(t, err)
 	assert.EqualError(t, err, "Failed to authorize the request: Failed to authorize namespace: BadRequestError: Unauthorized access for user@google.com to namespace ns1: Unauthorized access for user@google.com to namespace ns1")
 }
+
+func TestAuthorizeRequest_EmptyUserIdPrefix(t *testing.T) {
+	viper.Set(common.MultiUserMode, "true")
+	defer viper.Set(common.MultiUserMode, "false")
+	viper.Set(common.KubeflowUserIDPrefix, "")
+	defer viper.Set(common.KubeflowUserIDPrefix, common.GoogleIAPUserIdentityPrefix)
+
+	clients, manager, _ := initWithExperiment(t)
+	defer clients.Close()
+	authServer := AuthServer{resourceManager: manager}
+
+	md := metadata.New(map[string]string{common.GoogleIAPUserIdentityHeader: "user@google.com"})
+	ctx := metadata.NewIncomingContext(context.Background(), md)
+
+	request := &api.AuthorizeRequest{
+		Namespace: "ns1",
+		Resources: api.AuthorizeRequest_VIEWERS,
+		Verb:      api.AuthorizeRequest_GET,
+	}
+
+	_, err := authServer.Authorize(ctx, request)
+	assert.Nil(t, err)
+}