saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-15 09:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Force keep_acl_in_token to True when rest external_auth is used

Browse source
This commit is contained in:
Foorack / Max Faxälv 2022-12-08 23:00:47 +01:00 • committed by Megan Wilhite
parent d0e508f121
commit c92ff12404
5 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
conf/master
View file

@ -424,6 +424,11 @@
# Set to True to enable keeping the calculated user's auth list in the token
# file. This is disabled by default and the auth list is calculated or requested
# from the eauth driver each time.
#
# Note: `keep_acl_in_token` will be forced to True when using external authentication
# for REST API (`rest` is present under `external_auth`). This is because the REST API
# does not store the password, and can therefore not retroactively fetch the ACL, so
# the ACL must be stored in the token.
#keep_acl_in_token: False
# Auth subsystem module to use to get authorized access list for a user. By default it's

5
conf/suse/master
View file

@ -376,6 +376,11 @@ syndic_user: salt
# Set to True to enable keeping the calculated user's auth list in the token
# file. This is disabled by default and the auth list is calculated or requested
# from the eauth driver each time.
#
# Note: `keep_acl_in_token` will be forced to True when using external authentication
# for REST API (`rest` is present under `external_auth`). This is because the REST API
# does not store the password, and can therefore not retroactively fetch the ACL, so
# the ACL must be stored in the token.
#keep_acl_in_token: False
# Auth subsystem module to use to get authorized access list for a user. By default it's

5
doc/ref/configuration/master.rst
View file

@ -1868,6 +1868,11 @@ Set to True to enable keeping the calculated user's auth list in the token
file. This is disabled by default and the auth list is calculated or requested
from the eauth driver each time.
Note: `keep_acl_in_token` will be forced to True when using external authentication
for REST API (`rest` is present under `external_auth`). This is because the REST API
does not store the password, and can therefore not retroactively fetch the ACL, so
the ACL must be stored in the token.
.. code-block:: yaml
keep_acl_in_token: False

12
salt/config/__init__.py
View file

@ -3917,6 +3917,18 @@ def apply_master_config(overrides=None, defaults=None):
_adjust_log_file_override(overrides, defaults["log_file"])
if overrides:
opts.update(overrides)
# `keep_acl_in_token` will be forced to True when using external authentication
# for REST API (`rest` is present under `external_auth`). This is because the REST API
# does not store the password, and can therefore not retroactively fetch the ACL, so
# the ACL must be stored in the token.
if "rest" in opts.get("external_auth", {}):
# Check current value and print out warning
if opts["keep_acl_in_token"] is False:
log.warning(
"The 'rest' external_auth backend requires 'keep_acl_in_token' to be True. "
"Setting 'keep_acl_in_token' to True."
)
opts["keep_acl_in_token"] = True
opts["__cli"] = salt.utils.stringutils.to_unicode(os.path.basename(sys.argv[0]))

6
tests/unit/test_config.py
View file

@ -1846,6 +1846,12 @@ class ConfigTestCase(TestCase, AdaptedConfigurationTestCaseMixin):
self.assertNotIn("environment", ret)
self.assertEqual(ret["saltenv"], "foo")
# Test config to verify that `keep_acl_in_token` is forced to True
# when `rest` is present as driver in the `external_auth` config.
overrides = {"external_auth": {"rest": {"^url": "http://test_url/rest"}}}
ret = salt.config.apply_master_config(overrides=overrides)
self.assertTrue(ret["keep_acl_in_token"])
# MINION CONFIG
# Ensure that environment overrides saltenv when saltenv not