diff --git a/ocis/go.mod b/ocis/go.mod index bd3489e74..2c80eb640 100644 --- a/ocis/go.mod +++ b/ocis/go.mod @@ -8,7 +8,9 @@ require ( contrib.go.opencensus.io/exporter/zipkin v0.1.2 github.com/asim/go-micro/plugins/logger/zerolog/v3 v3.0.0-20210217182006-0f0ace1a44a9 github.com/asim/go-micro/v3 v3.5.1-0.20210217182006-0f0ace1a44a9 + github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d // indirect github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect + github.com/jmhodges/levigo v1.0.0 // indirect github.com/micro/cli/v2 v2.1.2 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 github.com/olekukonko/tablewriter v0.0.5 @@ -33,6 +35,7 @@ require ( github.com/spf13/cobra v1.1.3 github.com/spf13/viper v1.7.1 github.com/stretchr/testify v1.7.0 + github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c // indirect github.com/thejerf/suture/v4 v4.0.0 go.opencensus.io v0.23.0 golang.org/x/sys v0.0.0-20210309074719-68d13333faf2 diff --git a/ocs/go.mod b/ocs/go.mod index c11af655d..0ad345ec7 100644 --- a/ocs/go.mod +++ b/ocs/go.mod @@ -19,6 +19,7 @@ require ( github.com/openzipkin/zipkin-go v0.2.5 github.com/owncloud/ocis/accounts v0.5.3-0.20210216094451-dc73176dc62d github.com/owncloud/ocis/ocis-pkg v0.0.0-20210216094451-dc73176dc62d + github.com/owncloud/ocis/proxy v0.0.0-20210412105747-9b95e9b1191b github.com/owncloud/ocis/settings v0.0.0-20210413063522-955bd60edf33 github.com/owncloud/ocis/store v0.0.0-20210413063522-955bd60edf33 github.com/prometheus/client_golang v1.10.0 @@ -33,6 +34,7 @@ require ( replace ( github.com/owncloud/ocis/accounts => ../accounts github.com/owncloud/ocis/ocis-pkg => ../ocis-pkg + github.com/owncloud/ocis/proxy => ../proxy github.com/owncloud/ocis/settings => ../settings github.com/owncloud/ocis/store => ../store // taken from https://github.com/asim/go-micro/blob/master/plugins/registry/etcd/go.mod#L14-L16 diff --git a/ocs/go.sum b/ocs/go.sum index 76ac8d099..a616d6fcc 100644 --- a/ocs/go.sum +++ b/ocs/go.sum @@ -300,7 +300,6 @@ github.com/cs3org/go-cs3apis v0.0.0-20210325133324-32b03d75a535/go.mod h1:UXha4T github.com/cs3org/reva v1.6.1-0.20210329145723-ed244aac4ddc h1:/16ib5caXBq9iFiYG4pysrgJ+AtNaS+zMqLXId8V9C4= github.com/cs3org/reva v1.6.1-0.20210329145723-ed244aac4ddc/go.mod h1:exwJqEJ8lVVnmdY0GrGwuPRQ018xUU9mKVXQBiO0ZlQ= github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA= -github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -878,7 +877,6 @@ github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg= github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U= -github.com/jmhodges/levigo v1.0.0/go.mod h1:Q6Qx+uH3RAqyK4rFQroq9RL7mdkABMcfhEI+nNuzMJQ= github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0/go.mod h1:IiEW3SEiiErVyFdH8NTuWjSifiEQKUoyK3LNqr2kCHU= github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks= github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901/go.mod h1:Z86h9688Y0wesXCyonoVr47MasHilkuLMqGhRZ4Hpak= @@ -1217,8 +1215,6 @@ github.com/owncloud/ocis/idp v0.0.0-20210413063522-955bd60edf33/go.mod h1:xRLkgE github.com/owncloud/ocis/ocs v0.0.0-20210413063522-955bd60edf33/go.mod h1:QOeC8KOc96RUK3SV11N3Sn0IP7yuzN+fb9lt2yLMMEw= github.com/owncloud/ocis/onlyoffice v0.0.0-20210413063522-955bd60edf33 h1:uglH9MrbihxUZKX1/RtHRwo8vkZ9st1Vwi9qXa9Xed4= github.com/owncloud/ocis/onlyoffice v0.0.0-20210413063522-955bd60edf33/go.mod h1:f+nnBcAuvW+wgySKnv+uvtUHkjk2f5w64Zcgb4vC8+E= -github.com/owncloud/ocis/proxy v0.0.0-20210412105747-9b95e9b1191b h1:6OZBAng7McgOF4m+D3fJLkFFG/2ekM2h70Epql0eDE8= -github.com/owncloud/ocis/proxy v0.0.0-20210412105747-9b95e9b1191b/go.mod h1:7m3UEC7ep4heIYJr9Farq3YzkUtAOPdNDfz+fMoeWuU= github.com/owncloud/ocis/storage v0.0.0-20210413063522-955bd60edf33 h1:ao+LJU/QDdzu2lYRW9ZCL3vGq3xixrFgS6/vAGmALKA= github.com/owncloud/ocis/storage v0.0.0-20210413063522-955bd60edf33/go.mod h1:2GPFqG7mD4qVbyLJNYM73hxwmJzcAtQCr/fIAYsOU3Q= github.com/owncloud/ocis/thumbnails v0.0.0-20210216094451-dc73176dc62d/go.mod h1:IU4JjxsasmAxreD7LckETo3Bmy6cYIkTuDweE7JPVTE= @@ -1485,7 +1481,6 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ= github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA= -github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c/go.mod h1:ahpPrc7HpcfEWDQRZEmnXMzHY03mLDYMCxeDzy46i+8= github.com/technoweenie/multipartstreamer v1.0.1/go.mod h1:jNVxdtShOxzAsukZwTSw6MDx5eUJoiEBsSvzDU9uzog= github.com/thejerf/suture/v4 v4.0.0 h1:GX3X+1Qaewtj9flL2wgoTBfLA5NcmrCY39TJRpPbUrI= github.com/thejerf/suture/v4 v4.0.0/go.mod h1:g0e8vwskm9tI0jRjxrnA6lSr0q6OfPdWJVX7G5bVWRs= diff --git a/ocs/pkg/config/config.go b/ocs/pkg/config/config.go index 6a01ad55d..451701210 100644 --- a/ocs/pkg/config/config.go +++ b/ocs/pkg/config/config.go @@ -47,13 +47,15 @@ type TokenManager struct { // Config combines all available configuration parts. type Config struct { - File string - Log Log - Debug Debug - HTTP HTTP - Tracing Tracing - TokenManager TokenManager - Service Service + File string + Log Log + Debug Debug + HTTP HTTP + Tracing Tracing + TokenManager TokenManager + Service Service + AccountBackend string + RevaAddress string Context context.Context Supervised bool diff --git a/ocs/pkg/flagset/flagset.go b/ocs/pkg/flagset/flagset.go index 7e428536d..d1924af67 100644 --- a/ocs/pkg/flagset/flagset.go +++ b/ocs/pkg/flagset/flagset.go @@ -150,6 +150,21 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag { EnvVars: []string{"OCS_JWT_SECRET", "OCIS_JWT_SECRET"}, Destination: &cfg.TokenManager.JWTSecret, }, + + &cli.StringFlag{ + Name: "account-backend-type", + Value: flags.OverrideDefaultString(cfg.AccountBackend, "accounts"), + Usage: "account-backend-type", + EnvVars: []string{"OCS_ACCOUNT_BACKEND_TYPE"}, + Destination: &cfg.AccountBackend, + }, + &cli.StringFlag{ + Name: "reva-gateway-addr", + Value: flags.OverrideDefaultString(cfg.RevaAddress, "127.0.0.1:9142"), + Usage: "REVA Gateway Endpoint", + EnvVars: []string{"OCS_REVA_GATEWAY_ADDR"}, + Destination: &cfg.RevaAddress, + }, } } diff --git a/ocs/pkg/service/v0/groups.go b/ocs/pkg/service/v0/groups.go index f8fab1f0f..57c3f6c7c 100644 --- a/ocs/pkg/service/v0/groups.go +++ b/ocs/pkg/service/v0/groups.go @@ -9,6 +9,8 @@ import ( "regexp" "strconv" + "github.com/cs3org/reva/pkg/user" + merrors "github.com/asim/go-micro/v3/errors" "github.com/go-chi/chi" "github.com/go-chi/render" @@ -24,6 +26,19 @@ func (o Ocs) ListUserGroups(w http.ResponseWriter, r *http.Request) { var account *accounts.Account var err error + // short circuit if there is a user already in the context + if u, ok := user.ContextGetUser(r.Context()); ok { + // we are not sure whether the current user in the context is the admin or the authenticated user. + if u.Username == userid { + // the OCS API is a REST API and it uses the username to look for groups. If the id from the user in the context + // differs from that of the url we can assume we are an admin because we are past the selfOrAdmin middleware. + if len(u.Groups) > 0 { + mustNotFail(render.Render(w, r, response.DataRender(&data.Groups{Groups: u.Groups}))) + return + } + } + } + if isValidUUID(userid) { account, err = o.getAccountService().GetAccount(r.Context(), &accounts.GetAccountRequest{ Id: userid, diff --git a/ocs/pkg/service/v0/service.go b/ocs/pkg/service/v0/service.go index 09d559c9f..e5a882455 100644 --- a/ocs/pkg/service/v0/service.go +++ b/ocs/pkg/service/v0/service.go @@ -19,6 +19,8 @@ import ( ocsm "github.com/owncloud/ocis/ocs/pkg/middleware" "github.com/owncloud/ocis/ocs/pkg/service/v0/data" "github.com/owncloud/ocis/ocs/pkg/service/v0/response" + "github.com/owncloud/ocis/proxy/pkg/cs3" + "github.com/owncloud/ocis/proxy/pkg/user/backend" settings "github.com/owncloud/ocis/settings/pkg/proto/v0" ) @@ -57,6 +59,10 @@ func NewService(opts ...Option) Service { logger: options.Logger, } + if svc.config.AccountBackend == "" { + svc.config.AccountBackend = "accounts" + } + requireUser := ocsm.RequireUser() requireAdmin := ocsm.RequireAdmin( @@ -154,6 +160,14 @@ func (o Ocs) getAccountService() accounts.AccountsService { return accounts.NewAccountsService("com.owncloud.api.accounts", grpc.DefaultClient) } +func (o Ocs) getCS3Backend() backend.UserBackend { + revaClient, err := cs3.GetGatewayServiceClient(o.config.RevaAddress) + if err != nil { + o.logger.Fatal().Msgf("could not get reva client at address %s", o.config.RevaAddress) + } + return backend.NewCS3UserBackend(revaClient, nil, revaClient, o.logger) +} + func (o Ocs) getGroupsService() accounts.GroupsService { return accounts.NewGroupsService("com.owncloud.api.accounts", grpc.DefaultClient) } diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go index 62da81536..ac25d0541 100644 --- a/ocs/pkg/service/v0/users.go +++ b/ocs/pkg/service/v0/users.go @@ -9,14 +9,15 @@ import ( "strconv" "strings" + "github.com/asim/go-micro/plugins/client/grpc/v3" "github.com/cs3org/reva/pkg/user" "github.com/go-chi/chi" "github.com/go-chi/render" "google.golang.org/genproto/protobuf/field_mask" "google.golang.org/protobuf/types/known/fieldmaskpb" - "github.com/asim/go-micro/plugins/client/grpc/v3" merrors "github.com/asim/go-micro/v3/errors" + cs3 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" accounts "github.com/owncloud/ocis/accounts/pkg/proto/v0" "github.com/owncloud/ocis/ocs/pkg/service/v0/data" "github.com/owncloud/ocis/ocs/pkg/service/v0/response" @@ -39,11 +40,20 @@ func (o Ocs) GetSelf(w http.ResponseWriter, r *http.Request) { if err != nil { merr := merrors.FromError(err) - if merr.Code == http.StatusNotFound { - // if the user was authenticated why was he not found?!? log error? - mustNotFail(render.Render(w, r, response.ErrRender(data.MetaNotFound.StatusCode, "The requested user could not be found"))) - } else { - mustNotFail(render.Render(w, r, response.ErrRender(data.MetaServerError.StatusCode, err.Error()))) + // TODO(someone) this fix is in place because if the user backend (PROXY_ACCOUNT_BACKEND_TYPE) is set to, for instance, + // cs3, we cannot count with the accounts service. + if u != nil { + uid, gid := o.extractUIDAndGID(u) + d := &data.User{ + UserID: u.Username, + DisplayName: u.DisplayName, + LegacyDisplayName: u.DisplayName, + Email: u.Mail, + UIDNumber: uid, + GIDNumber: gid, + } + mustNotFail(render.Render(w, r, response.DataRender(d))) + return } o.logger.Error().Err(merr).Interface("user", u).Msg("could not get account for user") return @@ -73,11 +83,17 @@ func (o Ocs) GetUser(w http.ResponseWriter, r *http.Request) { var account *accounts.Account var err error - if userid == "" { + switch { + case userid == "": mustNotFail(render.Render(w, r, response.ErrRender(data.MetaBadRequest.StatusCode, "missing user in context"))) - } else { + case o.config.AccountBackend == "accounts": account, err = o.fetchAccountByUsername(r.Context(), userid) + case o.config.AccountBackend == "cs3": + account, err = o.fetchAccountFromCS3Backend(r.Context(), userid) + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) } + if err != nil { merr := merrors.FromError(err) if merr.Code == http.StatusNotFound { @@ -180,9 +196,19 @@ func (o Ocs) AddUser(w http.ResponseWriter, r *http.Request) { newAccount.GidNumber = gidNumber } - account, err := o.getAccountService().CreateAccount(r.Context(), &accounts.CreateAccountRequest{ - Account: newAccount, - }) + var account *accounts.Account + + switch o.config.AccountBackend { + case "accounts": + account, err = o.getAccountService().CreateAccount(r.Context(), &accounts.CreateAccountRequest{ + Account: newAccount, + }) + case "cs3": + o.logger.Fatal().Msg("cs3 backend doesn't support adding users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { merr := merrors.FromError(err) switch merr.Code { @@ -231,7 +257,18 @@ func (o Ocs) AddUser(w http.ResponseWriter, r *http.Request) { // EditUser creates a new user account func (o Ocs) EditUser(w http.ResponseWriter, r *http.Request) { userid := chi.URLParam(r, "userid") - account, err := o.fetchAccountByUsername(r.Context(), userid) + + var account *accounts.Account + var err error + switch o.config.AccountBackend { + case "accounts": + account, err = o.fetchAccountByUsername(r.Context(), userid) + case "cs3": + o.logger.Fatal().Msg("cs3 backend doesn't support editing users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { merr := merrors.FromError(err) if merr.Code == http.StatusNotFound { @@ -298,7 +335,18 @@ func (o Ocs) EditUser(w http.ResponseWriter, r *http.Request) { // DeleteUser deletes a user func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) { userid := chi.URLParam(r, "userid") - account, err := o.fetchAccountByUsername(r.Context(), userid) + + var account *accounts.Account + var err error + switch o.config.AccountBackend { + case "accounts": + account, err = o.fetchAccountByUsername(r.Context(), userid) + case "cs3": + o.logger.Fatal().Msg("cs3 backend doesn't support deleting users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { merr := merrors.FromError(err) if merr.Code == http.StatusNotFound { @@ -333,7 +381,18 @@ func (o Ocs) DeleteUser(w http.ResponseWriter, r *http.Request) { // EnableUser enables a user func (o Ocs) EnableUser(w http.ResponseWriter, r *http.Request) { userid := chi.URLParam(r, "userid") - account, err := o.fetchAccountByUsername(r.Context(), userid) + + var account *accounts.Account + var err error + switch o.config.AccountBackend { + case "accounts": + account, err = o.fetchAccountByUsername(r.Context(), userid) + case "cs3": + o.logger.Fatal().Msg("cs3 backend doesn't support enabling users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { merr := merrors.FromError(err) if merr.Code == http.StatusNotFound { @@ -373,7 +432,18 @@ func (o Ocs) EnableUser(w http.ResponseWriter, r *http.Request) { // DisableUser disables a user func (o Ocs) DisableUser(w http.ResponseWriter, r *http.Request) { userid := chi.URLParam(r, "userid") - account, err := o.fetchAccountByUsername(r.Context(), userid) + + var account *accounts.Account + var err error + switch o.config.AccountBackend { + case "accounts": + account, err = o.fetchAccountByUsername(r.Context(), userid) + case "cs3": + o.logger.Fatal().Msg("cs3 backend doesn't support disabling users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { merr := merrors.FromError(err) if merr.Code == http.StatusNotFound { @@ -490,9 +560,20 @@ func (o Ocs) ListUsers(w http.ResponseWriter, r *http.Request) { query = fmt.Sprintf("on_premises_sam_account_name eq '%s'", escapeValue(search)) } - res, err := o.getAccountService().ListAccounts(r.Context(), &accounts.ListAccountsRequest{ - Query: query, - }) + var res *accounts.ListAccountsResponse + var err error + switch o.config.AccountBackend { + case "accounts": + res, err = o.getAccountService().ListAccounts(r.Context(), &accounts.ListAccountsRequest{ + Query: query, + }) + case "cs3": + // TODO + o.logger.Fatal().Msg("cs3 backend doesn't support listing users") + default: + o.logger.Fatal().Msgf("Invalid accounts backend type '%s'", o.config.AccountBackend) + } + if err != nil { o.logger.Err(err).Msg("could not list users") mustNotFail(render.Render(w, r, response.ErrRender(data.MetaServerError.StatusCode, "could not list users"))) @@ -525,3 +606,43 @@ func (o Ocs) fetchAccountByUsername(ctx context.Context, name string) (*accounts } return nil, merrors.NotFound("", "The requested user could not be found") } + +func (o Ocs) fetchAccountFromCS3Backend(ctx context.Context, name string) (*accounts.Account, error) { + backend := o.getCS3Backend() + u, err := backend.GetUserByClaims(ctx, "username", name, false) + if err != nil { + return nil, err + } + uid, gid := o.extractUIDAndGID(u) + return &accounts.Account{ + OnPremisesSamAccountName: u.Username, + DisplayName: u.DisplayName, + Mail: u.Mail, + UidNumber: uid, + GidNumber: gid, + }, nil +} + +func (o Ocs) extractUIDAndGID(u *cs3.User) (int64, int64) { + var uid, gid int64 + var err error + if u.Opaque != nil && u.Opaque.Map != nil { + if uidObj, ok := u.Opaque.Map["uid"]; ok { + if uidObj.Decoder == "plain" { + uid, err = strconv.ParseInt(string(uidObj.Value), 10, 64) + if err != nil { + o.logger.Error().Err(err).Interface("user", u).Msg("could not extract uid for user") + } + } + } + if gidObj, ok := u.Opaque.Map["gid"]; ok { + if gidObj.Decoder == "plain" { + gid, err = strconv.ParseInt(string(gidObj.Value), 10, 64) + if err != nil { + o.logger.Error().Err(err).Interface("user", u).Msg("could not extract gid for user") + } + } + } + } + return uid, gid +} diff --git a/proxy/go.sum b/proxy/go.sum index e8cfc4e8d..6268b7c89 100644 --- a/proxy/go.sum +++ b/proxy/go.sum @@ -291,7 +291,6 @@ github.com/cs3org/go-cs3apis v0.0.0-20210325133324-32b03d75a535/go.mod h1:UXha4T github.com/cs3org/reva v1.6.1-0.20210329145723-ed244aac4ddc h1:/16ib5caXBq9iFiYG4pysrgJ+AtNaS+zMqLXId8V9C4= github.com/cs3org/reva v1.6.1-0.20210329145723-ed244aac4ddc/go.mod h1:exwJqEJ8lVVnmdY0GrGwuPRQ018xUU9mKVXQBiO0ZlQ= github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA= -github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -860,7 +859,6 @@ github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a/go.mod h1:yL958EeXv8 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k= github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U= -github.com/jmhodges/levigo v1.0.0/go.mod h1:Q6Qx+uH3RAqyK4rFQroq9RL7mdkABMcfhEI+nNuzMJQ= github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0/go.mod h1:IiEW3SEiiErVyFdH8NTuWjSifiEQKUoyK3LNqr2kCHU= github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks= github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901/go.mod h1:Z86h9688Y0wesXCyonoVr47MasHilkuLMqGhRZ4Hpak= @@ -1443,7 +1441,6 @@ github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ= github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA= -github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c/go.mod h1:ahpPrc7HpcfEWDQRZEmnXMzHY03mLDYMCxeDzy46i+8= github.com/technoweenie/multipartstreamer v1.0.1/go.mod h1:jNVxdtShOxzAsukZwTSw6MDx5eUJoiEBsSvzDU9uzog= github.com/thejerf/suture/v4 v4.0.0 h1:GX3X+1Qaewtj9flL2wgoTBfLA5NcmrCY39TJRpPbUrI= github.com/thejerf/suture/v4 v4.0.0/go.mod h1:g0e8vwskm9tI0jRjxrnA6lSr0q6OfPdWJVX7G5bVWRs= @@ -2102,6 +2099,7 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c h1:grhR+C34yXImVGp7EzNk+DTIk+323eIUWOmEevy6bDo= gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo= gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw= grpc.go4.org v0.0.0-20170609214715-11d0a25b4919/go.mod h1:77eQGdRu53HpSqPFJFmuJdjuHRquDANNeA4x7B8WQ9o= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= diff --git a/proxy/pkg/user/backend/accounts.go b/proxy/pkg/user/backend/accounts.go index 0ac24bb6a..29ce07b6a 100644 --- a/proxy/pkg/user/backend/accounts.go +++ b/proxy/pkg/user/backend/accounts.go @@ -3,15 +3,16 @@ package backend import ( "context" "fmt" + "net/http" + "strconv" + "strings" + cs3 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1" accounts "github.com/owncloud/ocis/accounts/pkg/proto/v0" "github.com/owncloud/ocis/ocis-pkg/log" "github.com/owncloud/ocis/ocis-pkg/oidc" settings "github.com/owncloud/ocis/settings/pkg/proto/v0" - "net/http" - "strconv" - "strings" ) // NewAccountsServiceUserBackend creates a user-provider which fetches users from the ocis accounts-service diff --git a/proxy/pkg/user/backend/cs3.go b/proxy/pkg/user/backend/cs3.go index 72a1920e3..3dff9c88c 100644 --- a/proxy/pkg/user/backend/cs3.go +++ b/proxy/pkg/user/backend/cs3.go @@ -3,6 +3,7 @@ package backend import ( "context" "fmt" + gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1" cs3 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1" @@ -10,6 +11,7 @@ import ( "github.com/owncloud/ocis/ocis-pkg/log" "github.com/owncloud/ocis/ocis-pkg/oidc" settings "github.com/owncloud/ocis/settings/pkg/proto/v0" + settingsSvc "github.com/owncloud/ocis/settings/pkg/service/v0" ) type cs3backend struct { @@ -57,7 +59,10 @@ func (c *cs3backend) GetUserByClaims(ctx context.Context, claim, value string, w } if len(roleIDs) == 0 { - return user, nil + roleIDs = append(roleIDs, settingsSvc.BundleUUIDRoleUser, settingsSvc.SelfManagementPermissionID) + // if roles are empty, assume we haven't seen the user before and assign a default user role. At least until + // proper roles are provided. See https://github.com/owncloud/ocis/issues/1825 for more context. + //return user, nil } enc, err := encodeRoleIDs(roleIDs) @@ -65,10 +70,14 @@ func (c *cs3backend) GetUserByClaims(ctx context.Context, claim, value string, w c.logger.Error().Err(err).Msg("Could not encode loaded roles") } - user.Opaque = &types.Opaque{ - Map: map[string]*types.OpaqueEntry{ - "roles": enc, - }, + if user.Opaque == nil { + user.Opaque = &types.Opaque{ + Map: map[string]*types.OpaqueEntry{ + "roles": enc, + }, + } + } else { + user.Opaque.Map["roles"] = enc } return res.User, nil