blob: c954f1bf47467ea6af733037663829e712a3a734 [file] [log] [blame]
khenaidooac637102019-01-14 15:44:34 -05001// Copyright 2016 The etcd Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15package clientv3
16
17import (
18 "context"
19 "fmt"
20 "strings"
21
Stephane Barbarie260a5632019-02-26 16:12:49 -050022 "go.etcd.io/etcd/auth/authpb"
23 pb "go.etcd.io/etcd/etcdserver/etcdserverpb"
khenaidooac637102019-01-14 15:44:34 -050024 "google.golang.org/grpc"
25)
26
27type (
28 AuthEnableResponse pb.AuthEnableResponse
29 AuthDisableResponse pb.AuthDisableResponse
30 AuthenticateResponse pb.AuthenticateResponse
31 AuthUserAddResponse pb.AuthUserAddResponse
32 AuthUserDeleteResponse pb.AuthUserDeleteResponse
33 AuthUserChangePasswordResponse pb.AuthUserChangePasswordResponse
34 AuthUserGrantRoleResponse pb.AuthUserGrantRoleResponse
35 AuthUserGetResponse pb.AuthUserGetResponse
36 AuthUserRevokeRoleResponse pb.AuthUserRevokeRoleResponse
37 AuthRoleAddResponse pb.AuthRoleAddResponse
38 AuthRoleGrantPermissionResponse pb.AuthRoleGrantPermissionResponse
39 AuthRoleGetResponse pb.AuthRoleGetResponse
40 AuthRoleRevokePermissionResponse pb.AuthRoleRevokePermissionResponse
41 AuthRoleDeleteResponse pb.AuthRoleDeleteResponse
42 AuthUserListResponse pb.AuthUserListResponse
43 AuthRoleListResponse pb.AuthRoleListResponse
44
45 PermissionType authpb.Permission_Type
46 Permission authpb.Permission
47)
48
49const (
50 PermRead = authpb.READ
51 PermWrite = authpb.WRITE
52 PermReadWrite = authpb.READWRITE
53)
54
Scott Bakerbeb3cfa2019-10-01 14:44:30 -070055type UserAddOptions authpb.UserAddOptions
56
khenaidooac637102019-01-14 15:44:34 -050057type Auth interface {
58 // AuthEnable enables auth of an etcd cluster.
59 AuthEnable(ctx context.Context) (*AuthEnableResponse, error)
60
61 // AuthDisable disables auth of an etcd cluster.
62 AuthDisable(ctx context.Context) (*AuthDisableResponse, error)
63
64 // UserAdd adds a new user to an etcd cluster.
65 UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error)
66
Scott Bakerbeb3cfa2019-10-01 14:44:30 -070067 // UserAddWithOptions adds a new user to an etcd cluster with some options.
68 UserAddWithOptions(ctx context.Context, name string, password string, opt *UserAddOptions) (*AuthUserAddResponse, error)
69
khenaidooac637102019-01-14 15:44:34 -050070 // UserDelete deletes a user from an etcd cluster.
71 UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error)
72
73 // UserChangePassword changes a password of a user.
74 UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error)
75
76 // UserGrantRole grants a role to a user.
77 UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error)
78
79 // UserGet gets a detailed information of a user.
80 UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error)
81
82 // UserList gets a list of all users.
83 UserList(ctx context.Context) (*AuthUserListResponse, error)
84
85 // UserRevokeRole revokes a role of a user.
86 UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error)
87
88 // RoleAdd adds a new role to an etcd cluster.
89 RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error)
90
91 // RoleGrantPermission grants a permission to a role.
92 RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error)
93
94 // RoleGet gets a detailed information of a role.
95 RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error)
96
97 // RoleList gets a list of all roles.
98 RoleList(ctx context.Context) (*AuthRoleListResponse, error)
99
100 // RoleRevokePermission revokes a permission from a role.
101 RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error)
102
103 // RoleDelete deletes a role.
104 RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error)
105}
106
Stephane Barbarie260a5632019-02-26 16:12:49 -0500107type authClient struct {
khenaidooac637102019-01-14 15:44:34 -0500108 remote pb.AuthClient
109 callOpts []grpc.CallOption
110}
111
112func NewAuth(c *Client) Auth {
Stephane Barbarie260a5632019-02-26 16:12:49 -0500113 api := &authClient{remote: RetryAuthClient(c)}
khenaidooac637102019-01-14 15:44:34 -0500114 if c != nil {
115 api.callOpts = c.callOpts
116 }
117 return api
118}
119
Stephane Barbarie260a5632019-02-26 16:12:49 -0500120func (auth *authClient) AuthEnable(ctx context.Context) (*AuthEnableResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500121 resp, err := auth.remote.AuthEnable(ctx, &pb.AuthEnableRequest{}, auth.callOpts...)
122 return (*AuthEnableResponse)(resp), toErr(ctx, err)
123}
124
Stephane Barbarie260a5632019-02-26 16:12:49 -0500125func (auth *authClient) AuthDisable(ctx context.Context) (*AuthDisableResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500126 resp, err := auth.remote.AuthDisable(ctx, &pb.AuthDisableRequest{}, auth.callOpts...)
127 return (*AuthDisableResponse)(resp), toErr(ctx, err)
128}
129
Stephane Barbarie260a5632019-02-26 16:12:49 -0500130func (auth *authClient) UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error) {
Scott Bakerbeb3cfa2019-10-01 14:44:30 -0700131 resp, err := auth.remote.UserAdd(ctx, &pb.AuthUserAddRequest{Name: name, Password: password, Options: &authpb.UserAddOptions{NoPassword: false}}, auth.callOpts...)
132 return (*AuthUserAddResponse)(resp), toErr(ctx, err)
133}
134
135func (auth *authClient) UserAddWithOptions(ctx context.Context, name string, password string, options *UserAddOptions) (*AuthUserAddResponse, error) {
136 resp, err := auth.remote.UserAdd(ctx, &pb.AuthUserAddRequest{Name: name, Password: password, Options: (*authpb.UserAddOptions)(options)}, auth.callOpts...)
khenaidooac637102019-01-14 15:44:34 -0500137 return (*AuthUserAddResponse)(resp), toErr(ctx, err)
138}
139
Stephane Barbarie260a5632019-02-26 16:12:49 -0500140func (auth *authClient) UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500141 resp, err := auth.remote.UserDelete(ctx, &pb.AuthUserDeleteRequest{Name: name}, auth.callOpts...)
142 return (*AuthUserDeleteResponse)(resp), toErr(ctx, err)
143}
144
Stephane Barbarie260a5632019-02-26 16:12:49 -0500145func (auth *authClient) UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500146 resp, err := auth.remote.UserChangePassword(ctx, &pb.AuthUserChangePasswordRequest{Name: name, Password: password}, auth.callOpts...)
147 return (*AuthUserChangePasswordResponse)(resp), toErr(ctx, err)
148}
149
Stephane Barbarie260a5632019-02-26 16:12:49 -0500150func (auth *authClient) UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500151 resp, err := auth.remote.UserGrantRole(ctx, &pb.AuthUserGrantRoleRequest{User: user, Role: role}, auth.callOpts...)
152 return (*AuthUserGrantRoleResponse)(resp), toErr(ctx, err)
153}
154
Stephane Barbarie260a5632019-02-26 16:12:49 -0500155func (auth *authClient) UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500156 resp, err := auth.remote.UserGet(ctx, &pb.AuthUserGetRequest{Name: name}, auth.callOpts...)
157 return (*AuthUserGetResponse)(resp), toErr(ctx, err)
158}
159
Stephane Barbarie260a5632019-02-26 16:12:49 -0500160func (auth *authClient) UserList(ctx context.Context) (*AuthUserListResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500161 resp, err := auth.remote.UserList(ctx, &pb.AuthUserListRequest{}, auth.callOpts...)
162 return (*AuthUserListResponse)(resp), toErr(ctx, err)
163}
164
Stephane Barbarie260a5632019-02-26 16:12:49 -0500165func (auth *authClient) UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500166 resp, err := auth.remote.UserRevokeRole(ctx, &pb.AuthUserRevokeRoleRequest{Name: name, Role: role}, auth.callOpts...)
167 return (*AuthUserRevokeRoleResponse)(resp), toErr(ctx, err)
168}
169
Stephane Barbarie260a5632019-02-26 16:12:49 -0500170func (auth *authClient) RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500171 resp, err := auth.remote.RoleAdd(ctx, &pb.AuthRoleAddRequest{Name: name}, auth.callOpts...)
172 return (*AuthRoleAddResponse)(resp), toErr(ctx, err)
173}
174
Stephane Barbarie260a5632019-02-26 16:12:49 -0500175func (auth *authClient) RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500176 perm := &authpb.Permission{
177 Key: []byte(key),
178 RangeEnd: []byte(rangeEnd),
179 PermType: authpb.Permission_Type(permType),
180 }
181 resp, err := auth.remote.RoleGrantPermission(ctx, &pb.AuthRoleGrantPermissionRequest{Name: name, Perm: perm}, auth.callOpts...)
182 return (*AuthRoleGrantPermissionResponse)(resp), toErr(ctx, err)
183}
184
Stephane Barbarie260a5632019-02-26 16:12:49 -0500185func (auth *authClient) RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500186 resp, err := auth.remote.RoleGet(ctx, &pb.AuthRoleGetRequest{Role: role}, auth.callOpts...)
187 return (*AuthRoleGetResponse)(resp), toErr(ctx, err)
188}
189
Stephane Barbarie260a5632019-02-26 16:12:49 -0500190func (auth *authClient) RoleList(ctx context.Context) (*AuthRoleListResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500191 resp, err := auth.remote.RoleList(ctx, &pb.AuthRoleListRequest{}, auth.callOpts...)
192 return (*AuthRoleListResponse)(resp), toErr(ctx, err)
193}
194
Stephane Barbarie260a5632019-02-26 16:12:49 -0500195func (auth *authClient) RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error) {
196 resp, err := auth.remote.RoleRevokePermission(ctx, &pb.AuthRoleRevokePermissionRequest{Role: role, Key: []byte(key), RangeEnd: []byte(rangeEnd)}, auth.callOpts...)
khenaidooac637102019-01-14 15:44:34 -0500197 return (*AuthRoleRevokePermissionResponse)(resp), toErr(ctx, err)
198}
199
Stephane Barbarie260a5632019-02-26 16:12:49 -0500200func (auth *authClient) RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error) {
khenaidooac637102019-01-14 15:44:34 -0500201 resp, err := auth.remote.RoleDelete(ctx, &pb.AuthRoleDeleteRequest{Role: role}, auth.callOpts...)
202 return (*AuthRoleDeleteResponse)(resp), toErr(ctx, err)
203}
204
205func StrToPermissionType(s string) (PermissionType, error) {
206 val, ok := authpb.Permission_Type_value[strings.ToUpper(s)]
207 if ok {
208 return PermissionType(val), nil
209 }
210 return PermissionType(-1), fmt.Errorf("invalid permission type: %s", s)
211}
212
213type authenticator struct {
214 conn *grpc.ClientConn // conn in-use
215 remote pb.AuthClient
216 callOpts []grpc.CallOption
217}
218
219func (auth *authenticator) authenticate(ctx context.Context, name string, password string) (*AuthenticateResponse, error) {
220 resp, err := auth.remote.Authenticate(ctx, &pb.AuthenticateRequest{Name: name, Password: password}, auth.callOpts...)
221 return (*AuthenticateResponse)(resp), toErr(ctx, err)
222}
223
224func (auth *authenticator) close() {
225 auth.conn.Close()
226}
227
Stephane Barbarie260a5632019-02-26 16:12:49 -0500228func newAuthenticator(ctx context.Context, target string, opts []grpc.DialOption, c *Client) (*authenticator, error) {
229 conn, err := grpc.DialContext(ctx, target, opts...)
khenaidooac637102019-01-14 15:44:34 -0500230 if err != nil {
231 return nil, err
232 }
233
234 api := &authenticator{
235 conn: conn,
236 remote: pb.NewAuthClient(conn),
237 }
238 if c != nil {
239 api.callOpts = c.callOpts
240 }
241 return api, nil
242}