blob: c954f1bf47467ea6af733037663829e712a3a734 [file] [log] [blame]
Scott Baker2d897982019-09-24 11:50:08 -07001// Copyright 2016 The etcd Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15package clientv3
16
17import (
18 "context"
19 "fmt"
20 "strings"
21
22 "go.etcd.io/etcd/auth/authpb"
23 pb "go.etcd.io/etcd/etcdserver/etcdserverpb"
24 "google.golang.org/grpc"
25)
26
27type (
28 AuthEnableResponse pb.AuthEnableResponse
29 AuthDisableResponse pb.AuthDisableResponse
30 AuthenticateResponse pb.AuthenticateResponse
31 AuthUserAddResponse pb.AuthUserAddResponse
32 AuthUserDeleteResponse pb.AuthUserDeleteResponse
33 AuthUserChangePasswordResponse pb.AuthUserChangePasswordResponse
34 AuthUserGrantRoleResponse pb.AuthUserGrantRoleResponse
35 AuthUserGetResponse pb.AuthUserGetResponse
36 AuthUserRevokeRoleResponse pb.AuthUserRevokeRoleResponse
37 AuthRoleAddResponse pb.AuthRoleAddResponse
38 AuthRoleGrantPermissionResponse pb.AuthRoleGrantPermissionResponse
39 AuthRoleGetResponse pb.AuthRoleGetResponse
40 AuthRoleRevokePermissionResponse pb.AuthRoleRevokePermissionResponse
41 AuthRoleDeleteResponse pb.AuthRoleDeleteResponse
42 AuthUserListResponse pb.AuthUserListResponse
43 AuthRoleListResponse pb.AuthRoleListResponse
44
45 PermissionType authpb.Permission_Type
46 Permission authpb.Permission
47)
48
49const (
50 PermRead = authpb.READ
51 PermWrite = authpb.WRITE
52 PermReadWrite = authpb.READWRITE
53)
54
Scott Baker8487c5d2019-10-18 12:49:46 -070055type UserAddOptions authpb.UserAddOptions
56
Scott Baker2d897982019-09-24 11:50:08 -070057type Auth interface {
58 // AuthEnable enables auth of an etcd cluster.
59 AuthEnable(ctx context.Context) (*AuthEnableResponse, error)
60
61 // AuthDisable disables auth of an etcd cluster.
62 AuthDisable(ctx context.Context) (*AuthDisableResponse, error)
63
64 // UserAdd adds a new user to an etcd cluster.
65 UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error)
66
Scott Baker8487c5d2019-10-18 12:49:46 -070067 // UserAddWithOptions adds a new user to an etcd cluster with some options.
68 UserAddWithOptions(ctx context.Context, name string, password string, opt *UserAddOptions) (*AuthUserAddResponse, error)
69
Scott Baker2d897982019-09-24 11:50:08 -070070 // UserDelete deletes a user from an etcd cluster.
71 UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error)
72
73 // UserChangePassword changes a password of a user.
74 UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error)
75
76 // UserGrantRole grants a role to a user.
77 UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error)
78
79 // UserGet gets a detailed information of a user.
80 UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error)
81
82 // UserList gets a list of all users.
83 UserList(ctx context.Context) (*AuthUserListResponse, error)
84
85 // UserRevokeRole revokes a role of a user.
86 UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error)
87
88 // RoleAdd adds a new role to an etcd cluster.
89 RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error)
90
91 // RoleGrantPermission grants a permission to a role.
92 RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error)
93
94 // RoleGet gets a detailed information of a role.
95 RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error)
96
97 // RoleList gets a list of all roles.
98 RoleList(ctx context.Context) (*AuthRoleListResponse, error)
99
100 // RoleRevokePermission revokes a permission from a role.
101 RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error)
102
103 // RoleDelete deletes a role.
104 RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error)
105}
106
107type authClient struct {
108 remote pb.AuthClient
109 callOpts []grpc.CallOption
110}
111
112func NewAuth(c *Client) Auth {
113 api := &authClient{remote: RetryAuthClient(c)}
114 if c != nil {
115 api.callOpts = c.callOpts
116 }
117 return api
118}
119
120func (auth *authClient) AuthEnable(ctx context.Context) (*AuthEnableResponse, error) {
121 resp, err := auth.remote.AuthEnable(ctx, &pb.AuthEnableRequest{}, auth.callOpts...)
122 return (*AuthEnableResponse)(resp), toErr(ctx, err)
123}
124
125func (auth *authClient) AuthDisable(ctx context.Context) (*AuthDisableResponse, error) {
126 resp, err := auth.remote.AuthDisable(ctx, &pb.AuthDisableRequest{}, auth.callOpts...)
127 return (*AuthDisableResponse)(resp), toErr(ctx, err)
128}
129
130func (auth *authClient) UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error) {
Scott Baker8487c5d2019-10-18 12:49:46 -0700131 resp, err := auth.remote.UserAdd(ctx, &pb.AuthUserAddRequest{Name: name, Password: password, Options: &authpb.UserAddOptions{NoPassword: false}}, auth.callOpts...)
132 return (*AuthUserAddResponse)(resp), toErr(ctx, err)
133}
134
135func (auth *authClient) UserAddWithOptions(ctx context.Context, name string, password string, options *UserAddOptions) (*AuthUserAddResponse, error) {
136 resp, err := auth.remote.UserAdd(ctx, &pb.AuthUserAddRequest{Name: name, Password: password, Options: (*authpb.UserAddOptions)(options)}, auth.callOpts...)
Scott Baker2d897982019-09-24 11:50:08 -0700137 return (*AuthUserAddResponse)(resp), toErr(ctx, err)
138}
139
140func (auth *authClient) UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error) {
141 resp, err := auth.remote.UserDelete(ctx, &pb.AuthUserDeleteRequest{Name: name}, auth.callOpts...)
142 return (*AuthUserDeleteResponse)(resp), toErr(ctx, err)
143}
144
145func (auth *authClient) UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error) {
146 resp, err := auth.remote.UserChangePassword(ctx, &pb.AuthUserChangePasswordRequest{Name: name, Password: password}, auth.callOpts...)
147 return (*AuthUserChangePasswordResponse)(resp), toErr(ctx, err)
148}
149
150func (auth *authClient) UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error) {
151 resp, err := auth.remote.UserGrantRole(ctx, &pb.AuthUserGrantRoleRequest{User: user, Role: role}, auth.callOpts...)
152 return (*AuthUserGrantRoleResponse)(resp), toErr(ctx, err)
153}
154
155func (auth *authClient) UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error) {
156 resp, err := auth.remote.UserGet(ctx, &pb.AuthUserGetRequest{Name: name}, auth.callOpts...)
157 return (*AuthUserGetResponse)(resp), toErr(ctx, err)
158}
159
160func (auth *authClient) UserList(ctx context.Context) (*AuthUserListResponse, error) {
161 resp, err := auth.remote.UserList(ctx, &pb.AuthUserListRequest{}, auth.callOpts...)
162 return (*AuthUserListResponse)(resp), toErr(ctx, err)
163}
164
165func (auth *authClient) UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error) {
166 resp, err := auth.remote.UserRevokeRole(ctx, &pb.AuthUserRevokeRoleRequest{Name: name, Role: role}, auth.callOpts...)
167 return (*AuthUserRevokeRoleResponse)(resp), toErr(ctx, err)
168}
169
170func (auth *authClient) RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error) {
171 resp, err := auth.remote.RoleAdd(ctx, &pb.AuthRoleAddRequest{Name: name}, auth.callOpts...)
172 return (*AuthRoleAddResponse)(resp), toErr(ctx, err)
173}
174
175func (auth *authClient) RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error) {
176 perm := &authpb.Permission{
177 Key: []byte(key),
178 RangeEnd: []byte(rangeEnd),
179 PermType: authpb.Permission_Type(permType),
180 }
181 resp, err := auth.remote.RoleGrantPermission(ctx, &pb.AuthRoleGrantPermissionRequest{Name: name, Perm: perm}, auth.callOpts...)
182 return (*AuthRoleGrantPermissionResponse)(resp), toErr(ctx, err)
183}
184
185func (auth *authClient) RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error) {
186 resp, err := auth.remote.RoleGet(ctx, &pb.AuthRoleGetRequest{Role: role}, auth.callOpts...)
187 return (*AuthRoleGetResponse)(resp), toErr(ctx, err)
188}
189
190func (auth *authClient) RoleList(ctx context.Context) (*AuthRoleListResponse, error) {
191 resp, err := auth.remote.RoleList(ctx, &pb.AuthRoleListRequest{}, auth.callOpts...)
192 return (*AuthRoleListResponse)(resp), toErr(ctx, err)
193}
194
195func (auth *authClient) RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error) {
196 resp, err := auth.remote.RoleRevokePermission(ctx, &pb.AuthRoleRevokePermissionRequest{Role: role, Key: []byte(key), RangeEnd: []byte(rangeEnd)}, auth.callOpts...)
197 return (*AuthRoleRevokePermissionResponse)(resp), toErr(ctx, err)
198}
199
200func (auth *authClient) RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error) {
201 resp, err := auth.remote.RoleDelete(ctx, &pb.AuthRoleDeleteRequest{Role: role}, auth.callOpts...)
202 return (*AuthRoleDeleteResponse)(resp), toErr(ctx, err)
203}
204
205func StrToPermissionType(s string) (PermissionType, error) {
206 val, ok := authpb.Permission_Type_value[strings.ToUpper(s)]
207 if ok {
208 return PermissionType(val), nil
209 }
210 return PermissionType(-1), fmt.Errorf("invalid permission type: %s", s)
211}
212
213type authenticator struct {
214 conn *grpc.ClientConn // conn in-use
215 remote pb.AuthClient
216 callOpts []grpc.CallOption
217}
218
219func (auth *authenticator) authenticate(ctx context.Context, name string, password string) (*AuthenticateResponse, error) {
220 resp, err := auth.remote.Authenticate(ctx, &pb.AuthenticateRequest{Name: name, Password: password}, auth.callOpts...)
221 return (*AuthenticateResponse)(resp), toErr(ctx, err)
222}
223
224func (auth *authenticator) close() {
225 auth.conn.Close()
226}
227
228func newAuthenticator(ctx context.Context, target string, opts []grpc.DialOption, c *Client) (*authenticator, error) {
229 conn, err := grpc.DialContext(ctx, target, opts...)
230 if err != nil {
231 return nil, err
232 }
233
234 api := &authenticator{
235 conn: conn,
236 remote: pb.NewAuthClient(conn),
237 }
238 if c != nil {
239 api.callOpts = c.callOpts
240 }
241 return api, nil
242}