Skip to content

Commit 1de4007

Browse files
ishank011ishank011
authored
Enable federated account access (#2685)
1 parent 6b39234 commit 1de4007

File tree

11 files changed

+39
-25
lines changed

11 files changed

+39
-25
lines changed

Diff for: ‎changelog/unreleased/federated-accounts.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Enhancement: Enable federated account access
2+
3+
https://github.com/cs3org/reva/pull/2685

Diff for: ‎internal/grpc/services/gateway/usershareprovider.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -323,7 +323,9 @@ func (s *svc) UpdateReceivedShare(ctx context.Context, req *collaboration.Update
323323
}
324324

325325
// if we don't need to create/delete references then we return early.
326-
if !s.c.CommitShareToStorageRef || ctxpkg.ContextMustGetUser(ctx).Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
326+
if !s.c.CommitShareToStorageRef ||
327+
ctxpkg.ContextMustGetUser(ctx).Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT ||
328+
ctxpkg.ContextMustGetUser(ctx).Id.Type == userpb.UserType_USER_TYPE_FEDERATED {
327329
return res, nil
328330
}
329331

Diff for: ‎internal/http/services/owncloud/ocs/handlers/cloud/users/users.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,8 @@ func (h *Handler) GetUsers(w http.ResponseWriter, r *http.Request) {
131131
}
132132
var total, used uint64
133133
var relative float32
134-
// lightweight accounts don't have access to their storage space
135-
if u.Id.Type != userpb.UserType_USER_TYPE_LIGHTWEIGHT {
134+
// lightweight and federated accounts don't have access to their storage space
135+
if u.Id.Type != userpb.UserType_USER_TYPE_LIGHTWEIGHT && u.Id.Type != userpb.UserType_USER_TYPE_FEDERATED {
136136
getQuotaRes, err := gc.GetQuota(ctx, &gateway.GetQuotaRequest{Ref: &provider.Reference{Path: getHomeRes.Path}})
137137
if err != nil {
138138
sublog.Error().Err(err).Msg("error calling GetQuota")

Diff for: ‎pkg/app/provider/wopi/wopi.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ func (p *wopiProvider) GetAppURL(ctx context.Context, resource *provider.Resourc
140140

141141
u, ok := ctxpkg.ContextGetUser(ctx)
142142
if ok { // else defaults to "Guest xyz"
143-
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
143+
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT || u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED {
144144
q.Add("userid", resource.Owner.OpaqueId+"@"+resource.Owner.Idp)
145145
} else {
146146
q.Add("userid", u.Id.OpaqueId+"@"+u.Id.Idp)

Diff for: ‎pkg/auth/manager/demo/demo.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ func (m *manager) Authenticate(ctx context.Context, clientID, clientSecret strin
6262
if c.Secret == clientSecret {
6363
var scopes map[string]*authpb.Scope
6464
var err error
65-
if c.User.Id != nil && c.User.Id.Type == user.UserType_USER_TYPE_LIGHTWEIGHT {
65+
if c.User.Id != nil && (c.User.Id.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || c.User.Id.Type == user.UserType_USER_TYPE_FEDERATED) {
6666
scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
6767
if err != nil {
6868
return nil, nil, err

Diff for: ‎pkg/auth/manager/json/json.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ func (m *manager) Authenticate(ctx context.Context, username string, secret stri
117117
if c.Secret == secret {
118118
var scopes map[string]*authpb.Scope
119119
var err error
120-
if c.ID != nil && c.ID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT {
120+
if c.ID != nil && (c.ID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || c.ID.Type == user.UserType_USER_TYPE_FEDERATED) {
121121
scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
122122
if err != nil {
123123
return nil, nil, err

Diff for: ‎pkg/auth/manager/oidc/oidc.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ func (am *mgr) Authenticate(ctx context.Context, clientID, clientSecret string)
238238
}
239239

240240
var scopes map[string]*authpb.Scope
241-
if userID != nil && userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT {
241+
if userID != nil && (userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || userID.Type == user.UserType_USER_TYPE_FEDERATED) {
242242
scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
243243
if err != nil {
244244
return nil, nil, err

Diff for: ‎pkg/auth/manager/owncloudsql/owncloudsql.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ func (m *manager) Authenticate(ctx context.Context, login, clientSecret string)
144144
}
145145

146146
var scopes map[string]*authpb.Scope
147-
if userID != nil && userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT {
147+
if userID != nil && (userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || userID.Type == user.UserType_USER_TYPE_FEDERATED) {
148148
scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
149149
if err != nil {
150150
return nil, nil, err

Diff for: ‎pkg/cbox/user/rest/rest.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ func (m *manager) getUser(ctx context.Context, url string) (map[string]interface
143143

144144
t, _ := userData["type"].(string)
145145
userType := getUserType(t, userData["upn"].(string))
146-
if userType != userpb.UserType_USER_TYPE_APPLICATION && userType != userpb.UserType_USER_TYPE_FEDERATED {
146+
if userType != userpb.UserType_USER_TYPE_APPLICATION {
147147
users = append(users, userData)
148148
}
149149
}
@@ -290,15 +290,15 @@ func (m *manager) GetUserByClaim(ctx context.Context, claim, value string, skipF
290290
}
291291

292292
var userData map[string]interface{}
293-
if strings.HasPrefix(value, "guest:") {
293+
if claim == "upn" && strings.HasPrefix(value, "guest:") {
294294
// Lightweight accounts need to be fetched by email, regardless of the demanded claim
295-
if userData, err = m.getLightweightUser(ctx, strings.TrimPrefix(value, "guest:")); err != nil {
296-
return nil, err
297-
}
295+
userData, err = m.getLightweightUser(ctx, strings.TrimPrefix(value, "guest:"))
298296
} else {
299-
if userData, err = m.getUserByParam(ctx, claim, value); err != nil {
300-
return nil, errors.Wrap(err, "rest: failed getUserByParam, claim="+claim+", value="+value)
301-
}
297+
userData, err = m.getUserByParam(ctx, claim, value)
298+
}
299+
300+
if err != nil {
301+
return nil, err
302302
}
303303
u, err := m.parseAndCacheUser(ctx, userData)
304304
if err != nil {
@@ -329,15 +329,18 @@ func (m *manager) findUsersByFilter(ctx context.Context, url string, users map[s
329329
continue
330330
}
331331

332-
upn, _ := usrInfo["upn"].(string)
332+
upn, ok := usrInfo["upn"].(string)
333+
if !ok {
334+
continue
335+
}
333336
mail, _ := usrInfo["primaryAccountEmail"].(string)
334337
name, _ := usrInfo["displayName"].(string)
335338
uidNumber, _ := usrInfo["uid"].(float64)
336339
gidNumber, _ := usrInfo["gid"].(float64)
337340
t, _ := usrInfo["type"].(string)
338341
userType := getUserType(t, upn)
339342

340-
if userType == userpb.UserType_USER_TYPE_APPLICATION || userType == userpb.UserType_USER_TYPE_FEDERATED {
343+
if userType == userpb.UserType_USER_TYPE_APPLICATION {
341344
continue
342345
}
343346

@@ -372,7 +375,7 @@ func (m *manager) FindUsers(ctx context.Context, query string, skipFetchingGroup
372375

373376
// Look at namespaces filters. If the query starts with:
374377
// "a" => look into primary/secondary/service accounts
375-
// "l" => look into lightweight accounts
378+
// "l" => look into lightweight/federated accounts
376379
// none => look into primary
377380

378381
parts := strings.SplitN(query, ":", 2)
@@ -413,7 +416,7 @@ func (m *manager) FindUsers(ctx context.Context, query string, skipFetchingGroup
413416
case "a":
414417
accountsFilters = []userpb.UserType{userpb.UserType_USER_TYPE_PRIMARY, userpb.UserType_USER_TYPE_SECONDARY, userpb.UserType_USER_TYPE_SERVICE}
415418
case "l":
416-
accountsFilters = []userpb.UserType{userpb.UserType_USER_TYPE_LIGHTWEIGHT}
419+
accountsFilters = []userpb.UserType{userpb.UserType_USER_TYPE_LIGHTWEIGHT, userpb.UserType_USER_TYPE_FEDERATED}
417420
}
418421

419422
for _, u := range users {

Diff for: ‎pkg/cbox/utils/conversions.go

+2
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,8 @@ func ExtractUserID(u string) *userpb.UserId {
199199
t := userpb.UserType_USER_TYPE_PRIMARY
200200
if strings.HasPrefix(u, "guest:") {
201201
t = userpb.UserType_USER_TYPE_LIGHTWEIGHT
202+
} else if strings.Contains(u, "@") {
203+
t = userpb.UserType_USER_TYPE_FEDERATED
202204
}
203205
return &userpb.UserId{OpaqueId: u, Type: t}
204206
}

Diff for: ‎pkg/storage/utils/eosfs/eosfs.go

+9-5
Original file line numberDiff line numberDiff line change
@@ -467,7 +467,7 @@ func (fs *eosfs) GetPathByID(ctx context.Context, id *provider.ResourceId) (stri
467467
if err != nil {
468468
return "", errors.Wrap(err, "eosfs: no user in ctx")
469469
}
470-
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
470+
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT || u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED {
471471
auth, err := fs.getRootAuth(ctx)
472472
if err != nil {
473473
return "", err
@@ -647,7 +647,8 @@ func (fs *eosfs) getEosACL(ctx context.Context, g *provider.Grant) (*acl.Entry,
647647
var qualifier string
648648
if t == acl.TypeUser {
649649
// if the grantee is a lightweight account, we need to set it accordingly
650-
if g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
650+
if g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT ||
651+
g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_FEDERATED {
651652
t = acl.TypeLightweight
652653
qualifier = g.Grantee.GetUserId().OpaqueId
653654
} else {
@@ -680,7 +681,8 @@ func (fs *eosfs) RemoveGrant(ctx context.Context, ref *provider.Reference, g *pr
680681
var recipient string
681682
if eosACLType == acl.TypeUser {
682683
// if the grantee is a lightweight account, we need to set it accordingly
683-
if g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
684+
if g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT ||
685+
g.Grantee.GetUserId().Type == userpb.UserType_USER_TYPE_FEDERATED {
684686
eosACLType = acl.TypeLightweight
685687
recipient = g.Grantee.GetUserId().OpaqueId
686688
} else {
@@ -779,7 +781,8 @@ func (fs *eosfs) GetMD(ctx context.Context, ref *provider.Reference, mdKeys []st
779781
}
780782

781783
fn := ""
782-
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
784+
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT ||
785+
u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED {
783786
p, err := fs.resolve(ctx, ref)
784787
if err != nil {
785788
return nil, errors.Wrap(err, "eosfs: error resolving reference")
@@ -1951,7 +1954,8 @@ func (fs *eosfs) getUserAuth(ctx context.Context, u *userpb.User, fn string) (eo
19511954
return fs.singleUserAuth, err
19521955
}
19531956

1954-
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT {
1957+
if u.Id.Type == userpb.UserType_USER_TYPE_LIGHTWEIGHT ||
1958+
u.Id.Type == userpb.UserType_USER_TYPE_FEDERATED {
19551959
return fs.getEOSToken(ctx, u, fn)
19561960
}
19571961

0 commit comments

Comments
 (0)